Commit bf0e6d7c authored by Tomi Fontanilles's avatar Tomi Fontanilles Committed by Carles Cufi
Browse files

secure_storage: introduce the secure storage subsystem 

Implements RFC https://github.com/zephyrproject-rtos/zephyr/issues/75275.

See also the PR (https://github.com/zephyrproject-rtos/zephyr/pull/76222)
for more information.

Signed-off-by: default avatarTomi Fontanilles <tomi.fontanilles@nordicsemi.no>
parent d022d315

MAINTAINERS.yml

+8 −0
Changes for MAINTAINERS.yml: 8 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -4107,6 +4107,14 @@ RTIO: 
  tests:

    - rtio



Secure storage:

  status: maintained

  maintainers:

    - tomi-font

  files:

    - subsys/secure_storage/

  labels:

    - "area: Secure storage"

Storage:

  status: odd fixes

  files:

subsys/CMakeLists.txt

+1 −0
Changes for subsys/CMakeLists.txt: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ add_subdirectory_ifdef(CONFIG_MODEM_MODULES modem) 
add_subdirectory_ifdef(CONFIG_NETWORKING net)

add_subdirectory_ifdef(CONFIG_PROFILING profiling)

add_subdirectory_ifdef(CONFIG_RETENTION retention)

add_subdirectory_ifdef(CONFIG_SECURE_STORAGE secure_storage)

add_subdirectory_ifdef(CONFIG_SENSING sensing)

add_subdirectory_ifdef(CONFIG_SETTINGS settings)

add_subdirectory_ifdef(CONFIG_SHELL shell)

subsys/Kconfig

+1 −0
Changes for subsys/Kconfig: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ source "subsys/random/Kconfig" 
source "subsys/retention/Kconfig"

source "subsys/rtio/Kconfig"

source "subsys/sd/Kconfig"

source "subsys/secure_storage/Kconfig"

source "subsys/sensing/Kconfig"

source "subsys/settings/Kconfig"

source "subsys/shell/Kconfig"

subsys/secure_storage/CMakeLists.txt

0 → 100644
+48 −0
Changes for subsys/secure_storage/CMakeLists.txt: 48 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# SPDX-License-Identifier: Apache-2.0



zephyr_library()

zephyr_library_link_libraries_ifdef(CONFIG_MBEDTLS mbedTLS)

zephyr_library_include_directories(include/internal) # secure_storage headers

add_subdirectory(src)



# Make the subsystem's PSA Secure Storage API headers available only when it's enabled.

zephyr_include_directories(

  include

)



# Make the secure_storage headers available to the application only when it's implementing the relevant APIs.

function(make_available header)

  if (NOT header STREQUAL "common.h")

    make_available(common.h)

  endif()

  if ((header MATCHES "^its") AND NOT (header STREQUAL "its/common.h"))

    make_available(its/common.h)

  endif()

  configure_file(include/internal/zephyr/secure_storage/${header}

                 ${CMAKE_BINARY_DIR}/zephyr/include/generated/zephyr/secure_storage/${header}

                 COPYONLY)

endfunction()



if (CONFIG_SECURE_STORAGE_ITS_IMPLEMENTATION_CUSTOM)

  make_available(its.h)

endif()



if (CONFIG_SECURE_STORAGE_PS_IMPLEMENTATION_CUSTOM)

  make_available(ps.h)

endif()



if (CONFIG_SECURE_STORAGE_ITS_TRANSFORM_IMPLEMENTATION_CUSTOM

    OR (CONFIG_SECURE_STORAGE_ITS_STORE_IMPLEMENTATION_CUSTOM

        AND CONFIG_SECURE_STORAGE_ITS_TRANSFORM_MODULE))

  make_available(its/transform.h)

endif()



if (CONFIG_SECURE_STORAGE_ITS_STORE_IMPLEMENTATION_CUSTOM)

  make_available(its/store.h)

endif()



if (CONFIG_SECURE_STORAGE_ITS_TRANSFORM_AEAD_SCHEME_CUSTOM

 OR CONFIG_SECURE_STORAGE_ITS_TRANSFORM_AEAD_KEY_PROVIDER_CUSTOM

 OR CONFIG_SECURE_STORAGE_ITS_TRANSFORM_AEAD_NONCE_PROVIDER_CUSTOM)

  make_available(its/transform/aead_get.h)

endif()

subsys/secure_storage/Kconfig

0 → 100644
+102 −0
Changes for subsys/secure_storage/Kconfig: 102 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# Copyright (c) 2024 Nordic Semiconductor

# SPDX-License-Identifier: Apache-2.0



menuconfig SECURE_STORAGE

	bool "Secure storage subsystem"

	depends on !BUILD_WITH_TFM

	select EXPERIMENTAL

	help

	  The secure storage subsystem provides an implementation of the PSA Secure Storage API

	  functions on board targets that don't already have one.

