Winning with Atmel on Kickstarter

Kickstarter first opened its virtual doors on April 28, 2009. Since then, the wildly popular crowdfunding website has tracked over $1 billion in pledges from 5.9 million individuals who actively funded 59,000 creative projects.

Unsurprisingly, quite a number of Atmel-powered Kickstarter projects have been successfully funded over the past year, including:

MicroView



MicroView is a chip-sized platform with a built-in OLED (64×48) display that allows Makers to see what the Atmel-based board is “thinking” without having to link with a PC.

The device, designed by the Geek Ammo crew, is built around Atmel’s versatile ATmega328P microcontroller (MCU).



1Sheeld

Integreight’s 1Sheeld – designed around Atmel’s ATMega162 MCU – is an easily configurable shield for Arduino boards.

http://www.kickstarter.com/projects/integreight/1sheeld-replace-your-arduino-shields-with-your-sma

Essentially, 1Sheeld connects to a mobile Android app that allows users to take advantage of various smartphone features including the display, gyroscope, accelerometer, magnetometer, GSM, Wi-Fi and GPS.

DIWire



The first desktop CNC wire bender recently hit Kickstarter with an Atmel MCU (ATxmega192/TinyG) under the hood.

https://www.kickstarter.com/projects/1638882643/diwire-the-first-desktop-wire-bender

Designed by Pensa Labs, the DIWire transforms drawn curves into bent wire that can be assembled to make just about anything.

Primo



Primo can best be described as a playful physical programming interface that helps teach children programming logic without the need for literacy.

https://www.kickstarter.com/projects/1039674461/primo-teaching-programming-logic-to-children-age-4

Powered by an Atmel-based Arduino board, the Primo play-set uses shapes, colors and spacial awareness to instruct programming logic through a tactile, warm and magical learning experience

.

Robox



Robox is a 3D printing and micro-manufacturing platform designed byC Enterprise Ltd. (CEL).

https://www.kickstarter.com/projects/robox/robox-desktop-3d-printer-and-micro-manufacturing-p?ref=live

Driven by an ARM-based Atmel chip, the Robox was designed by its creators to “demystify” the 3D printing process.

The EX¹ 

The Atmel-powered (ATmega2560) EX¹ allows Makers and engineers to quickly print circuit boards on a wide variety of material.

https://www.kickstarter.com/projects/cartesianco/the-ex1-rapid-3d-printing-of-circuit-boards

Simply put, the EX¹ is helping to transform electronics and prototyping in the same way that conventional 3D printing revolutionized traditional manufacturing.

Touch Board: Interactivity Everywhere



The Touch Board is an Atmel-powered platform (ATmega32U4 MCU) that allows Makers to more easily create interactive and responsive projects.

The Touch Board can change the world around you by turning almost any material or surface into a sensor.

Flutter

Flutter is an open source Atmel-powered wireless platform with a 1000m+ (3200 ft) range.

https://www.kickstarter.com/projects/flutterwireless/flutter-20-wireless-arduino-with-half-mile-1km-ran

Protected from digital intruders by Atmel’s ATSHA204 which offers 256-bit AES hardware encryption, Flutter makes it easy for DIY Makers to build projects that communicate across a house, neighborhood and beyond.

Hex ‘Copter

Hex – powered by Atmel’s ATmega32U4 – is a 3D-printed nanocopter that can be controlled using the gravity sensors in a mobile device.

https://www.kickstarter.com/projects/1387330585/hex-a-copter-that-anyone-can-fly

Essentially, Hex imitates the movement of the smartphone or a tablet in the air. In addition, traditional throttle, elevator, aileron, rudder control systems can be used to operate your Hex.

ATtiny85 ISP!



Designed by Ben Escobedo, the open source ATtiny85 ISP! can probably best be described as a breakout prototyping board for Atmel’s ATtiny85/45/25 lineup.

https://www.kickstarter.com/projects/rullywowr/attiny85-isp-shrink-your-arduino-projects-with-eas?ref=live

The project’s goal? Allowing Makers to take advantage of the ATtiny85 chip’s potential, while using the familiar Arduino IDE and harnessing the super awesome support from the Arduino community.

