Secure Boot and Trusted Platform Module (TPM) in Embedded System

Secure Boot 

Secure Boot is a security feature involving a combination of software and hardware components working together to ensure that only trusted software is loaded and executed during the boot process.

The software component of Secure Boot includes the bootloader, which is responsible for loading the operating system and other software components. The bootloader typically performs the digital signature verification process, which ensures that the software being loaded is authentic and has not been tampered with.

The hardware component of Secure Boot includes a Root of Trust (RoT), which is a trusted set of hardware components that are used to verify the integrity of the software. The RoT typically consists of a Boot ROM or a Trusted Platform Module (TPM), which is a hardware component that provides cryptographic services and secure storage for keys and other sensitive data. TPMs receive commands and return responses. To take the full benefit of a TPM, you must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. 

The most common threats to Secure Boot can be divided into two categories: Logical threats (e.g., Design error, Service backdoor, Driver weakness) and Hardware threats (e.g., Race condition, Selectable boot source, and Fault injection). 

Logical attacks are more common but easier to resolve, while physical attacks are rarer since they require more effort from an attack but can make all devices in circulation unsecure. 

Fault injection works by introducing glitches while attacking hardware via different means, such as light or time.

It is common for attacks to involve a combination of the two or use one to find a weakness in the other. Therefore, a proper security evaluation offers an independent view of the entire application.

Best Practice for Secure Boot

1. Make your process secure: Implement a good overall security practice everywhere at every time.

2. Keep your encryption strong: Make sure your algorithms are strong and up to date and fit for purpose. 

3. Check your code: For Secure Boot to mean anything, the rest of your code in the bootloader, OS, and other software also must be properly written for Secure Boot, and not have security flaws.  In addition, each stage of the boot process must check the next before executing it. If this isn’t done or only part-way done, there’s much less scope for calling the process secure.

4. Authenticate everywhere: For genuine security, authenticate as much of the code you want to load as possible, and ensure that it follows the practices established for the libraries. Secure Boot can only check the signing, and any signed image can be considered secure by the processor.

5. Confirm the process is authenticating correctly: It’s essential to ensure that your code is genuinely performing the Secure Boot and is authenticating the next step of code in order to maintain security.

Understand U-Boot

U-Boot is an open-source bootloader used in many embedded systems. It is responsible for initializing the hardware and loading the operating system into memory during system boot-up. Here are some of the key concepts that are important to understand when working with U-Boot:

1. U-Boot configuration: U-Boot is highly configurable and can be customized to support a wide range of hardware platforms and operating systems. The configuration is typically stored in a configuration file, which can be edited using a text editor or a menu-driven configuration tool.

2. U-Boot commands: U-Boot includes a set of built-in commands that can be used to interact with the bootloader and perform various system-level tasks. These commands can be entered at the U-Boot command prompt or executed automatically by U-Boot during the boot process.

3. U-Boot environment: U-Boot maintains an environment variable system that can be used to store configuration data, such as network settings, boot arguments, and boot commands. The environment can be accessed and modified using U-Boot commands or by editing the U-Boot environment file.

4. U-Boot drivers: U-Boot includes a set of device drivers that can be used to interface with hardware peripherals such as network adapters, storage devices, and display controllers. These drivers are typically loaded dynamically by U-Boot during the boot process.

5. U-Boot image formats: U-Boot supports several image formats that are used to package the bootloader, kernel, device tree, and other files into a single file that can be loaded into memory during the boot process. These image formats include the Universal Boot Loader (UBL) format, the Bootloader Object File (BOF) format, and the Flat Device Tree (FDT) format.

In summary, U-Boot is a powerful and flexible bootloader that is widely used in embedded systems. Understanding the concepts of U-Boot configuration, commands, environment, drivers, and image formats is essential for working with U-Boot and developing custom boot configurations for embedded systems.

Enable UEFI Secure Boot on U-Boot

Unified Extensible Firmware Interface (UEFI) is a modern replacement for the legacy BIOS (Basic Input/Output System) firmware that is used to initialize and configure hardware during system boot-up. UEFI is now the standard firmware interface for modern computer systems that provides a more advantages (such as larger boot volumes, faster boot time, extensible architecture, GUI, security) and flexible interface for booting modern operating systems. 

UEFI Secure Boot is a security feature that ensures that only authorized code can be loaded and executed during system boot. It requires that all firmware and operating system bootloaders be signed with trusted keys, which are stored in the system firmware.

While U-Boot is a popular bootloader for embedded systems, it does not support UEFI Secure Boot out of the box. However, it is possible to enable UEFI Secure Boot on U-Boot by following these general steps:

1. Obtain a trusted key from a trusted source, such as a certificate authority.

2. Configure U-Boot to support UEFI Secure Boot by enabling the "CONFIG_SECURE_BOOT" option in the U-Boot configuration file.

3. Generate a self-signed UEFI Secure Boot key and certificate by using the "openssl" command-line tool.

// Create 2048 bit key

openssl genrsa -out server.key 2048

// Create certificate directly

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt

// Create CSR for this key...

openssl req -new -key server.key -out server.csr -sha512

// Sign CSR with CA certificate

openssl x509 -req -in server.csr -CA ../root/server.crt -CAkey ../root/server.key -out server.crt -days 365 -sha512 -CAcreateserial -extfile v3.ext

// To sign with a SAN field create a config extension before

echo "authorityKeyIdentifier=keyid,issuer

basicConstraints=CA:FALSE

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

subjectAltName = @alt_names

4. Add the self-signed key and certificate to the U-Boot trusted key database by using the "fw_setenv" command.

5. Sign the U-Boot binary image with the self-signed key and certificate by using the "sbsign" command-line tool.

6. Test the UEFI Secure Boot-enabled U-Boot binary image on the target system to ensure that it can successfully boot.

These are the general steps for enabling UEFI Secure Boot on U-Boot, but the specific steps will depend on the hardware platform and the version of U-Boot being used. It is important to follow best practices for key management and secure boot to ensure the integrity and security of the system.