i.MX ProcessorsのトピックRe: Secure RAM/memory with CAAM and IEE

Secure RAM/memory with CAAM and IEE

joepvk — Wed, 03 Nov 2021 15:02:49 GMT

I am trying to understand how I could apply secure RAM on the i.MX8x.
This is what I know so far:
I do understand that CAAM is used for key generation based of the OTMPK.
And when running has a some secure RAM space for keys etc.
And CAAM is mainly used for secure memory with data blobs to retain secure memory across power cycles.
It seems IEE(Inline Encryption Engine) is used for securing RAM data. But it can also be used for secure memory. IEE can do this by using secret keys requested from CAAM through a private bus.

So now my question is:
Can I use CAAM for secure RAM or do I need to use IEE?
And also where can I find a guide or information to implement secure RAM?

Re: Secure RAM/memory with CAAM and IEE

Yuri — Fri, 05 Nov 2021 09:06:58 GMT

@joepvk
Hello,

The Secure RAM cannot be used by customers directly.
BLOBs should be applied instead.

Regards,
Yuri.

Re: Secure RAM/memory with CAAM and IEE

joepvk — Tue, 09 Nov 2021 09:45:25 GMT

@Yuri
So currently CAAM and it's BLOB mechanism is also used for secure RAM?
In the same order as secure memory?
For secure RAM: ((data+key) = blob) and save this to heap/stack depending.
Or should a different mechanism be used for RAM?

Sorry for the "double" question but I'm trying to make things clear for myself.

Re: Secure RAM/memory with CAAM and IEE

Yuri — Wed, 10 Nov 2021 05:19:38 GMT

@joepvk
Hello,

secure RAM is used by CAAM for its internal operations, and it is not
accessible for users. BLOB can be located in external memory. It is
accessible and protected by the master key.

Regards,
Yuri.

Re: Secure RAM/memory with CAAM and IEE

joepvk — Thu, 11 Nov 2021 11:08:45 GMT

Thank you for the replies @Yuri.
This answers the CAAM part of my question.

Now the other part of the question which I phrased badly at first because Secure RAM is part of CAAM.

How would you go about protecting data that is stored in RAM(stack/heap data)?
Or phrased differently:
How can you make it so that RAM data cannot be read/accessed by non authorized users?

Re: Secure RAM/memory with CAAM and IEE

Yuri — Fri, 12 Nov 2021 03:11:56 GMT

@joepvk
Hello,

Customers can use an external devices, such as SE050

https://www.nxp.com/docs/en/data-sheet/SE050-DATASHEET.pdf

Also, standard OS approaches, such as virtualization, to protect data
may be applied.

Regards,
Yuri.