Agent Smartwatch



Atmel’s SAM4S and tinyAVR MCUs are inside the Agent smartwatch which raised well over a million dollars on the crowdfunding website.

https://www.kickstarter.com/projects/secretlabs/agent-the-worlds-smartest-watch

The next-gen smartwatch offers brand-new technology, world-class developer tools, unparalleled battery life and Qi wireless charging.

Blinky Tape



BlinkyTape – powered by Atmel’s ATmega32U4 – is a portable LED strip with 60 pixels and an integrated USB-programmable light processor.

https://www.kickstarter.com/projects/740956622/blinkytape-the-led-strip-reinvented

Additional key specs include 32KB Flash memory, 2.5KB RAM, 1KB EEPROM, a micro USB connector for power and data, as well as an on-board micro switch for interactive applications.

Vega Edge



Made of laser-cut leather, the Atmel-powered, Arduino-based Edge is a wearable light that snaps securely onto your clothing with the help of four strong neodymium magnets.

https://www.kickstarter.com/projects/868814363/vega-edge

You can wear it discreetly by day or brightly at night with your winter coat, cardigan, hood, scarf, handbag, collar, pocket, belt, or wherever you’d like a touch of light.

The Open Enigma Project

Designed by the ST-Geotronics crew, the Open Enigma (M4) Project – powered by an Atmel-based Arduino Mega (ATmega1280) – first surfaced towards the end of 2013.

https://www.kickstarter.com/projects/438986934/the-open-enigma-project

When it went live on Kickstarter, the Open Engima successfully raised over $62,000, facilitating the implementation of several important stretch goals.

Skirmos: Open Source Laser Tag

Skirmos is an open source, versatile laser tag system that features an ATmega328P microcontroller (MCU), Arduino bootloader, color LCD screen (acts as a realtime HUD) and an infrared LED.

Skirmos currently offers a trio of preset gametypes: basic, free-for-all and team slayer. However, the platform is ultimately expected to boast an almost unlimited number of gametypes.

OSCAR: Open Screen Adapter



OSCAR is a super high resolution 9.7″ screen with an Atmel-powered (ATmega32u4) adapter that allows users to easily link the display to their PC, Mac or Linux machine.

https://www.kickstarter.com/projects/1859884318/oscar-the-open-screen-adapter?ref=live

The board is Arduino compatible ,which makes modifying the behavior easy, as all the software and hardware is open source.

DigiX

DigiX is an Atmel-based development board (AT91SAM3X8E) with WiFi and Mesh networking, Audio, USB OTG, microSD and 99 i/o pins.

https://www.kickstarter.com/projects/digistump/digix-the-ultimate-arduino-compatible-board-with-w?ref=live

The DigiX was designed to be a dev board ready for any project – with no compromises.

Reactor Core – Arduino/AVR Programmer, DIY Soldering Kit



The Reactor Core is a hardware programming platform for Arduino boards and stand-alone AVR-based microcontrollers (MCUs).

https://www.kickstarter.com/projects/1257390142/reactor-core-arduino-avr-programmer-diy-soldering?ref=live

Designed by Frank Fox, the Reactor Core is powered by Atmel’s ATmega328P MCU and an FT232R for USB to serial communication.

King’s Assembly Mouse

Solid Art Labs recently debuted the King’s Assembly – a unique device that packs a high-precision laser mouse, full mechanical keyboard and an analog joystick into a single platform.

https://www.kickstarter.com/projects/70308014/kings-assembly-a-computer-mouse-full-of-awesome

Atmel’s AT90USB128 MCU powers this three-in-one mouse. Key features include 30 keys for each hand, finger key rows angled for fast access and a two-axis analog joystick for each thumb.

Pi-Bot

The Atmel-powered Pi-Bot (ATmega328) is a hands-on robotic learning platform for both students and professional engineers.

https://www.kickstarter.com/projects/1158090852/pi-bot-the-next-great-tool-in-robotics-learning-pl?ref=category#

According to STEM Center USA CEO Melissa Jawaharlal, the team designed the Pi-Bot from the ground up to optimize functionality and ensure affordability.

