BQ28Z560-R1_14 Datasheet, PDF (50/61 Pages) Texas Instruments – Single Cell Li-Ion Battery Gas Gauge

bq28z560-R1
Not Recommended For New Designs
SLUSBD3 – APRIL 2013
COMMUNICATIONS
www.ti.com
AUTHENTICATION
The bq28z560-R1 can act as a SHA-1/HMAC authentication slave by using its internal engine. Refer to the Using
SHA-1 in bq20zxx Family of Gas Gauges Application Note (SLUA359) for SHA-1/HMAC information.
By sending a 160-bit SHA-1 challenge message to the bq28z560-R1, it causes the gauge to return a 160-bit
digest, based upon the challenge message and a hidden, 128-bit plain-text authentication key. If this digest
matches an identical one generated by a host or dedicated authentication master, and when operating on the
same challenge message and using the same plain text keys, the authentication process is successful.
KEY PROGRAMMING (DATA FLASH KEY)
By
default,
the
bq28z560-R1
contains
a
plain-text
authentication
key
of 0x0123456789ABCDEFFEDCBA9876543210. This default key is intended for development purposes. It
should be changed to a secret key and the part immediately sealed before putting a pack into operation. Once
written, a new plain-text key cannot be read again from the gas gauge while in SEALED mode.
Once the bq28z560-R1 is UNSEALED, the authentication key can be changed from its default value by writing to
the Authenticate() Extended Data Command locations. A 0x00 is written to BlockDataControl() to enable the
authentication data commands. The DataFlashClass() is issued 112 (0x70) to set the Security class. Up to 32
bytes of data can be read directly from the BlockData() (0x40...0x5F) and the authentication key is located at
0x48 (0x40 + 0x08 offset) to 0x57 (0x40 + 0x17 offset). The new authentication key can be written to the
corresponding locations (0x48 to 0x57) using the BlockData() command. The data is transferred to the data flash
when the correct checksum for the whole block (0x40 to 0x5F) is written to BlockDataChecksum() (0x60). The
checksum is (255 – x) where x is the 8-bit summation of the BlockData() (0x40 to 0x5F) on a byte-by-byte basis.
Once the authentication key is written, the gauge can then be SEALED again.
KEY PROGRAMMING (THE SECURE MEMORY KEY)
As the name suggests, the bq28z560-R1 secure-memory authentication key is stored in the secure memory of
the bq28z560-R1. If a secure-memory key has been established and the Data Flash Key is
0x00000000000000000000000000000000, only this key can be used for authentication challenges (the
programmable data flash key is not available). The selected key can only be established/programmed by special
arrangements with TI, using TI’s Secure B-to-B Protocol. The secure-memory key can never be changed or read
from the bq28z560-R1.
EXECUTING AN AUTHENTICATION QUERY
To execute an authentication query in UNSEALED mode, a host must first write 0x01 to the BlockDataControl()
command to enable the authentication data commands. If in SEALED mode, 0x00 must be written to
DataFlashBlock(), instead.
Next, the host writes a 20-byte authentication challenge to the Authenticate() address locations (0x40 through
0x53). After a valid checksum for the challenge is written to AuthenticateChecksum(), the bq28z560-R1 uses the
challenge to perform the SHA-1/HMAC computation in conjunction with the programmed key. The resulting
digest is written to AuthenticateData(), overwriting the pre-existing challenge. The host may then read this
response and compare it against the result created by its own parallel computation.
HDQ SINGLE-PIN SERIAL INTERFACE
The HDQ interface is an asynchronous return-to-one protocol where a processor sends the command code to
the bq28z560-R1. With HDQ, the least significant bit (LSB) of a data byte (command) or word (data) is
transmitted first. Note that the DATA signal on pin 12 is open-drain and requires an external pull-up resistor. The
8-bit command code consists of two fields: the 7-bit HDQ command code (bits 0–6) and the 1-bit R/W field (MSB
bit 7). The R/W field directs the bq28z560-R1 to do either of the following two actions:
• Store the next 8 or 16 bits of data to a specified register or,
• Output 8 bits of data from the specified register.
The HDQ peripheral can transmit and receive data as either an HDQ master or slave.
50
Submit Documentation Feedback
Product Folder Links: bq28z560-R1
Copyright © 2013, Texas Instruments Incorporated