NXP Security Solutions

The EdgeLock Secure Enclave is a dedicated security unit, providing Hardware Root of trust, physical isolation of critical security functions and secure storage of essential credentials. It protects SoC integrity, prevents application cores from gaining direct access to sensitive data, and provides enhanced isolation for execution of critical and sensitive security functions. For applications requiring very high bandwidth or ultra‑low‑latency encryption and authentication, dedicated EdgeLock® Accelerators complement the enclave by providing application‑level cryptographic performance without compromising the protection of secrets anchored in the enclave.

Physical attacks cover a wide range, from invasive techniques to subtle, non‑destructive methods such as side‑channel and fault‑injection attacks. To counter these threats, NXP implements advanced chip‑level tamper‑resistance technologies that help prevent unauthorized access, modification, or device disablement and reduce reliance on additional system‑level protections. The company also builds defenses against logical attacks that exploit software bugs or decision‑making flaws. When combined, physical and logical techniques can simplify attacks overall, enabling remote and automated exploitation.

Trust Provisioning Supports CRA essential cybersecurity requirements for secure supply‑chain practices by enabling controlled, traceable, and tamper‑resistant provisioning of unique device identities, certificates, and credentials.

NXP offers the SEC Tool and SPSDK to manage processor life‑cycle transitions and credentials generation (keys, certificates) during production. In the field, EdgeLock 2GO extends this capability by enabling secure remote connectivity and ongoing lifecycle and key management.

Quantum computing delivers dramatic gains in processing power but could break today’s public‑key cryptography. To address this, NXP contributes to new cryptographic algorithms, standards, and migration paths that protect current platforms against future quantum threats.

NXP enables robust runtime security and secure update across both MCUs and i.MX application processors. For MCUs, Arm® TrustZone® isolation, Trusted Firmware‑M (TF‑M) secure services, and MbedTLS crypto libraries provide secure boot, authenticated firmware update, and protected runtime execution, all available through the MCUXpresso SDK and security provisioning tools.

For i.MX processors, Arm® TrustZone® forms the foundation of a Trusted Execution Environment (TEE) implemented via OP‑TEE, supporting secure key management, memory protection, and trusted applications. Hardware modules such as Central Security Unit (CSU), Resource Domain Controllers (RDC/XRDC), and TrustZone Address Space Controller (TZASC) further enforce system isolation, while secure and encrypted boot establish a strong chain of trust for firmware updates. Developers can access OP‑TEE, secure boot tools, and security configurations through NXP’s BSPs, Yocto layers, and security documentation.

The EdgeLock SE05x Plug & Trust middleware package offers easy integration with different MCUs and MPUs simplifying design-in and reducing time-to-market.

In addition, the GitHub software packages are derivatives of the full Plug & Trust middleware package for specific use cases. For development purposes still look at the full package as well as it contains large amounts of examples, tools and additional documentation.

• The Plug and Trust middleware mini package is a subset of the Plug & Trust middleware for Linux use
• The Plug and Trust middleware nano package is a minimalistic version of the Plug & Trust middleware optimized for constrained devices. It also provides an integration with Zephyr OS and an example of Qi 1.3 authentication

Stay CRA-Ready with NXP. NXP's compliance and security certifications are supported by NXP's EdgeLock® Assurance Program and validated through a broad range of security compliance certifications.

Our processes support the key principles of the CRA, including:

• Operating a current Secure Development Lifecycle
• Implementing robust security testing and vulnerability management
• Maintaining security across all operations
• Completing a comprehensive risk management assessment

XP’s cybersecurity engineering processes are certified as compliant with the industrial cybersecurity standard IEC 62443-4-1, which specifies requirements for the secure development of products used in industrial automation and control systems.

The new standard ISO/SAE 21434 provides a well-defined cybersecurity framework and establishes cybersecurity as an integral element of engineering throughout the life of a vehicle, from concept through decommissioning. The policies and processes of NXP have been certified to comply with this standard.