15.4.1 Manufacturing Flows

The following sections discuss the different types of manufacturing flows.

15.4.1.1 HSM-based Manufacturing Flow

The HSM-based manufacturing process uses device-supported security protocols. For more information, refer to the Secure Production Programming Solution (SPPS) User Guide .

The U-HSM allows the user to generate and use various encryption and pass keys. Cryptographical operations requiring those keys are executed inside the security boundaries of the HSM Module:

Operation support for the HSM-based Manufacturing Flow is as follows:

  • Key import, generation, and use under protection of the U-HSM and the M-HSM
  • Initial secure key injection into the device using the Authorization Code protocol
  • Secure data transmission between the U-HSM and the M-HSM
  • Overbuild protection
  • Device authentication
  • U-HSM verification of cryptographically sealed certificate of conformance (CoC) from the design programmed into the device
  • U-HSM verification programming job end certificates
  • ​Initiator and Upgrade programming job types
  • eNVM and sNVM client update
  • eNVM client selection
  • Security overwrite
  • Secure debug with SmartDebug tool

15.4.1.1.1 HSM Server Requirements

In the HSM-based Manufacturing Flow, the Job Manager is configured to work with the U-HSM to generate the HSM Programming Job, and HSM Programming Jobs require the M-HSM for job execution. For more information about HSM servers, refer to the Secure Production Programming Solution (SPPS) User Guide . For information about installation, refer to the User HSM Installation and Setup User Guide for the U-HSM and the Manufacturer HSM Installation and Setup User Guide for the M-HSM.

15.4.1.2 Non-HSM Manufacturing Flow

Non-HSM Manufacturing Flow support by the Job Manager allows bitstream file and programming job generation outside of the Libero tool. The Job Manager supports the following operations for non-HSM Manufacturing Flow:

  • Initial key loading via KLK-protected bitstreams
  • Generate UEK1/UEK2/UEK3 encrypted update bitstreams
  • eNVM and sNVM client Update
  • eNVM client selection
  • Key value overwrite
  • Security overwrite