4.4 Key establishment
The key establishment process contains two stages: factory provisioning and registration. During the factory provisioning stage, hardware devices (Gateways and Endpoints) are provisioned with Amazon Sidewalk certificates and initial credentials. During the registration stage, hardware devices (Gateways and Endpoints) are associated and registered to a user.
4.4.1 Key assignment stages (initiating, storing discarding)
During obligatory device provisioning in the factory, initial credentials are stored on the device and the device is logged in manufacturing control logs. AWS consumes the control logs to allow devices to register with the network. The next mandatory stage for each device is owner provisioning. During owner provisioning the device is authenticated and its status is updated in AWS Cloud Services. During the device’s lifetime its ownership can be changed, device software can be updated, and the device can be deregistered, or blocked. If any of the above changes are made to the device, the relevant credentials are updated or removed.
Separate security procedures are implemented for each of the following cases:
- Factory (Gateway, Endpoint) provisioning: During this stage all credentials are flashed on the device.
- Gateway owner provisioning: During this stage the device is authenticated in the network and network credentials are updated.
- Endpoint owner provisioning: During this stage device is authenticated in the network.
- Endpoint changing ownership (this is beyond the scope of this specification).
- Device deregistration, blocklist (this is beyond the scope of this specification).
- Application software upgrade. (This is beyond the scope of this specification.)
- Firmware upgrade (This is beyond the scope of this specification.)
4.4.1.1 Factory provisioning
A provisioning process in the mass production flow is triggered by the Contract Manufacturer that manufactures devices. This flow is driven by a number of factory tools and is designed for high volume manufacturing scenarios. This flow combines Factory Diagnostic Firmware, Amazon Sidewalk Signing Tool, Amazon Sidewalk Provisioning Tool, and Amazon Sidewalk Control Logs to issue Amazon Sidewalk certificates to devices and register them with Amazon Sidewalk Cloud Services. A device being provisioned is connected to the Contract Manufacturer’s configuration system (hardware and software for data load, inventory management and unit calibration) and is also connected by an encrypted link to the Amazon Sidewalk Cloud. Device keys are signed by the Amazon Sidewalk signing tool using the HSM. Depending on the manufacturing needs, signing device keys can be done directly from the line PC, or by establishing a signing server on the local area network. The Amazon Sidewalk provisioning signing tool requests certificates after reading the Device Serial Number. Device certificates and signatures are generated based on received data EC key pairs (Ed25519 and p256r1). Device certificates and signatures are stored in device-persistent memory (flash). After certificates and signatures have been stored in the device, the Amazon Sidewalk Manufacturing Serial Number (SMSN), public keys and signatures are registered in the cloud by Amazon Sidewalk Cloud Services.
Each of the keys are signed by the Amazon Sidewalk Provisioning Tool during provisioning and flashed to the device by J-Link along with the rest of the certificate chain.Figure 4.7 shows the process flow.
The manufacturing page is a region in the internal memory that is reserved for various values to be written during the manufacturing of a device. Fields may be written to the manufacturing page either using a diagnostic version of the firmware or using the J-Link interface. Command line tools provided by the silicon vendor are used to write on the J-Link interface.
The following table summarizes the list of security items that need to be present on the device manufacturing page:
Table 4.6 Security items in hardware device
| Required Field | Description |
|---|---|
| SID_MFG_STORE_VERSION | Version of the manufacturing storage block format. |
| SID_MFG_STORE_DEV_ID | Sidewalk ID. The Sidewalk ID includes a size field in the first 3 most significant bits, so the unique Device IDs should be no larger than (2^37 - 1) and the first 3 most significant bits should be hard coded to 0b101. |
| SID_MFG_STORE_HW_MODEL_AND_VERSION | Hardware model and version number. This is a silicon vendor-specific value that is used by the boot loader to determine if a firmware package that is about to be loaded is compatible with the device. Each model of hardware shall use a different value. If a new hardware revision of the same model needs to run a different version of firmware, the hardware version byte shall be increased. 3B hardware model 1B hardware version |
| SID_MFG_STORE_BOARD_ID | Board ID |
| SID_MFG_STORE_SERIAL_NUM | Serial number of device. |
