We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X

Live Chat

Need Help?

Privacy Policy

Choose the Right Fit for Your Threat Model


  • Devices are pre-configured and pre-provisioned with keys and generic certificates for thumbprint authentication
  • MOQ is 10 units including provisioning
  • Code examples are available for the following use cases:
    • AWS IoT authentication
    • Microsoft Azure IoT Hub authentication
    • Google IoT authentication
    • LoRa® authentication
    • Third-party TLS authentication
  • Buy the device, claim it and you’re done
  • Devices are pre-configured and provisioned with default generic certificates for thumbprint authentication, but they can be replaced with your credentials
  • MOQ is 2,000 units including provisioning
  • We offer the following most commonly requested use cases:
  • PKI for any cloud
  • Certificate authentication
  • Token authentication
  • Secure boot and firmware verification
  • Over the Air (OTA) verification
  • IP protection
  • Message encryption
  • Qi® 1.3 WPC authentication
  • Accessories authentication
  • Key rotation
  • Devices are fully customizable if your needs go beyond the Trust&GO and TrustFLEX offerings
  • MOQ is 4,000 units including provisioning
  • Fully customizable
  • Start with a blank device

The main differences between the three Trust Platform tiers include the level of involvement you have in choosing or defining a secure element configuration for your use case, deciding what credentials you want to provision, and selecting the Minimum Orderable Quantity (MOQ) that will best suit your project requirements.  Take advantage of our Trust Platform Design Suite tool to guide you through your development, from prototyping up to production. 

Leverage Our Secure Manufacturing Infrastructure to Provision Credentials in Your Products


For deployments of as few as ten units to up to many thousands of devices, our Trust Platform is a cost-effective and flexible solution for onboarding our secure elements in your design and accelerating your product’s time to market. The Trust Platform is composed of a family of pre-provisioned, pre-configured or fully customizable secure elements. Credentials are generated inside each secure element’s boundary by leveraging our Hardware Secure Modules (HSMs) that are installed in our factories. The devices also come with hardware and software development tools to make prototyping easy and to fast track your development. The Trust Platform offers three tiers of secure elements—Trust&GO, TrustFLEX and TrustCUSTOM—to provide you with the options and flexibility to meet the requirements of your company’s security model.

When you use our Trust Platform, you will optimize your overall provisioning logistic costs by benefitting from an existing and amortized HSM infrastructure integrated into our factories. Generally, it is financially and technically challenging for third-party contractors that offer provisioning services to provide an efficient and cost-effective model, especially for smaller orders. When you leverage our provisioning service along with our Trust&GO, TrustFLEX or TrustCUSTOM secure elements, you can select the option that best meets your current needs, and then scale as your business or market share spreads across the globe. Trust&GO has a minimum orderable quantity of just ten units, making it easy for you to get started on a small scale.

Why Choose Our Trust Platform?


Without secure key provisioning, as your sensitive keys are injected during manufacturing they are exposed to third-party software, microcontroller firmware, contract manufacturers and operators. With the risks so high in these mass-production conditions, it’s important that the credentials are placed inside secure storage using a process that follows good security practices. The objective of our Trust Platform provisioning service is to isolate credentials from being exposed any time during and after production while eliminating the need for you to have extensive knowledge about handling and securing keys.

Ready to Get Started With the Trust Platform?


To prototype with the proposed development kits, use the tutorials and code examples within the Trust Platform Design Suite software available for Windows® and macOS® operating systems.

When you are ready to go to production, order the pre-provisioned devices and download the manifest file from Microchip Direct or from our distribution partners. Upload the list of public credentials in the corresponding cloud account.

Factory Security Certifications


Our factories are certified against Common Criteria standards:

  • SLC_CMC.5
  • ALC_CMS.5
  • ALC_DVS.2
  • ALC_LCD.1.
  • ALC_DEL.1

These site certifications ensure that we hold the processes in our supply chain to the highest standards.

Learn more about the certifications at our factory in the Philippines and our primary and secondary factories in Thailand. 

Still Not Sure How To Get Started?


  • To help with your configuration setup and transaction diagram, we handpicked a team of trusted design partners that offer their expertise to guide you along the way. They will also help with your project development from use case definition all the way through to production.
  • If you need more information about our secure elements, please visit our CryptoAuthentication™ ICs page.

