ESP-IDF ESP-TEE 安全服务演示TEE CLI 应用的配置、构建与实战指南【免费下载链接】esp-idfEspressif IoT Development Framework. Official development framework for Espressif SoCs.项目地址: https://gitcode.com/GitHub_Trending/es/esp-idf导读本文档围绕 ESP-IDF 仓库中 components/esp_tee/test_apps/tee_cli_app/README.md 展开详细介绍基于乐鑫 ESP-TEETrusted Execution Environment框架的 CLI 演示应用——tee_cli_app。该应用把 TEE 的远程证明Attestation、安全存储Secure Storage与 TEE/REE 双镜像 OTA三大核心安全服务封装为一条条可交互的串口命令帮助开发者在一台支持 TEE 的开发板上零门槛体验可信执行环境能力。读完本文你将掌握如何为目标芯片配置 TEE 安全存储模式与 eFuse 密钥、如何在无 HMAC 外设如 ESP32-C61与有 HMAC 外设两类芯片上正确烧录密钥、如何通过串口命令完成 EAT 令牌签发、ECDSA 签名验签、AES-256-GCM 加解密以及 HTTPS 驱动的 TEE/REE OTA 全流程。一、示例概览与支持目标tee_cli_app位于 components/esp_tee/test_apps/tee_cli_app是 ESP-TEE 组件components/esp_tee自带的 CLI 演示工程工程版本为1.0.0见 version.txt。它把若干 TEE 安全服务封装成串口控制台命令覆盖三类典型 TEE 能力实体证明Entity Attestation生成并输出由 TEE 签名的 EAT 令牌安全存储Secure Storage密钥生成、ECDSA 签名/验签、AES-GCM 加解密OTA 更新分别升级 TEE 镜像与用户REE应用镜像。原文档声明支持的芯片目标如下Supported TargetsESP32-C5ESP32-C6ESP32-C61ESP32-H2即任何搭载支持 TEE 框架的乐鑫 SoC 的开发板均可运行本示例详见下方“支持的芯片”表。从工程构建配置看CMakeLists.txt该工程启用了MINIMAL_BUILD只编译main及其依赖组件属于精简的演示型工程默认分区表为CONFIG_PARTITION_TABLE_TWO_OTA_TEE见 sdkconfig.defaults即包含两个 OTA 槽位、同时容纳 TEE 与用户应用的定制分区布局。二、工程配置与关键 Kconfig 选项2.1 目标芯片设置与 menuconfig开始配置与构建前务必先用idf.py set-target指定正确的芯片目标idf.py set-target chip_name随后打开配置菜单idf.py menuconfig本示例涉及的核心配置项集中在ESP-TEE (Trusted Execution Environment) → Secure Services菜单下。2.2 证明令牌签名密钥 ID在ESP-TEE (Trusted Execution Environment) → Secure Services → Attestation: Secure Storage key ID for EAT signing处配置安全存储密钥 IDTEE 将使用该 ID 对应的 ECDSA 密钥对为证明令牌EAT签名。对应 Kconfig 选项为SECURE_TEE_ATT_KEY_STR_ID其开关由SECURE_TEE_ATTESTATION控制见 Kconfig.projbuild。只有当CONFIG_SECURE_TEE_ATTESTATIONy时app_main中才会注册tee_att_info命令见 app_main.c。2.3 安全存储模式Development / Release在ESP-TEE (Trusted Execution Environment) → Secure Services → Secure Storage: Mode处选择 NVS XTS-AES 加密密钥的派生方式对应SECURE_TEE_SEC_STG_MODEchoice 选项Kconfig.projbuildDevelopment开发模式加密密钥直接内嵌在 ESP-TEE 固件中所有实例完全一致。适合开发调试但不具备生产安全性Release发布模式加密密钥通过 eFuse 中烧录的密钥派生由CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID指定 eFuse 密钥 ID。在该模式下手动指定 eFuse 密钥 ID 的路径为ESP-TEE (Trusted Execution Environment) → Secure Services → Secure Storage: eFuse HMAC key ID for storage encryption keys。运行应用前用户必须先把所需密钥烧入配置好的 eFuse 块具体步骤见下文。[!IMPORTANT] 对于无 HMAC 外设的目标芯片如 ESP32-C61烧录密钥到 eFuse 时必须不要标记为读保护务必使用--no-read-protect标志。若密钥被读保护TEE 将无法访问它。但这并不会削弱安全性APM 外设本身已阻止软件访问该密钥REE 侧任何非法的读写尝试都会触发 fault。三、eFuse 密钥烧录Release 模式前置步骤Release 模式下必须先把随机密钥写入 eFuse。根据芯片是否有 HMAC 外设烧录命令不同。3.1 无 HMAC 外设的芯片如 ESP32-C61# 生成 32 字节随机密钥 openssl rand -out hmac_key_file.bin 32 # 将 USER 用途密钥256 位烧入 eFuse # 其中 BLOCK_KEYx 是 BLOCK_KEY0 ~ BLOCK_KEY5 之间的空闲 eFuse 密钥块 espefuse -p PORT burn-key --no-read-protect BLOCK_KEYx hmac_key_file.bin USER关键点--no-read-protect必须保留否则 TEE 无法读取密钥而安全性由 APM 外设的访问控制保证。