The USB armory from F-Secure is an open source hardware design, implementing a flash drive sized computer.
The compact USB powered device provides a platform for developing and running a variety of applications.
The security features of the USB armory System on a Chip (SoC), combined with the openness of the board design, empower developers and users with a fully customizable USB trusted device for open and innovative personal security applications.
The hardware design features the NXP i.MX6UL processor, supporting advanced security features such as secure boot and ARM® TrustZone®.
The USB armory hardware is supported by standard software environments and requires very little customization effort. In fact vanilla Linux kernels and standard distributions run seamlessly on the tiny USB armory board.
- NXP i.MX6UL/i.MX6ULZ ARM® Cortex™-A7 900MHz, 512MB/1GB DDR3 RAM
- USB host powered (<500 mA) device with compact form factor (65 x 19 x 6 mm)
- ARM® TrustZone®, secure boot + storage + RAM
- Secure elements Microchip ATECC608A and NXP A71CH
- internal 16GB eMMC + external microSD
- u-blox ANNA-B112 Bluetooth module
- debug accessory support for UART, GPIO, SPI, I²C, CAN breakout
- customizable LEDs, including secure mode detection
- supported by vanilla Linux kernels and distros
- USB device emulation (CDC Ethernet, mass storage, HID, etc.)
- Open Hardware & Software
The USB armory board has been created to support the development of a variety of security applications.
The capability of emulating arbitrary USB devices in combination with the i.MX6UL SoC speed, the security features and the flexible and fully customizable operating environment, makes the USB armory the ideal platform for all kinds of personal security applications.
The transparency of the open and minimal design for the USB armory hardware facilitates auditability and greatly limits the potentiality and scope of supply chain attacks.
The secure boot feature allows users to fuse verification keys that ensure only trusted firmware can be ever executed on a specific USB armory board.
The support for ARM® TrustZone®, in contrast to conventional TPMs, allows developers to engineer custom trusted platform modules by enforcing domain separation, between the "secure" and "normal" worlds, that propagates throughout all SoC components, and therefore not only limited to the CPU core.
An excellent overview of the technology and its support for the i.MX series of SoC can be found at the Genode framework project.
The following example security application ideas illustrate the flexibility of the USB armory concept:
- Hardware Security Module (HSM)
- encrypted file storage with malware scanning, host authentication and data self-destruct
- USB firewall, bridging built-in receptacle and plug ports
- OpenSSH client and agent for untrusted hosts (kiosk)
- router for end-to-end VPN tunnelling, Tor
- password manager with integrated web server
- electronic wallet (e.g. pocket Bitcoin wallet)
- authentication, provisioning or licensing token
- portable penetration testing platform
- low level USB security testing
Standard connectivity options:
- USB device emulation on plug and receptacle
- TCP/IP communication via CDC Ethernet emulation
- flash drive emulation via mass storage gadget
- serial communication over USB or physical UART
- stand-alone mode with built-in receptacle port
The USB armory Mk II is available at the following resellers.
The manufacturing and assembly are entirely done in Italy.
Worldwide
ships from USA
The Inverse Path team, part of F-Secure, provides a variety of services,
for commercial inquiries concerning embedded system design or custom/bulk USB armory orders contact us at
info@inversepath.com.
The USB armory is an open hardware & software project.
Board schematics, layout and support files
