AN4992 Application Note - STMicroelectronics
AN4992Application noteSTM32 MCUs secure firmware install (SFI) overviewIntroductionThis application note supports the secure firmware install (SFI) feature available on theSTM32 MCUs listed in Table 1.Outsourcing of product manufacturing enables original equipment manufacturers (OEMs) toreduce their direct costs and concentrate on high added-value activities such as researchand development, sales and marketing.However, contract manufacturing puts the OEM's proprietary assets at risk, and since thecontract manufacturer (CM) manipulates the OEM's intellectual property (IP), it might bedisclosed to other customers, or appropriated.To meet the new market security requests and protect customers against any leakage oftheir IPs, STMicroelectronics introduces a new security concept, the secure firmware install(SFI), permitting to program OEM firmware into STM32 MCU internal Flash memory in asecure way (with confidentiality, authentication and integrity checks).STM32 Series supports protection mechanisms permitting to protect critical operations(such as cryptography algorithms) and critical data (such as secret keys) againstunexpected access.This application note gives an overview of the STM32 SFI solution with its associated toolsecosystem and explains how to use it to protect OEM firmware during the CM productmanufacturing stage.Table 1. Applicable productsTypePart numbersSTM32H75xxISTM32H7B3xIMicrocontrollersOrder codeAll order codes supported (refer todatasheet ordering information section).STM32L462CESTM32L462CEU6F(1)Referred hereafter as STM32L462CE.STM32L5xxxxEntire STM32L5 Series.Referred hereafter as STM32L5.STM32H733xxSTM32H735xxSTM32WL5xxxAll order codes supported (refer todatasheets ordering information section).Entire STM32WL5x line.Referred hereafter as STM32WL5.1. This is the only supported order code. This code is not listed in the datasheet ordering section. Contact STsales representative (special order).January 2021AN4992 Rev 101/39www.st.com1
ContentsAN4992Contents12Preamble . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.1Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.2Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6STM32 secure firmware install (SFI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72.12.233.23.33.42/392.1.1SFI and internal Flash memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82.1.2SFI and external Flash memory applied to STM32L562xx andSTM32H7B3xI/STM32H733xx/STM32H735xx (with OTFDEC) . . . . . . . 8SFI security features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15STM32 secure bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173.14SFI principles overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7STM32H75xxI/STM32H7B3xI/STM32H733xx/STM32H735xx . . . . . . . . . 173.1.1Secure bootloader overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173.1.2User Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173.1.3External Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.1.4Secure boot path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18STM32L462CE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.2.1Secure bootloader overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.2.2User Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193.2.3Secure boot path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20STM32L5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.3.1Secure bootloader overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.3.2User Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213.3.3External Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213.3.4Secure boot path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21STM32WL5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223.4.1Secure bootloader overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223.4.2User Flash memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223.4.3Secure boot path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22SFI image preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234.1SFI firmware image format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244.2SFI firmware image creation procedure . . . . . . . . . . . . . . . . . . . . . . . . . . 24AN4992 Rev 10
AN4992Contents4.2.1Internal Flash memory only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264.2.2Both internal and external Flash memories . . . . . . . . . . . . . . . . . . . . . . 295SFI HSM key provisioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326SFI image programming by OEMs or CMs . . . . . . . . . . . . . . . . . . . . . . 346.178Secure firmware installation flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Known limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367.1STM32H75xxI known limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367.2STM32L462CE known limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37AN4992 Rev 103/393