3.2 有 HMAC 外设的芯片# 生成 32 字节随机 HMAC 密钥 openssl rand -out hmac_key_file.bin 32 # 将 HMAC 密钥256 位烧入 eFuse # 其中 BLOCK_KEYx 是 BLOCK_KEY0 ~ BLOCK_KEY5 之间的空闲 eFuse 密钥块 espefuse -p PORT burn-key BLOCK_KEYx hmac_key_file.bin HMAC_UP注意命令中的PORT需替换为实际串口端口名BLOCK_KEYx需替换为具体的空闲密钥块编号。eFuse 属于一次性可编程OTP存储烧录前请确认所选块未被占用。四、构建、烧录与运行构建工程并烧录到开发板随后启动串口监视器查看输出# 将 PORT 替换为要使用的串口名称 idf.py -p PORT flash monitor退出串口监视器按Ctrl-]。完整的 ESP-IDF 环境配置与工程构建步骤可参考仓库根目录的Getting Started指南见 docs/zh_CN 下的入门文档。4.1 启动日志与命令帮助应用启动后会打印提示信息并进入交互式控制台输入help可查看全部已注册命令I (627) app_start: Starting scheduler on CPU0 I (632) main_task: Started on CPU0 I (632) main_task: Calling app_main() I (632) example: ESP-TEE: Secure services demonstration Type help to get the list of commands. Use UP/DOWN arrows to navigate through command history. Press TAB when typing command name to auto-complete. I (702) main_task: Returned from app_main() esp32c6 help wifi_connect [--timeoutt] ssid [pass] Join WiFi AP as a station --timeoutt Connection timeout, ms ssid SSID of AP pass PSK of AP tee_ota url Initiate TEE app OTA url URL for fetching the update user_ota url Initiate User app OTA url URL for fetching the update tee_att_info Dump the TEE-generated entity attestation token get_msg_sha256 msg Get the SHA256 digest for the given message msg Message for SHA256 digest calculation tee_sec_stg_gen_key key_id key_type Generate and store a new key of the specified type with the given ID key_id TEE Secure storage key ID key_type Key type (0: AES256, 1: ECDSA_SECP256R1) tee_sec_stg_sign key_id msg_sha256 Sign a message using the ECDSA keypair stored with the given key ID and verify the signature key_id TEE Secure storage key ID msg_sha256 SHA256 digest of the message to be signed and verified tee_sec_stg_encrypt key_id plaintext Encrypt data using AES-GCM key with the given ID from secure storage key_id TEE Secure storage key ID plaintext Plaintext to be encrypted tee_sec_stg_decrypt key_id ciphertext iv tag Decrypt data using AES-GCM key with the given ID from secure storage key_id TEE Secure storage key ID ciphertext Ciphertext to be decrypted iv AES-GCM initialization vector tag AES-GCM authentication tag help [string] [-v 0|1] Print the summary of all registered commands if no arguments are given, otherwise print summary of given command. string Name of command -v, --verbose0|1 If specified, list console commands with given verbose level4.2 命令注册逻辑源码视角从 app_main.c 可以看到命令的注册是条件编译的wifi_connect、tee_ota、user_ota仅在CONFIG_SOC_WIFI_SUPPORTED时注册tee_att_info仅在CONFIG_SECURE_TEE_ATTESTATION时注册get_msg_sha256与安全存储四命令始终注册。因此若目标芯片不支持 WiFi或未开启证明服务help输出中对应命令将不出现。此外控制台初始化支持 UART、USB-CDC、USB-Serial-JTAG 三种后端工程根据CONFIG_ESP_CONSOLE_*自动选择。五、Secure Services 详解与实测输出5.1 Attestation远程证明tee_att_info命令由证明服务提供其作用为生成并输出一份由 TEE 签名的Entity Attestation TokenEAT。令牌使用 TEE 安全存储中、以配置的密钥 ID 存储的ECDSAsecp256r1曲线密钥签名。