X-CUBE-SFI

Description

The X-CUBE-SFI STM32Cube Expansion Package shows how to go through the secure firmware install (SFI) process for STM32 microcontrollers. It illustrates how to protect an original equipment manufacturer (OEM) firmware during the product manufacturing stage at the contract manufacturer (CM).

The product manufacturing outsourcing enables the OEMs to reduce their direct costs and concentrate on high added-value activities such as research and development, sales, and marketing. However, contract manufacturing puts an OEM's proprietary assets at risk: The CM manipulates the OEM's intellectual property (IP), which can be disclosed to other customers, or appropriated.

STMicroelectronics proposes the SFI security concept to meet the new market security requests and protect its customers against any leakage of their IPs. The SFI enables the programming of an OEM firmware into the STM32 flash memory. The programming is done in a secure way with confidentiality, authentication, and integrity checks. The OEMs must check the availability of the SFI with their CMs.

Several STM32 microcontrollers support protection mechanisms against unexpected access for critical operations (such as cryptography algorithms) and critical data (such as secret keys). The SFI solution provides a protection when these microcontrollers are being programmed for the first time. For more details, visit the SFI overview page of the STM32 MCU wiki at wiki.st.com/stm32mcu. For the list of the supported STM32 microcontrollers, refer to the application note STM32 MCUs secure firmware install (SFI) overview (AN4992).

The SFI offers a complete toolset: the STM32 Trusted Package Creator to encrypt OEM binaries, the STM32CubeProgrammer (STM32CubeProg) to program the STM32 securely, and the STM32HSM-V2 hardware security module to transfer the OEM credentials to the programming partner.