Memory Protection Unit (MPU)

An MPU operates by dividing the processor's addressable memory into a limited number of configurable regions (typically 8-16). For each region, the MPU enforces rules defined by:

• Base Address: The starting memory location of the protected region.
• Size: The region's size, often required to be a power of two.
• Access Permissions: Defines which bus masters (e.g., CPU, DMA controller) can perform read, write, and execute operations.
• Memory Attributes: Specifies cache and buffer policies (e.g., write-through, non-cacheable). This granular control allows developers to create a privilege model, isolating the kernel, application tasks, and peripheral registers.

MPUs enforce a fundamental security principle: least privilege. They define at least two processor modes:

• Privileged Mode: Full system access (typically used by the OS kernel and trusted firmware).
• Unprivileged/User Mode: Restricted access, governed by MPU region rules. Any access violation—such as an unprivileged task attempting to write to a kernel region or execute from a non-executable data region—triggers a Memory Management Fault (MemManage). This fault exception immediately halts the offending operation and transfers control to a secure handler, preventing exploitation of memory corruption bugs.

MPU configuration is a critical system operation. Two primary management models exist:

• Static Partitioning: Regions are configured once at boot by secure firmware (e.g., a Real-Time Operating System kernel) and remain fixed. This is simple and secure but inflexible.
• Dynamic Reconfiguration: The OS kernel changes MPU region settings on every context switch between application tasks. This provides strong isolation for a multi-tasking system but adds overhead. The configuration must be managed in privileged mode to prevent a malicious task from granting itself unauthorized access.

While both manage memory access, an MPU is distinct from a full Memory Management Unit (MMU):

• MPU (Memory Protection Unit): Enforces protection only. It works with physical addresses, has a small number of fixed regions, and lacks address translation. It is lightweight, deterministic, and standard on Cortex-M series MCUs for real-time systems.
• MMU (Memory Management Unit): Provides protection + virtualization. It translates virtual addresses to physical addresses via page tables, supports demand paging, and enables complex operating systems like Linux. It is more powerful but has higher latency and complexity. For TinyML on microcontrollers, the MPU's deterministic, low-overhead protection is ideal.

An MPU is a foundational hardware-enforced security control within a defense-in-depth strategy for embedded systems:

• Fault Containment: Isolates a fault or malicious activity within a single task or subsystem, preventing a full system compromise.
• Trusted Computing Base (TCB) Minimization: Protects the integrity of the secure kernel and cryptographic libraries from buggy or compromised application code.
• Enabler for Secure Coding: Allows the use of an RTOS with kernel/user space separation even on resource-constrained devices, moving beyond a monolithic, all-privileged firmware model. It is often used in conjunction with other hardware features like ARM TrustZone-M to create a robust security perimeter.

In TinyML deployments, the MPU safeguards critical assets on the microcontroller:

• Model Integrity: The trained neural network model weights in flash or RAM can be placed in a read-only, executable region for the inference engine, preventing accidental or malicious corruption.
• Sensor Data Isolation: Raw sensor input buffers and pre-processed feature vectors can be assigned to regions accessible only by the specific data pipeline tasks.
• Secure Communication Buffers: Regions holding cryptographic keys or data for secure updates (OTA) can be made inaccessible to the main application tasks.
• Real-Time Guarantees: By preventing memory corruption, the MPU helps maintain the deterministic timing required for real-time sensor sampling and inference loops.

The MPU enforces read-only access to critical memory regions, preventing unauthorized code from corrupting the deployed machine learning model's weights and architecture. It also isolates sensor input buffers and inference output buffers, ensuring raw data and results cannot be tampered with by other application tasks. This is foundational for guaranteeing the deterministic behavior of a production TinyML pipeline.

In complex embedded applications, a bug in one task (e.g., a communication driver) must not crash the entire system. An MPU isolates task memory (stack, heap, data) into separate, unprivileged regions. A memory access violation triggers a precise hardware fault exception, allowing the Real-Time Operating System (RTOS) to terminate only the faulty task while the core TinyML inference engine and other critical services continue uninterrupted.

The MPU is used to implement a hardware-enforced privilege model. Critical kernel and security services execute in a privileged mode with full memory access. Application tasks, including the TinyML inference thread, run in an unprivileged user mode with access only to their explicitly allocated memory regions. This prevents a compromised inference task from accessing cryptographic keys, secure boot parameters, or other tasks' data, drastically reducing the attack surface.

