4

TPR0441BX–SMS–09/09

ATVaultIC460

3. The authenticator checks the signature using either the same secret key or the public key

associated to the claimant’s private key and decides whether the claimant is authorized or

not based on the signature verification result.

This strong authentication method requires storing secret data. Pure software multi-factor solu-

tions are thus not reliable.

Numerous companies are now providing authentication solutions based on USB tokens. Tokens

connected through USB are a convenient solution since they require no additional hardware.

Atmel’s turnkey USB Secure Microcontroller Solutions can help providers focus on their security

model and their application without loosing too much time on tamper protection and other com-

plex hardware security concerns.

1.3

Secure storage

If sensitive data is stored in files on a hard disk, even if those files are encrypted, the files can be

stolen, cloned and subjected to various kinds of attacks (e.g. brute force or dictionary attack on

passwords). Therefore secure microcontrollers-based hardware tokens are a must. Placing

secrets outside the computer avoids risking exposure to malicious software, security breaches in

web browsers, files stealing, etc.

1.4

Flexibility

The ATVaultIC460 product features:

Wire Interface), USB (Universal Serial Bus) and ISO7816 SmartCard interface.

• Low pin count (Reset, Vcc, GND, and communication interface specific pins) making

integration into an existing board simple. ATVaultIC460 modules are available in small

packages (SOIC8 or QFN44) to fit into the most size-constrained devices.

• Low power consumption, in order to extend battery life in portable devices and low-power

systems. ATVaultIC460 devices consume less than 400μA in standby mode, and only 10 to

20 mA during CPU-intensive operations depending on the required action.

• Embedded firmware that provides advanced functions:

– Secure storage: a fully user-defined non-volatile storage of sensitive or secret data.

– Identity-based authentication with user, administrator and manufacturer roles

supported.

– Administration mode to manage user authentication data and security features

– Manufacturer mode to initialize the file system content and module parameters.

– Cryptographic command set to perform cryptographic operations using keys and

data

from

the

file

system

including:

authentication,

digital

signature,

encryption/decryption, hash, one-time password generation, random generation and

public key pair generation.

v2.1, DSA, EC-DSA, MAC using DES, 3DES or AES

– Cryptographic protocols such as secret-key unilateral or mutual authentication [3]

and public key based unilateral or mutual authentication [4].

– Secure Channel Protocol using 3DES or AES.

– Robust communication protocol stacked over the physical communication

interfaces.