Pluton

what is it used for

PLUTON_GET_SECURITY_STATE
PLUTON_GENERATE_CLIENT_AUTH_KEY
PLUTON_COMMIT_CLIENT_AUTH_KEY
PLUTON_GET_TENANT_PUBLIC_KEY
PLUTON_PROCESS_ATTESTATION
PLUTON_SIGN_WITH_TENANT_ATTESTATION_KEY
PLUTON_SET_POSTCODE
PLUTON_GET_BOOT_MODE_FLAGS
PLUTON_IS_CAPABILITY_ENABLED
PLUTON_GET_ENABLED_CAPABILITIES
PLUTON_SET_MANUFACTURING_STATE
PLUTON_GET_MANUFACTURING_STATE




SECURITY_MONITOR_WRITE_LOG
SECURITY_MONITOR_GET_LOG_DATA
SECURITY_MONITOR_SMAPI_COMMAND (API)
SECURITY_MONITOR_DERIVE_KEY
SECURITY_MONITOR_GET_PERIPHERAL_COUNT
SECURITY_MONITOR_LIST_PERIPHERALS
SECURITY_MONITOR_LIST_PERIPHERALS_V1
SECURITY_MONITOR_ENABLE_PERIPHERAL_DRIVER
SECURITY_MONITOR_IO_CORE_CONTROL
SECURITY_MONITOR_RECORD_TELEMETRY_EVENT_DATA
SECURITY_MONITOR_GET_TELEMETRY
SECURITY_MONITOR_RESET_RETAIN_TELEMETRY




SECURITY_MONITOR_API_GET_VERSION 
SECURITY_MONITOR_API_PING 
SECURITY_MONITOR_API_QUERY_FLASH 
SECURITY_MONITOR_API_ERASE_FLASH 
SECURITY_MONITOR_API_WRITE_FLASH 
SECURITY_MONITOR_API_VERIFY_IMAGE_BY_FLASH_ADDRESS_CMD 
SECURITY_MONITOR_API_RESET_CMD 
SECURITY_MONITOR_API_WRITE_LOG 
SECURITY_MONITOR_API_GET_LOG_DATA_SIZE 
SECURITY_MONITOR_API_GET_LOG_DATA 
SECURITY_MONITOR_API_DERIVE_KEY_CMD 
SECURITY_MONITOR_API_GET_PERIPHERAL_COUNT 
SECURITY_MONITOR_API_LIST_PERIPHERALS 
SECURITY_MONITOR_API_GET_WIFI_FIRMWARE_LOCATION 
SECURITY_MONITOR_API_GET_APPLICATION_IMAGE_COUNT 
SECURITY_MONITOR_API_LIST_ALL_APPLICATION_IMAGES 
SECURITY_MONITOR_API_SHOULD_IMAGE_BE_UPDATED 
SECURITY_MONITOR_API_INVALIDATE_IMAGE 
SECURITY_MONITOR_API_OPEN_IMAGE_FOR_STAGING 
SECURITY_MONITOR_API_WRITE_BLOCK_TO_STAGE_IMAGE 
SECURITY_MONITOR_API_COMMIT_IMAGE_STAGING 
SECURITY_MONITOR_API_ABORT_IMAGE_STAGING 
SECURITY_MONITOR_API_INSTALL_STAGED_IMAGES 
SECURITY_MONITOR_API_GET_COMPONENT_COUNT 
SECURITY_MONITOR_API_GET_COMPONENT_SUMMARY 
SECURITY_MONITOR_API_GET_COMPONENT_IMAGES 
SECURITY_MONITOR_API_STAGE_COMPONENT_MANIFESTS 
SECURITY_MONITOR_API_COUNT_OF_MISSING_IMAGES_TO_DOWNLOAD 
SECURITY_MONITOR_API_GET_MISSING_IMAGES_TO_DOWNLOAD 
SECURITY_MONITOR_API_SET_PERIPHERAL_MAPPING 
SECURITY_MONITOR_API_SET_PIN_MAPPING 
SECURITY_MONITOR_API_GET_ABI_TYPE_COUNT 
SECURITY_MONITOR_API_GET_ABI_VERSIONS 
SECURITY_MONITOR_API_SET_RTC_CURRENT_TIME 
SECURITY_MONITOR_API_SET_RTC_ALARM 
SECURITY_MONITOR_API_GET_UPDATE_CERT_STORE_IMAGE_INFO 
SECURITY_MONITOR_API_STAGE_BASE_MANIFESTS 
SECURITY_MONITOR_API_COUNT_OF_MISSING_BASE_IMAGES_TO_DOWNLOAD 
SECURITY_MONITOR_API_GET_MISSING_BASE_IMAGES_TO_DOWNLOAD 
SECURITY_MONITOR_API_IO_CORE_CONTROL 
SECURITY_MONITOR_API_GET_ROLLBACK_INFO 
SECURITY_MONITOR_API_RECORD_TELEMETRY_EVENT_DATA 
SECURITY_MONITOR_API_GET_TELEMETRY_DATA 
SECURITY_MONITOR_API_RESET_TELEMETRY 
SECURITY_MONITOR_API_RETAIN_TELEMETRY

