How to configure a product in OnBoard™ IoT Security

This article will guide you through the following operations in OnBoard™ IoT Security (OBIS) to configure product materials and prepare for version creation:

• Configure the resource pool
• Set configuration items
• Upload programming station files

Prerequisites

Before getting started, please ensure that:

• You have product role permissions for the corresponding product: Product Owner, Product Manager, or Resource Manager.
• The certificates and keys have already been created.

Product material categories

Each product has its own independent material management system used to centrally manage various types of product materials. Users can upload firmware, configuration files, programming files, associate keys and certificate templates, and pre-configure product parameters. Product materials are divided into three categories, each containing different resource types:

Categories	Material Type	Description
Resource Pool	Key	Add keys from KMS to the product.
	Certificate	Add CA templates from PKI to the product.
	Firmware List	Upload the firmware files required for programming the product. Firmware formats supported: .bin, .hex, and .s37.
	File List	Upload other files required for version creation (excluding firmware). Files in any format are supported.
Config Item	Chip Config	Select and configure the chip part and security options used by the product.
	Matter Config	Select and configure settings related to the Matter protocol.
	Factory Data	Configure factory-related information.
	Custom certificate configuration	Configure settings related to custom certificates.
	Google certificate configuration	Configure settings related to the Google Cast protocol.
Programming Station File	Programming Script	Upload script files used for device programming (any script format is supported).
	Attachment Files	Upload other files required for batch creation (excluding programming scripts). Files in any format are supported.

Instructions

1. Sign in to OBIS.

2. In the left menu, click Product and select the corresponding product. Then, on the product page, configure the items in the Resource Pool, Config Item, and Programming Station File areas.

   info

   • The configurations of the Resource Pool and Config Item areas will be used for version creation. In these areas, configure the necessary resources and configuration items for the product (Certificate, Firmware List, Chip Config, Matter Config, and Factory Data). If the required configuration is not completed, version creation will be blocked, and the product status will remain in Draft.
   • Files in the Programming Station File area will be used for batch creation. Upload the necessary files for programming (Programming Script) in this area. Alternatively, you can select a programming script for a specific batch later in the Programming Station client.

   

Step one: Configure the resource pool

tip

The configurations in the Resource Pool area will be used for version creation. The files uploaded when configuring Firmware List and File List can be downloaded at any time from the configuration page of the corresponding resource.

Key (optional)

Key (optional)

tip

Key allows you to add keys from KMS to the product. Added keys can be selected during the Chip Config.

Keys can be created in KMS. For more information, refer to the steps for creating a key.

1. On the product page, select Key in the Resource Pool area to navigate to the Key page.

   

2. On the Key page, click Add, then select and add keys.

   

Certificate (required)

Certificate (required)

tip

Certificate allows you to add CA templates (End Entity templates, DAC templates, or Device templates) from PKI to the product. Added CA templates can be selected during the Matter Config.

CA templates can be created in PKI. For more information, refer to the steps to create a certificate.

1. On the product page, select Certificate in the Resource Pool area to navigate to the Certificate page.

   

2. On the Certificate page, click Add, then select and add CA templates.

   

Firmware List (required)

Firmware List (required)

tip

Firmware List allows you to upload the firmware files required for programming the product. Firmware formats supported: .bin, .hex, and .s37. Then, the uploaded firmware files can be selected when creating a version.

1. On the product page, select Firmware List in the Resource Pool area to navigate to the Firmware List page.

   

2. On the Firmware List page, click Upload File.

   

3. In the Confirm Resource window, select and enter the firmware-related information.

   

   Description of Firmware information:

   Information	Mandatory	Description
   Upload File	Yes	Upload files by selecting the local firmware files.
   Environment	Yes	Two environments can be selected: TEST and PROD.
   Start Address	No	Specify the start address of the firmware.
   Version	No	Indicate the firmware version.
   Firmware Type	Yes	Two types of firmware are supported: Application: Used to implement device functionality, relying on the environment provided by the Bootloader. Bootloader: Used for hardware initialization, firmware loading, and updates.

4. Click Save to complete the configuration of the Firmware List.

File List (optional)

File List (optional)

tip

File List allows you to upload other files required for version creation (excluding firmware). Files in any format are supported.

The uploaded files can be selected when creating a version.

1. On the product page, select File List in the Resource Pool area to navigate to the File List page.

   

2. On the File List page, click Upload File.

   

3. In the Confirm Resource window, select and enter the relevant information.

   

   Description of File List information:

   Information	Mandatory	Description
   Upload File	Yes	Upload files by selecting the local files.
   Environment	Yes	Two environments can be selected: TEST and PROD.
   Key	No	Assign keys to files. During later programming, the programming script can retrieve and use the corresponding files through their keys. Note: A file can be assigned multiple unique keys. Meanwhile, the same key can also be assigned to multiple files. You can add new keys or select from existing keys.
   File Version	No	Identify the file version and use it to track file changes.

