Atmel AT88CK9000 User manual

AT88CK9000
Atmel Secure Personalization Kit for CryptoAuthentication
USER GUIDE
Atmel AT88CK9000 Secure Personalization Kit
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
2
2
Features
Single Push-button Triggers Parallel Programming
Supports Programming of Up to (10) Devices at a Time for SOIC Package
Supports Programming of Up to (5) Devices at a Time for TSSOP, UDFN, SOT23-3, or CONTACT
Provides the Following Feedback:
–Serial Number
–Programming Count
–Programming Limitation Count
–Firmware Version
–Device and Protocol
–Verification Cycle
–Status Lights For Pass/Fail per Device
–Visual Feedback While Programming (Push Button Light is On)
Embedded Power Controller
Provides power to DUTs Only When Programming —Load/Unload Safe
Detects When Devices are Positioned Backwards and Cuts Power to Protect the Board
Standard Micro-USB Used for Power and Configuration
Contents
Atmel®AT88CK9000 Board
Universal Power Supply Adaptor
0.5m USB Cable
Introduction
The AT88CK9000 secure personalization kit has been developed to securely personalize the Atmel
CryptoAuthentication™ ATSHA204A device series. Depending on the ordering code, the kit can securely
personalize 8-lead SOIC, 8-lead TSSOP, 8-pad UDFN, 3-lead SOT23, and 3-lead RBH CONTACT
packages. The 8-lead SOIC kit has sockets which can accommodate two devices per socket making it
capable of personalizing up to 10 devices at a time. Safety and security has been added to ensure secure
high-reliability programming.
The AT88CK9000 kit interfaces to the Atmel Crypto Evaluation Studio (ACES) software suite to provide
communication to a PC via a USB interface. This allows trusted users to program the board outside of the
manufacturing environment. Once programmed, the board becomes a standalone board. As a
standalone board, it only requires power, after which, will allow the programming of the ATSHA204A
devices. In addition, this board has an internal counter to keep track of how many devices were
programmed, both in total, as well as by session.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
3
3
Table of Contents
Becoming Familiar with AT88CK9000 Board.................................................................... 4
Install Atmel Crypto Evaluation Studio (ACES)................................................................6
Configuring the AT88CK9000 Board.................................................................................7
Powering Up the AT88CK9000 Board................................................................................ 9
Putting the Board in Download Mode .............................................................................10
Firmware Upgrade/Recovery ........................................................................................... 13
Maintenance of the AT88CK9000 Board .........................................................................20
Troubleshooting the AT88CK9000 Kit.............................................................................20
Ordering Code Information.............................................................................................. 21
Revision History ............................................................................................................... 21

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
4
4
Becoming Familiar with AT88CK9000 Board
The AT88CK9000 has been designed to make secure personalization of the CryptoAuthentication
ATSHA204A devices as easy as possible.
USB PowerDisplayProgram Button
Pass/Fail Indicators

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
5
5
Download
Mode
Button
Reset
Button
FW Erase
Pads

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
6
6
Install Atmel Crypto Evaluation Studio (ACES)
To download ACES, visit:
http://www.atmel.com/tools/ATMELCRYPTOEVALUATIONSTUDIO_ACES_.aspx.
Note: The AT88CK9000 kit is compatible with version 4.3.2 or later.
1. Launch the installer by executing the downloaded file (e.g. ACES_Setup.exe).
2. Follow the installation instructions in the setup wizard.
3. Once installed, three ACES icons should be located on the desktop. These icons include:
4. The ACES Programmer icon will launch the ACES Programmer. See the following section,
“Configuring the AT88CK9000 Board”.
ACES CE recognizes the following kits.(Does not recognize the AT88CK9000):
Atmel AT88CK101 Development Kit –General Engineering, Combined Firmware
Atmel AT88CK454BLACK Evaluation Kit –ATSHA204A Rhino Black
Atmel AT88CK427GREEN Evaluation Kit –ATAES132 Rhino Green
Atmel AT88CK460WHITE –ATECC108 Rhino White
Atmel AT88CK490 Evaluation Kit –CryptoAuthentication