Trust Platform Devices


Development Tools


Learning


Title Description
How to Use Microsoft® Azure® RTOS and the ATECC608 TrustFLEX Secure Element In this blog you can read about how to implement a secure boot and Transport Layer Security (TLS) mutual authentication for your Internet of Things (IoT) device.
How Transport Layer Security (TLS) and Secure Elements Work In this blog you can learn about the importance of TLS and the embedded security pillars as encryption is weak without robust secure key storage to protect the private key.
Asymmetric Authentication Use Case Example The purpose of authentication is to prevent cloning and counterfeiting and to ensure that an object is genuine and authorized to connect to a product. In this use case example, find out how to authenticate an object, such as an accessory, peripheral, battery or cartridge, that is typically removable and replaceable by the consumer.
Secure Firmware Download Use Case Example In this use case example, you will see a demonstration of the authentication of a firmware update. The example uses asymmetric cryptography to establish a chain of trust to validate the update.
Securing Cloud-Connected Devices with Google Cloud IoT and Microchip This blog article written by Google discusses how the ATECC608B secure element strengthens authentication between IoT Core and IoT hardware.
Symmetric Authentication Use Case Example The purpose of authentication is to prevent cloning and counterfeiting and to ensure that an object is genuine and authorized to connect to a product. In this use case example, find out how to authenticate an object, such as an accessory, peripheral, battery or cartridge, that is typically removable and replaceable by the consumer.
Symmetric Authentication with a Non-Secure MCU Use Case Example In this use case example, you will learn how to authenticate an object using one-way symmetric authentication, which avoids the need for an Internet connection and white (or black) list. A white list is a lookup table for identifying approved units and a blacklist is a lookup table for identifying non-approved units.
Zero Touch Secure Provisioning Kit for AWS IoT - End-to-End Security with AWS Cloud This user's guide provides a detailed walkthrough of provisioning the Zero Touch Secure Provisioning Kit to connect and communicate with the Amazon Web Services (AWS) IoT service.

General Questions:

Q: How can I get started with the Trust Platform?
A:
 Use the “Let Us Guide You to the Right Option” on the Trust Platform page, which will help you take the first step. You will find additional information about getting started with Trust&GOTrustFLEX and TrustCUSTOM on their pages.

Q: I am a distribution partner. How do I enroll in the Trust Platform program?
A:
 Contact your local Microchip sales office to request assistance with joining the program.

Trust&GO Questions:

Q: Do I need to contact Microchip to provision my Trust&GO secure element?

A: No. When you buy the device, it is already provisioned with keys and certificates specific to the use case you have selected that are locked inside the device. Trust&GO cannot be altered and is intended to be used as is.

Q: Where can I obtain the public keys and certificates for my Trust&GO device?
A: Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file.

TrustFLEX Questions:

Q: Do I need to contact Microchip to provision my TrustFLEX secure elements?  
A:
 Yes. When you buy the device, it comes pre-configured with your selected use case(s). By default, the TrustFLEX device also come with keys and generic certificates for thumbprint authentication that are overwritable internally if you have not already locked them using the lock bit. While the configuration cannot be altered, the default credentials can be changed if you have not already locked them. If you decide to use the default credentials, you will have to lock them after receiving the device. If you don’t want to use the default credentials, you can replace them with yours and then lock them. After you have made your decision, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the public keys and certificates for my TrustFLEX device when I use the default credentials?
A:
 Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file. WARNING: If you have overwritten the default credentials in your device, the manifest file will no longer be compatible with the device’s new credentials.

TrustCUSTOM Questions:

Q: Do I need to contact Microchip to provision my TrustCUSTOM secure element?
A:
 Yes. When you buy the device, it will be blank. You will need to use the TrustCUSTOM configurator, which is available under Non-Disclosure Agreement (NDA) to define the configuration, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the secret packet exchange for my TrustCUSTOM device?
A:
 This utility is only available through a Non-Disclosure Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Q: Where can I get the full data sheet for my TrustCUSTOM device?
A:
 This document is only available through a Non-Discloser Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Credentials: Identity verification tools or methods that include X.509 certificates, generic certificates for thumbprint authentication, keys and data packets

Customization: The action of creating a unique device/system through its configuration and set of secrets

Firmware Verification: When a key and cryptographic operation are used to verify a signed image on a device at boot up or during run time

IP Protection: When a key and a cryptographic operation are used to verify signed (or hashed) firmware that is considered Intellectual Property (IP) of a product

Key(s): A set of binary numbers that is used to trigger a cryptographic algorithm that implements asymmetric or symmetric encryption

Over-the-Air (OTA) Verification: When a key and a cryptographic operation are used to verify a signed image that has been loaded into a connected device by a push notification from a cloud service

PKI: Public Key Infrastructure

Provisioning: The action of generating a credential into an embedded storage area

Birth Certificate: An X.509 certificate not issued by a certificate authority company that is used for authentication to the cloud

Trust Platform Design Suite v2 Introduction</a>">Trust Platform Design Suite v2 Introduction

Cryptography Primer</a>">Cryptography Primer

An Introduction to the ISA/IEC 62443 Standard</a>">An Introduction to the ISA/IEC 62443 Standard

Securely Connecting to AWS IoT Core With the ATECC608B</a>">Securely Connecting to AWS IoT Core With the ATECC608B

View our Security Design Partners page to find additional expertise.

Hardware-Based Security for IoT of Any Size

Microchip simplifies hardware-based IoT security with the industry’s first pre-provisioned solutions for deployments of any size.