|
Coming soon |
Please understand this is draft, thank you
1. WLAN Secure provisioning Presentation
The security of a system primarily depends on the trusted information shared between the actors involved in the system. From an integrated circuit (IC) perspective, security is achieved by embedding secure elements inside the IC, which cannot be updated or modified. This ensures that the information stored within the IC remains secure and cannot be altered or updated. One-time programmable (OTP) is a type of non-volatile memory that is commonly used in integrated circuits for secure applications, such as the Wi-Fi IC. OTP memory is programmed only once, and the data stored in it cannot be modified or erased, making it an ideal solution for storing sensitive and trusted information used for security purposes. Two types of trusted data are required for secure systems: Confidential data and public data.
- Confidential data refers to sensitive information that needs to be kept secret.
- Public data refers to information that is meant to be shared with others, but still needs to be trusted because of its origin and integrity.
The Wi-Fi IC provides hardware-based protection for OTP memory access, which is controlled by the security life cycle. This life cycle regulates the access (read, write) of the OTPs, ensuring that only trusted firmware can access them in close mode. When the IC is open, only non-confidential OTPs are accessible, while confidential OTPs remain secure. This ensures that sensitive information stored in the OTP memory remains secure and cannot be accessed by unauthorized parties.
The provisioning is executed in two steps, depending on the origin of the secrets. Secrets delivered by the IC provider are provisioned during the IC test engineering phase, while customer-provided secrets are provisioned at the EOM facility when the companion WI-FI IC is first connected to its host. The ST secrets are generated by a Common Criteria-certified HSM in a secure facility and are transferred in an encrypted manner, accessible by the IC, which already knows the secret.
The IC provider bootstraps is a dedicated firmware, which contains the shared and IC-specific secrets. The bootstrap firmware is authenticated and decrypted by the IC ROM to ensure the security and confidentiality of the provisioning, even in non-trusted facilities.
The IC provider also delivers the bootExtension firmware, which is used to securely provide the customer's secrets. In addition to the bootExtension running on the WI-FI IC, there is a firmware bridge tasked with loading the bootExtension and provisioning the non-protected OTPs.
2. ST secure provisioning
Bootstrap is a dedicated firmware authenticated by the BootROM, which is responsible for the ST provisioning process. The Typhon should be closed before loading the Bootstrap. The Bootstrap is loaded into the Typhon's SRAM1 through the SDIO interface. The bootstrap is built using four distinct parts.
- The first part is the bootstrap header, which contains versioning, size, target identifier, and information for decryption and authentication, such as the initial vector and the AES-GCM tag.
- The second part contains the code that is responsible for writing the secret to the OTP and authenticating the final part.
- The third part is also authenticated by the BootROM and contains all the secrets generated by ST central service shared among all the WI-FI ICs.
- The last part is authenticated by the code in the already bootrom authenticated second part and contains all the secrets specific to each WI-FI IC.
3. EOM provisioning
The EOM provisioning mainly rely on MDG cube programmer tools. The MDG cube programmer tool is connected to the STM32WW4 host board. The host board shall be initialized with CLU bridge firmware. The CLU bridge firmware is used to read and write otps in the WI-FI companion IC.
For each host, a CLU bridge should be created. This bridge is tasked with loading the bootromExtension firmware onto the WI-FI IC following bootrom authentication, and with provisioning the non-secure OTP for the WI-FI IC.
The CLU bridge can operate in two different modes: a UART command line mode or with CubeProgrammer. At the beginning of the EOM provisioning, the CLU bridge must be loaded onto the host to communicate with CubeProgrammer. According to the host ID, CubeProgrammer will select the correct CLU bridge and load it into the host's RAM or flash memory. The WI-FI IC is delivered in open mode, allowing full access.
The CubeProgrammer tool includes a dedicated Wi-Fi IC menu to control and provision the parameters and secrets of the OEM. The OEM should provide the Wi-Fi IC trimming configuration, the firmware public keys table, and the debug disable configuration using the OTP write command menu in CubeProgrammer. When the non-secure OTPs are set, CubeProgrammer then locks the Wi-Fi IC and downloads the bootExtension.
3.1. bootromExtension firmware
The bootromExtension runs on the WI-FI IC in closed mode to access the protected OTPs. Delivered by the IC provider, the bootromExtension is authenticated by the bootrom using the IC provider's secrets.
The bootromExtension is authenticated by the bootrom using ST secrets and ensures confidentiality of the module maker secrets. It is responsible for programming the module maker secrets in secure WI-FI IC OTPs and the WI-FI IC RMA secret. The bootromExtension is executed at the module maker facility, where it is authenticated using the ST provisioning secret.
The bootromExtension interacts with the CLU bridge to securely provision the EOM secrets. To generate a secure link, the bootromExtension provides the unique WI-FI IC certificate. This unique WI-FI IC certificate, signed by the IC provider, can be used to genuinely authenticate and identify the WI-FI IC module.
The CLU bridge sends a non-authenticated command to request the unique WI-FI IC certificat.The Nist P256 or P384 elliptic curves are supported by WI-FI IC.