Disabling the Debug access in K22

[vaibhavi_padwal]

Hi,

I am using a custom board with MK22FX512AVLQ12 controller. I want to disable the access of debug port/ debug lines once I have flashed the code but I should be able to update the firmware later through bootloader.

From the reference manual of the controller I found that, writes to flash can be disabled by setting the flash security bits. But even after setting the security bits flash can be mass erased to make it unsecure. So I'll have to disable the mass erase command as well (please find relevant screenshots attached). Doing this will effectively make the controller one time programmable.

But my requirement is that, I should be able to update the program in flash by bootloader method(sending the application code on serial data lines), only the access to actual debug port of the controller should be disabled. Is this possible for this controller? If so, how it can be done? 

Thanks & Regards,

Vaibhavi P

[ErichStyger]

Hi @vaibhavi_padwal ,

The flash protection has basically the function that if the part is secured, and if the mass flash erase is still enabled, you can use the debugger to recover the device with a mass erase (see https://mcuoneclipse.com/2012/11/04/how-not-to-secure-my-microcontroller/ and https://mcuoneclipse.com/2014/06/22/preventing-reverse-engineering-enabling-flash-security/ ).

You still are able to perform flash page erase and programming from your application or bootloader.

Now one way to disable the debugger access further is to disable/re-mux the SWD/JTAG pins right after reset, including disabling the reset line.

However, this leaves a very small window open for a power glitch attack (see https://mcuoneclipse.com/2021/05/20/recovering-cortex-m-microcontroller-with-a-power-glitch/ ).

I hope this helps,

Erich

I hope this helps,

Erich

[vaibhavi_padwal]

Hi @ErichStyger,

As I have understood from the articles you suggested, the best possible way to secure my device from unauthorized debug access is to enable Flash security (SEC bits) and disable the Mass Erase Access (MEEN bits).

In the article you mention 

" Every microcontroller has some specific bits and settings which need to be set, and different ways how to implement a back door to regain access. Typically it is best if the backdoor is implemented through another hidden channel, e.g. with an encrypted password sent over USB or RS-232."

Does implementing backdoor means using the Backdoor key access feature of the controller? Or I can use any other method which I'll define in my bootloader?

Also implementing a backdoor to regain access, for e.g. using encrypted password, means that if I receive the password correctly through RS232 should I make the flash unsecure and then Program the application code? or I can program the code with unsecuring the flash?

Thanks & Regards,

Vaibhavi P

[ErichStyger]

Hi @vaibhavi_padwal ,

I recommend that you check the K22FX reference manual (search for 'backdoor' in the PDF).

Additionally search for the AN4507 (Using the Kinetis Security andFlash Protection Features) which has lots of good information on that topic.

Or see https://community.nxp.com/t5/Kinetis-Microcontrollers/Using-a-backdoor-key-to-unlock-security-for-Ki...

(your internet search engine is your friend )

I hope this helps,

Erich