4. Click Add to complete the configuration of the File List.

Step two: Set configuration items

tip

The configurations in the Config Item area will be used for version creation. The files uploaded when configuring Matter Config and Factory Data can be downloaded at any time from the configuration page of the corresponding resource.

Chip Config (required)

Chip Config (required)

tip

Chip Config allows you to select and set the chip part and security options used by the product. Different chip parts provide corresponding security options in the Enablement Setting, and you can configure them as needed.

Please refer to the supported chip settings for the detailed list. Additional chip vendors, series, and parts will be added based on demand.

1. On the product page, select Chip Config in the Config Item area to navigate to the Chip Config page.

   

2. On the Chip Config page, locate the Chip Settings area, select the Vendor, Series, and Part, and then click Save.

   

   Currently supported chip settings:

   Vendor	Series	Part
   Beken	BK7238	BK7238
   NXP	s32k1	s32k144
   Qorvo	QPG6200	QPG6200
   Silicon Labs	EFR32MG24	EFR32MG24B210F1536IM48 EFR32MG24B020F1536IM48 EFR32MG24A110F1024IM48 EFR32MG24A020F1536IM48 EFR32MG24A420F1536IM48 EFR32MG24B020F1536IM40 EFR32MG24A010F1024IM40 EFR32MG24A020F1536IM40 EFR32MG24A420F1536IM40 EFR32MG24B010F1024IM48 EFR32MG24A010F1024IM48 EFR32MG24B110F1536IM48 EFR32MG24A021F1024IM40 EFR32MG24B010F1536IM40 EFR32MG24B220F1536IM48 EFR32MG24A020F1024IM40 EFR32MG24A010F1536IM40 EFR32MG24B010F1536IM48 EFR32MG24A410F1536IM48 EFR32MG24A010F1536IM48 EFR32MG24B120F1536IM48 EFR32MG24A410F1536IM40 EFR32MG24B310F1536IM48 EFR32MG24B020F1024IM48 EFR32MG24A020F1024IM48
   	SIMG301	SiMG301M113WIH
   Telink	TLSR92x	TLSR9268J

3. In the Enablement Setting, you can select and enable the Secure Boot and Secure Debug features in the PROD or TEST environment as needed. In the TEST environment, the enablement of the Secure Boot and Secure Debug features can be changed in the version.

   tip

   When creating a batch, if you need to enable the Secure Debug Reopen feature to allow the chip to be reprogrammed, you must enable the Secure Debug feature.

   Description of Enablement Setting items (different chip settings will display different setting items):

   Setting items	Description
   Secure Boot	A security protection mechanism that prevents unauthorized software from being loaded.
   Secure Debug	A security protection mechanism to prevent unauthorized debugging.
   Secure Boot Key	Select the key added in the Key configuration. The key is used to verify the firmware and ensure the secure boot of the device.
   Secure Boot Key Hash	The hash value of the Secure Boot Key.
   Secure Debug Key	Select the key added in the Key configuration. The key is used to authorize debugging access. Note: For Telink chips, this key is derived from the MCU Boot Key and Debug Plaintext.
   MCU Boot Key	Select the key added in the Key configuration. The key is used for device authentication and data encryption.
   Debug Plaintext	Unencrypted debug data.
   DAC Partition Address	Set the storage address in flash for downloading DAC certificates.

4. Click Save to complete the setting of the Chip Config.

Matter Config (required)

Matter Config (required)

tip

Matter Config allows you to select and configure settings related to the Matter protocol.

In this step, you need to select and upload the CD file and select the DAC template added in the Certificate configuration. Please ensure that the VID (Vendor ID) and PID (Product ID) in the CD file match those in the DAC template.

You can replace the CD file with another one as needed when creating a version later.

1. On the product page, select Matter Config in the Config Item area to navigate to the Matter Config page.

   

2. On the Matter Config page, select and enter the relevant information in the Matter Settings area.

   

   Description of Matter Settings information:

   Information	Mandatory	Description
   CD File	Yes	Notes for uploading files: The VID and PID in the CD file must match those in the DAC template. If the CD file contains multiple PIDs, at least one must match the PID in the DAC template. Note: Only .der format CD files are supported.
   PID	Yes	After uploading the CD file, the corresponding PID will be displayed.
   TEST DAC Template	Yes	Select the DAC template configured under the TEST environment in Certificate. The VID and PID in the DAC template must match those in the CD file.
   PROD DAC Template	No	Select the DAC template configured under the PROD environment in Certificate. The VID and PID in the DAC template must match those in the CD file.
   Spike2Iteration	Yes	A parameter of the SPAKE2+ protocol used during Matter commissioning, ensuring the security of the commissioning process.
   Commissioning Flow	Yes	The device commissioning flow, adaptable to different scenarios: Standard Commissioning Flow User-Intent Commissioning Flow Custom Commissioning Flow
   Discovery Mode	Yes	Supported discovery modes: BLE: Bluetooth Low Energy. On IP network: Discovery through an IP network.