Top Replies

danzima over 5 years ago

peterfenn
bwilless

Hi folks, any ideas on the above question?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
bwilless over 5 years ago

Georgi,

I don't understand the question. Can you be more precise in what you're asking for?

Brian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
clem57 over 5 years ago in reply to bwilless

He wizio and I are wondering what these API's are used for. Can our application utilize them?
Thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
wizio over 5 years ago in reply to danzima

Just informtation...
ioctl() to pluton and security-manager
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
wizio over 5 years ago in reply to clem57

oo I have questions - What is Telemetry and why is protected from pluton
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
wizio over 5 years ago

Example - Get Device ID
There is hidden function int Manufacturing_GetDeviceId(char * hex_buffer, int size = 129) libapplibs.so

Reversed Function is:

struct azure_sphere_get_security_state_result

{
uint32_t state;                     // Security state of device (0x04000000)
uint8_t general_public_key[64];     // ECC General public key
uint8_t attestation_public_key[64]; // Attestation public key (is used as DeviceID)
};

int get_security_state(struct azure_sphere_get_security_state_result *p)
{
if (NULL == p)
    return -1;
struct azure_sphere_get_security_state_result d;
int fd = open("/dev/pluton", 0x80000);
if (fd < 0)
    return -1;
int err = ioctl(fd, 0xC0847001, &d);
if (0 == err)
    memcpy(p, &d, sizeof(d));
else
    memset(p, 0, sizeof(d));
#if 0
char *c = (char *)&d;
printf("[security_state] ");
for (int i = 0; i < sizeof(d); i++)
    printf("%02X", (int)c[i]);
printf("\n");
#endif
close(fd);
return err;
}

so ... Manufacturing_GetDeviceId() return attestation_public_key[64]
ioctl( 0xC0847001 ) is
#define PLUTON_GET_SECURITY_STATE _IOWR('p', 0x01, struct azure_sphere_get_security_state_result)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
bwilless over 5 years ago in reply to clem57

I've never used any of these features. If you have any specific questions about them, you should post them in the Azure Sphere MSDN forum here: http://avnet.me/Azure_Sphere_MSDN_Forum

All the application APIs are documented here: https://docs.microsoft.com/en-us/azure-sphere/reference/applibs-reference/api-overview. You're free to use any APIs you want to in your application.

Brian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
bwilless over 5 years ago in reply to wizio

When you send application or sensor data to Azure, this is referred to as Telemetry. In Azure Sphere Telemetry is sent as JSON objects using the AzureIoT_SendMessage() routine. You can see examples of sending telemetry in the OOB blog example application.

Pluton contribution is in establishing a secure connection between your Azure Sphere device and the Azure IoT Hub. Telemetry data is sent using the MQTT protocol and is protected with a TLS secure connection.

Brian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
bwilless over 5 years ago in reply to wizio

When an Azure Sphere MCU is produced at the silicon factory, a private/public key pair is generated in the silicon. The private key is stored in the silicon is only accessible to the Pluton security sub system. The public key, is sent to the Azure Sphere Security Service (AS3) so that each device can send encrypted data to AS3 and since AS3 has the public key, it can decrypt data and also encrypt data to the device.

The public key IS the Azure Sphere Device ID.

Brian
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
wizio over 5 years ago in reply to bwilless

This post is ONLY for information ... for smart guys...
The information is FREE (GPL license) Reference: Azure Sphere_19.05_Linux Kernel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel