We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X

Leverage Our Secure Manufacturing Infrastructure to Securely Provision Credentials in Your Products


For deployments of as few as ten units to up to many thousands of devices, our Trust Platform is a cost-effective and flexible solution for onboarding our secure elements in your design and accelerating your product’s time to market. The Trust Platform is composed of a family of pre-provisioned, pre-configured or fully customizable secure elements. Credentials are generated inside each secure element’s boundary by leveraging our Hardware Secure Modules (HSMs) that are installed in our factories. The devices also come with hardware and software development tools to make prototyping easy and to fast track your development. The Trust Platform offers three tiers of secure elements—Trust&GO, TrustFLEX and TrustCUSTOM—to provide you with the options and flexibility to meet the requirements of your company’s security model.

When you use our Trust Platform, you will optimize your overall provisioning logistic costs by benefitting from an existing and amortized HSM infrastructure integrated into our factories. Generally, it is financially and technically challenging for third-party contractors that offer provisioning services to provide an efficient and cost-effective model, especially for smaller orders. When you leverage our provisioning service along with our Trust&GO, TrustFLEX or TrustCUSTOM secure elements, you can select the option that best meets your current needs, and then scale as your business or market share spreads across the globe. Trust&GO has a minimum orderable quantity of just ten units, making it easy for you to get started on a small scale.

Hardware-Based Security for IoT of Any Size

Microchip simplifies hardware-based IoT security with the industry’s first pre-provisioned solutions for deployments of any size.

What Are the Trust Platform Options?


The main differences between the three Trust Platform tiers include the level of involvement you have in choosing or defining a device configuration for your use case, deciding what credentials you want to provision, and selecting the Minimum Orderable Quantity (MOQ) that will best suit your requirements. You can also take advantage of our Trust Platform Design Suite to guide you through your development, from prototyping up to production. Here is an overview of the three options:

 

  • Devices are pre-configured and pre-provisioned with keys and generic certificates for thumbprint authentication
  • MOQ is 10 units including provisioning
  • Code examples are available for the following use cases:
    • AWS IoT authentication
    • Microsoft Azure IoT Hub authentication
    • Google IoT authentication
    • LoRa® authentication
    • Third-party TLS authentication
  • Buy the device, claim it and you’re done
  • Devices are pre-configured and provisioned with default generic certificates for thumbprint authentication, but they can be replaced with your credentials
  • MOQ is 2,000 units including provisioning
  • These most commonly requested use cases are available:
    • Any cloud, any PKI
    • Certificate-based authentication
    • Token-based authentication
    • Secure boot
    • Over the Air (OTA) verification
    • Firmware verification
    • IP protection
    • Message encryption
    • I/O protection key
    • Accessory authentication
    • Key rotation
  • Devices are fully customizable if your needs go beyond the Trust&GO and TrustFLEX offerings
  • MOQ is 4,000 units including provisioning
  • Fully customizable
  • Start with a blank device

Why Choose Our Trust Platform?


Without secure key provisioning, as your sensitive keys are injected during manufacturing they are exposed to third-party software, microcontroller firmware, contract manufacturers and operators. With the risks so high in these mass-production conditions, it’s important that the credentials are placed inside secure storage using a process that follows good security practices. The objective of our Trust Platform provisioning service is to isolate credentials from being exposed any time during and after production while eliminating the need for you to have extensive knowledge about handling and securing keys.

Let Us Guide You to the Right Option

Ready to Get Started with the Trust Platform?


Step 1: Buy the Trust Platform hardware featuring an Arm® Cortex®-M0+ based SAM D21 MCU and our WINC1500 Wi-Fi®IoT network controller.

Step 2: As you work with the development kit, use the tutorial and code example and create the manifest file using the Trust Platform Design Suite, available for Windows® and macOS® operating systems.

