🛠 Secure PlugMate Setup: First Connection Guide

Objectives

This tutorial aims to correctly initialize the PlugMate, a secure miniature computer, by mastering critical security aspects. Unlike standard storage devices, the PlugMate runs an isolated OS (PlugOS) requiring rigorous configuration to enable hardware encryption and process isolation. The goal is to establish an encrypted communication channel with the host while configuring anti-forensics defense mechanisms, specifically the duress PIN and auto-reset policies. This procedure is for advanced users wanting to understand the underlying security layer rather than following a simplified installation.

Required Hardware

• A PlugMate (TrustKernel) with up-to-date firmware.
• A compatible host: Windows (x86/x64), Linux, macOS (Apple Silicon only), or Android. Note: Intel Macs and Windows ARM are not supported.
• A high-quality USB-C data cable (USB 3.1 or higher recommended for bandwidth).
• The specific host client provided by TrustKernel (downloaded from the secure portal).
• A physically secure environment for initial setup.

Steps

1. Host Preparation: Download and install the official host client. Do not plug in the PlugMate yet. Verify USB-C drivers are loaded correctly.
2. Physical Insertion: Insert the PlugMate into a powered USB-C port. Booting takes about 24 seconds. LEDs indicate bus encryption status.
3. Secure Pairing: Launch the host client. An ephemeral session key is generated. Scan the QR code displayed on the host screen with the pairing app, or manually validate the key to prevent Man-in-the-Middle attacks.
4. Storage Initialization: The system detects the encrypted eMMC storage. Define a strong master password. This password derives the AES-256 keys used for encryption at rest.
5. Security Configuration: Set the duress PIN. In case of coercion, entering this code immediately wipes encryption keys, making data unrecoverable. Configure the auto-reset threshold (5 to 15 failed attempts).
6. Isolation Validation: Verify that virtual peripherals (GPS, Camera) are disabled by default if not required, to minimize the attack surface.

Verification

Access the security settings menu in PlugOS. Check that encryption status is "Active" and the audit log shows no unauthorized access attempts. Test network connectivity to confirm the system firewall filters traffic correctly. Ensure the host cannot directly read the PlugMate's file system via the standard file explorer.

Going Further

Explore system firewall rule configuration to restrict outgoing ports. Consult documentation on recovery key management to avoid data loss due to forgotten master passwords.