Compact Computing without a Security Penalty
Microcontrollers were traditionally computing units focused on small size and low power consumption. That meant sacrificing “unnecessary” functions such as built-in security. Today, we know security is anything but a luxury and a new generation of MCUs brings security to the table along with traditional MCU strengths.
A microcontroller unit (MCU) is a compact integrated circuit designed to govern specific operations in embedded systems. Unlike general-purpose processors that handle diverse computing tasks, MCUs are optimized to perform dedicated control functions. They combine essential components—including a processor core, memory, and input/output (I/O) peripherals—onto a single chip, offering an efficient solution for tasks that demand real-time responsiveness and low power consumption.
Unlike microprocessors used in PCs, MCUs operate without the need for external components for basic functions. MCUs are the processing units at the core of countless everyday electronic devices; their versatility and affordability make them foundational elements in modern embedded systems, where function-specific control and energy efficiency are key.
Rapid Evolution
Microcontrollers are undergoing a transformative evolution, driven by the demands of edge computing, IoT, and AI integration. One of the most significant trends is enhanced integration—modern MCUs now embed wireless communication (e.g., Wi-Fi 6, BLE, NB-IoT), advanced analog peripherals, and security features directly on-chip. This reduces system complexity, board space, and power consumption, making them ideal for compact, connected devices.
Energy efficiency remains a top priority. Manufacturers are leveraging near-threshold voltage operation, adaptive voltage scaling, and FinFET processes to create ultra-low-power MCUs valuable in applications including wearables, medical sensors, and remote monitoring.
Stepping Into Security
With greater power and more critical applications tied to MCUs, security is no longer optional. Today’s MCUs feature hardware-based encryption, secure boot, tamper detection, and trusted execution environments. Many are certified to standards like PSA Level 3 and FIPS 140-2, ensuring resilience against cyber threats in critical applications.
Another critical development is the integration of AI and machine learning. MCUs now include dedicated neural processing units (NPUs) or support for TinyML frameworks, enabling real-time inference at the edge without cloud dependency. This is rapidly changing the applications considered possible for MCUs.
MCUs have evolved with increasingly sophisticated security features to meet growing demands for data integrity, confidentiality, and resistance to tampering—especially in embedded and IoT applications. Those more sophisticated security features now found on MCUs include:
- Debug & JTAG Lockout—Disables debugging interfaces to prevent low-level hardware access.
- Firmware Authentication & Signing—Ensures only trusted, signed updates are applied.
- Flash & SRAM Protection—Prevents unauthorized access to internal memory.
- Hardware Cryptographic Engines—Accelerate encryption/decryption using AES, RSA, ECC, SHA, and more.
- Key Management Systems—Safeguards the storage and handling of cryptographic keys.
- Physical Security—Anti-reverse engineering features such as epoxy coating, mesh grids, or secure enclosures.
- Secure Boot—Verifies the integrity of the firmware on startup.
- Tamper Detection & Response—Includes voltage, clock, temperature sensors that trigger data erasure or lockdown when anomalies occur.
- TrustZone Technology (ARM-based MCUs)—segregates secure and non-secure code execution environments.
- Unique Device Identifiers (UID)—Bind credentials to a device.
These technologies don’t all solve the same problem. Instead, they form a security mesh, each covering different aspects of protection across the breadth of an MCU-based system.
Small, Secure, Graphics
The Apollo4 Plus SoC, brings enhanced graphics performance, significant on-chip memory and solid memory performance to the Apollo4 SoC product family. Apollo4 Plus is designed for next-generation wearables and smart devices.
The Apollo4 Plus SoC is built on Ambiq’s Subthreshold Power-Optimized Technology (SPOT) platform. This MCU is intended to allow battery-powered endpoint devices to achieve a higher level of intelligence without sacrificing battery life.
The Apollo4 Plus has enough compute power and storage to handle complex algorithms and neural networks while displaying crystal-clear, smooth graphics. If additional memory is required, external memory is supported through multi-bit SPI and eMMC interfaces.
