🛠 Sécurité industrielle : élément sécurisé SE050C2 (EAL6+), PSA Certified et Parsec

Objectives

The X8 is marketed as "one of the first Cassini products" on the market: a complete embedded security chain. Mapping: NXP SE050C2 on a dedicated bus (I²C slave up to 3.4 MHz) — Common Criteria EAL 6+ (up to OS level), key generation, accelerated crypto, secure storage, "secures user flash memory up to 50 kB"; PSA Certified and Arm SystemReady IR certified platforms; integrated Parsec services to expose the root of trust to containers; factory-signed OTA. This tutorial: understand where keys live, how a container leverages security without touching them, and how signed OTA protects deployment.

Hardware

• 1 × Arduino Portenta X8 + USB-C data cable
• adb + sudo access
• A test container (the Python bridge from the RPC tutorial is sufficient for experimenting)
• Docs: SE050-DATASHEET.pdf on docs.arduino.cc; Parsec docs (parsec-tools)
• For the MCU side: the SE050C2 is on a dedicated bus — the two worlds (Linux and M4) must share the card with discernment

Complete code

# 1. Verifier la presence des services de securite dans l'image
adb shell
fio@portenta-x8:~$ sudo -i
fio@portenta-x8:~$ ls /sys/class/misc/ | grep -i se050   # trace du SE ?
fio@portenta-x8:~$ systemctl list-units | grep -iE "parsec|m4-proxy"

# 2. Un conteneur consigne Parsec (racine de confiance) sans jamais
#    voir les cles : montage du socket dans l'app conteneurisee.
#    > 
#    d'usine — verifie avec systemctl status parsec sur ta carte.
docker run -d --name app-securisee \
  -v /run/parsec:/run/parsec \
  -p 5002-5020:5002-5020 \
  --device /dev/ttyGS0 \
  arduino/python-rpc-serial

# 3. Principes a respecter (pas de code magic) :
#    - les cles privees sont generees et restent DANS le SE050C2 ;
#    - l'OTA de la factory est signee : une image falsifiee n'est
#      pas installee ; les cles de provisioning sont par appareil ;
#    - le M4 (Arduino) n'a pas besoin des secrets reseau : garde
#      l'authentification MQTT/TLS dans le conteneur, adossee au SE.

Expected verification

The board exposes traces of the security components (Parsec service, SE access) and a container can leverage the service without any key appearing in its filesystem — this is the whole point of the model: the SE050C2 signs/decrypts for the application, secrets never traverse the container. On the deployment side, only an image signed by your factory passes — a tampered image in transit is rejected.

Common errors

• Storing MQTT/TLS secrets in the Docker image or in the sketch: this is exactly what the SE050C2 avoids — keys in the secure element (or the security service keystore), never in the versioned binary.
• Confusing the worlds: the SE050C2 is on a dedicated bus; before using it from the M4, check whether Linux or the MCU controls this bus — both cannot have it simultaneously.
• Believing that "secure element" = transparent application: without the access service (Parsec or equivalent) exposed to the container, the app has no path to the chip — check the service before writing code.
• Reusing the factory provisioning key on multiple devices: the Portenta X8 Manager model is precisely about the individual key per device — a shared key turns a theft into fleet compromise.
• Relying on encryption for availability: signed OTA protects integrity, not availability — keep a valid previous image slot (A/B) and do not cut power during a swap.
• >
• >