Flasher Secure
The Flasher Secure is a mass production tool, intended to be used at an external manufacturing company. The goal is to protect the intellectual property against unauthorized copying. Owners enjoy full control over the programming process — even when their production is outsourced to contract manufacturers (CM).
It is fast, robust, reliable, and engineered to handle almost all flash programming requirements in the industry. The Flasher Secure can be used in stand-alone or PC-based mode. The configuration is done in MSD mode. It connects via USB, Ethernet or an RS232 interface allowing control of the Flasher Secure. Every device to be programmed must be authorized by the Flasher Secure Control Server. Devices can be tracked by their unique ID.
Powered via USB, the Flasher Secure has 128 MB of internal memory to store firmware images and programming configurations. The 20-pin target connector adapts to multiple standard and proprietary connectors through a wide variety of adapters from SEGGER. The Flasher Secure supports a large number of CPU cores and an even greater number of different devices from various vendors.
As a multi-platform solution, Flasher Secure comes with the setup and control software for Linux and Windows.
Key features
- Authenticated production with full visibility
- Production volume control
- Flasher Secure Control Server for CM administration and setup
- Ultra fast programming
- Reliability
- Supports MCUs with Unique IDs
- Supports Arm, Cortex, PowerPC and Renesas RX cores
- Target interface: JTAG / SWD
- Prevents production of counterfeit units
- No overhead in programming time
- Secures production at contract manufacturers
- 128 MB internal memory for configuration and data file storage
- Multi-platform: Includes setup and control software for Linux and Windows
- Security: Flasher Secure and Flasher Portable PLUS support Authorized Flashing.
Supported devices
SEGGER Flashers support a wide range of CPU cores and an even wider range of different devices, such as SPI-Flash devices.
This includes support for tens of thousands of devices in hundreds of device families with billions of devices programmed.
Universal target support
Flasher Secure has a very flexible target and programming interface.
This concept makes it possible to adapt to almost any system for ISP programming purposes. Dedicated flash loaders, which can be easily downloaded to the programmer, make it possible to program almost any device. This flexibility allows using the debug or dedicated programming interfaces of microcontrollers to program the on-chip memories as well as the programming of the off-chip parallel or (Q)SPI flashes. (Q)SPI can also be programmed directly.
Software
As for every Flasher, the Flasher Software and Documentation Package is also available for the Flasher Secure. It comes with the flash loaders for all supported devices.
Please note:
To set up the complete infrastructure and use the Flasher Secure as intended, it is essential to set up and run the Flasher Secure Control Server Software.
To use the full range of security features, the RSA Verification Package is recommended.
Updates
Future software and firmware updates as well as any new flash loaders for target devices that will be added, are also free of charge.
- No licensing costs, even for newly supported devices.
- No hidden costs.
- No future costs.
Multi-platform
As a multi-platform solution, Flasher Secure comes with the setup and control software for Linux and Windows. Software and firmware updates are included. Similarly, use on all currently supported target devices, and any that will be added, is also included.
High-speed programming
The Flasher Secure is an in-circuit programmer using the same ultra-fast proprietary flash programming algorithms as the Flasher PRO and other Flasher models. Flasher programmers are designed to achieve top programming speeds, coming very close to the theoretical minimum programming time of the target hardware. In many cases, more than 95 % of the maximum speed can be achieved, often resulting in a programming speed of more than 1 MB / s. Maximum programming speed highly depends on the target hardware and programming speed of the flash itself.
Turbo mode
For microcontrollers which are programmed via debug interface and which allow memory access while the CPU is running, the Flasher Secure is able to minimize overhead by simultaneously downloading and programming. This “turbo mode” makes it possible to reach speeds not achievable by other programmers.
Authorized Flashing
The Flasher Secure can limit the number of flash programming cycles, thereby limiting the number of devices that the firmware can be transferred to. This protects the Flasher against unauthorized access such as during external production or when a device is lost.
End-to-end security
Flasher Secure supports trusted firmware features to ensure end-to-end encryption, authentication, and confidentiality, covering the whole process including the ‘last mile’.
