Secure Embedded Linux Product - A Success Story
summary
Demonstrates a complete, working secure-embedded-Linux stack: UBIFS with CTR-mode encryption patched into the kernel, NAND-aware file systems (UBI/JFFS2), and boot-time sealing using vendor secure-boot/fuse features and Freescale DCP accel for low-overhead crypto. Uses per-device symmetric keys stored via device-tree/device attributes and one-time fuses, yields ~10–20% read slowdown but keeps real-time loops in RAM. Build system integrates signing/encryption and per-unit key provisioning; recovery/fallback requires careful dual-image or bootloader design.
AI-written summary · about
chapters (33)
- 0:00Intro
- 0:14About Martin Bis
- 0:46Secure Embedded Linux
- 1:28Attack Surface
- 2:42Attack Vectors
- 4:40Embedded vs Standard
- 6:28Misuse of Security
- 7:44Common Methods
- 10:02Passive Security
- 10:29The Consumer
- 11:08Hardware becomes cheaper
- 12:44How to do it
- 13:14tivo civilization
- 15:28Hardware methods
- 17:28Examples
- 17:53Layers
- 18:23Paths
- 18:59Secure Data
- 21:02Possible Solutions
- 24:28FLASH
- 24:54UBI
- 26:44Crypto API
- 27:57Crypto App
- 28:54Block Cipher
- 30:23Counter Mode
- 31:39How to use
- 34:44Security is a process
- 37:24Dont trust yourself
- 39:19Multiple keys
- 43:57Encryption
- 46:24Security by obscurity
- 49:04Two keys
- 52:17DCP
related talks
34mAuthenticated and Encrypted Storage on Embedded Linux
45mNavigating Security Tradeoffs in Embedded Linux Systems
42mBecoming a tyrant: Implementing secure boot in embedded devices
32mSecurity Features for UBIFS
49mSecure Boot from A to Z
29mEnabling a secure IoT from design to deployment
45mBuilding a Secure IoT Device
25mSecuring your next 96Boards design using Xilinx Zynq MPSoC