At Rambus, we create cutting-edge semiconductor and IP products, spanning memory and interfaces to security, smart sensors and lighting.
Secure Boot
The Rambus Secure Boot solution (formerly from Inside Secure) provides tools for integrating security into an embedded device’s system boot sequence. The Secure Boot solution uses strong cryptography to protect the boot process of SoCs and application processors.
ContactHow the Secure Boot works
The Secure Boot solution protects the device boot sequence by providing the following security layers:
Integrity + Authenticity:
This layer ensures that the system only boots images that are from a trusted source, without any changes introduced to the images. Thus, this layer protects against tampering.
Confidentiality + Anti-Cloning:
This layer protects images from being examined by encrypting the image using strong cryptography. By using product-line specific encryption keys, the protected images are also prevented from being used on other product lines.
Anti-Rollback:
This layer enforces a secure firmware update by protecting against installing of images that are revoked. It prevents a hacker to use an old image with known vulnerabilities, which have been fixed in maintenance updates.
Features
Included Components
- Secure Boot ROM code libraries to embed in the boot loader(s)
- The Secure Boot Image Generation Tool to sign and encrypt the images
Cryptographic Algorithms
- Hash algorithms: SHA-244/SHA-256
- Asymmetric Crypto algorithms: ECDSA (P224 & P256)
- Symmetric Crypto algorithms: AES (128-256)
Support for Rambus Security Cores and Hardware Root of Trust
- Asymmetric Crypto acceleration only:
– PKA-IP-28
– PKA-IP-150 - Symmetric Crypto acceleration only:
– PacketEngine-IP-93 - Asymmetric and Symmetric Crypto acceleration with strict Asset Protection and Rollback protection:
– VaultIP Platform Security Solutions
Support for Certificates
The Secure Boot solution supports use of certificates. The use of certificates allows the creator of the secure boot loader (the chip manufacturer) to delegate the secure boot image signing to device manufacturers. The alternative to using certificates is using multiple boot loader stages.
