Doc ID024209 Rev 2

5/30

AN4240

CSE IP block overview

1

CSE IP block overview

Cryptographic Service Engine (CSE) is a peripheral module that implements the security

functions described in the Secure Hardware Extension (SHE) Functional Specification

Version 1.1.

The CSE is an on-chip extension of the microcontroller. It is intended to move the control

over cryptographic keys from software domain into the hardware domain and therefore

protect those keys from software attacks.

CSE design includes a host interface (via peripheral bridge) with a set of memory mapped

registers used by CPU to issue commands (for example Get_ID, INIT_CSE, etc).

Furthermore a system bus interface (via xbar IF) allows the CSE to directly access the

system memory. Here the crypto module behaves like any other master. Through the host

interface the user configures and controls the CSE module, for example putting the module

into low power mode, enabling interrupts for finished command processing or suspending

command processing. The status and error register gives further system information.

Figure 1. CSE IP block

Two dedicated blocks of system flash memory are used by the CSE for secure key and

firmware storage. These blocks are not accessible by other masters from system and

therefore are called secure flash. The command processing is done by a 32-bit CSE core

with attached ROM and RAM running at system frequency of SoC. See Figure 1.