其实现位于 tee_srv_att.c先用esp_fill_random生成 32 字节认证挑战PSA_INITIAL_ATTEST_CHALLENGE_SIZE_32再调用 PSA APIpsa_initial_attest_get_token_size查询缓冲区大小最后通过psa_initial_attest_get_token生成令牌并以日志形式输出。示例输出tee_att_infoesp32c6 tee_att_info I (8180) tee_attest: Attestation token - Length: 1705 I (8180) tee_attest: Attestation token - Data: {header:{magic:44fef7cc,encr_alg:,sign_alg:ecdsa_secp256r1_sha256,key_id:tee_att_key0},eat:{auth_challenge:dcb9b53143ad6b081dad1a05c7ebda4e314d388762215799cf24ed52e9387678,client_id:262974944,chip_id:13,device_ver:0,ueid:{mac:d885ac67c978,optional_id:94fa4d7e305682714d48e7bbd710c961},device_id:cd9c173cb3675c7adfae243f0cd9841e4bce003237cb5321927a85a86cb4b32e,instance_id:9616ef0ecf02cdc89a3749f8fc16b3103d5100bd42d9312fcd04593baa7bac64,psa_cert_ref:0716053550477-10100,device_status:165,sw_claims:{tee:{type:1,ver:v0.3.0,idf_ver:v5.1.4-241-g7ff01fd46f-dirty,secure_ver:0,part_chip_rev:{min:0,max:99},part_digest:{type:0,calc_digest:94536998e1dcb2a036477cb2feb01ed4fff67ba6208f30482346c62bca64b280,digest_validated:true,sign_verified:true}},app:{type:2,ver:v0.1.0,idf_ver:v5.1.4-241-g7ff01fd46f-dirty,secure_ver:0,part_chip_rev:{min:0,max:99},part_digest:{type:0,calc_digest:3d4c038fcec76852b4d07acb9e94afaf5fca69fc2eb212a32032d09ce5b4f2b3,digest_validated:true,sign_verified:true,secure_padding:true}},bootloader:{type:0,ver:,idf_ver:,secure_ver:-1,part_chip_rev:{min:0,max:99},part_digest:{type:0,calc_digest:1bef421beb1a4642c6fcefb3e37fd4afad60cb4074e538f42605b012c482b946,digest_validated:true,sign_verified:true}}}},public_key:{compressed:02039c4bfab0762af1aff2fe5596b037f629cf839da8c4a9c0018afedfccf519a6},sign:{r:915e749f5a780bc21a2b21821cfeb54286dc742e9f12f2387e3de9b8b1a70bc9,s:1e583236f2630b0fe8e291645ffa35d429f14035182e19868508d4dac0e1a441}}令牌内部结构包含头部魔术字、签名算法、签名密钥 ID、EAT 载荷认证挑战、client_id、chip_id、ueid、device_id、instance_id、psa_cert_ref、软件声明sw_claims——含 TEE/App/Bootloader 三部分的版本、分区摘要与签名验证状态以及压缩公钥与 ECDSA 签名(r, s)。这份令牌可用于向服务端证明设备身份与固件完整性。5.2 Secure Storage安全存储TEE 安全存储服务提供以下命令tee_sec_stg_gen_key以指定 ID 在 TEE 安全存储中生成并保存新密钥ECDSA 或 AEStee_sec_stg_sign使用指定 ID 的 ECDSAsecp256r1密钥对消息签名并验证签名tee_sec_stg_encrypt使用指定 ID 的 AES256-GCM 密钥加密数据输出密文与认证标签tee_sec_stg_decrypt使用指定 ID 的密钥与标签对密文解密并进行完整性校验get_msg_sha256计算消息的 SHA256 摘要可作为tee_sec_stg_sign的输入。从 tee_srv_sec_str.c 的源码可知底层实现细节tee_sec_stg_gen_key先调用esp_tee_sec_storage_clear_key清理旧密钥ESP_ERR_NOT_FOUND可接受再调用esp_tee_sec_storage_gen_key生成新密钥key_type取0表示 AES256、1表示 ECDSA_SECP256R1tee_sec_stg_sign要求输入恰好 64 个十六进制字符的 SHA256 摘要签名后调用esp_tee_sec_storage_ecdsa_get_pubkey导出非压缩公钥并通过 PSApsa_verify_hash在本地验签详见 tee_srv_sec_str.c加密使用 AES-256-GCMIV 固定为 12 字节AES256_GCM_IV_LEN、认证标签 16 字节AES256_GCM_TAG_LEN明文/密文最长 256 字节MAX_AES_PLAINTEXT_LEN且输入需为偶数字节长度的十六进制字符串。