STM32H533CE datasheet(22/231 Pages) STMICROELECTRONICS

22 / 231 page

Functional overview

STM32H533xx

22/231

DS14539 Rev 1

Note:

The ECC is supported by SRAM2, and BKPSRAM when enabled with the SRAM2_ECC,

and BKPRAM_ECC user option bits.

3.5.1

SRAMs TrustZone security

When the TrustZone security is enabled, all SRAMs are secure after reset. The SRAM1,

SRAM2, SRAM3, can be programmed as secure or non-secure by blocks, using the

MPCBB (block-based memory protection controller).

The granularity of SRAM secure block based is a page of 512 bytes. Backup SRAM regions

can be programmed as secure or non-secure with watermark, using the TZSC (TrustZone

security controller) in the GTZC (global TrustZone controller).

3.5.2

SRAMs privilege protection

The SRAM1, SRAM2, SRAM3, can be programmed as privileged or non-privileged by

blocks, using the MPCBB. The granularity of SRAM privilege block based is a page of

512 bytes. Backup SRAM regions can be programmed as privileged or non-privileged with

watermark, using the TZSC (TrustZone security controller) in the GTZC (global TrustZone

controller).

3.6

Security overview

The STM32H533xx security enables the possibility to reopen the debug mode even if the

product is in secure state.

The reopening of the debug mode is controlled with a debug authentication procedure which

permits the authentication of the host.

The sensible assets such as keys or secret codes must be protected when opening the

debug mode. The protection is made via code protection and hardware keys storage

solutions where all root of trust can be protected thanks to hardware mechanisms.

In cases where sensitive information cannot be protected, a partial or a full regression can

be launched in order to allow a debugging. Regressions are enabled by a debug

authentication method.

The STM32H533xx design also permits the developers to introduce their own root of trust

solution (OEM-iROT), including their installation in a non-trusted environment thanks to a

secure firmware install (SFI) solution.

The STM32H533xx boot stages are isolated via a hardware mechanism called HDPL

(temporal isolation level). The HDPL guarantees isolation of the different boot stages: ST

assets, iROT (immutable root of trust), uROT (updatable root of trust), secure operating

system and non-secure applications.

STM32H533xx devices embed a hardware key storage solution with the following

characteristics:

•

Feature a dedicated flash memory area per boot stages with access-control based on

HDPL and which can be secure or non-secure.

•

The keys can be stored encrypted with a derived key related to the current execution

context (HDPL, regression counter called EPOCH, secure or non-secure).

•

One crypto accelerator hardware DPA resistant (SAES), connected via hardware key

bus to a non-DPA protected accelerator.

STM32H533CE 数据表(PDF) 22 Page - STMicroelectronics

STM32H533CE 数据表(HTML) 22 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

数据表下载