NXP Semiconductors EdgeLock A5000, Примечание к применению

Страница: 44 / 45

NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Figures
Fig. 1. Device-to-device authentication scenario ..........3
Fig. 2. Certificate chain of trust .................................... 4
Fig. 3. Certificate hierarchy .......................................... 5
Fig. 4. Machine and control unit credentials .................5
Fig. 5. Control unit authentication flow ......................... 7
Fig. 6. Machine authentication flow ..............................8
Fig. 7. A5000 CMake options .....................................11
Fig. 8. Principle of the OpenSSL engine .................... 12
Fig. 9. Check the installed OpenSSL version .............13
Fig. 10. ssscli help ........................................................14
Fig. 11. ssscli connect help ..........................................14
Fig. 12. ssscli se05x help .............................................15
Fig. 13. ssscli readidlist ................................................ 15
Fig. 14. Retrieve the pre-provisioned A5000 device
certificats ......................................................... 17
Fig. 15. Device certificats in PEM format ..................... 17
Fig. 16. Content of the machine certificate ...................18
Fig. 17. Content of the control unit certificate ...............19
Fig. 18. Retrieve the pre-provisioned A5000 device
certificate's public keys ................................... 19
Fig. 19. Device public keys in PEM format ...................20
Fig. 20. Content of the device public keys ................... 20
Fig. 21. Create the reference key files for the
OpenSSL engine .............................................21
Fig. 22. Reference private keys in PEM format ............21
Fig. 23. Content of the reference private keys ............. 22
Fig. 24. Certification chain of the pre-provisioned
A5000 device certificates ................................ 23
Fig. 25. Download the NXP intermediate certificate ..... 23
Fig. 26. Convert the NXP intermediate certificate
file nxp_a5000_intermediate_ca.crt" into a
PEM formatted file .......................................... 24
Fig. 27. Download the NXP root certificate .................. 24
Fig. 28. Convert the NXP root certificate file "nxp_
a5000_root_ca.crt"into a PEM formatted
file ....................................................................24
Fig. 29. Control unit authentication flow ....................... 25
Fig. 30. OpenSSL - Verify control unit device
certificate ......................................................... 25
Fig. 31. OpenSSL - Random numbers generated by
OpenSSL in software ...................................... 26
Fig. 32. Plug & Trust Middleware OpenSSL engine
default configuration ........................................27
Fig. 33. OpenSSL - Random number generated by
A5000 .............................................................. 27
Fig. 34. OpenSSL - A5000 random numbers are
stored in a text file .......................................... 28
Fig. 35. OpenSSL - The A5000 signs the random
numbers with the private ECC key stored
inside the A5000 ............................................. 28
Fig. 36. Control unit signature ......................................28
Fig. 37. OpenSSL - Verify control unit signature .......... 29
Fig. 38. Control unit authentication flow ....................... 30
Fig. 39. OpenSSL - Verify machine certificate ..............31
Fig. 40. OpenSSL - A5000 random numbers are
stored in a text file .......................................... 32
Fig. 41. OpenSSL - The A5000 signs the random
numbers with the private ECC key stored
inside the A5000 ............................................. 32
Fig. 42. Machine signature ...........................................32
Fig. 43. OpenSSL - Verify machine signature .............. 33
Fig. 44. SPC03 mutual authentication – principle .........35
Fig. 45. SPC03 Encryption and MACing principle ........ 35
Fig. 46. A5000 CMake options to enable Platform
SCP ................................................................. 36
Fig. 47. A5000Platform SCP plain text key file .............37
Fig. 48. A5000 CMake options to enable Platform
SCP ................................................................. 38
AN13500 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
44 / 45