Steps to Evaluate and Protect Secure Boot Implementation on Embedded Devices
White Papers
The majority of mobile, embedded, and Internet of Things (IoT) systems implement some form of Secure Boot to preserve the integrity, protect sensitive content and operations on a device, and reduce chances of a severe compromise of a system. Smartphones and tablets, IoT devices, industrial automation systems, game consoles, and other solutions rely on Secure Boot: a critical method of setting the chain of trust.
Although Secure Boot alone does not guarantee reliable protection from all types of attacks on devices, its compromise proves to be the most damaging, leading to risks of financial, reputational, and legal damage for a vendor. Existing requirements for immunity of Secure Boot are high, yet security experts at Riscure, a Keysight company, typically find serious vulnerabilities in the majority of implementations during the first stage of security evaluation.
This paper reveals common weaknesses in Secure Boot implementations and proposes practical steps to enhance security of this critical element of an embedded system.