Introduction to Manufacturing for STM32H7RS

1. Introduction

During the product development process, original equipment manufacturers (OEMs) can subcontract the manufacturing to a contract manufacturing (OEM CM). The OEM CM can manage the programming tools or call for a third-party programmer. The manufacturing therefore takes place in an untrusted environment, putting proprietary assets at risk. As the OEM CM works with OEM intellectual properties (IPs), these can be exposed or appropriated by other customers. This is referred to as untrusted manufacturing.

To meet the new market security requests and protect customers against any leakage of their IPs, STMicroelectronics introduces new security concepts and tools. These new security concepts and tools enable the safe programming of an OEM firmware into the STM32 MCU internal flash memory or external non-volatile memories (including confidentiality, authentication and integrity checks).

Trusted manufacturing is based on the OEM owning the full chain of development and manufacturing. However, even products manufactured in such an environment can be vulnerable to security threats, once deployed in the field. To enhance the device resistance to such threats, the microcontrollers of the STM32H7RS series provide solutions that enable firmware authentication and secure firmware updates using cryptography and memory protection mechanisms. These measures help protect critical operations and data from unauthorized access.

2. Trusted manufacturing

2.1. STiRoT

The devices deployed in the field operate in an untrusted environment and are susceptible to various security risks. To mitigate these risks, it is crucial to ensure that only an authentic firmware runs on the device. Firmware updating is a common practice for connected devices, however it can also introduce security vulnerabilities if not done securely. The updates must be carried out in a secure manner, to prevent security breaches.

To address these issues, STMicroelectronics has developed the STiRoT, which stands for ST immutable (unchangeable) Root Of Trust, and acts as a first boot stage. This is a ROM code targeting a SESIP level 3 certified implementation. The STiROT is available only on STM32H7S devices. STiRoT provides two services:

  • The Secure boot (root of trust services) is an immutable code, always executed after a system reset. It activates runtime protections and verifies the integrity of the application code and data before every execution.
  • The Secure firmware update application is an immutable code that detects if a new application code or data image is available. It checks authenticity, then the integrity of the new image before installing it after the decryption phase, allowing the confidentiality.

The STiRoT activation is done by configuring the related option byte and defining the STiRoT configuration. STiRoT is activated in two different use cases :

  • One boot stage: The STiROT directly manages the user application.
  • Two boot stages: The STiROT manages an updatable boot stage (uROT) located in the user flash memory which, in turn, manages the user application. The updatable boot stage can be customized to fit customer needs.

The STiRoT configuration gives the possibility to define the number of managed images (firmware images, or firmware and data images), the location of the images, and the cryptographic keys. A loader code called iLoader manages the application images transfer between the installation slot, the external flash memory and the internal RAM, with the MCE encrypting and decrypting the images as needed.
Once the configuration is done, an image is generated and the device can be programmed with the option bytes, the OBKeys, and the generated image.

For more general information about the STiRoT, refer to the dedicated chapter and for more information on the STM32H7RS series, refer to the STiRoT for STM32H7S article.

2.2. OEMiRoT

Instead of using the Root of Trust provided by STMicroelectronics, the STM32H7RS series allows the OEM to develop and use their own solution.

OEMiRoT, which stands for OEM immutable (unchangeable) Root of Trust, is an example based on the MCUboot open-source software (refer to mcuboot) provided with STM32H5 MCUs. The OEMiRoT can be modified by the OEM to be tailored to their own application.

The given example also features the Secure boot and the Secure firmware update as for the STiRoT. An OEM updatable RoT (OEMuRoT) can be generated from the OEMiRoT to act as a second boot stage after STiRoT.

For more information about the OEMiRoT for STM32H7R and OEMiRoT for STM32H7S refer to the dedicated chapters.

3. Untrusted manufacturing

3.1. SFI

The secure firmware install (SFI) solution provides security when programming devices in a non-trusted facility owned by a contract manufacturer (CM). The SFI addresses the two main issues at a non-trusted facility:

  • OEM application confidentiality against CM during STM32 programming.
  • Avoid CM overproduction of OEM devices.

Without the use of Secure firmware install (SFI), the STM32 is programmed with non-encrypted code and data, leaving the application code vulnerable to security breaches or unauthorized copying. To avoid theft, application code tampering, and the unauthorized production of devices, the OEM must rely on the trustworthiness of the CM.
SFI offers a complete solution:

  • the STM32 Trusted Package Creator software package encrypts the OEM application (including code and data)
  • the STM32CubeProgrammer flashes the STM32 securely
  • the STM32-HSM transfers the OEM credentials to the programming partner (CM).

For more general information about the secure firmware install, refer to the SFI dedicated chapter.
The STM32CubeProgrammer software package is delivered under the SLA0048.

This procedure is described in the SFI for STM32H7RS dedicated article.

SFIx extension is not supported in STM32H7RS. The proposed way of working to provision product including external memories in non-trusted environment is to provision the H7RS itself (User flash + OBKeys + Option bytes) and then to provision the external memories with pre-encrypted images for parts requiring this protection with global keys.