Design Win

X-CUBE-SFI Secure Firmware Install demonstration software package and tools

Get Software Download databrief
Sample & Buy
Tools & Software
Quality & Reliability
Partner products
Sales Briefcase
Get Started

Product overview


The X-CUBE-SFI STM32Cube Expansion Package shows how to go through the secure firmware install (SFI) process for STM32 microcontrollers. It illustrates how to protect an original equipment manufacturer (OEM) firmware during the product manufacturing stage at the contract manufacturer (CM). The product manufacturing outsourcing enables the OEMs to reduce their direct costs and concentrate on high added-value activities such as research and development, sales, and marketing. However, contract manufacturing puts an OEM's proprietary assets at risk: The CM manipulates the OEM's intellectual property (IP), which can be disclosed to other customers, or appropriated.
STMicroelectronics proposes the SFI security concept to meet the new market security requests and protect its customers against any leakage of their IPs. The SFI enables the programming of an OEM firmware into the STM32 flash memory. The programming is done in a secure way with confidentiality, authentication, and integrity checks. The OEMs must check the availability of the SFI with their CMs.
Several STM32 microcontrollers support protection mechanisms against unexpected access for critical operations (such as cryptography algorithms) and critical data (such as secret keys). The SFI solution provides a protection when these microcontrollers are being programmed for the first time. For more details, visit the SFI overview page of the STM32 MCU wiki at wiki.st.com/stm32mcu. For the list of the supported STM32 microcontrollers, refer to the application note STM32 MCUs secure firmware install (SFI) overview (AN4992).
The SFI offers a complete toolset: the STM32 Trusted Package Creator to encrypt OEM binaries, the STM32CubeProgrammer (STM32CubeProg) to program the STM32 securely, and the STM32HSM-V2 hardware security module to transfer the OEM credentials to the programming partner.
  • All features

    • SFI: secure firmware install in the internal flash memory
      • Encrypted OEM firmware and option bytes secure installation in the internal flash memory
      • Counted installation of the OEM firmware with the HSM (hardware security module)
    • SFIx: secure firmware install in the external flash memory.Supports the same features as SFI with additionally:
      • Random key generation in the internal flash memory (can be used for external flash memory encryption)
      • Encrypted OEM firmware secure installation in the external flash memory
    • SMI: secure module install
      • Encrypted OEM module firmware secure installation in the internal flash memory
      • Counted installation of OEM module firmware with the HSM

Get Software

X-CUBE-SFI documentation