.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png){kind=logo}
What is SandGrain CyberRock - Core Functions?
Core Functions is the Python integration package for SandGrain CyberRock, which provides hardware-anchored trust for connected devices. It answers a question every IoT deployment eventually faces: how do you know the device talking to your systems is the genuine device, and not a clone, an emulator, or software with stolen credentials?
How it works, in one paragraph
Each device carries a physical CyberRock token (part number SGT1001), a small chip that acts as a hardware HMAC engine. The CyberRock Cloud holds the matching secret inside an HSM-backed enclave. Every security flow in Core Functions is a variation on the same idea:
A challenge is issued, only the genuine token can compute the response, and the cloud verifies it independently.
The secret never leaves the hardware and is never transmitted. That means possession of the token is the credential: there is no key file that can be copied off a disk, leaked in a repository, or extracted from firmware.
What you can do with it
| Capability | What it gives you |
|---|---|
| Device identification | Read the token's unique ID (TID) to identify a device. |
| Hardware self-test | Verify the token hardware is healthy (BIST). |
| Token claiming | Bind a token to your tenant account so only you can verify it. |
| Device authentication | Prove a device is genuine, initiated by either the cloud or the device. |
| Mutual authentication | The cloud proves itself to the device as well, blocking server impersonation. |
| Ephemeral Key (EK) derivation | A session key both sides derive independently but never transmit. |
| RSA-2048 encrypted key delivery | Session-key confidentiality beyond what HTTPS alone provides. |
| HRW generation | A hardware-backed tag over your own data: sign and verify readings, logs, or messages. |
| Secure boot attestation | Prove which firmware actually ran on the device. |
| Daisy chain | Cover a whole batch of items with a single verification. |
The pieces
- CyberRock token (SGT1001): the hardware HMAC engine on the device. Connected over SPI (Raspberry Pi/Linux) or USB serial (all platforms).
- CyberRock Cloud: the verification service. HSM-backed, fronted by Cloudflare Access, with sandbox and production environments.
- Core Functions (the Python package): four core modules plus 27 self-contained example scripts, organised by outcome. You copy the example closest to your use case into your project and replace the block marked
YOUR INTEGRATION POINT.
Core Functions at a glance
| Component | Role |
|---|---|
CyberRock_Token.py |
Hardware abstraction: SPI and USB transport, token commands, shared helpers. |
CyberRock_Cloud.py |
REST client for the CyberRock Cloud device API, 48 endpoint wrappers. |
CyberRock_Config.py |
Interface selection (SPI/USB), serial port, environment (sandbox/production). |
SandGrain_Credentials.py |
Credential store: a template you edit in place. |
examples/ |
27 runnable demos in six folders, each folder named for the outcome it achieves. |
Requirements
Python 3.9+, requests, and pyserial. The RSA-2048 examples additionally need cryptography. SPI is Linux/Raspberry Pi only; USB works on Linux, Windows, and macOS.
- Setting up: see Getting started: configuration and first run.
- First integration: most projects start from device authentication; see Proving device identity.
- Support: SandGrain IoT Integration Team: support@sandgrain.eu. Credentials and Access are issued once SandGrain has created your tenant account.
Source code: SandGrain CyberRock - Core Functions on GitHub