3. Click Save to complete the setting of the Matter Config.

Factory Data (required)

Factory Data (required)

tip

Factory Data allows you to configure factory-related information and supports all fields required by the Matter specification. You can change the Factory Data as needed when creating a version later.

1. On the product page, select Factory Data in the Config Item area to navigate to the Factory Data page.

   

2. On the Factory Data page, locate the Settings area and enter the Factory Data information of the product (values can be left empty).

   note

   If the checkbox in the Mandatory column of a Factory Data item is selected, members must enter a value for that item when creating a version.

   

   Description of Factory Data information:

   tip

   The supported data types include: String, Number, Hex, Factory, DateFormat, TimeFormat, and File.

   Information	Type	Description
   Start Address	Hex	Start address.
   Vendor Name	String	Vendor name.
   Product Name	String	Product name.
   Hardware Version	String	Hardware version.
   Hardware Version String	String	Hardware version information presented as a string, which may include a more detailed version description. For example, HW_V1.0_20240101.
   Part Number	String	Part number.
   Product URL	String	Product link.
   Product Label	String	Product label.
   Manufacturing Date	DateFormat	Manufacturing date, default format is yyyyMMdd.
   Manufacturing Time	TimeFormat	Manufacturing time, default format is HHmmss.
   Manufacturing Code	String	Manufacturing code.
   Factory Name	Factory	The factory name configured in batch.

3. Click Save to complete the configuration of the Factory Data.

Custom certificate configuration (optional)

Custom certificate configuration (optional)

tip

Custom certificate configuration allows you to configure settings related to the custom certificates.

1. On the product page, click Add in the Config Item area.

   

2. In the Confirm Resource window, set the Name, Type, and Resource Key.

   

   Description of Resource information:

   Information	Description
   Name	Resource name.
   Type	Resource type.
   Resource Key	The resource key must be unique.

3. Click the configuration item you just added in the Config Item area.

   

4. In the Custom Certificate Settings area, select the End Entity template when configuring the Certificate.

   

5. Click Save to complete the setting of the Custom certificate configuration.

Google certificate configuration (optional)

Google certificate configuration (optional)

tip

Google certificate configuration allows you to configure settings related to the Google Cast protocol.

1. On the product page, click Add in the Config Item area.

   

2. In the Confirm Resource window, set the Name, Type, and Resource Key.

   

   Description of Resource information:

   Information	Description
   Name	Resource name.
   Type	Resource type.
   Resource Key	The resource key must be unique.

3. Click the configuration item you just added in the Config Item area.

   

4. In the Google Certificate Settings area, select the Device template when configuring the Certificate.

   

5. Click Save to complete the setting of the Google certificate configuration.

Step three: Upload programming station files

tip

Files in the Programming Station File area will be used for batch creation. The files uploaded when configuring Programming Script and Attachment Files can be downloaded at any time from the configuration page of the corresponding resource.

Programming Script (optional)

Programming Script (optional)

tip

Programming Script allows you to upload script files used for device programming (any script format is supported). The uploaded programming scripts can be selected when creating a batch.

You can select and upload the programming script as needed. If it is not required at the moment, you can also select it for a specific batch later in the Programming Station client.

1. On the product page, select Programming Script in the Programming Station File area to navigate to the Programming Script page.

   

2. On the Programming Script page, click Upload File.

   

3. In the Confirm Resource window, select and enter the information related to the programming script.

   

   Description of Programming Script information:

   Information	Mandatory	Description
   Upload Programming Script	Yes	Upload files by selecting the local programming script files.
   Version	No	Indicate the version of the programming script.
   Environment	Yes	Two environments can be selected: TEST and PROD.
   Select Chip Vendor	No	Select the corresponding chip vendor.

4. Click Save to complete the configuration of the Programming Script.

Attachment Files (optional)

Attachment Files (optional)

tip

Attachment Files allows you to upload other files required for batch creation (excluding programming scripts). Files in any format are supported. The uploaded files can be selected when creating a batch.

1. On the product page, select Attachment Files in the Programming Station File area to navigate to the Attachment Files page.

   

2. On the Attachment Files page, click Upload File.

   

3. In the Confirm Resource window, select and enter the relevant information.

   

   Description of Attachment Files information:

   Information	Mandatory	Description
   Upload File	Yes	Upload files by selecting the local files.
   Environment	Yes	Two environments can be selected: TEST and PROD.
   Key	No	Assign keys to files. During later programming, the programming script can retrieve and use the corresponding files through their keys. Note: A file can be assigned multiple unique keys. Meanwhile, the same key can also be assigned to multiple files. You can add new keys or select from existing keys.
   File Version	No	Identify the file version and use it to track file changes.

4. Click Add to complete the configuration of Attachment Files.