Game Frame: The Art of Pixels



Game Frame – an Arduino-based grid of 256 ultra-bright LED pixels – was designed by Jeremy Williams to showcase pixel art and old school video games.

https://www.kickstarter.com/projects/jerware/game-frame-the-art-of-pixels

As Williams notes, video game artists used to draw everything with a sheet of graph paper, a few colors and a couple of animation frames.

Robot Army Starter Kit

The Robot Army is a DIY Delta Robot kit powered by Atmel’s versatile ATmega328 microcontroller for the rapidly growing Maker community.

https://www.kickstarter.com/projects/1984252088/robot-army-starter-kit?ref=footer

The kit includes all mechanical pieces in grey and neon yellow plastic (the yellow fluoresces under black light), spacers, brackets, ball bearings and hardware required for assembly. In addition, the kit is packed with electronic components, PCB and wire harnesses.

MicroSlice: Mini Laser Cutter & Engraver



The MicroSlice is a mini laser cutter and engraver.

The open source platform, powered by an Atmel-based Arduino Uno (ATmega328), is currently being promoted as a kit that takes approximately 15 hours to build.

uARM: Miniature Industrial Robot



This four-axis parallel-mechanism desktop robot arm is modeled after the ABB industrial PalletPack robot and is built around Atmel’s ATmega328 MCU which powers a custom board.

https://www.kickstarter.com/projects/ufactory/uarm-put-a-miniature-industrial-robot-arm-on-your?ref=live

The uARM platform is constructed with acrylic or wood parts and fitted with standard RC hobby servos.

Smart Nixie Tube



The Smart Nixie Tube is an open source platform powered by Atmel’s versatile ATmega328p.

https://www.kickstarter.com/projects/popshields/smart-nixie-tube?ref=live

Designed by Tyler Nehowing, the platform is fully programmable using the unmodified Arduino IDE, as it appears as an Arduino Uno running at 16MHz/5V.

OpenBCI: An Open Source Brain-Computer Interface For Makers

OpenBCI – designed by Joel Murphy & Conor Russomanno – is a low-cost programmable open-source EEG platform that offers Makers easy access to their brainwaves. In addition to an ADS1299 IC, the OpenBCI is equipped with Atmel’s ATmega328 (+ Arduino’s latest bootloader).

https://www.kickstarter.com/projects/openbci/openbci-an-open-source-brain-computer-interface-fo?ref=live

The project’s vision? 

”To realize the potential of the open-source movement to accelerate innovation in brain science through collaborative hardware and software development.”

White Bread Shield for Arduino

Mark Davidson recently designed an Atmel-powered (ATmega328) Arduino prototyping shield that can also be used as a stand-alone board for various DIY Maker projects.

https://www.kickstarter.com/projects/1214533021/white-bread-shield-for-arduino?ref=live

Dubbed the “White Bread Shield,” the platform is compatible with Arduino Uno boards.

Hauntbox



The Hauntbox is a prop controller and automation machine that is browser-configured and open source.

https://www.kickstarter.com/projects/1020117671/hauntbox

The ATmega2560-based platform allows Makers to easily automate inputs and outputs without the need for complex programming.

ControlLeo

ControLeo – designed by two retired Silicon Valley engineers – can probably best be described as a quad relay controller enclosed in a professional box.

https://www.kickstarter.com/projects/1471240030/controleo-an-arduino-compatible-controller?ref=live

The platform is driven by Atmel’s ATmega32u4 paired with an Arduino Leonardo boot loader.

FEZ Medusa



FEZ Medusa is an open source hardware (OSHW) processor board powered by Atmel’s ATmega328P.

https://www.kickstarter.com/projects/1359959821/an-arduino-compatible-electronic-building-block-sy?ref=search

Aptly described as “electronic building blocks” by the GHI Electronics crew, the Fez Medusa is designed to keep soldering irons optional with a comprehensive ecosystem of mainboards, sensors and control modules.

