New release of Secure Manager 1.2.0 for STM32H5 - overview
The Secure Manager for STM32H573 version 1.2.0 has recently been released. It’s available on our Secure Manager webpage. We wanted to inform you about the importance of this new release, and to refresh how it could improve your security concerns.
Updating to version 1.2.0 is essential for users.
Version 1.2.0 will be the first version for production purposes, allowing further versions and updates not to break your system implementation. Users will therefore be able to update their applications and the Secure manager to any further version remotely.
Version 1.1.x will not be supported anymore. You can still find the Secure Manager version 1.1 certificate on SESIP website at Secure Manager & STM32H5 certification. Version1.2.0 is undergoing a full security certification. This certification is expected to be available around November 2024 period.
Improved security and additional features
Here are a few details on the changes:
- Security improvements
- New third-party security services support from our ST partner: ProvenRun
- Footprint optimizations, allowing to increase the maximum allowed application size
- AES GCM multipart support
- Improved debug capabilities
Additional features are described in the user manual:
Secure Manager for STM32H573xx microcontrollers - User manual
The importance of MCU and MPU security
Security within an MCU or MPU or MPU application is a complex and costly journey.
Your final product or application will soon require to prove its cyber security resilience. European laws are being put in place imposing that every digital object will require a cyber security focus. Details are available at Cyber Resilience Act: MEPs adopt plans to boost security of digital products | News | European Parliament (europa.eu).
Within this law several items will have to be covered:
- Security by design to ensure security is a core element of each new product
- Strong Root of Trust to ensure the origin and integrity of the firmware running on the product
- Security updates to ensure that every device can be updated in case of security vulnerability
- Secure communication to ensure mutual attestation of communicating devices and privacy of data transiting on the networks
Building this is made seamless and straightforward using Secure Manager 1.2.0. All functions being made available natively into a software framework that can be securely installed on STM32H573 devices.
Furthermore, Secure Manager is running in an isolated partition of the device, using the TrustZone(C) from Arm architecture. See the following architecture description
In this architecture, developers do not need to write any code on security aspects, everything is covered by the framework. This includes a pre-configured TrustZone.
Let's see how Secure Manager helps you to solve your previous requirements:
- Security by design - dedicated security service design for high security, maintained and corrected by ST in case of malicious vulnerabilities
- Strong Root of Trust - 2-stage Root of Trust, one immutable, one updatable to allow application verification of authenticity, integrity and confidentiality
- Security update - PSA API compliant solution, to securely & independently update your application and the secure modules (or secure apps) as well as the root of trust itself.
Verifying that your security application is robust against threats
Security assurance is indeed highly important and clearly a difficulty for developers. Developers often do not know how to implement a secure code, neither how attackers are going to break it. It takes years for them to get trained on security and reach the right expertise.
With Secure Manager we used decades of security expertise of our embedded software developers and partners to provide a solution capable to resist to multiple type of threats. Knowing trust can only come from external independent 3rd parties, it was tested and certified by external and highly skilled security laboratories. Penetration testing was done targeting a security assurance of SESIP Assurance Level 3 (SESIP3) including physical attacks.
Do you have any questions about Secure Manager?
We encourage you to comment on this article if you have any questions or points to discuss, and we will be happy to respond.
Related links
- STM32Trust - Our security repository for all STM32
- STM32H5 Online security trainings - Training of all our security IPs and services
- Secure Manager - Software download page with all documentation
- Secure manager presentation - Explains Secure Manager is and provides a marketing overview of the functionalities and support services
- Wiki Security H5