To prevent counterfeit devices, the Flasher reads out a unique ID from the system it is going to program. This ID is sent to a server that is under physical control of the IP owner. This server validates the ID and determines whether a programming run is allowed. In this case, a signature is generated for the device. The signature generation uses a proven asymmetric algorithm where the private key is not accessible by anyone but the IP owner. This prevents attackers from forging a signature for a given ID. The signature is sent back to the Flasher which stores the signature inside the target device it programs.
With the optional RSA verification package, it is possible to authenticate the hardware against the stored signature using the unique identifier to prevent the firmware from running/booting if this fails. The CM can now boast that the production floor will protect the customers IP.
All communication between the Flasher and server is encrypted and authenticated by a secure SSL/TLS connection to prevent unauthorized access.
Flasher Secure Control Server
The Flasher Secure Control Server (essential; sold separately) runs in a trusted environment and authorizes signatures which are bind to the hardware. It also provides a web interface for administration where all actions are logged and accessible to provide as much transparency to the IP owner as possible.
User management
The Flasher Secure Control Server includes user management and user access management, allowing full oder limited access to the system. It is also possible to add specific manufacturers to selected projects and provides an overview about the programming status at each manufacturer.
The Flasher Secure Control Server offers the following options:
- Managing administrator & user accounts
- Managing manufacturer accounts
Overview of manufacturer accounts associated with selected projects
Project management
The Flasher Secure Control Server offers different options for managing projects:
- Project management, e.g. creation, deletion
- Firmware setup & management, e.g. upload, import, installation
- Device management, e.g. unique device IDs (UIDs), programming cycles, list export
- Server status monitoring, e.g. access logs, REST interface
Overview of manufacturer accounts associated with selected projects
Use case
IP protection for secure device management at contract manufacturers
Contract manufacturing is a serious option when production volumes exceed a certain threshold. Most companies are hesitant to take that route. For production, the CM stores large quantities of the components for the final product to be produced. If the CM also has access to the customer’s intellectual property, risks arise for the owner. Common risks include unauthorized cloning of the goods produced or unintentional leakage of the software/algorithms contained in the target images. Because of this, it is essential that customers control both their IP and limit CM production to prevent theft and secure revenue.
“Intellectual property” (IP) is a common feature of modern products. It is often located in the firmware and this IP needs to be protected. Thanks to authentication algorithms, the Flasher Secure ensures only authorized boot loaders and firmware are used in the system. If one component is not genuine, the device stops working. Copying firmware and/or bootloaders from one device to another doesn’t work.
As an IP owner, you have full end-to-end control of your production chain. To secure your IP and production run, Flasher Secure uses:
- Mutual authentication
- Authorization
- Confidentiality
As an essential step in SEGGER’s Secure Product Lifecycle Management (sPLM), the Flasher Secure in combination with emSecure aim to hardware authentication in production.
emSecure — Create and verify digital signatures
emSecure enables the secure authentication of digital assets. The highest portability with a very small memory footprint makes emSecure the ideal cryptographic solution. Its algorithms are designed to suit different needs and meet important cryptographic requirements. Thanks to its powerful API, users can easily integrate it into existing applications while a key generator and tools round off this complete security package.
Technical specifications
| Specifications | |
| Power supply | USB powered, 500 mA if target is powered by Flasher Secure |
| USB host interface | USB2.0 (Full Speed) |
| RS232 host interface | RS232 9-pin |
| Target interface | JTAG 20-pin (various adapters available) |
| Max. target cable length | Recommended (delivered): 20 cm (8″) Max. 2 m (6.5″) allowed but might reduce max. target interface speed. |
| Serial transfer rate between Flasher Secure and target | Max. target interface (JTAG, …) speed: 15 MHz |
| Supported target voltage | 1.2 – 5 V |
| Current drawn from target voltage sense pin (VTRef) | < 25 µA |
| Target supply voltage | 5 V |
| Target supply current | Max. 400 mA |
| Operating temperature | 5 °C … + 60 °C |
| Storage temperature | 20 °C … + 65 °C |
| Relative humidity (non-condensing) | < 90 % rH |
| Size (without cables) | 121 mm x 66 mm x 30 mm |
| Weight (without cables) | 119 g |
| Supported OS | Microsoft Windows (x86/x64), Linux (x86/x64/Arm) |
Package content
Flasher Secure
Ethernet cable
20-pin, 0.1″ target ribbon cable
RS232 cable 1:1 female / male
USB cable