Rapid IoT prototyping with SODAQ

The Atmel-based SODAQ (ATmega328P) is a LEGO-like, plug-in, rapid prototyping board.

Simply put, the multi-feature microprocessor board allows both Makers and engineers to easily connect a wide variety of sensors and devices to the Internet.

Oscilloscope Watch

A Maker by the name of Gabriel Anzziani recently designed a rather impressive oscilloscope watch built around Atmel’s versatile ATxmega256A3U MCU.

https://www.kickstarter.com/projects/920064946/oscilloscope-watch

The device boasts all the trappings of a modern watch (time, calendar and alarm), along with all the features of the popular Xprotolab – oscilloscope, waveform generator, logic analyzer, protocol sniffer and frequency counter.

GPS Cookie

Developed by Richard Haberkern, the open source GPS Cookie is built around Atmel’s popular ATmega328P.

https://www.kickstarter.com/projects/richardhaberkern/gps-cookie-leaving-crumbs-wherever-it-goes

The Cookie’s compact form factor (available in two form factors, or shapes) makes it easy to carry, experiment with and expand.

Little Robot Friends



Little Robot Friends are both interactive and customizable, each with a unique and evolving personality.

https://www.kickstarter.com/projects/aesthetec/little-robot-friends?ref=home_spotlight

According to Mark Argo of Aesthetec Studio, the Little ‘bot family is built around Atmel’s ATmega328P MCU. Each Little Robot is powered by two rechargeable AAA batteries and depending on the frequency of use, should last for weeks or months on a single charge.

Lumapad



The Lumapad is an open source, high intensity, 8000 lumen LED lighting system built around Atmel’s ATmega328P MCU and an (optional) electric IMP.

https://www.kickstarter.com/projects/richardhaberkern/open-source-ultra-bright-led-light-pad-with-wifi-a

According to project designer Richard Haberkern, 32 ultra-bright LEDs are positioned in a landscape array to provide bright, even and controllable lighting, drawing only 88 watts. Last, but certainly not least, a built in electronic dimmer makes the light intensity adjustable to fit just about any environment.

Delta Six Game Controller



The Delta Six mirrors the look of a modern military combat rifle, including real time aiming as well as a kickback sensation. The Atmel-powered, Arduino-based Delta Six was developed using IR sensors, accelerometers and gyroscopes to provide unparalleled arcade experience.

https://www.kickstarter.com/projects/356540105/delta-six-a-new-kind-of-game-controller

The controller is compatible with Xbox 360, Play Station 3, and PC systems – and upgradeable for next-gen systems like Playstation 4.

Neko – A Color Field Oil Painter



Created by Laura Lippincott, Neko was brought to life with an Arduino Mega (Atmel ATmega1280), hobby parts and a 3D printer.

https://www.kickstarter.com/projects/painterbot/neko-a-color-field-oil-painter?ref=live

The ‘bot is currently being primed with color data in an attempt to make him more creative.

Smart Citizen Kit

Designed by Acrobotic, the Smart Citizen Kit is an open-source environmental monitoring platform powered by Atmel’s ATmega32U4.

https://www.kickstarter.com/projects/acrobotic/the-smart-citizen-kit-crowdsourced-environmental-m?ref=live

Dubbed the Ambient Board, the Kit hardware comprises two printed-circuit boards – an interchangeable daughterboard or shield, and an Arduino-compatible data-processing board. As the name suggests, it is equipped with sensors to measure air composition (CO and NO2), temperature, light intensity, sound levels and humidity.

Sparki – The Easy Robot for Everyone


Sparki is an easy to use Arduino-based robot (ATmega32u4RC) that offers a fun introduction to programming, electronics and robotics.

Although Sparki is simple enough for beginners, the ‘bot is packed with more than enough features to satisfy more experienced Makers.

Linkbot



Designed by Barobo, the Linkbot  is a modular robot platform powered by Atmel’s ATmega128RFA1 (running at 16MHz) that boasts 100oz-in (7.2 Kg-cm) of torque and a free-run speed of 300 deg/sec.

https://www.kickstarter.com/projects/barobo/linkbot-create-with-robots

Atmel’s ATSHA204 helps secure the BBB

Hashlet – an authentication device embedded on a mini-cape – is specifically designed to secure the BeagleBone Black (BBB). 

Powered by Atmel’s advanced ATSHA204, the mini-cape functions as an external hardware random number generator, performs the SHA-256 algorithm in hardware and is capable of storing up to 16 256-bit keys in write and read protected memory.

Manufactured by Cryptotronix, the device is packaged with free software (GPLv3) that provides an easy to use Command Line Interface (CLI).

“The Hashlet is assembled and tested by Cryptotronix prior to shipping,” the Cryptotronix crew explained in a recent product post.
 
”Simply slip the board on the top of the expansion header and the device is ready. The device uses /dev/i2c-1, which is enabled by default so there are no device-tree files that have to be installed.”

Random numbers (data) are easily generated with a single line command, while creating and verifying a MAC is similarly straightforward. 

According to the Cryptotronix crew, the Hashlet is both 3.3V and 5V friendly and can be used on any device capable of communicating with I²C. Meaning, the mini-cape is also compatible with a Raspberry Pi – if the I²Cs signals are split separately. 

The Hashlet can be purchased here for $12.

As we’ve previously discussed on Bits & Pieces, Atmel’s ATSHA204 boasts a number of defensive mechanisms specifically designed to prevent physical attacks on the silicon itself or logical attacks on the data transmitted between the chip and the system. 

Plus, each ATSHA204 ships with a unique 72-bit serial number.

By using the cryptographic protocols supported by the chip, a host system or remote server is able to prove the serial number is authentic and not a copy. 

In addition, the ATSHA204 is capable of generating high-quality random numbers and employing them for any purpose, including usage as part of the crypto protocols of the chip. Access to the silicon is granted via a standard I²C interface at speeds up to 1Mb/sec.

And last but certainly not least, it is compatible with most UART or serial IO controllers. 

So that’s the physical spec rundown, but what about specific attacks ATSHA204 is designed to shield against?

Well, the ATSHA204 is capable of helping to protect devices from a variety of nefarious threats, including algorithmic, protocol, microprobe, environmental, timing, bug, dumpster diving, emissions, fault and power cycling. 

Meanwhile, a secure boot system prevents unauthorized modification of host firmware and protects against unauthorized users enabling extra features without payment. Last, but certainly not least, the ATSHA204 helps thwart illicit system copies, piracy and code reverse engineering.

Interested in learning more about Atmel’s secure ATSHA204? You can check out the official product page here and full data sheet here (PDF).

Building a $20 wireless platform with the Atmel-powered Flutter

Flutter – which recently tipped up on Kickstarter – can best be described as an open source Atmel-powered wireless platform with a 1000m+ (3200 ft) range. Protected from digital intruders by Atmel’s ATSHA204 which offers 256-bit AES hardware encryption, Flutter makes it easy for DIY Makers to build projects that communicate across a house, neighborhood and beyond.

“Creating Flutter networks is easy, even if it’s just two boards. Specify networks in Arduino code or configure Flutter with our mobile app,” the Flutter crew explained in a Kickstarter post. “Once configured, devices can enter and exit the network seamlessly. This makes it extremely easy to set up a network at home (or anywhere else) where all of your projects can reliably communicate. Flutter is like a second network for your devices.”

In terms of hardware, the Flutter crew is currently offering a range of options for Kickstarter backers, including basic, pro and a number of shields (Bluetooth, breakout board, RC, network and Bluetooth).

Potential applications for Flutter? Mesh networking, quadcopters, sensors (light, water and temperature) sensors, self-diagnosis/spectrum analyzer, as well as RC cars.

As noted above, Flutter is powered by Atmel technology. More specifically, prototype devices were originally designed using the  Arduino Pro Mini board (Sparkfun), although the final version of Flutter will be built around Atmel’s SAM3S, based on a powerful ARM CPU with plenty of speed and storage space.

Interested in learning more about Flutter? You can check out the project’s official Kickstarter page here.

Secure personalization service safeguards your IP

Written by Steve Jarmusz

Afraid of having your IP/firmware stolen?  Don’t want unauthorized accessories in the marketplace taking revenue that’s rightfully yours and potentially damaging your brand equity?  Security concerns are serious and worth addressing, but what if you don’t have the expertise in cryptography or infrastructure?

Well, one turnkey solution that does not require security expertise are Atmel ATSHA204 CryptoAuthentication™ ICs.  Atmel provides a personalization service to customers of CryptoAuthentication products. This personalization service (configuring the CryptoAuthentication device for a specific application) is performed at final package test. Before this service can be performed, Atmel solicits secrets from the customer while never knowing the value of those secrets. The secrets are received from the customer encrypted and stay encrypted until they are requested by the test program at final package test. Because of the transport key mechanism innate to the ATSHA204 silicon, these secrets are even encrypted at the probe tips while they are being placed into the secure memory of the ATSHA204.

How does Atmel protect the secrets solicited from customers? We use a SafeNet Hardware Security Module (HSM), which are ranked #1 in worldwide markets. HSMs provide the highest performing, most secure transaction security solutions for enterprise and government organizations. They are used in banking, military, and other government applications where information security is paramount.

SafeNet, Hardware Safety Module

Atmel sends customers that are going to use the Secure Personalization Service the public key of a RSA key pair that was generated and stored on the HSM. Atmel also provides a template that represents the CryptoAuthentications memory contents and an encryption utility. Once the customer fills in this template with their specific data, it is encrypted with an AES key generated by the encryption utility. After AES encryption, the AES key is encrypted with the public RSA key and then deleted.

The encryption utility subsequently packages the AES encrypted template with customer secrets, the encrypted AES key and various other non-encrypted data used for data integrity into a file that is sent to Atmel. This file then is placed on the HSM system at locations performing the final ATSHA204 package tests. When the tester has determined that the ATSHA204 has passed all functional and electrical tests, that file is sent into the HSM for decryption. It is here that the secrets are placed into the ATSHA204 device’s secure memory. Both device and the SafeNet HSM are tamper proof. If a physical attack or tamper is detected, all data contents are destroyed.

Achieving a secure lockdown with Atmel’s ATSHA204

Despite its obvious importance, security often takes a backseat when it comes to designing a device or electronic component.

Perhaps one of the most shocking examples of security failure in the electronic world was highlighted last year during the Black Hat conference when a hacker demonstrated how he used a simple microcontroller to compromise hotel room doors by accessing 32-bit keys.

Unfortunately, the above-mentioned breach is hardly an isolated incident, as hacks for poorly secured hardware can be found swirling around the internet ether where they are routinely bought and sold by less-than-savory elements.

While it may seem somewhat daunting, securing a device can be made easier with an optimized authentication chip like Atmel’s ATSHA204 which includes a 4.5Kb EEPROM. This array can be used for the storage of keys, miscellaneous read/write, read-only, password or secret data. As expected, access to various sections of memory can be restricted in a variety of ways, with the configuration locked to prevent changes.

The chip also boasts a number of defensive mechanisms specifically designed to prevent physical attacks on the silicon itself or logical attacks on the data transmitted between the chip and the system. Plus, each ATSHA204 ships with a unique 72-bit serial number. By using the cryptographic protocols supported by the chip, a host system or remote server is able to prove the serial number is authentic and not a copy.

In addition, the ATSHA204 is capable of generating high-quality random numbers and employing them for any purpose, including usage as part of the crypto protocols of the chip. Access to the silicon is granted via a standard I²C interface at speeds up to 1Mb/sec. And last but certainly not least, it is compatible with most UART or serial IO controllers.

So that’s the physical spec rundown, but what about specific attacks ATSHA204 is designed to shield against? Well, the authentication chip is capable of helping to protect devices from a variety of nefarious threats, including algorithmic, protocol, microprobe, environmental, timing, bug, dumpster diving, emissions, fault and power cycling.

Meanwhile, a secure boot system prevents unauthorized modification of host firmware and protects against hackers enabling extra features without payment. And last, but certainly not least, the ATSHA204 helps thwart illicit system copies, piracy and code reverse engineering.