List of figuresAN4992List of figuresFigure 1.Figure 2.Figure 3.Figure 4.Figure 5.Figure 6.Figure 7.Figure 8.Figure 9.Figure 10.Figure 11.Figure 12.Figure 13.Figure 14.Figure 15.Figure 16.Figure 17.Figure 18.Figure 19.4/39SFI process overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8SFI and external Flash memory encryption without secure bootloader . . . . . . . . . . . . . . . 10Internal firmware and external Flash memory handling . . . . . . . . . . . . . . . . . . . . . . . . . . . 11External Flash memory encryption with secure bootloaderand global AES Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Internal firmware and external Flash memory handling (using global key). . . . . . . . . . . . . 13External Flash memory encryption with secure bootloaderand unique AES Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Internal firmware and external Flash memory handling (using unique key) . . . . . . . . . . . . 15STM32H75xxI/STM32H7B3xI/STM32H733xx/STM32H735xx secure bootloader . . . . . . . 17STM32L462CE secure bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19STM32L462CE internal user Flash memory mapping with SFI . . . . . . . . . . . . . . . . . . . . . 20STM32L5 secure bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21STM32WL5 secure bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22STM32 Trusted Package Creator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23SFI image preparation procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25SFI image generation tab example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26SFI image successful generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28SFIx image generation tab example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29SFIx image successful generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31HSM key provisionning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33AN4992 Rev 10
AN4992Preamble1Preamble1.1Related documentsRefer to the following documents available from www.st.com (unless an NDA applies):[AN3155] USART protocol used in the STM32 bootloader[AN3156] USB DFU protocol used in the STM32 bootloader[AN4286] SPI protocol used in the STM32 bootloader[AN4221] I2C protocol used in the STM32 bootloader[AN3154] CAN protocol used in the STM32 bootloader[AN5054] Secure programming using STM32CubeProgrammer[RM0394] STM32L41xxx/42xxx/43xxx/44xxx/45xxx/46xxx advanced Arm -based 32-bitMCUs(a)[RM0433] STM32H742, STM32H743/753 and STM32H750 Value line advanced Arm based 32-bit MCUs(a)[RM0438] STM32L552xx and STM32L562xx advanced Arm -based 32-bit MCUs(a)[RM0455] STM32H7A3/7B3 advanced Arm -based 32-bit MCUs(a)[RM0468] STM32H723/733, STM32H725/735 advanced Arm -based 32-bit MCUs(a)[RM0453] STM32WL5x advanced Arm -based 32-bit MCUs with sub-GHz radio solution(a)[UM2237] STM32CubeProgrammer software description[UM2238] STM32 Trusted Package Creator tool software descriptionNote:Programming tool manufacturers who want to support SFI/SMI/SSP solutions fromSTMicroelectronics and integrate them into their production line equipment should contactST sales office for additional information under NDA.a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.AN4992 Rev 105/3938
Preamble1.2AN4992GlossaryTable 2. Glossary termsTerm6/39DefinitionAESAdvanced encryption standardAES GCMAES Galois counter modeCMContract manufacturerFTFlash memory programming toolHSMHardware security moduleMACMessage authentication codeMCUMicrocontroller unitOBOption bytesOCTOSPIOcto-SPI interfaceOEMOriginal equipment manufacturerOTFDECOn-the-fly decryption engineRDPReadout protectionSecure bootRoot of trust, check STM32 security protectionSecure bootloaderStandard ST bootloader with additional security featuresSFISecure firmware installSFIxSFI on external Flash memorySTM32 TPCSTM32 Trusted Package Creator (see [UM2238])user Flash memoryFlash memory embedded within STM32 microcontrollers (internal Flashmemory)WRPWrite protectionAN4992 Rev 10
AN4992STM32 secure firmware install (SFI)2STM32 secure firmware install (SFI)2.1SFI principles overviewSFI is a secure mechanism implemented in STM32 microcontrollers that allows secure andcounted installation of OEM firmware in untrusted production environment (such as OEMcontract manufacturer). SFI is implemented in a secure bootloader.The SFI process prevents the OEM firmware code from: being accessed by the contract manufacturer. being extracted or disclosed.This mechanism consists in having the whole OEM firmware and the option bytes encryptedwith an AES secret key, thanks to STM32 Trusted Package Creator tool(1), during OEMfirmware development.OEM must use STM32 Trusted Package Creator tool to program HSM with its own AESsecret key(2), its own nonce, and a maximum installation counter.OEM contract manufacturer have to use STM32CubeProgrammer to initiate SFI processand send encrypted SFI image(3) to STM32 device.A hardware security module (HSM) is in charge of: Securely storing OEM AES secret key Checking STM32 device certificate(4) that is used to authenticate STM32 device(5) Generating and providing the license(6) to the secure bootloader to securely install theencrypted firmware on STM32 device. Counting number of produced STM32 devices.The applicable STM32 microcontrollers are provisioned by STMicroelectronics with devicededicated public/private keys (unique key pair per device). The device keys can beaccessed only through the embedded secure bootloader that retrieve AES secret key(7) bydecrypting license using device private key.Thanks to STM32 security features and cryptographic algorithm, STM32 support secureOEM firmware programming in internal Flash memory and ensure OEM firmware protection(confidentiality, authenticity and integrity) during OEM CM manufacturing stage. The securefirmware install solution securely receives and decrypts the firmware and option bytes insideSTM32 internal Flash memory (8) and optionally external Flash memory. Section 2.1.1focuses on the way SFI process securely installs firmware and data within the internal Flashmemory, whereas Section 2.1.2 focuses on the way SFI process securely installs firmwareand data within the external Flash memory.AN4992 Rev 107/3938
