How to save persistently secure data in nRF9160 DK?

[Zhenchuan]

hi, 

We are working on nRF9160 DK board.

One of the issues is how to save secure data (e.g, data key) into flash. Is there any examples or document on data storage APIs?

Another follow up issue. Since the Key data is supposed to be  handled in the secure area. I think secure service in SPM is the right place to export the key operations to application. But it looks the project should be either Secure or Non-secure during creation. So how can I create a project/solution that includes both application and our modified SPM secure services? 

Thanks

Zhenchuan

[Martin Lesund]

Hi Zhenchuan,

One option you can use is to store keys/credentials in the modem flash as we have done with the nRF Cloud Certificates to be able to connect to the nrfcloud.com (aws_server).

(The samples e.g. the Asset_tracker/LTE sensor Getaway uses these credentials to connect to the cloud)

To provision credentials to the modem flash, you can use the AT command: AT%CMNG

It depends a bit on what kind of data you want to store.

You also have some other ways of keeping your data/keys secure:

- CRYPTOCELL — ARM TrustZone CryptoCell 310

- KMU — Key management unit

---

For your last question, when you build your application it should automatically include the SPM

[Zhenchuan]

Hi Martin,

Thanks for the help.

I have a follow-up question regarding the SPM.  Yes, I could find that SPM code included in my project. The problem is that the SPM code is in the directory ncs/nrf/subsys/spm/, which is shared by all other projects. If I modify the code, all other projects will be affected. Is that correct?

I want SPM changes only apply to that specific application. Can I do that?

Thanks

Zhenchuan