ST X-CUBE-SBSFU, Руководство пользователя, Страница: 14 / 94

Secure Boot and Secure Firmware Update (SBSFU) UM2262
14/94 UM2262 Rev 6
3 Secure Boot and Secure Firmware Update (SBSFU)
3.1 Product security introduction
A device deployed in the field operates in an untrusted environment and it is therefore
subject to threats and attacks. To mitigate the risk of attack, the goal is to allow only
authentic firmware to run on the device. In fact, allowing the update of firmware images to fix
bugs, or introduce new features or countermeasures, is commonplace for connected
devices, but it is prone to attacks if not executed in a secure way.
Consequences may be damaging such as firmware cloning, malicious software download or
device corruption. Security solutions have to be designed in order to protect sensitive data
(potentially even the firmware itself) and critical operations.
Typical countermeasures are based on cryptography (with associated secret key) and on
memory protections:
•
Cryptography ensures integrity (the assurance that data has not been corrupted),
authentication (the assurance that a certain entity is who it claims to be) and
confidentiality (the assurance that only authorized users can read sensitive data)
during firmware transfer.
•
Memory protection mechanisms prevent external attacks (for example by accessing
the device physically through JTAG) and internal attacks from other embedded
processes.
The following chapters describe solutions implementing confidentiality, integrity and
authentication services to address the most common threats for an IoT end-node device.
3.2 Secure Boot
Secure Boot (SB) asserts the integrity and authenticity of the user application image that is
executed: cryptographic checks are used in order to prevent any unauthorized or
maliciously modified software from running. The Secure Boot process implements a Root of
Trust (refer to
Figure 1 ): starting from this trusted component (1), every other component is
authenticated (2) before its execution (3).
Integrity is verified so as to be sure that the image that is going to be executed has not
been corrupted or maliciously modified.
Authenticity check aims to verify that the firmware image is coming from a trusted and
known source in order to prevent unauthorized entities to install and execute code.