示例输出tee_sec_stg_gen_key get_msg_sha256 tee_sec_stg_signesp32c6 tee_sec_stg_gen_key ecdsa_p256_k0 1 I (2964) tee_sec_stg: Generated ECDSA_SECP256R1 key with ID ecdsa_p256_k0 esp32c6 get_msg_sha256 hello world I (3984) tee_sec_stg: Message digest (SHA256) - b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 esp32c6 tee_sec_stg_sign ecdsa_p256_k0 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 I (5384) tee_sec_stg: Generated signature - 944684f6ddcf4c268ac6b65e34ccb8d95bd2849567a87867101bc1f09208f0885d935d7b3ba9d46014f28e4c7c988d68c775431fcb2cb2d4ca5c6862db771088 I (6404) tee_sec_stg: Public key (Uncompressed) - 04a515bf1c43766cc34980dd6934b9ff54fd3d5d70fe7a694b1fea7a0bbc74434d008c7c3117ce0a5216ffdb2b807f2668cce9c973d524c038ab47b4344064dbbf I (6444) tee_sec_stg: Signature verified successfully!示例输出tee_sec_stg_gen_key tee_sec_stg_encrypt tee_sec_stg_decryptesp32c6 tee_sec_stg_gen_key aes256_k0 0 I (2784) tee_sec_stg: Generated AES256 key with ID key0 esp32c6 tee_sec_stg_encrypt aes256_k0 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 I (3084) tee_sec_stg: Ciphertext - f72e44dda3b2d0a44ffc8cafd2f28b7933776dce78684c5514f9398daf3dc344 I (3294) tee_sec_stg: IV - ef5c08c05828cf933440f121 I (3594) tee_sec_stg: Tag - 826a2e65f0e1d8aede1fb12e78957f0d esp32c6 tee_sec_stg_decrypt aes256_k0 f72e44dda3b2d0a44ffc8cafd2f28b7933776dce78684c5514f9398daf3dc344 ef5c08c05828cf933440f121 826a2e65f0e1d8aede1fb12e78957f0d I (4314) tee_sec_stg: Decrypted plaintext - b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9实际使用中加密命令产生的IV与Tag必须原样传入解密命令二者任一被篡改都会导致解密失败——这正是 GCM 认证加密的完整性保护体现。5.3 Over-the-Air updatesOTA 升级TEE/REE OTA 服务演示了如下工作流通过wifi_connect命令连接 WiFi 网络通过tee_ota/user_ota命令从给定 URL 拉取新应用镜像分别发起 TEE/REE OTA 更新。实现层面tee_srv_ota.cTEE OTA 走esp_tee_ota_begin/esp_tee_ota_write/esp_tee_ota_end三阶段 API逐块256 字节缓冲下载写入并校验镜像头的chip_id与目标芯片一致完成后调用esp_restart()重启用户应用 OTA 直接复用esp_https_ota标准组件两者通过一个二值信号量s_ota_mgmt互斥确保同一时刻只有一个 OTA 流程在运行tee_srv_ota.cHTTPS 连接统一挂载esp_crt_bundle_attach证书包工程通过CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE把 test_certs/server_cert.pem 编译进固件用于测试见 sdkconfig.defaults示例级配置Kconfig.projbuild提供EXAMPLE_SKIP_COMMON_NAME_CHECK跳过服务器证书 CN 字段校验与EXAMPLE_OTA_RECV_TIMEOUTOTA 接收超时默认 5000ms示例默认配置覆盖为 30000ms。示例输出wifi_connectesp32c6 wifi_connect myssid mypassword I (498) connect: Connecting to myssid I (498) pp: pp rom version: 5b8dcfa I (508) net80211: net80211 rom version: 5b8dcfa I (518) wifi_init: rx ba win: 6 I (518) wifi_init: tcpip mbox: 32 I (518) wifi_init: udp mbox: 6 I (518) wifi_init: tcp mbox: 6 I (528) wifi_init: tcp tx win: 5760 I (528) wifi_init: tcp rx win: 5760 I (538) wifi_init: tcp mss: 1440 I (538) wifi_init: WiFi IRAM OP enabled I (538) wifi_init: WiFi RX IRAM OP enabled I (548) phy_init: phy_version 290,81efd96,May 8 2024,10:42:13 W (598) wifi:(bf)761:0x600a7cac:0x01b4b4b0 W (598) wifi:(agc)0x600a7128:0xd2173800, min.avgNF:0xce-0xd2(dB), RCalCount:0x173, min.RRssi:0x800(-128.00) W (608) wifi:(TB)WDEV_PWR_TB_MCS0:19 W (608) wifi:(TB)WDEV_PWR_TB_MCS1:19 