Connected IoT devices can be found in every aspect of modern digital life, from autonomous and connected vehicles to medical devices, smart meters, and smartwatches.
While exposing a device to the external world, trust needs to be established in the system. Hence, security is fundamental to successful adoption of connectivity. Connected devices operate in an environment where attacks The first step to ensure security at the device level is through secure boot in an IoT-embedded system. can originate from anywhere. Devices must be capable of adapting to an evolving threat landscape. With the exponential increase in connected devices and the value of data stored in them, security has to be multifaceted, “baked-in” from the lowest levels of system-onchip (SoC) design through to the applications that run on them and in communications between devices and services.
The first step to ensure security at the device level is through secure boot in an IoT-embedded system
Secure boot is a process where your OS boot images and code are authenticated against a trusted hardware before they are allowed to be used in the boot process.
The hardware is set up beforehand such that it only authenticates code generated using security credentials you trust.
Secure boot is applicable for any single-use device, something that is not intended to be a general-purpose computing.
Verifying the authenticity of a bootloader is crucial for assuring and executing the rest of the boot process. Verification of the bootloader executable file is done using public/private keys. During secure development, the bootloader is digitally signed with the manufacturer’s private key.
When the bootloader firmware is installed on the device, it is checked against the embedded public key on the device to confirm that it is genuine. The same process is repeated whenever the device boots or installs an update.
Once the bootloader file is checked successfully for authenticity, the secure boot process checks the validity of the operating system and other functional applications. The signed application code is verified against the embedded public key to ensure it is genuine. If the operating system and the applications are assured, they can start running.
The series of steps involved in the secure boot process is depicted below.
To summarize, the device start-up process is initiated by a trusted bootloader file and every phase is run only after the previous phase is verified for authenticity and started successfully.
Secure boot is based on the hardware root of trust offered by OEMs.