- ARM Cortex-M4 Processor with FPU and up to 192MHz clock frequency
- Up to 2MB of non-volatile MRAM for code/data
- Up to 2.75MB of low-power RAM for code/data
- Memory Protection Unit (MPU)
- Secure boot
- Secure over-the-air (OTA) updates
- Secure wired updates
- Key Revocation
- MIPI DSI 1.2 with two data lanes up to 500Mbps and up to 500 x 500 resolution
- 2D/2.5D graphics accelerator
- 4x stereo Digital microphones and 2x full-duplex I²S ports with ASRC
Secure AIoT Power
The ESP32-S3 from Espressif is a versatile SoC tailored for Artificial Intelligence of Things (AIoT), Human-Machine Interface (HMI), and low-power edge computing. ESP32-S3 provides all the necessary security requirements for building securely connected devices. It supports AES-XTS-based flash encryption, RSA-based secure boot, digital signature, and HMAC. ESP32-S3 also has a “World Controller” peripheral that provides two fully-isolated execution environments.
ESP32-S3 has 45 programmable GPIOs, SPI, I2S, I2C, PWM, RMT, ADC and UART, SD/MMC host and TWAI. ESP32-S3 has additional support for vector instructions in the MCU, which provides acceleration for neural network computing and signal processing workloads.
- Dual-core Xtensa LX7 processor at up to 240MHz
- ULP-RISC-V and ULP-FSM co-processors for deep sleep tasks
- ROM: 384KB
- SRAM: 512KB + 16KB RTC SRAM
- External Flash/RAM: Octal SPI, QPI, OPI support
- Secure RSA-based boot
- AES-XTS flash encryption
- Digital Signature & HMAC
- World Controller featuring dual isolated execution environments
- 4Kb OTP with up to 1792 bits user-accessible
- Cryptographic Accelerators for AES-128/256, SHA, RSA, and RNG
Low-Power HigH Security
The Infineon PSoC 6 ARM Cortex-M4/M0+ microcontroller family has been designed for secure, low-power IoT applications. With a dual-core architecture—Cortex-M4 for performance and Cortex-M0+ for security—it enables efficient partitioning of secure and non-secure tasks.
The PSoC 6 integrates a comprehensive suite of hardware-based security mechanisms that include:
Secure Boot with Immutable ROM, Chain of Trust (CoT), eFuse and Lifecycle Management, Memory and Peripheral Protection Units (MPUs, SMPUs, PPUs), and Debug Port Restrictions. These features make PSoC 6 suitable for applications requiring robust embedded security—such as smart home devices, medical wearables, and industrial IoT nodes.
- ARM Cortex-M4 (up to 150MHz) + Cortex-M0+ (up to 100MHz)
- Inter-Processor Communication (IPC) Hardware semaphores and mutexes for safe resource sharing
- AES, SHA, RSA/ECC, TRNG crypto accelerators
- Active power as low as 22µA/MHz
- Multiple sleep modes including Deep Sleep, Hibernate, and Stop
- Flash memory 256KB to 2048KB
- SRAM 128KB to 1024KB
- DEEPCRAFT Studio for edge-based machine learning
- Wi-Fi, Bluetooth, and Bluetooth LE available
Robust MCU Cryptography
The Microchip CEC1712 is a 32-bit ARM Cortex-M4-based microcontroller tailored for secure embedded applications. It features a robust hardware cryptographic engine supporting AES, SHA, RSA, and ECC algorithms, and a secure boot capability, which ensures that only authenticated firmware is executed. The CEC1712 also supports secure firmware updates, SPI flash protection, and runtime integrity checks.
The Microchip CEC1712 is widely used as a critical component in systems requiring high assurance against tampering and unauthorized code execution. Additionally, it supports secure key storage and cryptographic acceleration, which offloads security tasks from the main processor, improving overall system performance.