W (608) wifi:(TB)WDEV_PWR_TB_MCS2:19 W (608) wifi:(TB)WDEV_PWR_TB_MCS3:19 W (618) wifi:(TB)WDEV_PWR_TB_MCS4:19 W (618) wifi:(TB)WDEV_PWR_TB_MCS5:19 W (618) wifi:(TB)WDEV_PWR_TB_MCS6:18 W (628) wifi:(TB)WDEV_PWR_TB_MCS7:18 W (628) wifi:(TB)WDEV_PWR_TB_MCS8:17 W (628) wifi:(TB)WDEV_PWR_TB_MCS9:15 W (648) wifi:(TB)WDEV_PWR_TB_MCS10:15 W (648) wifi:(TB)WDEV_PWR_TB_MCS11:15 W (1328) wifi:ba-addidx:0, ifx:0, tid:0, TAHI:0x1008fe0, TALO:0xc7e45510, (ssn:0, win:64, cur_ssn:0), CONF:0xc0000005 I (6358) esp_netif_handlers: sta ip: 192.168.1.30, mask: 255.255.255.0, gw: 192.168.1.1 I (6358) event_handler: got ip:192.168.1.30 I (6368) connect: Connectedwifi_connect的实现位于 tee_cmd_wifi.c参数--timeout可选默认 15000msWiFi 断开事件会自动重连获得 IPIP_EVENT_STA_GOT_IP后置位连接事件位。示例输出tee_otaesp32c6 tee_ota https://192.168.1.1:4443/esp_tee/esp_tee.bin I (5884) ota_with_tee: Starting TEE OTA... esp32c6 I (1066394) esp-x509-crt-bundle: Certificate validated I (7424) ota_with_tee: esp_tee_ota_begin succeeded I (7904) ota_with_tee: Connection closed I (7904) ota_with_tee: esp_tee_ota_write succeeded I (7904) ota_with_tee: Total binary data written: 118784 I (8064) ota_with_tee: esp_tee_ota_end succeeded I (8064) ota_with_tee: Prepare to restart system!示例输出user_otaesp32c6 user_ota https://192.168.1.1:4443/tee_cli.bin I (2388) ota_with_tee: Starting User OTA task... I (2388) ota_with_tee: Attempting to download update from https://192.168.1.1:4443/tee_cli.bin I (2438) esp-x509-crt-bundle: Certificate validated esp32c6 I (62888) esp_https_ota: Starting OTA... I (2888) esp_https_ota: Writing to partition subtype 17 at offset 0x1f0000 I (37338) esp_image: segment 0: paddr001f0020 vaddr420e0020 size2ecc0h (191680) map I (37368) esp_image: segment 1: paddr0021ece8 vaddr40811000 size01330h ( 4912) I (37378) esp_image: segment 2: paddr00220020 vaddr42020020 sizeb88b0h (755888) map I (37518) esp_image: segment 3: paddr002d88d8 vaddr40812330 size14488h ( 83080) I (37538) esp_image: segment 4: paddr002ecd68 vaddr408267c0 size032c0h ( 12992) I (37538) esp_image: segment 5: paddr002f0030 vaddr00000000 size0ffa0h ( 65440) I (37568) esp_image: Verifying image signature... I (37568) secure_boot_v2: Take trusted digest key(s) from eFuse block(s) I (37568) secure_boot_v2: #0 app key digest #0 trusted key digest I (37578) secure_boot_v2: Verifying with RSA-PSS... I (37638) secure_boot_v2_rsa: Signature verified successfully! I (37648) esp_image: segment 0: paddr001f0020 vaddr420e0020 size2ecc0h (191680) map I (37678) esp_image: segment 1: paddr0021ece8 vaddr40811000 size01330h ( 4912) I (37678) esp_image: segment 2: paddr00220020 vaddr42020020 sizeb88b0h (755888) map I (37828) esp_image: segment 3: paddr002d88d8 vaddr40812330 size14488h ( 83080) I (37848) esp_image: segment 4: paddr002ecd68 vaddr408267c0 size032c0h ( 12992) I (37848) esp_image: segment 5: paddr002f0030 vaddr00000000 size0ffa0h ( 65440) I (37868) esp_image: Verifying image signature... I (37878) secure_boot_v2: Take trusted digest key(s) from eFuse block(s) I (37878) secure_boot_v2: #0 app key digest #0 trusted key digest I (37888) secure_boot_v2: Verifying with RSA-PSS... I (37948) secure_boot_v2_rsa: Signature verified successfully! I (37998) ota_with_tee: OTA Succeed, Rebooting...