So while securing a device may seem like somewhat of a daunting task, especially in the face of so many critical threats, Atmel’s ATSHA204 is a comprehensive hardware-based solution that offers full applications support for both AVR and ARM systems, while helping to streamline and optimize the lockdown process.

Why Should You Consider Hardware Security on the Host Side?

By: Rocendo Bracamontes

Over the last year, I’ve come across many different applications and systems that require security. The majority of them can be categorized as follows:  accessory authentication, consumables, system anti-cloning and session key exchange.

Since the ATSHA204, the latest Atmel CryptoAuthentication™ device, uses a symmetric algorithm, the system where the security is implemented requires the same key at the host and the client.

To provide the best security, designers are recommended, with few exceptions, to include a “host” chip ATSHA204 that holds the system’s symmetric keys.

The following example illustrates a critical application where the usage of hardware security on the transmitter (host) is crucial to perform a receiver (client) authentication over a network. For example, this applies to smart meters, industrial lighting and sensitive sensor networks.

Without it, the transmitter would have to store the secret keys in Flash and perform the cryptographic functions by software, making the system vulnerable to malicious hacks, and impacting overall system performance.  To learn more about why hardware security is recommended over software security, check out our previous blog post on this topic.

Hardware Security on Host Side

A Closer Look at Secure Boot and Why It’s Important

By: Gunter Fuchs

Who has not experienced a misbehaving computer due to a  virus? Or, you may have at least seen your virus protection software catching one in the act. One especially nasty type of virus is one that is executed before the anti-virus (AV) software begins its process, because it can then manipulate your AV program in a way that it does not find the virus.

Two main programs are executed before your AV program: the binary input / output system (BIOS) and the operating system (OS). The central processing unit (CPU) executes these two programs as part of the “boot” process. Making this boot process secure can increase the overall security of a system in a big way.  By verifying the authenticity of the code for the OS, a secure boot process prevents any virus from sneaking in and compromising a system before the AV program can take over system security.

To be able to verify the code, it is stored along with a “signature” of it at the time of manufacturing or code update. The signature is the output of a cryptographic hash function. (A hash function is irreversible and “condenses” a big blob of information such as boot code into a quite tiny size, 32 bytes for example.) Its inputs are the code and a secret key, known only to the generator of the signature and the verifying routine inside boot code (BIOS) that gets executed immediately after power-up or system restart. This verifying routine calculates the signature the same way it was calculated before by the host (system at manufacturing plant, online site for updating, etc.), and compares it with the stored signature. Only if the calculated and stored signatures match does the boot process continue. Otherwise, the boot verification routine halts the system.

The paragraph above describes a system where the verification (calculation and key storage) is done in the boot ROM. The picture below shows a system where the calculation and key storage are loaded off into a hardware device (ATSHA204) offered by Atmel. Storing the key in very secure, tamper-safe hardware adds a big obstacle to any hack attempt.

Secure Boot

Securing Your Design with the Fixed Challenge Authentication Model

By: James Tomasetta

Fixed challenge authentication is an easy way to add security to your product without the added expense of additional hardware to the host or client, interactive testing, or extensive software development.

Fixed Challenge Response

Fixed challenge authentication is the only authentication model that does not require a key or calculation on either the host or client.  With the fixed challenge model the host sends the same challenge every time authentication is needed and the client always responds with the same response.  By ensuring the same challenge and response are used both sides can have a pre-calculated version of the challenge response pair.

The major weakness in this model is that an attacker can monitor the bus and record the challenge/response pair and then use the recording to fool the system into validating a fake device.  This is known as a replay attack and is one of the easiest forms of attacks.  To counter this, the host can have a list of challenge/response pairs and randomly select from the list requiring the attacker to record multiple transactions on the bus prior to fooling the system.

Another key weakness in the system is that the challenge/response pairs need to be stored in memory, making them easy to extract from the host.  One solution to this is to add a hardware authentication device to the host.  Adding a hardware device like the Atmel ATSHA204 CryptoAuthentication IC allows the system to increase the level of security without the need to change any client device already in the field.