Hello @MartinL ,
if you use USB DFU communication to download your firmware, you will provide update feature but without any security. The firmware will be provided in binary but in clear. This means a hacker could possibly adapt it to another board.
The only was to ensure your firmware is not used for other purpose is to encrypt it and use a secure boot.
You can have a look the X-CUBE-SBSFU solution provided on st.com. There is one example provided for STM32F413 that you can easily port on STM32F411.
After compilation and link, the IDE will launch a postbuild script that will sign and encrypt the firmware.
The secureboot on the STM32 will be able to check the signature and decrypt the firmware.
The update link provided in this example is the UART with Ymodem protocol. It can be changed to use a USB based protocol like DFU.
STM32F4 is quite old now and is not resistant to board level attack such as power glitching.
If you want to increase the level of security, the STM32H5 can be used as replacement with minimum impact on PCB. To be check with available parts.
STM32H5 is certified PSA and SESIP Level 3 meaning that security mechanisms are resistant to board level attacks. In that case you will also need to use a secure boot. Here the solution is provided as part of the STM32H5Cube. You can find lots of documentation on st wiki on this topic.
Best regard
Jocelyn
