🛠 PlugMate Advanced: Securing Network Flows and Encrypted Storage
Objectives
This tutorial aims to leverage PlugMate's advanced security capabilities to create an isolated work environment. We will configure the system firewall to restrict network connections, set up the 128 GB encrypted eMMC storage for sensitive data backups, and implement a duress PIN policy. The goal is to ensure internal applications never see host data (Android, iOS, Windows, macOS, Linux) while borrowing its display and network resources via the encrypted USB-C channel.
Required Hardware
- One PlugMate (MediaTek Helio G80 SoC, 4 GB RAM, 128 GB eMMC).
- A compatible host (Android, iOS, Windows x86/x64, macOS Apple Silicon, Linux). Note: Not compatible with Intel Macs or Windows ARM.
- The specific PlugMate host client installed on the machine.
- A high-quality USB-C data cable.
- Administrator access to PlugOS (hardened Android 14).
Steps
Insert the PlugMate into the host's USB-C port. Launch the host client. Boot time is approximately 24 seconds. Authenticate with your primary constraint code. Ensure the encrypted connection indicator is active.
- Secure Connection and Initialization
Access PlugOS security settings. Enable "Strict Isolation" mode. Configure the firewall to block all unsolicited incoming traffic. Allow only necessary ports for your business applications (e.g., 443 for HTTPS). Virtual peripherals (GPS, SIM, camera) should remain disabled if unused to minimize the attack surface.
- System Firewall Configuration
Navigate to the storage manager. The 128 GB volume is natively encrypted. Create a dedicated work profile. Import sensitive documents via the USB-C channel. Verify that host data is not accessible from the PlugOS interface thanks to peripheral virtualization.
- Encrypted Storage Management
In security settings, define a Duress PIN. If entered, this code immediately erases encryption keys, rendering data unreadable. Test this feature in a controlled environment to validate system responsiveness.
- Duress PIN Implementation
Configure the authentication failure threshold. By default, the system auto-resets after 5 to 15 failed attempts. Adjust this parameter according to your risk level, knowing that it wipes local data.
- Auto-Reset Policy
Verification
To validate the configuration, launch an internal application requiring network access. Use a network monitoring tool on the host to confirm that traffic is encrypted and that local host data does not transit through the PlugMate. Verify that abrupt disconnection or entering the duress code correctly triggers key erasure. The system must remain isolated, even if the host is compromised.
Further Reading
Explore task automation via Shell scripts accessible in developer mode on PlugOS. You can also configure multiple profiles to strictly separate personal and professional uses, leveraging the 2 GHz octa-core power for local calculations without data leakage to the host.