For devices hosting software from multiple vendors or running isolated workloads (e.g., a proprietary ML model alongside a customer's application logic), the MPU creates hardware-enforced partitions. Each tenant's code and data are confined to distinct, non-overlapping memory regions. This enables secure IoT edge scenarios where a sensor analytics model from one provider is logically separated from device management firmware from another, all on a single, cost-effective microcontroller.

The MPU mitigates common software exploitation techniques. It can mark the .text (code) section as execute-only (XO) or read-only (RO), preventing an attacker from writing malicious shellcode into executable memory. It can also mark the stack and heap as non-executable (XN), thwarting attempts to run injected code from these data areas. This is a key defense in devices that parse complex network packets or file formats.

The MPU is a foundational element in a layered security architecture. After Secure Boot verifies the initial firmware, the MPU is configured to protect the bootloader and root-of-trust code. In systems with ARM TrustZone-M, the MPU defines memory access rules for both the Secure and Non-secure worlds, acting as the hardware gatekeeper for the Trusted Execution Environment (TEE) where sensitive ML model parameters or keys might be stored.

A Trusted Execution Environment (TEE) is a secure, isolated area of a main processor that provides a protected space for the execution of sensitive code and the handling of confidential data, separate from the device's standard operating system. While an MPU enforces memory access rules, a TEE creates a complete, hardware-isolated execution environment.

• Isolation: Uses hardware features to create a 'Secure World' separate from the 'Normal World' OS.
• Use Case: Protects cryptographic operations, secure boot sequences, and payment credentials.
• Example: ARM TrustZone technology is a widely implemented TEE for Cortex-M and Cortex-A processors.

Secure Boot is a hardware-enforced security mechanism that ensures a microcontroller executes only cryptographically signed and verified firmware during its initial startup sequence. It establishes a chain of trust from immutable hardware (Root of Trust) up through the operating system.

• Process: Each stage of the bootloader verifies the digital signature of the next stage before loading and executing it.
• Integrity: Prevents the execution of malicious or tampered firmware.
• MPU Synergy: After Secure Boot completes, the MPU is often configured to protect the now-verified code and data regions from runtime attacks.

A Hardware Security Module (HSM) is a dedicated, tamper-resistant physical computing device that safeguards and manages digital keys, performs cryptographic operations, and provides a root of trust. Compared to an MPU, which is a protection unit, an HSM is an active cryptographic unit.

• Dedicated vs. Integrated: Can be a discrete chip or a certified core integrated into a System-on-Chip (SoC).
• Key Functions: Secure key generation, storage, and use; acceleration of encryption/decryption; digital signing.
• Application: Used in high-assurance scenarios like automotive, payment terminals, and government ID systems.

Control Flow Integrity (CFI) is a software security mechanism that protects against control-flow hijacking attacks (e.g., Return-Oriented Programming) by ensuring a program's runtime execution flow adheres to a pre-determined, legitimate control-flow graph. It complements MPU's data and code region protection.

• Mechanism: Inserts runtime checks before indirect branch instructions (like function pointers) to validate the target address.
• Defense: Thwarts exploits that aim to redirect program execution to malicious code.
• Embedded Use: Lightweight, compile-time CFI schemes are increasingly important for securing firmware on constrained devices.

Platform Security Architecture (PSA) is an ARM-led industry framework that provides a holistic set of threat models, security specifications, and open-source firmware to enable the design of secure, connected devices from the ground up. It defines how components like MPUs, TrustZone, and Secure Boot should work together.

• Components: Includes threat models, security API specifications (PSA Certified APIs), and reference firmware (Trusted Firmware-M).
• Goal: Standardizes a security baseline for IoT and embedded devices across the silicon ecosystem.
• MPU Role: PSA specifications mandate and provide templates for MPU configuration to isolate trusted firmware from application code.

Lightweight Cryptography refers to a class of cryptographic algorithms—including ciphers, hash functions, and authentication protocols—specifically designed for implementation on constrained devices. They feature small code size, low RAM usage, and minimal computational overhead.

• Standards: NIST has standardized algorithms like ASCON for authenticated encryption and hashing, designed for microcontrollers.
• Trade-off: Optimizes for resource efficiency while maintaining a rigorous security margin suitable for embedded applications.
• System Context: These algorithms are often the ones executed within memory regions protected by an MPU or inside a TEE.