Step 3: Once the C code for the secure element is working in your embedded application, you are ready to go to production. Order the pre-provisioned devices and download the manifest file from our online store or from our distribution partners. Upload the list of public credentials in the corresponding cloud account.

Still Not Sure How To Get Started?


To help with your configuration setup and transaction diagram, we handpicked a team of trusted design partners that offer their expertise to guide you along the way. They will also help with your project development from use case definition all the way through to production.

If you need more information about our secure elements, please visit our CryptoAuthentication™ ICs page.

Trust Platform Devices


View All Parametrics
Product Provisioning Algorithm Type Density Interface Type Temp (C)
ATECC608B-TCSM TrustCUSTOM ECC-P256 (ECDH and ECDSA), SHA256, AES128-GCM 10.5Kb Single-wire; I2C -40 to 85
ATECC608B-TFLXTLS TrustFLEX ECC P256 (ECDH and ECDSA), SHA256, AES-GCM 10.5Kb Single-wire; I2C -40 to 85
ATECC608B-TNGTLS Trust&GO ECC-P256 (ECDH and ECDSA), SHA256, AES128-GCM 10.5Kb Single-wire; I2C -40 to 85
ATSHA204A-TCSM TrustCUSTOM SHA256 4.5Kb Single-wire; I2C -40 to 85

Development Tools


Development Tool Description
CryptoAuth Trust Platform Development Kit
(DM320118)
This USB-based development kit includes a SAM D21 MCU, debugger, mikroBUS™ socket and on-board ATECC608B secure element with Trust&GO, TrustFLEX and TrustCUSTOM options.
ATECC608B Trust Platform Kit
(DT100104)
For use as an add-on board to the CryptoAuth Trust Platform Development Kit (DM320118), this kit provides a mikroBUS footprint for adding soldered-down versions of Trust&GO, TrustFLEX or TrustCUSTOM secure elements.
CryptoAuthentication™ SOIC Socket Kit
(AT88CKSCKTSOIC-XPRO)
This board provides an SOIC8 socket to accommodate an ATECC608B or ATSHA204A secure element and an Xplained Pro (XPro) interface to develop solutions using the microcontrollers featured on our Xplained Pro boards.
CryptoAuthentication UDFN Socket Kit
(AT88CKSCKTUDFN-XPRO)
This board provides a uDFN8 socket to accommodate an ATECC608B or ATSHA204A secure element and an Xplained Pro (XPro) interface to develop solutions using the microcontrollers featured on our Xplained Pro boards.
AVR-IoT WG Development Board
(AC164160)
The AVR-IoT WG development board combines a powerful 8-bit ATmega4808 MCU, an ATECC608B CryptoAuthentication™ secure element IC and the fully certified ATWINC1510 Wi-Fi® network controller to provide the most simple and effective way to connect your embedded application to Google’s Cloud IoT core platform.
PIC-IoT WG Development Board
(AC164164)
The PIC-IoT WG development board combines a powerful PIC24FJ128GA705 MCU, an ATECC608B CryptoAuthentication™ secure element IC and the fully certified ATWINC1510 Wi-Fi® network controller to provide the most simple and effective way to connect your embedded application to Google’s Cloud IoT core platform. The board also includes an on-board debugger and requires no external hardware to program and debug the MCU. Transmit light and temperature sensor data from the board to the cloud or add your own sensor using the mikroBUS™ header to interface to MikroElekronika Click boards™.
Google Cloud IoT Core Secure Authentication Kit with 32-bit MCU Use this prototyping kit to learn how to implement a hardware root of trust and secure your authentication to Google Cloud IoT Core. It includes an ATWINC1500 Wi-Fi® device, SAM D21 microcontroller and ATECC608B secure element.
Secure UDFN click This Click board™ from MikroElektronika provides a uDFN8 socket to accommodate an ATECC608B or ATSHA204A secure element and operate it on the CryptoAuth Trust Platform Development Kit (DM320118).
WiFi 7 click This Click board™ from MikroElektronika includes an ATWINC1500 Wi-Fi® module which can be used to add TCP/IP and TLS links to the CryptoAuth Trust Platform Development Kit (DM320118).
Shuttle click This Click board™ from MikroElektronika provides an easy and elegant solution for stacking up to four Click boards on a single mikroBUS™ socket.
mikroBUS Shuttle This small add-on board is intended to be used with Shuttle click to expand the mikroBUS™ socket with additional stacking options. One Shuttle click can support up to four mikroBUS Shuttles, allowing a simple and elegant stacking solution for the Click board™ line of products.

