Secure manager software adds PSA services to STM32 designs
Ready-made trusted execution software from STMicroelectronics brings PSA services, secure boot, attestation, firmware update, and isolated key storage to STM32H5 microcontrollers.
Security certification and trusted execution can add substantial development work to embedded projects, particularly when teams need to protect keys, firmware, and device identity. The STM32TRUSTEE-SM for STM32Cube gives developers a ready-to-use secure manager for STM32 microcontrollers based on Arm® Cortex®-M cores with Arm TrustZone®. This is first being supported on STM32H573xx microcontrollers.
The software includes secure boot, a root of trust with chip-diversified keys, cryptographic services, internal trusted storage, initial attestation, and firmware update. By providing these services as an ST-supplied package, STM32TRUSTEE-SM reduces the need for developers to write and validate their own trusted execution environment.
The Secure Manager access kit (SMAK) provides the production-ready secure manager package. It can be installed by customers on production lines and called from non-secure application firmware through reference source code supplied by STMicroelectronics.
The secure manager binary runs in an isolated TrustZone-protected environment. This protects secure services and original equipment manufacturer (OEM) application credentials managed and stored by the secure manager.
The package also supports software intellectual property (IP) protection through PSA isolation Level 3. This allows trusted software functions to run as a sandboxed secure service.
The external Flash profile extends the approach to larger applications. Dedicated download slots in external Flash memory allow application sizes of up to 1.5MB, while preserving the secure manager framework.