System overview - Secure storage¶

Stack compatibility	Radio profile
v5.8+	All

Introduction¶

The secure storage feature allows secrets to be safely stored in the device’s non-volatile memory. The stack will automatically utilize this feature for all its confidential and sensitive data. Additionally, applications can leverage secure storage for their own purposes.

All data will be encrypted and integrity-protected, preventing access or modification by attackers who might gain unauthorized access to the programming interface.

Wirepas stack secrets¶

All secrets will be encrypted and integrity protected automatically by the stack, without any user interaction. They can be safely provided during factory setup or by the stack, through the application API.

Note

Secrets refers to sensitive and confidential data as per EN 18031-1 standard [1], it includes security keys but also parameters like node and network addresses, or network channel.

Factory setup

The production chain can write un-encrypted network parameters into a device non-volatile memory, the bootloader will encrypt and add authentication to them at first boot.

Wirepas stack API

There is no change in the API, either single MCU [2] or remote API [3], stack handle secure storage internally.

User area secrets¶

Applications can use the secure storage API to store their own sensitive data. It consists of a set of functions to store, retrieve and delete data. All data can be encrypted and integrity protected by the same primitive than the stack secure storage, it is up to the application to select if the encryption and integrity protection should be used for each record.

Warning

Application developers must take into account secure storage header overhead when allocating the area memory.

Implementation specifics¶

Hardware vs software crypto¶

Some Wirepas supported chipsets provide a hardware crypto element while others don’t. Hardware secure element are always used when available, otherwise Wirepas stack provides a software implementation.

Root key generation and storage¶

An device root key is generated at first boot and stored in the hardware secure element if available, otherwise it is stored in the non-volatile memory. It is used to derive the secure storage encryption and integrity protection keys, which are volatile and generated on-demand: they are never stored.

Note

For enhanced security the root key is randomly generated using a combination of seed (from hardware random number generator when available) and chip unique ID.

Feature compatibility matrix¶

Manufacturer	Chip	RNG	Crypto operations	Device root secret storage
Nordic	nRF52832	Hardware	Software	Flash
	nRF52833	Hardware	Software	Flash
	nRF52840	Hardware	Software	Secured flash area
	nRF91x1	Hardware	Hardware	ARM KMU [4]
	nRF54L	Hardware	Hardware	ARM KMU [4]
Silicon labs	EFR32xG12	Hardware	Software	TBC
Silicon labs	EFR32xG22	Hardware	Hardware	TBC

References¶

[1]

EN 18031-1:2024

[2]

TBC - Single MCU API ref

[3]

Wirepas Massive Remote API Reference Manual

[4] (1,2)

ARM Key Management Unit (KMU)

Legal Notice¶

Use of this document is strictly subject to Wirepas’ Terms of Use and Legal Notice.

Table of contents