Bootware 1.2 available!

Bootware
1

For those of you who have been waiting, we released Bootware 1.2 last week! It’s a major release, with a ton of new features and ease-of-use improvements.

A/B updates with cryptographic isolation.

  • Keep devices current with frequent operational and security updates.
  • A/B filesystems are cryptographically isolated, including boot artifacts.
  • Updates are supervised by an independent security controller.
  • Roll back to a stable filesystem in case of failed or compromised updates.

Encrypted filesystem and kernel.

  • Data and kernel are encrypted with keys managed in the HSM.
  • Keys are scrubbed upon device penetration to prevent access to data.
  • Works seamlessly with A/B updates.

Automatic recovery from failed updates.

Loss of network access, loss of power and incorrect signatures, are a few common failure modes. When updates fail it is essential that a device has the possibility to recover to some trusted operational state, and preferably without human intervention, remote or local.

Bootware supports three levels of trusted recovery.

  • Failed update of Image-A > revert to Image-B.
  • Failed Image-B > revert to Safe Recovery mode.
  • Failed Safe > revert to user intervention.

Signed images and updates.

  • Only devices with the correct HSM keys will be able to authenticate the source and pull these secure updates.

Key storage in secure silicon.

  • Cryptographic keys are created, managed and stored in a special purpose secure element with grid protection.
  • Logical and physical access is restricted through multiple layers of cryptography, hardware and tamper sensors.

Supervised boot with user defined artifacts.

  • Zymbit S2, S3 level devices use an independent security controller to supervise the boot process.
  • Boot artifacts are individually verified for integrity and authenticity against a user defined manifest.
  • Security policies can be put in place to prevent failed and compromised updates.

Seamless integration with Raspberry Pi OS and Ubuntu.

  • Push secure updates to systems with Debian based OS.
  • Support for custom kernel builds.
  • Switch between Bullseye and Ubuntu 22.04 during development.

Supported on Zymbit secure compute products