Mbed OS Reference
Loading...
Searching...
No Matches
SecureStore.h
1/*
2 * Copyright (c) 2018 ARM Limited. All rights reserved.
3 * SPDX-License-Identifier: Apache-2.0
4 * Licensed under the Apache License, Version 2.0 (the License); you may
5 * not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an AS IS BASIS, WITHOUT
12 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef MBED_SECURESTORE_H
18#define MBED_SECURESTORE_H
19
20#if !defined(MBEDTLS_CONFIG_FILE)
21#include "mbedtls/config.h"
22#else
23#include MBEDTLS_CONFIG_FILE
24#endif
25
26#include "device_key/DeviceKey.h"
27
28#define SECURESTORE_ENABLED 1
29
30// Whole class is not supported if entropy, device key or required mbed TLS features are not enabled
31#if !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CIPHER_MODE_CTR) || !defined(MBEDTLS_CMAC_C) || !DEVICEKEY_ENABLED
32#undef SECURESTORE_ENABLED
33#define SECURESTORE_ENABLED 0
34#endif
35
36#if SECURESTORE_ENABLED || defined(DOXYGEN_ONLY)
37
38#include <stdint.h>
39#include <stdio.h>
40#include "KVStore.h"
41#include "rtos/Mutex.h"
42
43// Forward declarations
44struct mbedtls_entropy_context;
45
46namespace mbed {
47
48/**
49 * \addtogroup kvstore
50 * @{
51 */
52
53/** SecureStore class
54 *
55 * SecureStore is a KVStore-based storage solution, providing security features on the stored data, such as encryption, authentication, rollback protection and write once, over an underlying KVStore class. It references an additional KVStore class for storing the rollback protection keys.
56 *
57 * Only available if your device has Flash IAP and a hardware entropy source (TRNG).
58 */
59
60class SecureStore : public KVStore {
61public:
62
63 /**
64 * @brief Class constructor
65 *
66 * @param[in] underlying_kv KVStore that will hold the data.
67 * @param[in] rbp_kv Additional KVStore used for rollback protection.
68 */
69 SecureStore(KVStore *underlying_kv, KVStore *rbp_kv = 0);
70
71 /**
72 * @brief Class destructor
73 */
74 virtual ~SecureStore();
75
76 /**
77 * @brief Initialize SecureStore class. It will also initialize
78 * the underlying KVStore and the rollback protection KVStore.
79 *
80 * @returns MBED_SUCCESS Success.
81 * or any other error from underlying KVStore instances.
82 */
83 virtual int init();
84
85 /**
86 * @brief Deinitialize SecureStore class, free handles and memory allocations.
87 *
88 * @returns MBED_SUCCESS Success.
89 * or any other error from underlying KVStore instances.
90 */
91 virtual int deinit();
92
93
94 /**
95 * @brief Reset KVStore contents (clear all keys)
96 * Warning: This function is not thread safe.
97 *
98 * @returns MBED_SUCCESS Success.
99 * MBED_ERROR_NOT_READY Not initialized.
100 * or any other error from underlying KVStore instances.
101 */
102 virtual int reset();
103
104 /**
105 * @brief Set one KVStore item, given key and value.
106 *
107 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
108 * @param[in] buffer Value data buffer.
109 * @param[in] size Value data size.
110 * @param[in] create_flags Flag mask - WRITE_ONCE_FLAG|REQUIRE_CONFIDENTIALITY_FLAG|
111 * REQUIRE_INTEGRITY_FLAG|REQUIRE_REPLAY_PROTECTION_FLAG
112 *
113 * @returns MBED_SUCCESS Success.
114 * MBED_ERROR_NOT_READY Not initialized.
115 * MBED_ERROR_READ_FAILED Unable to read from media.
116 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
117 * MBED_ERROR_INVALID_SIZE Invalid size given in function arguments.
118 * MBED_ERROR_WRITE_PROTECTED Already stored with "write once" flag.
119 * MBED_ERROR_FAILED_OPERATION Internal error.
120 * or any other error from underlying KVStore instances.
121 */
122 virtual int set(const char *key, const void *buffer, size_t size, uint32_t create_flags);
123
124 /**
125 * @brief Get one KVStore item, given key.
126 *
127 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
128 * @param[in] buffer Value data buffer.
129 * @param[in] buffer_size Value data buffer size.
130 * @param[out] actual_size Actual read size.
131 * @param[in] offset Offset to read from in data.
132 *
133 * @returns MBED_SUCCESS Success.
134 * MBED_ERROR_NOT_READY Not initialized.
135 * MBED_ERROR_READ_FAILED Unable to read from media.
136 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
137 * MBED_ERROR_INVALID_SIZE Invalid size given in function arguments.