| SID_DEVCFG_DEVICE_PRIV_ED25519 SID_DEVCFG_DEVICE_PUB_ED25519 SID_DEVCFG_DEVICE_PUB_ED25519_SIGNATURE | Unique per device curve Ed25519 key pair, and signature (see: SID device authentication, SID key and signature generation) |
| SID_DEVCFG_DEVICE_PRIV_P256R1 SID_DEVCFG_DEVICE_PUB_P256R1 SID_DEVCFG_DEVICE_PUB_P256R1_SIGNATURE | Unique per device curve p256r1 key pair, and signature (see: SID device authentication, SID key and signature generation) |
| SID_DEVCFG_MODEL_PUB_ED25519 SID_DEVCFG_MODEL_PUB_ED25519_SIGNATURE SID_DEVCFG_MODEL_ED25519_SERIAL | Model device curve Ed25519 key pair, and signature (see: SID device authentication, SID key and signature generation) |
| SID_DEVCFG_MODEL_PUB_P256R1 SID_DEVCFG_MODEL_PUB_P256R1_SIGNATURE SID_DEVCFG_MODEL_P256R1_SERIAL | Model curve p256r1 key pair and signature (see: SID device authentication, SID key, and signature generation) |
| SID_DEVCFG_MAN_PUB_ED25519 SID_DEVCFG_MAN_PUB_ED25519_SIGNATURE SID_DEVCFG_MAN_ED25519_SERIAL | Product Manufacturer curve Ed25519 key pair and signature (see: SID device authentication, SID key and signature generation) |
| SID_DEVCFG_MAN_PUB_P256R1 SID_DEVCFG_MAN_PUB_P256R1_SIGNATURE SID_DEVCFG_MAN_P256R1_SERIAL | Product Manufacturer curve p256r1 key pair, and signature (see: SID device authentication, SID key and signature generation) |
| SID_AMZN_PUB_ED25519 | Amazon Ed25519 public key |
| SID_AMZN_PUB_P256R1 | Amazon p256r1 public key |
| SID_MFG_STORE_FW_KEY1 SID_MFG_STORE_FW_KEY1_Signature | Production Public Key #1 and signature used to check FW signatures. This key must be the same for every device that runs the same firmware. see: SID key and signature generation |
| SID_MFG_STORE_FW_KEY2 SID_MFG_STORE_FW_KEY2_SIGNATURE | Production Public Key #2 and signature used to check FW signatures. This key must be the same for every device that runs the same firmware. see: SID key and signature generation |
| SID_MFG_STORE_FW_DEV_KEY SID_MFG_STORE_FW_DEV_SIGNATURE | Development Public Key and signature used to check FW signatures. This key must be the same for every device that runs the same firmware. see: SID key and signature generation |
| SID_DHAv2_REGION_ADDRESS | DHAv2 region start address. The address should be at the beginning of the page |
| SID_DHAv2_REGION_SIZE | DHAv2 Region Size |
| SID_DHAv2_PID | Defined by Amazon and assigned to a product during product onboarding. SID_DHAv2_PID is unique to every product even for multiple products from the same manufacturer. This is alphanumeric and 4 characters in length. ASCII encoded. This location is used for devices that do not have the DHAv2 page extension. |
| SID_DHAV2_PIN | ASCII encoded secret PIN used for DHAv2 Registration. This location is used for devices that do not have the DHAv2 page extension. |
| SID_MFG_STORE_TEST_MASTER_HW_ID | Lower 32 bits of Bluetooth MAC of master device that controlled the RF testing of this device. |
| SID_MFG_STORE_REG_ISO_COUNTRY | String containing two characters that determines the default country where the device is certified to operate. In ISO 3166-2 |
| APP_MFG_STORE | Device-specific manufacturing value storage not specified by Sidewalk. (ie calibration values for sensors, etc.) |
| SID_MFG_STORE_CRC | Calculated over Amazon Sidewalk manufacturing storage. (words 0-1022) |
4.4.2 Device registration
Devices are required to register before using Amazon Sidewalk. During registration the device is authenticated.
4.4.2.1 Gateway registration
As Amazon Sidewalk Gateways are based on Amazon and Ring product devices, an Amazon or Ring user account is required to register the product. To use an Amazon or Ring account requires configuring local Internet access. Amazon Sidewalk registration happens automatically once the user has signed in and registered the Gateway product. As part of Amazon Sidewalk registration, the Gateway establishes an encrypted connection with the Amazon Sidewalk Cloud, providing an authenticated connection.
4.4.2.2 Endpoint registration
The release described in this specification supports Endpoint registration via BLE and FSK can also be used.
An Endpoint can be registered using a mobile application leveraging the Amazon Sidewalk mobile SDK.
An Amazon registered user with a dedicated mobile application connects to Sidewalk Cloud Services and to the device while it is in Out Of the Box Experience (OOBE) mode and provides the device ID to register.
During this stage security is set up and a connection with the Client’s API is established. The Endpoint connects to the Mobile Application with default settings and further configuration proceeds.
Then the authenticated link between AWS Cloud Services and the Endpoint is associated, the Endpoint is bound to the user Gateway and necessary credentials are established.
The following diagram summarizes the sequence flow:
fig 4.8 EN registration part 1
fig 4.9 EN registration part 2