Security Aids for Power Path

Power paths (eFuse, Hot-Swap, Ideal-Diode/OR-ing) face practical risks: fake adapters or forged batteries, tampered EN/ILIM/PG/FAULT, and field bypasses that leave no evidence. The stack needs three layers: adapter/battery authentication, signed switching, and tamper-proof logs.

• Pre-attach authentication: after a challenge–response, decide allow / limit / deny enable.
• Signed switching: non-repudiable events for EN/ILIM changes, priority switches, and reverse-current blocking.
• Tamper-proof logs: power-loss resilient, append-only, hash/MAC chained for RMA and compliance.

Anti-overlap: this page does not cover eFuse SOA, Hot-Swap loop compensation, or Ideal-Diode current-sharing math. It focuses on how security binds to (EN, ILIM, PG, FAULT, PRIORITY, ΔV_trip).

{
  "AuthResult": {"adapter_id":"","battery_id":"","chal":"","resp":"","alg":"","key_slot":"","exp":"","ok":true},
  "EventRecord": {"counter":0,"ts":"UTC","action":"","path_id":"","ilim":0.0,"vdrop":0.0,"temp":0.0,"reason":"","mac":""}
}

Decompose threats into four layers and bind them to concrete power-path signals with testable mitigations.

Physical/Electrical layer

• Fake adapter, forged battery, hot-plug fishing, reverse current, rising contact resistance → priority flapping.
• Interfaces: EN, ILIM, RCB, ΔV_trip, PRIORITY, PG.
• Mitigations: pre-attach authentication; signed RCB triggers; ΔV_trip hysteresis + signed events.

Protocol/Control layer

• EN/ILIM tamper, forged PG/FAULT, malicious TIMER; replay of a past success.
• Interfaces: EN, ILIM, PG, FAULT, TIMER.
• Mitigations: challenge–response; signed switching; replay windows and monotonic counters.

Maintenance/Process layer

• Log wipe, serial reuse, weak key lifecycle.
• Interfaces: log I/O, key-injection.
• Mitigations: hash-chained logs, RBAC, revocation.

Environment/Boundary (optional)

• Temperature cycling, brownouts, surge, noise → RNG quality and counter sync issues.
• Mitigations: entropy checks; cold-start counter policy; power-up index; minimal surge record.

Authentication decides whether the power path is allowed, limited, or denied. ID storage ≠ authentication — use cryptographic proof with fresh nonces and monotonic counters to block replay.

Mechanism comparison

• Symmetric (HMAC/CMAC): low cost/latency; needs nonce + counter and protected key distribution.
• Asymmetric (ECDSA/EdDSA): non-repudiation & per-unit certs; higher latency/cost; quality RNG.
• Physical interfaces: I²C, 1-Wire/HDQ, vendor sidebands (hot-plug/EMI rules apply).

Minimal data objects

{
  "AuthResult": {
    "adapter_id": "", "battery_id": "",
    "chal": "", "resp": "", "alg": "HMAC|ECDSA",
    "key_slot": 0, "exp": "UTC-ISO", "ok": true
  }
}
      

Brand attachment points

• Microchip: ATECC on adapter/pack side.
• NXP: SE050/EdgeLock via I²C; cloud mapping friendly.
• ST: STSAFE/TPM lines; clean hook to power-domain gating.
• TI: Gauge/charger/USB-PD with PG/EN gating.
• Renesas: RA MCU + SCE bridge.
• onsemi: Power/monitor with external SE.
• Melexis: Sensor diagnostics signed into logs.

Design traps & validation

• ID-EEPROM is not an authenticator; reject ID-only substitutions.
• Guarantee entropy and monotonic counters; define strict replay window.
• Hot-plug/noise: debounce handshakes; atomic enable after success.
• Tests: cold/hot-plug; low-temp RNG; replay must fail with reason="Replay".

Policy ok=true → allow (EN=1, nominal ILIM); ok=false → limit; hard fail → deny + log AuthFail.

Make action = evidence. Each critical power-path action produces a signed, non-replayable record tied to the rail and time base.

Event coverage

• Actions: TurnOn, TurnOff, ILIMChange, PrioritySwitch, RCBTrip, ThermalShutdown.
• Record: {"counter","ts","action","path_id","ilim","vdrop","temp","reason","mac"}
• Reasons: AuthOK, AuthFail, OC, OT, OV, RCB, Manual.

