ST X-CUBE-SBSFU, User Manual, Page: 28 / 94

Protection measures and security strategy UM2262
28/94 UM2262 Rev 6
•
PCROP (proprietary code readout protection): a section of Flash is defined as execute-
only applying PCROP protection on it: it is not possible to access this section in reading
nor writing. Being an execute-only area, a key is protected with PCROP only if it is
"embedded" in a piece of code: executing this code moves the key to a specific pointer
in RAM. Placed behind the firewall, its execution is not possible from outside.
•
WRP (write protection): write protection is used to protect trusted code from external
attacks or even internal modifications such as unwanted writings/erase operations on
critical code/data.
•
MPU (memory protection unit): the protected environment managing all critical data
and operations (Secure Engine) is isolated from the other software components by
leveraging the Memory Protection Unit (MPU). The Secure Engine code and data can
be accessed only through privileged level of software execution. Therefore, a software
running in non-privileged level cannot call the Secure Engine services nor access the
critical data. This strict access control to Secure Engine services and resources is
implemented by defining specific MPU regions described in
Table 5 .
Besides, the MPU also ensures that only authorized code is granted execution
permission when the Secure Boot and Secure Firmware Update processes are
running.
Before launching the user application, the MPU protection is disabled but the secure
user memory protection is activated.
•
Secure user memory : when the secure user memory protection is activated, any
access to securable memory area (fetch, read, programming, erase) is rejected,
generating a bus error. All the code and secrets located inside the secure user memory
(protected environment) is fully hidden. Secure Engine stack and data are cleared
when launching the user application as not under secure user memory protection.
Figure 9 illustrates the closure of the secure user memory when starting the user
application.
Table 5. MPU regions in the STM32G0 Series, STM32G4 Series and STM32H7 Series
Region content Privileged permission Unprivileged permission
Secure Engine code & constants
Read Only
(execution allowed)
No access
Secure Engine stack & VDATA
Read Write
(not executable)
No access