从user_ota日志可见应用镜像下载后经过secure_boot_v2的 RSA-PSS 签名验证验证通过后才重启——说明示例默认配置开启了安全启动CONFIG_SECURE_BOOT_FLASH_BOOTLOADER_DEFAULTy见 sdkconfig.defaults。六、本地 HTTPS 服务器OTA 镜像托管辅助脚本components/esp_tee/test_apps/tee_cli_app/https_server.py 是 OTA 服务的辅助脚本。执行python https_server.py即可启动一个本地 HTTPS 服务器使用 test_certs 目录下的测试证书并托管build目录中的 TEE 与 REE 生成产物。脚本帮助信息如下python https_server.py --help usage: https_server.py [-h] [--certfile CERTFILE] [--keyfile KEYFILE] [--port PORT] [--path PATH] Start a local HTTPS server. options: -h, --help show this help message and exit --certfile CERTFILE Path to the SSL certificate file (default: test_certs/server_cert.pem) --keyfile KEYFILE Path to the SSL key file (default: test_certs/server_key.pem) --port PORT Port number to bind the server to (default: 4443) --path PATH Path to the directory to serve files from (default: build directory) E.g., python https_server.py --certfile test_certs/server_cert.pem --keyfile test_certs/server_key.pem --port 8070 --path build典型用法先构建工程生成build下的镜像再启动服务器python https_server.py --port 4443 --path build然后在设备端执行esp32c6 tee_ota https://192.168.1.1:4443/esp_tee/esp_tee.bin esp32c6 user_ota https://192.168.1.1:4443/tee_cli.bin注意示例固件默认内嵌了test_certs/server_cert.pem作为证书包CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH故服务器需使用配套的 server_key.pem 私钥测试证书仅供开发验证切勿用于生产环境。七、进阶资料与测试配置安全启动签名密钥工程目录下的 test_keys 提供了 ECDSA-P256 与 RSA-3072 两套签名密钥配合secure_boot_v2使用CI 测试配置sdkconfig.ci.default、sdkconfig.ci.release、sdkconfig.ci.minimal_tee、sdkconfig.ci.sb_fe等文件见 tee_cli_app 目录分别覆盖默认、Release 安全存储模式、最小 TEE、安全启动 Flash 加密等测试场景自动化测试pytest_tee_cli.py 以 pytest 方式驱动 CLI 命令可参考它编写针对安全服务的自动化回归用例底层 APITEE 侧的服务接口如esp_tee_sec_storage_*、esp_tee_ota_ops.h位于 ESP-TEE 子工程 components/esp_tee/subproject/components其中 tee_sec_storage/include/esp_tee_sec_storage.h 定义了安全存储相关数据结构与 API 原型tee_ota_ops/include/esp_tee_ota_ops.h 定义了 TEE OTA 三阶段接口。八、总结tee_cli_app是一份将 ESP-TEE 三大安全能力证明、安全存储、双镜像 OTA打包成交互式命令的完整参考实现。通过本文可以完整复现其环境从set-target、menuconfig选择安全存储模式与证明密钥 ID到区分有无 HMAC 外设两种场景烧录 eFuse 密钥再到flash monitor后逐一执行tee_att_info、tee_sec_stg_*、tee_ota/user_ota命令观察安全服务行为。结合 app_main.c 的条件注册逻辑、tee_srv_sec_str.c 的 PSA 密码学调用以及 tee_srv_ota.c 的 OTA 状态机开发者可以快速理解 ESP-TEE 的服务边界与编程模型并以此为模板在自己的产品中集成可信执行环境能力。【免费下载链接】esp-idfEspressif IoT Development Framework. Official development framework for Espressif SoCs.项目地址: https://gitcode.com/GitHub_Trending/es/esp-idf创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
