Design and Implementation of a Security Architecture for Critical Infrastructure
summary
GE claims responsibility for over 50% of global power generation and prototypes a cross-architecture security stack running on x86, PPC and ARM that uses TPM-backed measured boot, kernel IMA and encrypted disks tied to TPM keys. Reference implementation includes tboot extended to support AMD, IMA appraisal, a Predix cloud attestation server and a demo that blocks unsigned binaries even as root and detects kernel tampering when the TPM quote fails. Remaining gaps include TPM2 support, u-boot TPM drivers, container IMA namespacing and long‑lived CA/key migration for 30–35 year devices.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:50Power Generation
- 2:25Cyberattacks
- 4:15Industrial Internet
- 7:16Information Insurance Framework
- 7:59Reference Implementation
- 12:06Types of Secure Boot
- 13:30Control Embedded Control Systems
- 28:38Tboot
- 30:58Concept
- 31:45Logging in
- 32:36Kernel Backdoor
related talks
51mSecuring Embedded Linux Systems with TPM 2.0
51mApplications of TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
24mSecure architectures for the IoT
21mIndustrial IoT security issues and countermeasures
29mEnabling a secure IoT from design to deployment
59mLayered Attestation of a Cross-Domain System
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers