How to save persistently secure data in nRF9160 DK?

RE: How to save persistently secure data in nRF9160 DK?

Zhenchuan — Tue, 10 Sep 2019 17:43:25 GMT

Hi Martin,

Got it, thanks! That works for me!

Regards

Zhenchuan

RE: How to save persistently secure data in nRF9160 DK?

Martin Lesund — Tue, 10 Sep 2019 12:34:54 GMT

Hi Zhenchuan,
What you can do is turn OFF the automatic building/merging of the SPM in your main application.

In prj.conf put in:

CONFIG_SPM=n

and make a copy of the SPM (ncs/nrf/subsys/spm/) which you want to modify and build it.

You would build the SPM secure instead of non-secure.

RE: How to save persistently secure data in nRF9160 DK?

Zhenchuan — Tue, 10 Sep 2019 06:42:12 GMT

Hi Martin,

Thanks for the help.

I have a follow-up question regarding the SPM. Yes, I could find that SPM code included in my project. The problem is that the SPM code is in the directory ncs/nrf/subsys/spm/, which is shared by all other projects. If I modify the code, all other projects will be affected. Is that correct?

I want SPM changes only apply to that specific application. Can I do that?

Thanks

Zhenchuan

RE: How to save persistently secure data in nRF9160 DK?

Martin Lesund — Mon, 09 Sep 2019 13:49:49 GMT

Hi Zhenchuan,

One option you can use is to store keys/credentials in the modem flash as we have done with the nRF Cloud Certificates to be able to connect to the nrfcloud.com (aws_server).

(The samples e.g. the Asset_tracker/LTE sensor Getaway uses these credentials to connect to the cloud)

To provision credentials to the modem flash, you can use the AT command: AT%CMNG

It depends a bit on what kind of data you want to store.

You also have some other ways of keeping your data/keys secure:

- CRYPTOCELL — ARM® TrustZone® CryptoCell 310

- KMU — Key management unit

For your last question, when you build your application it should automatically include the SPM