NXP Semiconductors SLN-LOCAL2-IOT, User Manual

Page: 54 / 87

Chapter 8
Security architecture
8.1 Application chain of trust
The basis of the security architecture implemented in the SLN-LOCAL2-IOT are the signed application images. The signing
requires the use of a Certificate Authority (CA). NXP has its own CA to sign applications in the factory, but the CA is not shared
with customers.
The CA is used to create signing entities for the bootloader and application, as shown in
Figure 68 . The certificate from the CA
is stored in the SLN-LOCAL2-IOT’s filesystem and used to verify the signatures of the signing entity certificates. In addition, the
locally stored certificates from the signing entities are used to verify the signature of firmware images coming in the Over-the-Air
(OTA) or Over-the-Wire (OTW) bootloader interfaces.
Figure 68. Application chain of trust
When creating new firmware images for a secure boot implementation, the Automated Manufacturing Tool (Ivaldi) can be used
alongside your unique CA.
8.2 FICA and image verification
The FICA table is a section inside the filesystem that describes the images that will be booted. It contains information about
the image and signatures of the applications used to ensure that only verified firmware is executed. This ensures that malicious
images cannot be executed without being signed by the certificate authority and certificate that is programmed into the filesystem.
Before any image is jumped to, it is first verified using the signature from its associated FICA entry.
For example, the standard boot flow (
Figure 15 ) is as follows:
• The bootstrap uses the bootloader FICA entry to validate the bootloader.
• The bootloader uses the AppA FICA entry to validate the AppA image.
• The bootloader uses the AppB FICA entry to validate the AppB image.
For final production, the solution provides programming scripts to enable the i.MX RT High Assurance Boot (HAB) to verify and
protect the bootstrap component. Enable the HAB for your end product. The downside of having this security protection enabled
is that programming new images can be a little more complex, because it requires signature generation. Because this flow may
be time consuming and not required for basic development tasks, NXP introduced some bypasses to make the job easier.
These bypasses should not be deployed in production.
NOTE
NXP Semiconductors
SLN-LOCAL2-IOT Developer’s Guide, Rev. 0, 19 April 2021
User's Guide 54 / 87