nRF9160 Use secure peripheral from non-secure(ns) firmware

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Sigurd Hellesvik — Thu, 03 Feb 2022 08:07:13 GMT

The Secure Services sample showcases how to use Secure Services.
These are functions in the Secure partition that are accessible from the Non-Secure part.

Since there are no premade Secure Service for handling UARTE2, you will have to make a custom Secure Service for this.
Here is an older guide on Using a custom Secure Partition Manager with your application. It might not work as it is for v1.8.0, but it should outline the consent at least.

There should be a way to do this in Trusted Firmware-M also, but we do not have any example to showcase this at this time.

Regards,
Sigurd Hellesvik

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Siddharth Kachhia — Wed, 02 Feb 2022 14:53:40 GMT

Here I have choose UARTE2 as secure for understanding of how to use secure peripheral from non-secure.

So, Though it may compromise security, how would I handle secure peripheral from non-secure FW image ? Do you have any sample/demo which provides my steps for understanding of using secure peripheral from non-secure board FW image ?

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Sigurd Hellesvik — Fri, 28 Jan 2022 10:10:07 GMT

[quote user="Siddharth Kachhia"]data(UART) would be safe from attackers.[/quote]

The UART goes between the nRF9160 and the nRF52840.
Where can the attack come from?

Why would it be bad if attackers had access to the UARTE2?

Regards,
Sigurd Hellesvik

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Siddharth Kachhia — Fri, 28 Jan 2022 08:23:29 GMT

As on configuring UARTE2 secure, data(UART) would be safe from attackers. To safe that peripheral from attacks, want to make it secure peripheral.

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Sigurd Hellesvik — Fri, 28 Jan 2022 08:12:21 GMT

As security is important, i think it is an good idea to be thorough, so let me ask you this:

[quote user="Siddharth Kachhia"]So, want to make UARTE2 secure for security purpose.[/quote]

Why does the UARTE2 need to be secure?

Regards,
Sigurd Hellesvik

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Siddharth Kachhia — Thu, 27 Jan 2022 17:13:17 GMT

nRf9160 and nRF52840 communicate with each other and send MQTT-SN msg over UARTE2.
So, want to make UARTE2 secure for security purpose. But also have to use modem with nRF9160 for cloud connection. Hence, need to configure non-secure(ns) board for nRF9160.

That's why question arise here that
1) How to use UARTE2 secure peripheral from non-secure firmware ?
2) Can SPM service be modified to add UARTE2 secure peripheral communication from non-secure image ?

RE: nRF9160 Use secure peripheral from non-secure(ns) firmware

Sigurd Hellesvik — Thu, 27 Jan 2022 14:16:42 GMT

Hi Siddharth

When you build for nrf9160dk_nrf9160, all peripherals memory are in the same "zone". Therefore, peripherals are neither secure or non-secure.

When you build for nrf9160dk_nrf9160_ns, peripherals and memory are split into two different parts, the non-secure and the secure.
You can choose which peripherals are set as non-secure. The rest are secure.

Secure peripherals are secure only because the non-secure parts can not access the secure parts.
Some functions can bridge the non-secure/secure gap, but this should not be done lightly, as it may compromise the security of the device.

See Secure Partition Manager for more information on secure and non-secure.

What are you going to use the nRF52840 for?

Would it be an alternative to make UARTE2 non-secure instead of secure, or does it need to be secure?

Regards,
Sigurd Hellesvik