From Fresh to Secure
🚧 Documentation is under development
The RidgeRun Platform Security Manual guide is currently under active development. Some sections may be incomplete or change without notice.
Questions? Contact RidgeRun or email to support@ridgerun.com.
- Introduction
- General Security Concepts
- Getting Started
- Contact Us
- Sponsor your Favorite Feature
Tutorial: Securing a Platform from Scratch: Step-by-Step Guide
This tutorial walks you through all the steps required to secure your embedded platform from a fresh system install, using the RidgeRun Platform Security Manual as a reference.
A secure platform follows a similar structure to the following:
1. Understand the Security Fundamentals
Before implementation, ensure you're familiar with the building blocks of platform security:
- Root of Trust (RoT): Establishes a trusted base for system validation.
- Secure Boot: Ensures only signed, verified code runs at boot.
- Trusted Execution Environment (TEE): Isolates sensitive operations in a secure CPU region.
- Disk Encryption: Keeps data secure at rest.
- Over-the-Air Updates: Keeps the system updated.
For more information on the fundamentals, please check the Platform Security section.
2. Implement Secure Boot
Secure Boot involves a series of steps. It can be considered the longest process when preparing a secure platform. Nevertheless, ensuring secure boot prevents the system from loading software components that have been altered or come from untrusted sources.
The following steps are required for NVIDIA Jetson:
- Generate cryptographic key pairs: it involves creating certificates and generating keys.
- Burn public key hashes into fuses (irreversible): it involves the use of the Factory Secure Key and Expansion Key Provisioning (FSKP) from NVIDIA and burning the fuses.
- Sign bootloaders and OS components with your private key and flash: it involves signing the bootloader, kernel, and device tree.
- Activating UEFI Secure Boot: involving the generation of the UEFI keys and the UEFI payloads.
3. Set Up a Trusted Execution Environment (TEE)
TEE Overview and Setup
- Compile OP-TEE modules and device tree: Enabling OP-TEE allows critical security components to work, from disk encryption to customer's secure apps.
- Integrate it into the build: flashing the board with the new device tree and modules, which integrate necessary parts to leverage OP-TEE.
It provides a hardware-backed, isolated environment for secure operations.
4. Enable Disk Encryption
NVIDIA Jetson Disk Encryption Setup
- Install tools like
cryptsetup: this tool will help to encrypt the partitions. - Define encrypted partitions (rootfs, data, etc.): select whether a partition should be encrypted or not.
- Generating the EKS image: EKS is a mechanism for securely storing encryption keys, typically used in systems that employ disk or file-level encryption.
- Generate and securely manage encryption keys: generate the keys used to encrypt/decrypt the partitions.
- Implement the changes: the final step is to integrate the changes through flashing.
This ensures your stored data is protected even if the device is compromised.
5. Implement Over-the-Air (OTA) Updates
OTA Security Guide
- Choose and integrate an OTA system (e.g., Mender): The first step is to choose and integrate a method. Mender is used as an example.
- Ensure it supports authentication, rollback, and verification: Authentication and rollback are essential since we want to automate the process of updates.
- Integrate with Secure Boot and TEE to maintain trust throughout the update process: the integration with all the platforms to automate the process will help to update the system and mitigate threats.
6. Add Additional Security Layers
Platform Security Extensions
- Implement Trusted Platform Module (TPM) if hardware supports it: TPM provides a way to provision, process, and store keys.
- Add Kiosk Mode to the platform (optional): Restrict the usage of the platform.
If available:
- Use a secure key management system (e.g., kernel keyring).
- Apply IMA (Integrity Measurement Architecture) for file integrity checking.
7. Test and Validate Your Security Setup
- Verify Secure Boot with unauthorized code tests (in progress)
- Test TEE applications and ensure isolation: create an app and integrate it into the system
- Confirm encryption works by examining partition data externally: check the encryption of the partition.
- Simulate OTA updates to verify rollback and signature validation: test some packages to check that OTA is working.
For detailed instructions and platform-specific steps, refer to the full RidgeRun Platform Security Manual.