	  It allows making use of the PSA Secure Storage API and persistent keys in the PSA Crypto

	  API in a standard and portable way.

	  It is configurable and different implementations can be used to accommodate the varying

	  capabilities of different devices.

	  In addition to providing functional support for the PSA Secure Storage API, depending on

	  the device-specific security features that are available and used, the subsystem may

	  secure the data stored through it at rest.

	  This is however highly dependent on the device and configuration in use, and not a

	  guarantee of the subsystem.



if SECURE_STORAGE



module = SECURE_STORAGE

module-str = secure_storage

source "subsys/logging/Kconfig.template.log_config"



choice SECURE_STORAGE_ITS_IMPLEMENTATION

	prompt "Internal Trusted Storage (ITS) API implementation"



config SECURE_STORAGE_ITS_IMPLEMENTATION_ZEPHYR

	bool "Zephyr's ITS implementation"

	select SECURE_STORAGE_ITS_TRANSFORM_MODULE

	select SECURE_STORAGE_ITS_STORE_MODULE

	help

	  Use Zephyr's implementation of the ITS API.

	  It calls into the transform and store modules, which

	  can be configured and have custom implementations.



config SECURE_STORAGE_ITS_IMPLEMENTATION_CUSTOM

	bool "Custom ITS implementation"

	help

	  A custom implementation of the ITS API is present.

	  Implement the functions declared in <zephyr/secure_storage/its.h>.

	  The header is made available when this Kconfig option is enabled.



endchoice # SECURE_STORAGE_ITS_IMPLEMENTATION



config SECURE_STORAGE_ITS_MAX_DATA_SIZE

	int "Maximum data size of an ITS entry in bytes"

	default 128

	help

	  The maximum size, in bytes, that the data of an ITS entry can be.

	  Increasing this value increases the stack usage when serving PSA ITS API calls.



menuconfig SECURE_STORAGE_ITS_TRANSFORM_MODULE

	bool "ITS transform module"

	help

	  The module that handles the transformation and validation of the

	  ITS data before it's written to and after it's read from NVM.

	  Zephyr's ITS implementation calls into it.



if SECURE_STORAGE_ITS_TRANSFORM_MODULE

rsource "Kconfig.its_transform"

endif



menuconfig SECURE_STORAGE_ITS_STORE_MODULE

	bool "ITS store module"

	imply FLASH # for FLASH_HAS_DRIVER_ENABLED

	help

	  The module that handles the storage/retrieval of the ITS data to/from NVM.

	  Zephyr's ITS implementation calls into it.



if SECURE_STORAGE_ITS_STORE_MODULE

rsource "Kconfig.its_store"

endif



choice SECURE_STORAGE_PS_IMPLEMENTATION

	prompt "Protected Storage (PS) API implementation"

	default SECURE_STORAGE_PS_IMPLEMENTATION_ITS



config SECURE_STORAGE_PS_IMPLEMENTATION_ITS

	bool "PS calls directly into the ITS"

	help

	  The PS API doesn't have an implementation of its own, and directly calls into the ITS API.

	  This means that the implementation of the PS API will be identical to that of the ITS API.



config SECURE_STORAGE_PS_IMPLEMENTATION_CUSTOM

	bool "Custom PS implementation"

	help

	  A custom implementation of the PS API is present.

	  Implement the functions declared in <zephyr/secure_storage/ps.h>.

	  The header is made available when this Kconfig option is enabled.



endchoice # SECURE_STORAGE_PS_IMPLEMENTATION



config SECURE_STORAGE_PS_SUPPORTS_SET_EXTENDED

	bool "PS API implementation supports psa_ps_create() and psa_ps_set_extended()"

	depends on SECURE_STORAGE_PS_IMPLEMENTATION_CUSTOM

	help

	  Whether the psa_ps_create() and psa_ps_set_extended() functions are implemented.



endif # SECURE_STORAGE

CRA Git | Maintained and supported by SUSTech CRA and CCSE