138 * MBED_ERROR_FAILED_OPERATION Internal error.
139 * MBED_ERROR_ITEM_NOT_FOUND No such key.
140 * MBED_ERROR_AUTHENTICATION_FAILED Data authentication failed.
141 * MBED_ERROR_AUTHENTICATION_RBP_FAILED
142 * Rollback protection data authentication failed.
143 * or any other error from underlying KVStore instances.
144 */
145 virtual int get(const char *key, void *buffer, size_t buffer_size, size_t *actual_size = NULL,
146 size_t offset = 0);
147
148 /**
149 * @brief Get information of a given key.
150 *
151 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
152 * @param[out] info Returned information structure containing size and flags.
153 *
154 * @returns MBED_SUCCESS Success.
155 * MBED_ERROR_NOT_READY Not initialized.
156 * MBED_ERROR_READ_FAILED Unable to read from media.
157 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
158 * MBED_ERROR_FAILED_OPERATION Internal error.
159 * MBED_ERROR_ITEM_NOT_FOUND No such key.
160 * MBED_ERROR_AUTHENTICATION_FAILED Data authentication failed.
161 * MBED_ERROR_AUTHENTICATION_RBP_FAILED
162 * Rollback protection data authentication failed.
163 * or any other error from underlying KVStore instances.
164 */
165 virtual int get_info(const char *key, info_t *info);
166
167 /**
168 * @brief Remove a KVStore item, given key.
169 *
170 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
171 *
172 * @returns MBED_SUCCESS Success.
173 * MBED_ERROR_NOT_READY Not initialized.
174 * MBED_ERROR_READ_FAILED Unable to read from media.
175 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
176 * MBED_ERROR_WRITE_PROTECTED Already stored with "write once" flag.
177 * MBED_ERROR_FAILED_OPERATION Internal error.
178 * or any other error from underlying KVStore instances.
179 */
180 virtual int remove(const char *key);
181
182
183 /**
184 * @brief Start an incremental KVStore set sequence. This operation is blocking other operations.
185 * Any get/set/remove/iterator operation will be blocked until set_finalize is called.
186 *
187 * @param[out] handle Returned incremental set handle.
188 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
189 * @param[in] final_data_size Final value data size.
190 * @param[in] create_flags Flag mask - WRITE_ONCE_FLAG|REQUIRE_CONFIDENTIALITY_FLAG|
191 * REQUIRE_INTEGRITY_FLAG|REQUIRE_REPLAY_PROTECTION_FLAG
192 *
193 * @returns MBED_SUCCESS Success.
194 * MBED_ERROR_NOT_READY Not initialized.
195 * MBED_ERROR_READ_FAILED Unable to read from media.
196 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
197 * MBED_ERROR_INVALID_SIZE Invalid size given in function arguments.
198 * MBED_ERROR_WRITE_PROTECTED Already stored with "write once" flag.
199 * MBED_ERROR_FAILED_OPERATION Internal error.
200 * or any other error from underlying KVStore instances.
201 */
202 virtual int set_start(set_handle_t *handle, const char *key, size_t final_data_size, uint32_t create_flags);
203
204 /**
205 * @brief Add data to incremental KVStore set sequence. This operation is blocking other operations.
206 * Any get/set/remove operation will be blocked until set_finalize is called.
207 *
208 * @param[in] handle Incremental set handle.
209 * @param[in] value_data value data to add.
210 * @param[in] data_size value data size.
211 *
212 * @returns MBED_SUCCESS Success.
213 * MBED_ERROR_NOT_READY Not initialized.
214 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
215 * MBED_ERROR_INVALID_SIZE Invalid size given in function arguments.
216 * MBED_ERROR_FAILED_OPERATION Internal error.
217 * or any other error from underlying KVStore instances.
218 */
219 virtual int set_add_data(set_handle_t handle, const void *value_data, size_t data_size);
220
221 /**
222 * @brief Finalize an incremental KVStore set sequence.
223 *
224 * @param[in] handle Incremental set handle.
225 *
226 * @returns MBED_SUCCESS Success.
227 * MBED_ERROR_NOT_READY Not initialized.
228 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
229 * MBED_ERROR_INVALID_SIZE Invalid size given in function arguments.
230 * MBED_ERROR_FAILED_OPERATION Internal error.
231 * or any other error from underlying KVStore instances.
232 */
233 virtual int set_finalize(set_handle_t handle);
234
235 /**
236 * @brief Start an iteration over KVStore keys.
237 * There are no issue with any other operation while iterator is open.
238 *
239 * @param[out] it Returned iterator handle.
240 * @param[in] prefix Key prefix (null for all keys).
241 *
242 * @returns MBED_SUCCESS Success.
