Secure Element — Hardware Root of Trust for Embedded Systems
A Secure Element (SE) is a dedicated, tamper-resistant microchip designed to store cryptographic keys and perform security operations in an isolated environment. It provides a hardware root of trust — a physically anchored security foundation that software alone cannot replicate.
What Does a Secure Element Do?
A secure element performs the security functions that would be vulnerable if implemented in software:
| Function | Without SE | With SE |
|---|---|---|
| Key storage | In flash memory (extractable) | In tamper-proof silicon (non-extractable) |
| Crypto operations | CPU-based (side-channel vulnerable) | Isolated processor (protected) |
| Device identity | Software certificate (clonable) | Hardware-anchored identity (unique) |
| Secure boot verification | Software check (bypassable) | Hardware check (immutable) |
| Certificate management | File-based (overwritable) | Secure object storage (access-controlled) |
Leading Secure Elements (2026)
| Product | Vendor | Certification | Key Features |
|---|---|---|---|
| STSAFE-A110 | STMicroelectronics | CC EAL5+ | TLS 1.3 offload, STSAFE-V for automotive |
| OPTIGA Trust M | Infineon | CC EAL6+ | Shielded connection, platform integrity |
| EdgeLock SE050 | NXP | CC EAL6+ | IoT-to-cloud, multi-root cert support |
| ATECC608B | Microchip | FIPS 140-2 | Low cost, CryptoAuth, AWS IoT integration |
| A71CH | NXP | CC EAL6+ | Plug-and-trust, pre-provisioned keys |
All European-manufactured secure elements (STMicroelectronics, Infineon) — ensuring supply chain sovereignty for EU hardware manufacturers.
Secure Element Architecture
A typical secure element contains:
- Secure CPU — Isolated processor for cryptographic operations, with hardware countermeasures against fault injection and side-channel attacks.
- Secure memory — Encrypted NVM for key and certificate storage, with active tamper detection.
- Crypto accelerators — Hardware engines for AES, RSA, ECC (P-256, P-384), and increasingly PQC algorithms.
- True Random Number Generator (TRNG) — Hardware entropy source for key generation.
- Communication interface — I²C, SPI, or ISO 7816 for host MCU connection.
SE vs. TPM vs. TEE
| Feature | Secure Element | TPM (Trusted Platform Module) | TEE (Trusted Execution Environment) |
|---|---|---|---|
| Form factor | Discrete chip on PCB | Discrete chip or firmware | Zone within main processor |
| Isolation | Physically separate | Physically separate (discrete) | Logical separation only |
| Key storage | Dedicated secure NVM | Dedicated secure NVM | Shared memory (encrypted) |
| Certification | CC EAL5–EAL6+ | FIPS 140-2/3 | PSA Certified, GP TEE |
| Cost | $0.30–$2.00 per unit | $1–$5 per unit | Included in SoC |
| Best for | IoT devices, smart cards | PCs, servers, enterprise | Mobile phones, rich OS devices |
Use Cases in IoT
1. IoT Device Identity & Authentication
Each device receives a unique, hardware-anchored identity during manufacturing. The SE stores the private key and X.509 certificate, enabling mutual TLS authentication with cloud services. The key never leaves the chip.
2. Secure Boot Chain
The SE verifies the authenticity of the bootloader before the main MCU executes it — creating a hardware-anchored chain of trust from power-on to application.
3. Secure OTA Firmware Updates
The SE verifies the signature of incoming firmware packages using its stored root public key. Combined with anti-rollback counters, this prevents both tampered and downgraded firmware from being accepted.
4. Data Protection
Sensor data can be encrypted using keys stored in the SE before transmission, ensuring end-to-end confidentiality even if the communication channel is compromised.
EU Regulatory Context
The EU Cyber Resilience Act (CRA) classifies secure elements as “Important Class II” products — requiring mandatory third-party conformity assessment. This underscores their critical role in the EU’s cybersecurity infrastructure.
Related Terms
- HSM — Larger-scale hardware security modules; SEs are essentially miniaturized HSMs.
- Secure Boot — The chain-of-trust process that relies on SE-stored keys.
- IoT — Connected devices where secure elements provide hardware-level protection.