Definitions


Credentials: Identity verification tools or methods that include X.509 certificates, generic certificates for thumbprint authentication, keys and data packets

Customization: The action of creating a unique device/system through its configuration and set of secrets

Firmware Verification: When a key and cryptographic operation are used to verify a signed image on a device at boot up or during run time

IP Protection: When a key and a cryptographic operation are used to verify signed (or hashed) firmware that is considered Intellectual Property (IP) of a product

Key(s): A set of binary numbers that is used to trigger a cryptographic algorithm that implements asymmetric or symmetric encryption

Over-the-Air (OTA) Verification: When a key and a cryptographic operation are used to verify a signed image that has been loaded into a connected device by a push notification from a cloud service

PKI: Public Key Infrastructure

Provisioning: The action of generating a credential into an embedded storage area

Thumbprint Certificate: An X.509 certificate not issued by a certificate authority that is used for authentication to the cloud

FAQs


General Questions:

Q: How can I get started with the Trust Platform?
A:
 Use the “Let Us Guide You to the Right Option” on the Trust Platform page, which will help you take the first step. You will find additional information about getting started with Trust&GOTrustFLEX and TrustCUSTOM on their pages.

Q: I am a distribution partner. How do I enroll in the Trust Platform program?
A:
 Contact your local Microchip sales office to request assistance with joining the program.

 

Trust&GO Questions:

Q: Do I need to contact Microchip to provision my Trust&GO secure element?

A: No. When you buy the device, it is already provisioned with keys and certificates specific to the use case you have selected that are locked inside the device. Trust&GO cannot be altered and is intended to be used as is.

Q: Where can I obtain the public keys and certificates for my Trust&GO device?
A: Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file.

 

TrustFLEX Questions:

Q: Do I need to contact Microchip to provision my TrustFLEX secure elements?  
A:
 Yes. When you buy the device, it comes pre-configured with your selected use case(s). By default, the TrustFLEX device also come with keys and generic certificates for thumbprint authentication that are overwritable internally if you have not already locked them using the lock bit. While the configuration cannot be altered, the default credentials can be changed if you have not already locked them. If you decide to use the default credentials, you will have to lock them after receiving the device. If you don’t want to use the default credentials, you can replace them with yours and then lock them. After you have made your decision, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the public keys and certificates for my TrustFLEX device when I use the default credentials?
A:
 Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file. WARNING: If you have overwritten the default credentials in your device, the manifest file will no longer be compatible with the device’s new credentials.

 

TrustCUSTOM Questions:

Q: Do I need to contact Microchip to provision my TrustCUSTOM secure element?
A:
 Yes. When you buy the device, it will be blank. You will need to use the TrustCUSTOM configurator, which is available under Non-Disclosure Agreement (NDA) to define the configuration, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the secret packet exchange for my TrustCUSTOM device?
A:
 This utility is only available through a Non-Disclosure Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Q: Where can I get the full data sheet for my TrustCUSTOM device?
A:
 This document is only available through a Non-Discloser Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Training

