Protecting IoT Firmware Before it Reaches the Contract Manufacturer
Silicon Labs Custom Part Manufacturing Service (CPMS) moves critical programming and security provisioning into the Silicon Labs manufacturing environment. Instead of handing a CM an unprotected firmware image, a device maker can use CPMS to provision security controls before parts ever leave Silicon Labs, so the CM receives only what it needs to assemble the product, not the sensitive material behind it.
CPMS can also help reduce cloning and unauthorized production. Customer-specific part numbers and provisioned device identities give manufacturers more visibility into what’s shipped and can help a cloud service distinguish an authentic, provisioned product from a clone that merely copies application firmware.
Extending Protection After IoT Device Deployment With Secure Vault
Once a device leaves the factory, the threat model changes. Physical access, exposed interfaces, and firmware modification all become possible. Silicon Labs Secure Vault™ is an integrated collection of hardware and software security features, including secure boot, secure debug, hardware cryptographic acceleration, and device identity, that help ensure only authorized firmware runs, restrict access to sensitive interfaces, and protect key material even under physical attack.
In 2025, Series 3 Secure Vault on the SiXG301 became the first product reported to achieve PSA Certified Level 4, a certification focused on resistance to sophisticated physical and side-channel attacks.
One Firmware Protection Strategy, Two Critical Stages
CPMS and Secure Vault address different parts of the product lifecycle. Together, they enable a more continuous approach to firmware protection.
During manufacturing: reduce firmware exposure, provision device identity, and limit dependence on the contract manufacturer’s security infrastructure.
After deployment: verify authorized code, protect key material, control debug access, and raise the difficulty of device-level attacks.
Neither technology replaces secure software development, threat modeling, or supply-chain governance. Security is a system property, and the final protection level depends on how silicon, firmware, backend, and operational controls work together.
Designing Secure Firmware for a Lower-Trust World
AI will continue to improve both defensive and offensive engineering. Device makers can’t rely on firmware obscurity, or on the assumption that reverse engineering is too costly to be practical. The stronger approach is to ensure that valuable firmware is not unnecessarily exposed, that devices only execute authorized software, and that keys and identities are protected by hardware-backed controls appropriate to the product’s threat model.
With CPMS and Secure Vault, Silicon Labs helps customers build security into two of the most important stages of an IoT product’s lifecycle: when the device is manufactured, and when it is operating in the field. In an era of faster, more accessible analysis, that end-to-end view is becoming essential. For a deeper technical look at configuring these protections, including how secure boot and secure debug work together to protect firmware during programming, see the CPMS documentation on docs.silabs.com.