> For the complete documentation index, see [llms.txt](https://sandbox-docs.verifone.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sandbox-docs.verifone.com/s-adk-5.1-programmers-guide/readme/system_overview/pg_all_components/pg_scp_users_guide.md).

# Security Control Panel Programmers Guide

## Security Control Panel <a href="#scp_panel" id="scp_panel"></a>

## Preface <a href="#preface" id="preface"></a>

This guide provides information about the usage of the Security control panel application.

### Audience <a href="#audience" id="audience"></a>

This document is meant for programmers who wish to understand and use the Security control panel

### Organization <a href="#subsec_scp_organization" id="subsec_scp_organization"></a>

this guide is organized as follows:

[Introduction](#sec_scp_introduction): Introduction to SCP

[Getting Started](#sec_scp_getting_started): Explains concept

[System setup and requirements](#sec_scp_compile): Compiler and linker settings, dependencies to other components, environment setup.

[Troubleshooting](#sec_scp_troubleshooting): Error handling.

[Appendix: List of SCP panels](#sec_scp_panels): List of panels contained in SCP.

[Appendix: Keys](#subsec_scp_keys): Handles loading and displaying keys on the device.

[Appendix: Tamper](#subsec_scp_tamper): Displays tamper status and option to clear tamper.

[Appendix: Security ID](#subsec_scp_sec_id): Provides information about PCI relevant fields and values.

[Appendix: Secure RTC Date & Time](#subsec_scp_date_time): Shows secure processors RTC and allows changing its values.

[Appendix: MIB](#subsec_scp_mib): Shows values stored in MIB and handles MIB updating.

[Appendix: Password manager](#subsec_scp_password): Handles changing the passwords for users.

## Introduction <a href="#sec_scp_introduction" id="sec_scp_introduction"></a>

SCP is a component to handle all secure operations like keys, tampers and MIB. SCP can be activated from the MAC desktop.

## Getting Started <a href="#sec_scp_getting_started" id="sec_scp_getting_started"></a>

### Installation <a href="#subsec_scp_installation" id="subsec_scp_installation"></a>

Package name --- dl.scp-{version}.tgz

## System Setup and Requirements <a href="#sec_scp_compile" id="sec_scp_compile"></a>

SCP depends on certain components:

| Component | Purpose                            |
| --------- | ---------------------------------- |
| ADK-GUI   | GUI rendering                      |
| ADK-IPC   | Notification interface             |
| ADK-PM    | Power management                   |
| SYSPROP   | Access to device properties        |
| SPROC     | Access to secure processor         |
| AUTHMAN   | Password protection and management |
| VFIRKL    | Key loading tool                   |

## Troubleshooting <a href="#sec_scp_troubleshooting" id="sec_scp_troubleshooting"></a>

SCP reports error codes from three outside components, SYSPROP, SPROC and VFIRKL. SYSPROP error codes have explanations added, as well as the most common SPROC error codes. Error codes when loading warranty keys come from VFIRKL library and have no explanations, they can be found in kld\_err.h in the VFIRKL component.

## Appendix: SCP panels <a href="#sec_scp_panels" id="sec_scp_panels"></a>

| SCP panel           | Description                                                                                                                     |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Keys                | The keys panel allows for the loading of Warranty and payment keys as well as viewing the current status of keys on the device. |
| Tamper              | The tamper panel shows current device tamper status and allows to acknowledge a tamper                                          |
| Security ID         | Security ID panel shows PCI relevant device parameters in a list                                                                |
| Secure Date & Time  | The Date & Time panel allows you to view and change secure RTC Date and Time                                                    |
| MIB                 | MIB panel allows for the loading of a new MIB via zontalk protocol. As well as displaying the current MIB contents              |
| Password management | Password management panel shows which passwords are set ro not and allows to set or change a password                           |

