Cypress CY8CPROTO-064B0S3, Руководство пользователя

Страница: 22 / 47

CY8CPROTO-064B0S3 PSoC 64 "Secure Boot" Prototyping Kit Guide, Doc. # 002-29505 Rev. *B 21
4. Running Code on PSoC 64 “Secure Boot”
MCUs
The CY8CPROTO-064B0S3 PSoC 64 “Secure Boot” Prototyping Kit can run code examples
available on ModusToolbox software. However, prior to running any code on the PSoC 64 line of
secured MCUs, they must first be provisioned with keys and device security policies so only signed
code can be executed.
This section will go through the process to provision, build, program and run the “Secure Blinky LED
FreeRTOS” example. Before going through the detailed steps, an overview of the provisioning
process will be presented.
4.1 Provisioning Overview
Provisioning is a process by which secure assets like keys and security policies are injected into the
device. This step typically occurs in a secure manufacturing environment that has a Hardware
Security Module (HSM).
For a more detailed overview of what provisioning entails, see Chapter 2 of the “Secure Boot” SDK
user guide .
In the context of evaluating this kit, the provisioning flow can be visualized as follows:
Figure 4-1. Provisioning Flow
Generate keys,
Define policies
Form Provisioning Packet
Provision the chip
Generate image signing
key pair
Image key pair Image key pair
Modify device policies
from template if needed
Boot&Upgrade Policy
Debug Policy
Sign with development
RoT key to form your
asset packet
Image Public key
Boot&Upgrade Policy
Debug Policy
Signed by Dev Rot Key
prov_req.JWT
cy_auth.JWT
rot_auth.JWT
prov_auth.JWT
“Cypress Bootloader”
Bootloader Cert
Signed by Development
HSM Priv key
Development
tokens Provided by
“Secure Boot” SDK
Hex file and certificate
provided by “Secure
Boot” SDK
Development HSM
private key provided
by “Secure Boot” SDK
prov_cmd.JWT
Run Entrance Exam
Send prov_cmt.JWT
Device validates packet
for signatures, accepts
assets
Device Provisioned