What you’ll learn:
- How secure serial flash memory works.
- Features provided by a secure serial flash memory.
Secure serial flash memory devices like Winbond’s TrustME W77 series support a range of security features to a host processor, such as verified over-the-air (OTA) updates to secure boot. They’re well-suited for system-on-chip (SoC) devices that utilize SPI serial memories for program storage. I talked with Jun Kawaguchi, Marketing Executive at Winbond, about the specifics of secure serial flash storage (watch the video above).
Secure Functionality Using Serial Flash Memories
Secure commands with a secure serial flash memory device enable secure functionality; otherwise, it operates like a conventional serial flash storage device. The device acts as a secure, hardware root-of-trust (RoT) with secure key provisioning and storage (Fig. 1).
The device builds on this functionality to provide other services such as secure code and data storage, as well as an authenticated watchdog timer and a secure and unique device ID that’s critical for cloud/edge security (Fig. 2).
Winbond’s devices offer fast secure boot and firmware integrity protection support by authenticating the contents of memory using its secure keys. On-chip data hash is used for fast code authentication and provides secure OTA firmware updates by checking the update via local keys. The secure code update with rollback protection feature works by checking any updates and not using them if they can’t be authenticated. The prior version is retained in that case.
The chip interface integrates local and remote secure-channel support as well as on-chip encryption and authentication. The replay-protected monotonic counter (RPMC) is designed to prevent rollback attacks. In addition, the secure serial flash chips provide cryptographically secured write protection.
Winbond’s device meet security certifications including Common Criteria EAL 2+, SESIP Level 2 (with IEC 62443, NIST 8259A, WP.29 ready), ISO 21434, and FIPS 140-3 CMVP. They’re also designed to comply with ISO 26262 ASIL-C safety qualification.