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
7
7
Configuring the AT88CK9000 Board
Once ACES has been installed, begin configuring the ATSHA204A device to work in your system.
This step will not involve the AT88CK9000 board directly but is a preparation step before you
can download the device configuration to the AT88CK9000 and subsequently program the
multiple devices in the AT88CK9000.
The recommended method is to define and test the device configuration using the ACES Configuration
Environment (CE). In order to use ACES CE, one of the compatible kits listed above that ACES CE
recognizes is required. ACES CE does not recognize the AT88CK9000 as a development kit, however,
ACES CE creates a personalization file which is targeted for the AT88CK9000 kit.
Save the personalization file in ACES CE:
1. Launch ACES CE:
–From your desktop, select the ACES CE icon, or
–From the Start Menu, select Start > Atmel Crypto Solutions > ACES > ACES CE.
2. Configure the working device to the desired configuration.
3. From ACES CE menu bar, select File > Save Personalization File...

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
8
8
4. The File Save As dialog box will be displayed.
5. Check the checkbox for Save as ‘Atmel Personalization’.
If the ‘Atmel Personalization’checkbox is not checked and the resulting .shax file is
downloaded into the AT88CK9000, an Invalid Format error during the download process
will be produced.
6. Select the ‘Session Key Slot’ that the ATCK9000 will use during programming. If the
‘Session Key Slot’ selector is empty, then define a slot from slot 6 to slot F to be
Read:Secret/Write:Never (SlotConfig = 8F8F)
7. Check the ‘Save Responses File (*.shar)’checkbox if desired. The *.shar file is a responses file
that can be used with ACES CE to verify that parts are programmed properly. After programming
parts, launch ACES CE select the Tools>Verify… menu then select the *.shar file to verify.
8. Name the personalization file, and then select Save.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
9
9
Powering Up the AT88CK9000 Board
The AT88CK9000 board can be powered via the multi-voltage power supply which is supplied with the kit
or via a USB port on a PC. Once powered, the green LED will illuminate next to the USB connector, and
the green LEDs will illuminate below each socket.
USB
Power
LEDs are illuminated
Power LED
is illuminated

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
0
10
Putting the Board in Download Mode
There are two main modes the secure personalization board may be in:
1. Download Mode
2. Personalization (Programming) Mode
Download mode is used to initially load the configuration of the crypto parts –the configuration is created
with ACES. It is typically done once before you start producing programmed parts with the
AT88CK9000, but after you’ve tested the device configuration in your application. This order insures that
when you start programming devices with the AT88CK9000 in higher quantities, those parts will be
programmed with the tested configuration.
Personalization (Programming) mode is the default mode when the board is first powered up. It is the
mode used most often and is used to personalize the crypto parts.
This section describes how to download the ACES to create the configuration file into the AT88CK9000.
1. Plug in the secure personalization board while holding the Boot Select button.
Holding the Boot Select button located on the back of the board while powering the board will put
the board in the Download mode. The below image shows what should be shown on the display.
2. Download the file contents to the programmer board.
–Select the ACES Programmer desktop icon to launch the ACES Programmer.
–The Personalize Programmer Board dialog box will then be presented.
Notes: 1. The board is attached.
2. The file is not selected.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
1
11
–Select the XX button and select a personalization file.
(Select the file that you have created using ACES CE.)
3. To load the contents of the file in preparation to download to the programmer board, select
Preview File. The Programmer User Interface should resemble the below dialog box.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
2
12
4. Select Download.
–If download is successful, the download confirmation dialog box will be displayed.
–If download is not successful, the unsuccessful download dialog box will be displayed.
5. Once the board has been successfully loaded with the new configuration, either:
–Unplug the USB cable from the board, or
–Press the Reset button located on the back of the board.
The AT88CK9000 display should display the communication panel screen as shown below which
indicates your board is ready to personalize (program) parts.
6. Congratulations, the AT88CK9000 board is up and running. You maynow load the devices into the
sockets and press the Program button when ready to program the parts.
Be sure to test the first few programmed devices before mass programming additional
devices.
Device =Device Type and Protocol
Count–T = Lifetime Count of Programmed Devices
Count–S = Session Count of Programmed Devices
Limit = Configurable Limit Per Session
S/N = Unique Serial Number
FW = Firmware Revision
Status = Board Status

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
3
13
Firmware Upgrade/Recovery
To perform a firmware recovery or upgrade, the follow the next steps:
1. Download and install Atmel SAM-BA®In-system Programmer from the following link:
http://www.atmel.com/tools/ATMELSAM-BAIN-SYSTEMPROGRAMMER.aspx
If using Windows, download and install the atm6124 CDC USB driver for Windows
on the located on the link above or use the below direct link:
http://www.atmel.com/images/atm6124_cdc_signed.zip
2. Download and unzip the AT88CK9000 SAM-BA patch from the following link:
http://www.atmel.com/tools/AT88CK9000.aspx
3. Copy the directory located under at88ck9000-SAM-BA-v2.11-patch: tcl_lib
.
4. Paste the tcl_lib directory inside the SAM-BA installation directory.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
4
14
5. Plug the board to a computer USB port.
6. Using a metal object, short the Firmware-Erase pads to enable the USB Bootloader, then
simultaneously reset the board using the reset switch on the bottom of the board.
AT88CK9000 will appear as a virtual COM port: AT91 USB to Serial Converter (COMxx).
Firmware-Erase
Pads

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
5
15
7. Open the device manager to check the COM port number.
8. Launch SAM-BA and select the board AT88CK9000-AT91SAM3U4 > then select Connect.
9. Select OK.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
6
16
10. From the Scripts drop-down menu, select Enable Flash Access > select Execute.
11. From the Scripts drop-down menu, select Boot from Flash (GPNVM1) > select Execute.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
7
17
12. From the Scripts drop-down menu, select Erase All Flash > select Execute.
13. In Download / Upload File next to the field for Send File Name, select the browse icon to locate
the binary firmware file.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
8
18
14. Find the binary firmware file located in the directory, at88ck9000_fw. The nameof the firmware file
could change based on the version.
15. Once the file has loaded, select Send File to download the new firmware.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
1
9
19
16. Select Yes to lock the regions.
17. Verify the new firmware > select Compare sent file with memory.
18. Be sure you get a success match, similar to the following message.
19. Reset the board to allow the new firmware to execute.
20. Congratulations. The firmware recovery or upgrade is complete.

AT88CK9000 Secure Personalization Kit for CryptoAuthentication [USER GUIDE]
Atmel-8821C-CryptoAuth-AT88CK9000-Secure-Personalization-Kit-UserGuide_122014
2
0
20
Maintenance of the AT88CK9000 Board
The sockets used in the AT88CK9000 kit are rated for 50,000 insertions per socket. Care must be taken
to not bend or deform the leads of the socket.
If the sockets become damaged or worn, the following part numbers and suppliers should be used for
replacement purchases. The sockets will need to be unsoldered and then resoldered onto the board.
Package Type
Part Number
Supplier
8-lead SOIC
216-7388-55-1902
Digikey 3M5078-ND
8-lead TSSOP
FP-8(24)-065-01A
Enplas
3-lead SOT23-3
499-P36-10
WellsCTI
8-pad UDFN
08QN50L43020
Plastronics
3-lead CONTACT
06QHCMY01-A
Plastronics
Troubleshooting the AT88CK9000 Kit
Issue: No Power.
Resolution: Verify the USB cable is plugged correctly to the board, and is plugged into an approved
power source.
If the cable is plugged into the correct power source, try unplugging the cable, and
then replug the cable into the AT88CK9000 board.
Issue: One or More Sockets (Sites) Always Fail.
Resolution: Visually inspect the socket for bent leads.
If the leads are straight, clean the contacts on the socket.
If the site is still failing, the socket may be worn and should be replaced.
Issue: Board Fails to be detected by the PC for Download Mode.
Resolution: Be sure the board is in the Download mode and is not in the Programming mode.
Try unplugging and then replug the USB cable into the board while pushing the Boot
Select Mode button on the back of the board.