Secure Engine protected environment
UM2262
60/94
UM2262 Rev 6
Appendix A
Secure Engine protected environment
The Secure Engine (SE) concept defines a protected enclave exporting a set of secure
functions executed in a trusted environment.
The following functionalities are provided by SE to the SBSFU application example:
•
Secure Engine initialization function
•
Secure cryptographic functions
–
AES-GCM and AES-CBC decryption
–
SHA256 hash and ECDSA verification
–
Sensitive data (secret key, AES context) never leaves the protected environment
and cannot be accessed from unprotected code
•
Secure read/write access to firmware image Information
–
Read and write operation on a protected Flash area
–
Access to this area is allowed only to protected code
•
Secure service to lock some functions in Secure Engine
–
One way lock mechanism: once locked, no way to unlock it except via a system
reset
–
Once locked, functions execution is no more possible via call gate mechanism
–
Functionalities that are locked via the lock mechanism in Secure Engine example:
- Secure Engine initialization function
- Secure Encryption functions with OEM key
- Secure read/write access to firmware image Information
- Secure service to lock some functions in Secure Engine
Note:
Functionalities exported by SE can be extended depending on final user applications needs
In the KMS variant,
SE functionalities are extended with
the secure key management
services providing cryptographic services to the user application through the PKCS #11
APIs (KEY ID based APIs) are executed inside the Secure Engine protected environment.
User Application keys are stored in this protected/isolated environment.
In the STSAFE-A variant, KMS is extended with STSAFE-A middleware, so as to provide
access to keys and services provided by the Secure Element through a standard interface.
Communication with the STSAFE-A100 is secured with symmetric keys stored in the
protected/isolated environment.
In order to deal with the firewall callgate mechanism and to provide the user with a set of
secure APIs, SE is designed with a two-level architecture, composed of SE Core and SE
Interface.
The call gate concept and the two-level architecture apply also when using the MPU to
protect the Secure Engine, as described in