---
title: Key Concepts & Glossary
description: "Definitions of every SandGrain SDK term: Token, TID, Challenge and Response Word, mutual authentication, Device and Gateway mode, MQTT, and BLE terms."
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/key-concepts-glossary#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en)
3. [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
October 6, 2026
# Key Concepts & Glossary
**Who this is for:** First-time readers of the SandGrain SDK documentation. Skim this once, then refer back whenever a term is unfamiliar.
Every other setup article assumes the terms below. You don't need to memorize them, just know they're here.
### Core hardware and identity
| Term | Meaning |
| --- | --- |
| **Token / SandGrain chip** | The cryptographic hardware on a device that holds the secret and computes responses. The hardware root of trust. |
| **TID (Token ID)** | The unique identifier of a Token. Used to register a device and to resolve which device is which. |
| **Device** | The unit that holds the Token. Runs the SDK in **Device mode** (the `test_device` binary). |
| **Gateway** | The node that relays and orchestrates authentication between devices and the cloud. Runs the SDK in **Gateway mode** (the `test_gw` binary). |
| **Server / Cloud** | The trusted verifier. In TrustBridge this is the Cloud SDK agent plus the backend. |
### The authentication exchange
| Term | Meaning |
| --- | --- |
| **CW: Challenge Word** | The random value issued by the verifier in a challenge–response exchange. |
| **RW: Response Word** | The value the Token computes from the CW using its secret. Proves authenticity. |
| **Mutual authentication** | Two-way verification: *Token-to-Server* and *Server-to-Token*. |
| **Firmware verification** | The chip signs a SHA-256 hash of a firmware image; the server validates it (result is FW\_OK or FW\_NOK). |
| **Installation authorization** | New firmware is installed only after a verified, server-approved exchange. |
| **Error Management** | Candidate-based tolerance of channel bit errors, so genuine devices still authenticate over noisy links. |
| **Bit-flip thresholds** | `CW_BITFLIP_THRESHOLD` / `RW_BITFLIP_THRESHOLD`, configurable tolerance limits for how many bit differences are accepted. |
### Platform and configuration
| Term | Meaning |
| --- | --- |
| **Whitelist (auth\_db)** | The list of authorized TIDs the Gateway accepts. Unregistered devices are rejected. |
| **TrustBridge** | The management platform (backend, frontend, Cloud agent, database, MQTT broker). Delegates challenge/response generation and verification to CyberRock via the Cloud SDK agent. |
| **CyberRock** | SandGrain's cloud authentication service. |
| **MQTT / Mosquitto** | The messaging transport used between gateway, device, and cloud. Mosquitto is the specific broker used. |
| **SDK\_MODE** | Compile-time selector, `DEVICE_MODE` or `GATEWAY_MODE`. Determines which functions and port implementations are built into a binary. |
| **HCW / HRW** | A pre-computed CyberRock Challenge Word / Response Word credential pair, used for bulk import and offline authentication. Obtained from SandGrain, or via BIST enrollment (device menu option 0). Empty HCW/HRW in a manifest selects online import; filled values select offline authentication. |
### Bluetooth LE / Nordic board variant
These terms appear only in the Bluetooth LE variant, where the device SDK runs on Nordic boards instead of a USB Token on a PC.
See [*Walkthrough: Nordic nRF54L15 Boards over Bluetooth LE*](https://portal.sandgrain.eu/knowledge-base/what-question-is-your-article-answeringwalkthrough-nordic-nrf54l15-boards-over-bluetooth-le?hsLang=en).
| Term | Meaning |
| --- | --- |
| **Nordic nRF54L15 (DK)** | A Nordic Semiconductor development board that runs the SandGrain device SDK. In the BLE variant it acts as the device (a BLE peripheral). |
| **SGT1001 / SGB chip** | The SandGrain security chip fitted to each Nordic board. Holds the secret and computes responses, the same role the Token plays elsewhere. |
| **BLE (Bluetooth Low Energy)** | The low-power wireless link between the boards and the Raspberry Pi gateway. |
| **Peripheral / Central** | In BLE, the board is the **peripheral** (it advertises); the Pi gateway is the **central** (it scans and connects). |
| **Advertising / Scanning** | A board **advertises** under the name `SandGrain-Dev`; the gateway **scans** for that name and connects. |
| **Channel** | One reserved connection slot on the gateway, one per board. The gateway is built for a fixed number (2 by default). |
| **Flashing** | Programming a board with the SandGrain firmware, using Nordic's tools plus the SEGGER J-Link driver. |
| **Zephyr / nRF Connect SDK** | The embedded OS and SDK the board firmware is built on (nRF Connect SDK v3.3.0). |
LTE / cellular variant
These terms appear only in the cellular variant, where a single Nordic nRF9151-DK board runs the gateway-mode SDK and reaches a hosted TrustBridge stack over LTE.
See *Nordic nRF9151-DK over LTE / Cellular*.
| Term | Meaning |
| --- | --- |
| **Nordic nRF9151-DK** | A Nordic cellular development board. In this variant it runs the gateway-mode SDK and connects over LTE. |
| **LTE-M / NB-IoT** | Low-power cellular network types the board attaches to through an activated SIM. |
| **Self-authentication (device+gateway)** | One board plays both roles: it holds its own crypto chip and authenticates its own token against the cloud (the Token-to-Server / Server-to-Token path). A development shortcut; production keeps device and gateway separate. |
| **SPI wiring** | The SGT1001 chip is wired to the board's SPI header (SCK/MISO/MOSI/CS) rather than plugged in over USB. |
| **Hosted TrustBridge** | A TrustBridge stack running in the cloud (AWS), reached directly over the internet. No local Docker. |
| **EMQX broker** | The MQTT broker used by the hosted stack, reached on plain TCP over the board's cellular link. |
| **Last Will / retained presence** | The board publishes a retained `online` status and registers a retained `offline` Last Will at connect time, so its presence survives restarts on either side. |
| **BIST** | Built-in self-test (board menu option `0`): reads the chip over SPI and prints its status byte and TID. |
> **A note on TID format.** On the Nordic boards, the TID is shown as a 64-character code starting with `8000...`. Read it with board menu option `0`.
> **A note on names you'll see in commands.** The binaries are `test_device` (Device mode) and `test_gw` (Gateway mode). MQTT topics use the lowercase namespace `sandgrain/v1/...`, for example `sandgrain/v1/{tid}/cmd/run_auth`.
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu