2.2 How Our Products Can Help

The ATECC608 is a technology enabler that provides IACS product suppliers with the means to satisfy the component requirements mandated by ISA/IEC 62443-4-2. Below is a list of cryptographic features and security protection of the ATECC608 that will be later mapped against the ISA/IEC 62443 specification.

The ISA/IEC 62443 is calling for “secure key storage” or protection of the cryptographic keys. This is not a vague term in security but rather a specific feature the silicon is designed with. A secure key storage or the act of protecting keys consists of implementing a physical secure boundary wherein both the crypto-operations and cryptographic keys live. If keys and algorithms are not in that same secure boundary, the keys will be exposed at some point during transactions. This is where the essence of secure elements like the ATECC608 start to bring their contribution to a successful certification. Secure elements are secure key storage devices tested against the Joint Interpretation Library (JIL) rating scale from the Common Criteria practices to evaluate its robustness to protect keys.

Following the value of secure key storage, loading keys in such a device location following a secure manufacturing process comes up immediately as the next question. Microchip has factories equipped with a network of managed hardware security modules (HSM) that enable our customers to leverage our secure key provisioning service. By onboarding the secure element with this service, customers follow a controlled secret key exchange process that binds the credentials securely stored in the device to their own chain of trust or their client’s chain of trust without exposing the various cryptographic keys to any third party such as contract manufacturers. In complementary fashion, Microchip’s secure element can enable late-stage provisioning when an end-customer desires to activate the cryptographic keys late in the provisioning process.

The table below refers to the component requirements defined in ISA/IEC 62443-4-2, and provides indications on how the ATECC608 can act as a technology enabler to help the client’s product meet each of the requirements. The Security Level (SL) is specified for each CR and Cryptographic feature listed in the table below.

The ISA/IEC 62443 standard defines the requirements for four types of components:

• Embedded Devices (EDR)
• Software Applications (SAR)
• Host Devices (HDR)
• Network Devices (NDR).

Those component requirements that apply to all types of components are marked as “CR”, while the other requirements are marked according to the component type that they apply to (respectively: EDR, SAR, HDR, NDR).

When reading the table below, keep in mind the RE is associated to the CR of the same base paragraph. For example, “CR 1.1 RE(1) Unique identification and authentication” is part of the “CR1.1 Human user identification and authentication”.