1. Boot and Runtime Protection
   • Secure Boot verifies the firmware’s digital signature to ensure that the firmware loaded during startup is complete and unaltered.
   • The Memory Protection Unit (MPU) and TrustZone® create isolated SRAM and flash regions to run applications with different privilege and security levels, thereby protecting critical code and data from unauthorized access.
   • Flash memory protection features include Readout Protection (lock bits), which prevents unauthorized access to or modification of firmware stored in internal flash memory. In addition, mechanisms such as eXecute-Only Memory (XOM), Write Protection, and Secure Conceal enable designers to define flash memory blocks with specific access controls, such as execute-only, read-only, or hidden, protecting critical data and firmware from being copied, modified, or read.
2. Encryption and Key Security
   • Hardware Crypto Accelerators support AES, RSA, ECC and SHA algorithms, enhancing encryption performance and strengthening overall security.
   • Random number generators include True Random Number Generators (TRNG) and Pseudo-Random Number Generators (PRNG). A TRNG produces unpredictable random numbers that can be used to derive cryptographic keys and generate nonces for cryptographic operations, enhancing security against attacks. A PRNG generates random numbers from a secure seed, enabling fast and consistent cryptographic operations while maintaining strong security.
   • Key Store (KS) stores and manages encryption keys in secure storage such as SRAM, flash, or OTP memory. When a key is needed, KS retrieves it directly from secure storage and transfers it to the crypto accelerator, minimizing any risk of key exposure.
3. Tamper Detection and Incident Response
   • The tamper detection sensors can detect abnormal behaviors and trigger protective responses. These sensors include an I/O Tamper Detector, which detects unexpected changes in I/O pin status; a Clock Detector, which monitors whether the clock frequency goes out of range; and a Voltage Detector, which identifies sudden spikes, over-voltage, or under-voltage on the power line. If a tamper event is recorded, the hardware can immediately respond by clearing sensitive data, such as RTC spare registers and keys in the Key Store, or by restarting the system to prevent further damage or data leakage.
4. Lifecycle Management and Debug Control
   • The Product Lifecycle Manager (PLM) ensures that critical data loaded into the microprocessor such as firmware, keys, and certificates, receives appropriate access control based on the microprocessor's current lifecycle state, thereby preventing data leakage.
   • Debug Port Management (DPM) prevents unauthorized access to the microcontroller’s internal resources via the debug port, protecting against potential security vulnerabilities. It also supports password-based authentication, ensuring that only authorized users can enable the debug port when needed, while preserving flexibility for product maintenance.
   • The Firmware Version Counter (FVC) securely stores the current firmware version, allowing the update program to compare version numbers and block the installation of older or less secure firmware, thereby protecting against rollback attacks.

These security features, each serving a specific function, work together to provide a robust and comprehensive foundation for protecting the entire system. The following is a brief summary of all NuMicro® IoT Security Technology.