Timing policies

• Pre-sign then act for TurnOn/TurnOff (min repudiation; small enable delay).
• Act then immediate sign for faults (≤10 ms window; sticky FAULT until persisted).

Counters, concurrency & durability

• Monotonic counter per rail; include power-up index to detect resets.
• Serialize commits across rails; no counter reuse across domains.
• Append-only, hash/MAC-chained log; ring + sealed segments; double-write with CRC+MAC.

{
  "EventRecord": {
    "counter": 0, "ts": "UTC-ISO", "action": "TurnOn|TurnOff|...",
    "path_id": "railA", "ilim": 2.0, "vdrop": 0.06, "temp": 38.5,
    "reason": "AuthOK", "mac": "..."
  }
}
      

Targets event coverage ≥99%, lost-event ≤1e-6/switch, counter rollback = 0, pre-sign enable latency ≤3 ms typ.

Build logs that are traceable, verifiable, and power-loss safe to support RMA and compliance without leaking sensitive data.

Storage architecture

• Two-tier layout: Ring Area (recent/high-frequency) + Sealed Area (incident windows; append-only segments).
• Write protocol: double-write → CRC → MAC; commit only after both copies pass CRC; track a commit_index.
• Version & identity: bind log_version, device serial, and powerup_index to the monotonic counter domain.

Record skeleton

{
  "counter": 0, "ts": "UTC-ISO", "powerup": 7,
  "action": "TurnOn|TurnOff|ILIMChange|PrioritySwitch|RCBTrip|ThermalShutdown",
  "path_id": "railA", "ilim": 2.0, "vdrop": 0.06, "temp": 38.5,
  "reason": "AuthOK|AuthFail|OC|OT|OV|RCB|Manual",
  "hash_prev": "...", "mac": "..."
}

Power-loss consistency

• Shutdown: flush ring tail, seal current segment, store checkpoint hash.
• Boot: replay from checkpoint, verify chain, mark partial commits as chain breaks.
• No RTC: order by counter + powerup_index; map coarse time in the cloud.

Privacy & access

• Redaction: export ID-mapped fields; keep signatures verifiable at edge/cloud.
• RBAC tiers: Maintenance (read/export), Development (decode redactions), Legal (full audit).
• Transport: encrypted export packages with chain root and metadata.

Endurance & compression

• Budget ring size for worst-case event rate × lifetime with wear margin.
• Coalesce repetitive chatter (e.g., PG) into burst summaries; keep edges verbatim.
• Even-wear across pages; batch writes to avoid tiny updates.

RMA workflow

1. Bundle: ring tail + last N sealed segments + metadata (chain_root, log_version, serial, powerup_range).
2. Cloud verify: recompute CRC/MAC/chain; flag gaps/dupes/rollback.
3. Report: machine verdict + readable timeline + non-repudiation token.

Targets lost-commit ≤1e-6, chain-verify ≥99.999%, replay detection = 100%.

Attach the security layer at concrete power-path signals. Policies decide enable/limit/deny; every action emits a signed event.

Binding points

• eFuse: EN, ILIM, TIMER, FAULT, PG
• Hot-Swap: GATE, TIMER, SOA_MON, FAULT, PG
• Ideal-Diode / OR-ing: PRIORITY, ΔV_trip, RCB, PG

Policy templates

• AuthOK: enable path (EN=1/GATE drive), nominal ILIM, normal priority.
• AuthSoftFail: limit ILIM or delay/back-off; require extra confirmation.
• AuthHardFail: deny/disable (EN=0/GATE off/RCB open); force signed audit event.
• All actions: emit EventRecord (pre-sign for planned actions; bounded post-sign for faults).

Cross-domain semantics & stability

• Normalize PG/FAULT to OK/Degraded/Failed across vendors.
• Prevent priority ping-pong: hysteresis on ΔV_trip and hold-off timers.
• Serialize event commits per rail; unique path_id per domain.

Black-box verification scripts

• Probe PG/FAULT/EN; confirm event→action equivalence and ordering.
• Inject ±ΔV noise; verify single decision per hold-off window.
• Reverse current step → RCB trips; immediate block + post-sign within window; state sticky until persisted.

Targets pre-sign enable latency ≤3 ms typ; priority decision ≤1 per hold-off window; missed-event ≤1e-6/switch.