243 * MBED_ERROR_NOT_READY Not initialized.
244 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
245 * or any other error from underlying KVStore instances.
246 */
247 virtual int iterator_open(iterator_t *it, const char *prefix = NULL);
248
249 /**
250 * @brief Get next key in iteration.
251 * There are no issue with any other operation while iterator is open.
252 *
253 * @param[in] it Iterator handle.
254 * @param[in] key Buffer for returned key.
255 * @param[in] key_size Key buffer size.
256 *
257 * @returns MBED_SUCCESS Success.
258 * MBED_ERROR_NOT_READY Not initialized.
259 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
260 * or any other error from underlying KVStore instances.
261 */
262 virtual int iterator_next(iterator_t it, char *key, size_t key_size);
263
264 /**
265 * @brief Close iteration.
266 *
267 * @returns MBED_SUCCESS Success.
268 * MBED_ERROR_NOT_READY Not initialized.
269 * MBED_ERROR_INVALID_ARGUMENT Invalid argument given in function arguments.
270 * or any other error from underlying KVStore instances.
271 *
272 * @returns 0 on success or a negative error code on failure
273 */
274 virtual int iterator_close(iterator_t it);
275
276#if !defined(DOXYGEN_ONLY)
277private:
278 // Forward declaration
279 struct inc_set_handle_t;
280
281 rtos::Mutex _mutex;
282 bool _is_initialized;
283 KVStore *_underlying_kv, *_rbp_kv;
284 mbedtls_entropy_context *_entropy;
285 inc_set_handle_t *_ih;
286 uint8_t *_scratch_buf;
287
288 /**
289 * @brief Actual get function, serving get and get_info APIs.
290 *
291 * @param[in] key Key - must not include '*' '/' '?' ':' ';' '\' '"' '|' ' ' '<' '>' '\'.
292 * @param[in] buffer Value data buffer.
293 * @param[in] buffer_size Value data buffer size.
294 * @param[out] actual_size Actual read size.
295 * @param[in] offset Offset to read from in data.
296 * @param[out] info Returned information structure.
297 *
298 * @returns 0 on success or a negative error code on failure
299 */
300 int do_get(const char *key, void *buffer, size_t buffer_size, size_t *actual_size = NULL,
301 size_t offset = 0, info_t *info = 0);
302#endif
303};
304/** @}*/
305
306} // namespace mbed
307
308#endif
309#endif
mbed::KVStore
KVStore class.
Definition KVStore.h:38
mbed::SecureStore
SecureStore class.
Definition SecureStore.h:60
mbed::SecureStore::get_info
virtual int get_info(const char *key, info_t *info)
Get information of a given key.
mbed::SecureStore::iterator_open
virtual int iterator_open(iterator_t *it, const char *prefix=NULL)
Start an iteration over KVStore keys.
mbed::SecureStore::remove
virtual int remove(const char *key)
Remove a KVStore item, given key.
mbed::SecureStore::iterator_next
virtual int iterator_next(iterator_t it, char *key, size_t key_size)
Get next key in iteration.
mbed::SecureStore::SecureStore
SecureStore(KVStore *underlying_kv, KVStore *rbp_kv=0)
Class constructor.
mbed::SecureStore::set_finalize
virtual int set_finalize(set_handle_t handle)
Finalize an incremental KVStore set sequence.
mbed::SecureStore::set
virtual int set(const char *key, const void *buffer, size_t size, uint32_t create_flags)
Set one KVStore item, given key and value.
mbed::SecureStore::iterator_close
virtual int iterator_close(iterator_t it)
Close iteration.
mbed::SecureStore::set_start
virtual int set_start(set_handle_t *handle, const char *key, size_t final_data_size, uint32_t create_flags)
Start an incremental KVStore set sequence.
mbed::SecureStore::deinit
virtual int deinit()
Deinitialize SecureStore class, free handles and memory allocations.
mbed::SecureStore::reset
virtual int reset()
Reset KVStore contents (clear all keys) Warning: This function is not thread safe.
mbed::SecureStore::get
virtual int get(const char *key, void *buffer, size_t buffer_size, size_t *actual_size=NULL, size_t offset=0)
Get one KVStore item, given key.
mbed::SecureStore::~SecureStore
virtual ~SecureStore()
Class destructor.
mbed::SecureStore::set_add_data
virtual int set_add_data(set_handle_t handle, const void *value_data, size_t data_size)
Add data to incremental KVStore set sequence.
mbed::SecureStore::init
virtual int init()
Initialize SecureStore class.
rtos::Mutex
The Mutex class is used to synchronize the execution of threads.
Definition Mutex.h:79
mbed::KVStore::info
Holds key information.
Definition KVStore.h:56