Secure USB-C computer with Linux operating system

USB armory Mk II is a fully equipped computer (ARM® 900 MHz processor, 512 MB RAM, Bluetooth, USB-C) in a small design, designed from the ground up with regard to information security applications.

Hardware

• SoC: NXP i.MX6ULZ ARM® Cortex ™ -A7 900 MHz
• RAM: 512 MB DDR3
• Storage: internal 16 GB eMMC + external microSD
• Bluetooth module: u-blox ANNA-B112 BLE
• USB-C ports: Dual Role Power (DRP) socket + Upstream Facing Port (UFP) plug, USB 2.0 only (no video support)
• LEDs: two
• Slide switch: to select the boot mode between eMMC and microSD
• External security features: Microchip ATECC608A + NXP A71CH
• Physical size: 66 mm x 19 mm x 8 mm (without cover, including USB-C connector)
• Cover: part of all unit protection units

Software

The Mk II USB armor hardware is supported by a standard software environment and requires very little customization. In fact, Linux vanilla kernels and standard distributions work fine on a small board:

• Booted from built-in eMMC or microSD (or via USB serial downloader)
• Native Linux support - creating boot images is easy
• Precompiled images are available for Debian 9 (Stretch) and Arch Linux and more are on the way
• USB device emulation (CDC Ethernet, mass storage, HID, etc.)

Connectivity

• USB 2.0 connector via USB-C for hosting with full device emulation
• USB 2.0 socket via USB-C for other devices or as a connection to a host
• Full TCP / IP connection to / from USB from USB CDC Ethernet emulation
• Flash drive function by emulating a USB mass storage device
• Serial communication via USB or physical UART using Debug Board
• Wireless connection via BLE

Note: Only USB 2.0 is supported via both USB-C ports, so it should be emphasized that HDMI video via USB-C is not supported.

Applications

The following example of security application ideas illustrates the flexibility of the Mk II USB armor concept:

• Mass storage device with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruction
• Hardware Security Module (HSM)
• OpenSSH client and agent for untrusted hosts (eg Internet kiosks)
• End-to-end VPN tunneling router
• Torov bridge
• Password manager with integrated web server
• Electronic wallet
• Authentication token
• Portable platform for penetration testing
• Low-level USB security testing