STM32 secure firmware install (SFI)2.1.1AN4992SFI and internal Flash memoryFigure 1. SFI process overviewOEM contract manufacturingSTM32 SFI deviceOEM firmware developmentSFI image (encrypted)3FirmwareSFI image (encrypted)Data FileDatFialSecureootloabootloaderSTM32 Cube ProgrammerSTM32 Trusted Package Creator1DataFileData FileData FileFirmware andoption bytesData File78Option bytesData File642AES secret key5HardwareSTM32 chip certificate (public key)SecuritySTM32 chip private keyModuleLicense (encrypted AES secret key)HSM smartcardMSv50922V11. SFI image (encrypted) available from STM32 Trusted Package Creator.2. Program HSM with AES secret key.3. SFI process launch.4. Device certificate.5. STM32 device authentication.6. Provide license.7. Retrieve AES secret key.8. Firmware and option bytes programming.The secure bootloader is a standard ST bootloader with additional security features.If the STM32 microcontroller is reset during retrieving AES secret key(7), all sensitive dataare erased before restarting initial SFI procedure.During SFI process, the secure bootloader never allows any other code to access userFlash memory or SRAM.2.1.2SFI and external Flash memory applied to STM32L562xx andSTM32H7B3xI/STM32H733xx/STM32H735xx (with OTFDEC)When speaking of external Flash memory, it matters to clearly identify the firmware and datathat reside in external Flash memory from the firmware and data that reside in user Flashmemory. Firmware and data in user Flash memory are named hereafter internal firmwareand data.The firmware and data that reside in external Flash memory are referenced as externalfirmware and external data throughout the next sections.The internal firmware must enable the read/fetch of data/code within external Flashmemory, using OTFDEC and OCTOSPI peripherals.Note:8/39SFI cannot handle internal Flash memory in a first sequence and external in a separateindependent one: when SFI handles external firmware and data, it must first handle internalfirmware and data that in turn enable decryption at runtime of external firmware and data.AN4992 Rev 10
AN4992STM32 secure firmware install (SFI)External firmware and data on-the-fly decryption is handled by the OTFDEC peripheral. Thisperipheral can encrypt and decrypt on-the-fly external firmware and data stored in externalFlash memory connected to STM32 microcontrollers through the OCTOSPI interface. TheOTFDEC can handle up to 4 regions of external Flash memory, each one with its owndedicated Key. The OTFDEC uses standard and enhanced AES CTR 128-bit algorithm forencryption and decryption operations. Refer to the OTFDEC section of the STM32microcontroller reference manual to get more insight.OEM can ensure the confidentiality of external firmware and data within external Flashmemory through 3 different use cases that are depicted within next sections.External Flash memory encryption without secure bootloaderThe cryptographic engine responsible for the on-the-fly external Flash memory decryption(OTFDEC) supports AES standard cryptographic algorithm. Thanks to this standardalgorithm, OEM can encrypt external firmware and data on host before programmingexternal Flash memory, without using secure bootloader.If external Flash memory programming is done within a non-trusted facility, OEM mustencrypt the external firmware and data before sending them to the non-trusted facility.OEM internal firmware must handle the configuration of the OTFDEC peripheral with theAES key for external Flash memory decryption. OEM must implement this part within thesecure internal firmware in order to guaranty the confidentiality of the external Flashmemory AES encryption keys.OEM internal firmware must also handle external Flash memory drivers (through OCTOSPI)in order to get access to the external firmware and data.Since OEM programs external Flash memory on host, OEM must not encrypt externalfirmware and data thanks to STM32 Trusted Package Creator. However, OEM must sendthe external firmware and data AES encryption keys within the SFI image. Then, whenbuilding the SFI image thanks to STM32 Trusted Package Creator, OEM must create theSFI image with at least: Internal firmware and data (include external Flash memory drivers). External firmware and data AES key.Figure 2 below shortly depicts SFI of an internal firmware that manages external firmwareand data. The sequence part that addresses internal Flash memory is the same than theone depicted in section Section 2.1.1: SFI and internal Flash memory.Figure 2 shows that the secure programming of internal Flash memory(1) and the encryptionplus programming of external firmware and data(2) are done in two separated flows withinSFI. The first flow uses secure bootloader, the second one uses host for programmingrespectively internal Flash memory and external Flash memory.AN4992 Rev 109/3938
