11.4 Secure boot programming with High Assurance Boot (HAB)
The i.MX RT106S MCU has some fundamental security enablement to protect itself against unsigned images and ensure the
integrity of high-value software running on the device. The HAB forces the Read Only Memory (ROM) to only boot into a signed
image. This ensures image integrity and prevents from physical and remote attacks since the device is powered on. The HAB is
described in detail in the
i.MX RT1060 Processor Reference Manual
). See the white paper related to
the security aspect of i.MX RT processor.
The implementation steps to enable the HAB of the i.MX RT processor for the SLN-LOCAL2-IOT kit is assured by the Python
scripts. With the Ivaldi package, the bootstrap is signed to work with the HAB.
For additional information about the Ivaldi tool’s HAB enablement, build the documents in the Ivaldi/doc folder according to the
README.md file.
11.4.1 HAB setup
This section assumes that
NXP application image signing tool
is completed as needed to generate the CA and application
certificate that will be loaded into the flash. It will also be used to generate the FICA table used to validate the application signature.
The first step is to create a signed Flashloader which will be used to set everything up and communicate with the blhost tool. The
blhost tool in its simplest form is used to read and write registers, but it communicates with the Flashloader. The Flashloader is
a RAM-based application that supports the blhost communication. In normal circumstances, the Flashloader can be executed
without being signed. When the HAB is enabled, the Flashloader must be signed by the generated keys.
The secure boot Python scripts are separated into two folders:
• OEM – The scripts should only be executed by the Product Owner and the output must be stored in a secure environment.
This is because it contains important key information, which if lost, could brick the SLN-LOCAL2-IOT kits or result in a loss
of image integrity. The example scripts demonstrate how to configure the Public Key Infrastructure (PKI) and generate a
secure binary.
• MANF – The scripts are executed on the manufacturing line. They are used to execute the signed Flashloader and
communicate with the chip to encrypt the binaries. The scripts contain the generation and programming of FICA. The
scripts also serve as examples for the production line programming. Note that the script to enable the HAB should only be
performed once per device with a known PKI (i.e., certificates and keys).
This process has several failure points, if you have insufficient knowledge of the device. Some of these features
are one-way and they permanently impact the behavior of the i.MX RT106S MCU.
NOTE
The “./oem/setup_hab.py” script creates the PKI infrastructure, secure-boot (SB) file, and a signed Flashloader.
• The generated PKI files are located in the crts and keys folders.
• The following secure-boot (SB) file is located in the Image_Binaries folder:
— enable_hab.sb
• The following signed Flashloader files are located in the Image_Binaries folder:
— ivt_flashloader_signed.bin
— ivt_flashloader_signed_nopadding.bin
shows the output of the setup_hab.py script.
NXP Semiconductors
Automated manufacturing tools
SLN-LOCAL2-IOT Developer’s Guide, Rev. 0, 19 April 2021
User's Guide
77 / 87
