{"id":3142,"date":"2022-05-24T04:33:55","date_gmt":"2022-05-24T04:33:55","guid":{"rendered":"https:\/\/www.pufsecurity.com\/?post_type=technology&p=3142"},"modified":"2022-07-27T08:41:07","modified_gmt":"2022-07-27T08:41:07","slug":"secure-boot","status":"publish","type":"technology","link":"https:\/\/www.pufsecurity.com\/zh-hans\/technology\/secure-boot\/","title":{"rendered":"Secure Boot"},"content":{"rendered":"\n

The development of the boot process<\/h2>\n\n\n\n

The booting of a chip is a critical weak point in establishing a Hardware Root of Trust<\/a> for a device\u2019s security architecture. When a secure booting procedure is not adopted, the entire secure boundary of a device can be easily compromised, leaving the chip vulnerable to attack.<\/p>\n\n\n\n

We are now entering the 3rd<\/sup> generation of boot processes. The 1st<\/sup> generation, or the conventional booting process, had the boot code stored without any security protocols in place. The 2nd<\/sup> generation introduced a basic level of protection, by encrypting the boot code. The global key, for decryption, is then injected to protect the firmware. However, the boot code remains externally stored, requiring key management protocols to ensure that the global key is not compromised. The key injection process is typically done during the CP\/FT phase, requiring a secure room and multiple extra security procedures. Between the external key management and injection costs, this can result in up to an extra $2 per unit, added on top of continually rising chip production costs.<\/p>\n\n\n\n

\"3<\/figure>\n\n\n\n

Secure booting represents a generational shift in the approach to chip security by dissecting the process into multiple stages and bringing some of the boot code into the SoC. This allows the system to verify the authenticity of the code stored in the flash memory during the booting stage.<\/p>\n\n\n\n

The Secure Boot Flow procedure<\/h2>\n\n\n\n

The Secure boot flow begins with the first boot code, which is typically stored in the SoC\u2019s ROM. This procedure allows the verification of the first boot code from within the chip, removing the need for any key injection and establishing an inborn root key. This can be used for decryption purposes during the following stage in the protocol.<\/p>\n\n\n\n

\"The<\/figure>\n\n\n\n

The Secure boot flow begins with the first boot code, which is typically stored in the SoCs ROM. This procedure allows the verification of the first boot code from within the chip, removing the need for any key injection and establishing an inborn root key. This can be used for decryption purposes during the following stage in the protocol.<\/p>\n\n\n\n

The next phase of the Secure Boot Flow usually stores the boot code in OTP non-volatile memory, allowing the programming to be completed separately from the chip\u2019s fabrication. This phased procedure of key generation, followed by decryption and verification, extends from hardware to firmware to the operating system and then, in turn, through the installation of each application.<\/p>\n\n\n\n

Phasing the Secure Boot Flow procedure allows each stage\u2019s authentication to be verified in a chain through each of the previous steps, with the chain of trust extending right back to the initial Hardware Root key.<\/p>\n","protected":false},"excerpt":{"rendered":"

The development of the boot process The booting of a ch […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"subjects":[228],"tech-tag":[],"class_list":["post-3142","technology","type-technology","status-publish","hentry","subjects-applications"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/technology\/3142"}],"collection":[{"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/technology"}],"about":[{"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/types\/technology"}],"author":[{"embeddable":true,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/comments?post=3142"}],"version-history":[{"count":8,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/technology\/3142\/revisions"}],"predecessor-version":[{"id":4372,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/technology\/3142\/revisions\/4372"}],"wp:attachment":[{"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/media?parent=3142"}],"wp:term":[{"taxonomy":"subjects","embeddable":true,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/subjects?post=3142"},{"taxonomy":"tech-tag","embeddable":true,"href":"https:\/\/www.pufsecurity.com\/zh-hans\/wp-json\/wp\/v2\/tech-tag?post=3142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}