- 32-bit ARM Cortex-M4 running at 48MHz
- SRAM 256KB total (224KB code, 32KB data)
- Boot ROM with runtime APIs
- Hardware Root of Trust using immutable bootloader
- Supports AES-256 encrypted SPI flash images
- True random-number generator 1kb FIFO
- Multiple 16/32-bit auto-reloading and RTOS timers
- ADC Interface: 10-bit/12-bit, 5 channels, 500ns conversion
- GPIOs: 2 banks (1.8V/3.3V), over-voltage tolerant, glitch protection
Secure DSP for Audio
The i.MX RT600 series from NXP is a crossover microcontroller that combines high-performance DSP capabilities with advanced security features. It’s based on a dual-core architecture: an ARM Cortex-M33 core for control and a Cadence Tensilica HiFi4 DSP core for DSP.
Security is a key focus of the MCU, which includes a secure bootloader, hardware cryptographic accelerators (AES, RSA, ECC, SHA), a random number generator, and secure key storage.
The i.MX RT600 is a solution for developers building secure, high-performance embedded systems with audio and signal processing needs.
- Cortex-M33 Control Processor Core
- PowerQuad hardware accelerator forDSP functions
- CASPER Crypto coprocessor
- Cortex-M33 built-in memory protection unit (MPU) supporting eight regions
- Up to 4.5MB of system SRAM accessible by both CPUs and all DMA engines
- Secure execution environment through Arm TrustZone technology for ARMv8-M
- Symmetric key isolation through hardware engines
- Secure boot support implemented in boot ROM
- Certificate-based debug authentication
- Symmetric cryptography (AES) with 256-bit key strength
High-Clock Secure MCU
The RX65N is a 32-bit microcontroller from Renesas based on the proprietary RXv2 core, designed for secure and connected embedded applications. It features Trusted Secure IP (TSIP), a hardware-based security module that provides secure key storage, cryptographic acceleration (AES, RSA, ECC, SHA), and secure boot functionality. It also includes a true random number generator (TRNG) and supports secure firmware updates.
The RX65N has features that make it suitable for applications in industrial automation, smart meters, and building management systems. In addition to its security capabilities, the RX65N offers high performance with clock speeds up to 120MHz and includes a rich set of peripherals. This MCU is a potential solution for developers building secure, networked embedded systems.
- RXv2 Core 120MHz operation (34 CoreMark/mA), single-precision FPU
- 2.7V to 3.6V operation
- Ethernet, USB, CAN, SD host/slave interface, and quad SPI
- Program Flash up to 2MB, SRAM up to 640KB
- SCIg and SCIh with multiple functionalities (up to 11 channels)
- 100-pin to 176-pin packages
- NIST FIPS 140-2 Level 3 CMVP certification
- Encryption engines: AES, TRNG, TDES, RSA, ECC, SHA
- 8 CS areas: 8-, 16-, or 32-bit bus space is selectable per area
Hardware Protection for IoT
The Silicon Labs EFM32 PG28 microcontroller is a high-performance, low-power solution designed for embedded IoT applications. Built around an 80MHz ARM Cortex-M33 core with DSP and floating-point support, it integrates advanced analog, communication, and AI/ML acceleration capabilities for edge inferencing.
The PG28 offers a robust suite of hardware-based protections, including cryptographic acceleration, a true random number generator (TRNG), root of trust and secure loader (RTSL), PUF (Physically Unclonable Function), and unlock countermeasures. These features make the PG28 a strong candidate for applications requiring secure data handling, authentication, and firmware integrity.