STM32 secure firmware install (SFI)AN4992Figure 2. SFI and external Flash memory encryption without secure bootloaderSTM32CPUIntfirmwareSecure bootloader1AESOTFDEC KeyOTFDEC HALOCTOSPI HALSTM32 Cube ProgrammerExt FlashOTFDECExtFW/data2: AES 128 bit key for external firmware and data encryption/decryption: internal firmware and data: encryptedby STM32 TPC: external firmware and data: encryptedby: encryptedby STM32 TPCMSv64444V11. Secure programming of internal Flash memory.2. Encryption plus programming of external firmware and data.Figure 3 below depicts the execution of the same internal firmware in order to manageexternal firmware and data decryption.10/39AN4992 Rev 10
AN4992STM32 secure firmware install (SFI)Figure 3. Internal firmware and external Flash memory handlingSTM32CPUOCTOSPI HALSecure bootloaderIntfirmwareOTFDEC KeyOTFDEC HALOTFDEC1Region x: KeyExt Flash2OctoSPIExtfirmware/data: AES 128 bit key for external firmware and data encryption/decryption: internal firmware and data: external firmware and data: encryptedbyMSv64445V11. AES external firmware and data key programming in OTFDEC peripheral.2. On-the-fly external Flash memory decryption.At runtime, during secure boot, the secure internal firmware first copies the AES firmwareand data key within the OTFDEC peripheral and activates the OTFDEC region tied to thiskey(1). Then the CPU can seamlessly read/fetch data/code from external Flash memoryonce the OCTOSPI driver has been initialized(2).External Flash memory encryption with secure bootloader and global keyIn the next two sections, this document focuses on SFI use cases with encryption of theexternal firmware and data by the secure bootloader. The STM32 receives encryptedexternal firmware and data, decrypts them with the SFI OEM key, and re-encrypts them withan external Flash memory AES key common to all devices to be programmed or with aunique external Flash memory AES key per device. This section focuses on the firstscenario: a key common to all devices.The STM32 secure bootloader uses the OTFDEC peripheral to encrypt external firmwareand data, the STM32 secure bootloader stores the encryption result within SRAM. Then anexternal Flash memory loader
STM32 MCUs listed in Table 1. Outsourcing of product manufacturing enables original equipment manufacturers (OEMs) to reduce their direct costs and concentrate on high added-value activities such as research and development, sales and marketing. However, contract manufacturing puts the OEM's proprietary assets at risk, and since the contract manufacturer (CM) manipulates the OEM's intellectual .
STM32CubeIDE quick start guide - User manual Author: STMICROELECTRONICS Subject: STM32CubeIDE is STMicroelectronics integrated development environment for STM32 microcontrollers and microprocessors. Keywords: STM32, IDE, Eclipse , QSG Created Date: 11/2/2020 4:57:17 PM
[2]. Ben Jordan, Amit Bahl Rigid - Flex PCB Design a guide book for design, Sierra Proto express, 2013 [3]. STMicroelectronics. STM32 embedded graphic objects/ touchscreen library, 2011. [4]. STMicroelectronics. STM32F10xxx ı2c optimized examples, 2010. [5]. STMicroelectronics. Migratin
[UM2553] STM32CubeIDE quick start guide - User manual (1) [AN4992] Overview secure firmware install (SFI) - Application note (1) [AN5156] Introduction to STM32 microcontrollers security - Application note (1) . N
How a designer can make the most of STMicroelectronics serial EEPROMs Introduction Electrically Erasable and PROgrammable Memory (EEPROM) devices are standard products used for the non-volatile storage of data parameters, with a fine-granularity. This application note describes most of the internal architecture and related functionality of
– Electrostatic discharge protection Application Reverse battery protection of an electronic control unit Description The VN5R003H-E is a device made using STMicroelectronics VIPower technology. It is intended for providing reverse battery protection to an electronic module. This devic
Application note SPC560Pxx/SPC56APxx HW design guideline Introduction This application note is intended for hardware designers. It gives hardware design references on SPC560Pxx/SPC56APxx microcontroller. Four topics are covered: Voltage Regulator (VREG) Main oscillator Supply pins Reference Reset circuit www.st.com
March 2017 DocID028650 Rev 3 1/7 For further information contact your local STMicroelectronics sales office www.
Botany-B.P. Pandey 3. A Textbook of Algae – B.R. Vashishtha 4. Introductory Mycology- Alexopoulos and Mims 5. The Fungi-H.C. Dube . B.Sc. –I BOTANY : PAPER –II (Bryophytes, Pteridophytes, Gymnosperms and Palaeobotany) Maximum marks- 50 Duration - 3 hrs. UNIT -1 General classification of Bryophytes as Proposed by ICBN. Classification of Pteridophytes upto the rank of classes as proposed .