### Appendix: Keys <a href="#subsec_scp_keys" id="subsec_scp_keys"></a>

| Keys functions               | Description                                                                                                                                                                                                                                   |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Warranty Key status          | <p>Displays current status of Warranty keys. Status can be:<br>-INSTALLED<br>-NOT INSTALLED<br>-ERASED ON TAMPER</p>                                                                                                                          |
| Payment Key status           | <p>Displays current status of Payment keys. Status can be:<br>-INSTALLED<br>-UNHEALTHY<br>-ERASED ON TAMPER</p>                                                                                                                               |
| Load Warranty Keys           | Allows to load Warranty keys. Requires a KLD/SST connection via serial                                                                                                                                                                        |
| Load Payment Keys            | <p>Allows to load payment keys. Payment keys are loaded from json file from usb storage stick.<br>Multiple keys can be loaded form single json file. After loading, installation return status will be reported for each key individually</p> |
| Write VRK certificate to USB | Writes the certificate from VFI\_VRK\_ECC key. VFI\_VRK\_ECC key has to be installed on device for this to work                                                                                                                               |

### Appendix: Tamper <a href="#subsec_scp_tamper" id="subsec_scp_tamper"></a>

| Tamper functions | Description                                                                                                                   |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Tamper status    | <p>Displays current device tamper status. Status can be:<br>-Tamper detected<br>-Tampers not armed<br>-No tamper detected</p> |
| Tamper log       | Displays log of tamper events                                                                                                 |
| Clear tamper     | Acknowledges tamper event. To fully clear tamper, Warranty keys have to be loaded                                             |

### Appendix: Security ID <a href="#subsec_scp_sec_id" id="subsec_scp_sec_id"></a>

Shows PCI relevant information fields about the device.

| Information field            |
| ---------------------------- |
| Model name                   |
| Hardware version             |
| Firmware version             |
| Model name                   |
| Secure chip boot version     |
| Secure chip firmware version |
| Secure chip library version  |

Additionaly on development devices or devices in debug mode shows additional information

| Information field           |
| --------------------------- |
| Secure processor state      |
| Application processor state |
| Device build type           |

### Appendix: Date & Time <a href="#subsec_scp_date_time" id="subsec_scp_date_time"></a>

Displays system Date and Time in UTC as well as Secure RTC date and Time in UTC. Allows changing the secure RTC date and time if the device is in tampered state. "Update the secure RTC to the system UTC time" button changes the secure RTC date and time to current system UTC date and time. The device has to be in tamper state for this to work.

### Appendix: MIB <a href="#subsec_scp_mib" id="subsec_scp_mib"></a>

MIB info screen shows information fields contained in the MIB. The fields are divided into security and non-security fields. Security fields cannot be changed on production devices when loading a new MIB.

| Non-security fields       |
| ------------------------- |
| HDR signature             |
| HDR filesize              |
| HDR date & time           |
| Part Number               |
| Hardware Version          |
| Model number              |
| Hardware ID               |
| Software ID               |
| Extended hardware options |

| Security fields |
| --------------- |
| Serial Number   |
| PTID            |
| Ethernet MAC    |
| Wifi MAC        |
| BT MAC          |
| UWB MAC         |
| Security Option |
| Detamper Option |

'load MIB' button allows to load a new MIB onto the device via zontalk protocol using the 'MIB download' tool. On development devices any MIB can be downloaded and installed on the device. On production devices only a MIB with all matching security field values can be installed on the device. Loading a new MIB on the device triggers a reboot.

It is currently not possible to go back to the previous screen when the device has entered the 'waiting for upload' state without going through with a MIB download or rebooting the device.

When a successful conection has been made to the download tool, on device will be "DOWNLOADING" message. On a successful MIB loading the following messages will be displayed:

* DOWNLOAD DONE
* MIB store success
* MIB send back success
* MIB loading successful If any of the steps fail, an error message will be displayed instead.

### Appendix: Password manager <a href="#subsec_scp_password" id="subsec_scp_password"></a>

Allows for the setting or changing of a password on the device.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://sandbox-docs.verifone.com/s-adk-5.1-programmers-guide/readme/system_overview/pg_all_components/pg_scp_users_guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.