- 32-bit 80MHz ARM Cortex-M33 with DSP instruction and floating-point unit
- Up to 1024kB flash program memory
- Up to 256kB RAM data memory
- Analog to Digital Converter (IADC) with 12, 16, or 20-bit output
- 1.71V to 3.8V single power supply
- Hardware Cryptographic Acceleration for AES128/192/256, ChaCha20-Poly1305, SHA-1, SHA-2/256/384/512, ECDSA +ECDH(P-192, P-256, P-384, P-521), Ed25519 and Curve25519, J-PAKE, PBKDF2
- True Random Number Generator (TRNG)
- Secure Boot with (Root of Trust and Secure Loader (RTSL)
- Secure Key Management with PUF
Ultra-Low-Power Security
The STM32U5 series is a 32-bit microcontroller built on the Arm Cortex-M33 core, optimized for ultra-low-power applications with advanced security requirements. It integrates Arm TrustZone technology. This allows developers to isolate sensitive operations such as cryptographic key handling and secure boot from general application code.
The STM32U5 includes a secure bootloader, hardware cryptographic accelerators (AES, RSA, ECC, SHA), and a true random number generator (TRNG). It also supports secure firmware updates, secure key storage, and tamper detectionl.
The STM32U5 is a strong choice for developers building battery-powered devices that require both energy efficiency and robust embedded security.
- ARM 32-bit Cortex-M33 CPU with TrustZone, MPU, DSP, and FPU
- 512KB flash memory with ECC, 2 banks read-while-write
- 274KB SRAM including up to 64KB SRAM with ECC ON
- 1 Octo-SPI memory interface
- SESIP3 and PSA Level 3 Certified Assurance Target
- ARM TrustZone and securable I/Os, memories and peripherals
- Root of Trust
- Secure firmware installation (SFI)
- Secure data storage with hardware-unique key (HUK)
- Secure firmware upgrade support with TF-M
Control and Security
The C2000 F2838x series from Texas Instruments is a high-performance 32-bit microcontroller designed for real-time control applications with integrated security features. It is based on the C28x core and includes a dual-core architecture with an ARM Cortex-M4 subsystem for communications and security. This enables the separation of control and security tasks.
The F2838x includes a hardware AES encryption engine, secure bootloader, secure key storage, and memory protection units. It also supports secure firmware updates and secure debug access. These features make it ideal for applications in automotive systems, industrial drives, and grid infrastructure.
- Two TMS320C28x 32-bit CPUs at 200MHz
- IEEE 754 double-precision (64-bit) Floating Point Unit (FPU), Trigonometric Math Unit (TMU), CRC engine and instructions (VCRC), Fast Integer Division (FINTDIV)
- 512KB (256KW) of flash on each CPU
- 44KB (22KW) of local RAM on each CPU
- 32-channel Micro Direct Memory Access (µDMA) controller
- Connectivity Manager (CM) – Arm Cortex-M4 processor
- Hardware Built-in Self Test (HWBIST)
- Developed for functional safety applications–documentation available to aid ISO 26262 and IEC 61508 system design
- Advanced Encryption Standard (AES) accelerator
PUBLISHED IN CIRCUIT CELLAR MAGAZINE • SEPTEMBER 2025 #422 – Get a PDF of the issue
Sponsor this Article
Curtis Franklin has been a journalist working in the computer and technology fields for more than forty years. From his early career as a columnist at Computer Shopper and the founder of the BYTE Testing Lab, he has covered computing devices from handheld to supercomputing and applications from trivial to life-altering. In 1988, he was the first editor of an exciting startup publication that was then called Circuit Cellar INK. Since then, he has edited and written for publications including ComputerWorld, NetworkWorld, InfoWorld, InformationWeek, and Dark Reading. Most recently, he was Principal Analyst for Cybersecurity Management at Omdia.
Curtis co-wrote one of the first books on podcasting and has been a host or co-host on more than 500 episodes of various podcasts, including hundreds of episodes of This Week in Enterprise Technology, a production of the TWiT Podcast Network.
When not telling stories of computers and the people who make them, Curtis is an amateur radio operator (KG4GWA), an artist, and a Florida Master Naturalist. He’s also active in the maker community, working on the teams that produce Maker Faire Orlando and Maker Faire Miami.