Title Description
Asymmetric Authentication Use Case Example The purpose of authentication is to prevent cloning and counterfeiting and to ensure that an object is genuine and authorized to connect to a product. In this use case example, find out how to authenticate an object, such as an accessory, peripheral, battery or cartridge, that is typically removable and replaceable by the consumer.
Secure Firmware Download Use Case Example In this use case example, you will see a demonstration of the authentication of a firmware update. The example uses asymmetric cryptography to establish a chain of trust to validate the update.
Securing Cloud-Connected Devices with Google Cloud IoT and Microchip This blog article written by Google discusses how the ATECC608B secure element strengthens authentication between IoT Core and IoT hardware.
Symmetric Authentication Use Case Example The purpose of authentication is to prevent cloning and counterfeiting and to ensure that an object is genuine and authorized to connect to a product. In this use case example, find out how to authenticate an object, such as an accessory, peripheral, battery or cartridge, that is typically removable and replaceable by the consumer.
Symmetric Authentication with a Non-Secure MCU Use Case Example In this use case example, you will learn how to authenticate an object using one-way symmetric authentication, which avoids the need for an Internet connection and white (or black) list. A white list is a lookup table for identifying approved units and a blacklist is a lookup table for identifying non-approved units.
Zero Touch Secure Provisioning Kit for AWS IoT - End-to-End Security with AWS Cloud This user's guide provides a detailed walkthrough of provisioning the Zero Touch Secure Provisioning Kit to connect and communicate with the Amazon Web Services (AWS) IoT service.

AWS IoT Security: The New Frontiers

In this session from AWS re:Invent 2016, AWS explains the value of Just in Time Registration (JITR) and Bring you Own Certificate (BYOC) using an ATECC508A secure element.

AWS re:Invent 2016: Introduction to AWS IoT in the Cloud

In this session from AWS re:Invent 2016, an AWS IoT product manager discusses why protecting a devices identity is important and how it can be implemented using the ATECC508A secure element with the AWS IoT service.

Hardware Root of Trust with Google Cloud IoT Core and Microchip

Check out how to improve IoT security by securing the authentication between Google Cloud IoT Core and IoT devices using an ATECC608B secure element.

Internet of Things (IoT) Security Best Practices With Google Cloud (Cloud Next '19)

Security is a critical concern when deploying and managing IoT devices. Learn how Cloud IoT provisioning service simplifies the device provisioning and on-boarding experience for Cloud IoT customers and OEMs. We will demonstrate how to efficiently do bulk provisioning of 8-, 16- and 32-bit microcontrollers. You will also learn about best practices and practical examples of how to provision devices in the wild and keep them secure for their lifetime.

IoT Security: Solving the Primary Hurdle to IoT Deployments (Cloud Next '18)

Security is a huge hurdle to IoT deployment. No company wants to be in the news for having its product as part of a large, IoT-driven DDoS attack. In this session you will learn how Google and Microchip have partnered to offer a seamless and highly secure solution for IoT devices connecting to Google Cloud IoT.

Secure Authentication for LoRa® with the ATECC608B and The Things Industries (TTI) Join Server

In this archived Livestream event, our security experts discuss how to easily develop a LoRa-connected device with secure authentication using our robust, yet simple-to-use, hardware-based security solution using our ATECC608B secure element, SAM R34 radio and The Things Industries (TTI) join server.

Secure Provisioning Service with the Trust Platform for the CryptoAuthentication™ Device Family

In this episode of the Microchip SHIELDS UP! series of security webinars, we provide an overview of the Trust Platform service for the CryptoAuthentication™ family of devices. You will learn about the pre-provisioned Trust&GO, pre-configured TrustFLEX and fully customizable TrustCUSTOM options for the ATECC608B. You will also be given a high-level description of the on-boarding process and the basic information you need to get started with using the provisioning services available from our factories.

Trust&GO: How to Connect an Embedded Device Securely to AWS IoT

Learn how the new multi-account registration feature available in AWS IoT can be combined with our secure element provisioning service for faster, easier on boarding. You will also see how to build a prototype using the Trust&GO ATECC608B-TNGTLS secure element that comes pre-provisioned with generic certificates, add it to a SAM D21 Xplained Pro Evaluation Kit and connect a ATWINC1500 Wi-Fi® module to mutually authenticate with AWS IoT. You will also find out how this security solution can be taken to mass production and how it can be scaled worldwide.

AWS IoT Authentication Use Case

Microchip explains how hardware root of trust works using the ATECC608B secure element and AWS IoT. The Just In Time Registration and Use Your Own certificates functions from AWS IoT allow large-scale authentication of automated systems, while maintaining security by protecting private keys from users, software and manufacturing backdoors.

Cryptography Primer (Part 1): Why Security Today?

During this tutorial about embedded security, Microchip discusses why security is an important consideration.

Cryptography Primer (Part 2): Authenticity, Integrity and Confidentiality

During this tutorial about embedded security, Microchip discusses the three key pillars of security: authentication, integrity and confidentiality.

Cryptography Primer (Part 3): Hashing, Secret Key and Symmetric Cryptography

In this video, learn about the basics of embedded security and how and when to use hashing.

Cryptography Primer (Part 4): Public Key and Asymmetric Authentication

During this tutorial about embedded security, Microchip discusses the concepts of asymmetric cryptography, illustrates how authentication can be implemented and highlights the importance of protecting private keys in hardware secure key storage.

Cryptography Primer (Part 5): Chain of Trust

In this cryptography primer tutorial, Microchip discusses how to implement robust authentication between a host and a client using Public Key Infrastructure (PKI).

Google Cloud IoT Core Authentication Use Case

Check out how Google Cloud IoT combined with the ATECC608B secure element strengthens device-to-cloud authentication. This flexible and TLS-agnostic implementation leverages the JWT token and optimizes code size to enable connectivity and security for very small microcontrollers.

Hardware Root of Trust for AWS IoT with ATECC608B

The threat model for IoT devices is very different from the threat model for cloud applications. During this session at AWS re:Invent, we discussed how all IoT solutions must incorporate end-to-end security from the start, how to mitigate threats and how to avoid common pitfalls. You will also learn about the steps to take in the manufacturing process, how to provision and authenticate devices in the field and how to comply with IT requirements during the maintenance phase of the product lifecycle.

How to Build a Secure Provision Workflow - The Things Conference 2019

Manipulating application and network server keys is not only a daunting process but also opens backdoors in LoRaWAN™ connected products. In this workshop recorded at The Things Conference 2019, you’ll find out how to use Microchip’s secure element to build a secure provision workflow and strengthen authentication to The Things Industry’s (TTI’s) join server.

Secure Boot for Small Microcontrollers

Learn how to implement a secure boot architecture on very small microcontrollers using the ATECC608B secure element. Keys are protected from users, factory operators and equipment as well as software.

Secure Boot with ATECC608B

Learn how to architect a secure boot with Microchip's ATECC608B secure element. This solution implements strong security by verifying the signed boot image of a small microcontroller with an immutable public key kept in the secure element.

Secure Download Firmware Update (DFU)

Learn how to implement a secure, Over-the-Air (OTA) firmware update with a traditional microcontroller using a Microchip secure element such as the ATECC608B. This simple-to-use, cost-efficient and robust security implementation protects the key by verifying the signed code comes from a legitimate source. The key remains protected by leveraging the ATECC608B secure element. Both asymmetric and symmetric architectures are covered in the video.

Partners


Partner Location Contact
  Bristol BS34 8RB, 
United Kingdom
info@cerb-labs.com

Tampere,
Finland
jouni.hautamaki@crosshill.fi

San Diego, CA
USA
Dean Gereaux
deang@goldenbits.com

Tampa, FL
USA
info@occamtechgroup.com

Chicago, IL
USA
info@optimaldesignco.com

BSD City, 
Indonesia
Edy Gunawan
edy@mailc.net

Munich,
Germany
sales@sematicon.com