Hardware-Assisted Secure Boot for Edge Devices using Lightweight Cryptographic Verification

Abstract

The recent wave of the Internet of Things (IoT) edge devices has put the relevance of critical security vulnerabilities at the firmware level, where malicious code is authenticating during the process of a system booting up, and it is not even detected. It has implemented software and based security systems, which are not as helpful in preventing such an attack as none of them is triggered after the system itself is operationalized, and perhaps built on hardware provides confidence. The paper provided will recommend a hardware-assisted secure boot framework of resource-restricted edge devices, which safeguards the integrity of the firmware that is being executed before execution. The system is an obfuscation of light and not a very heavy hash algorithm, BLAKE2s of the system that confirms the integrity, and Elliptic Curve Digital Signature Algorithms (ECDSA), which confirms the authenticity. The ESP32 microcontroller developed a hardware root-of-trust, which has a read-only Boot ROM and one-time programmable in public key storage using eFuse, created on the controller. The given configuration can facilitate such aspects as firmware signing, verification, and execution of boot-time choices that cannot permit the unwanted implementation of firmware to more than four types of attacks, among which are direct firmware attacks, unsigned-firmware attacks, eFuse subvert attempts, and roll-back attacks. The experimental tests have been shown to measure usage of all conceit and unattended system firmware in all situations of attacks and generate a mean-time-boost of 31.4 ms with a standard deviation of 1.8 ms of average increase in boot-time of 30 repeat tests of 128 KB firmware binary. P-256 signature checks if it is 19.5 ms (62.1% total overhead), and P-256 signature is the BLAKE2s hash of the whole firmware image, which is 9.3 ms compared with the statement of the lightweight cryptographic pipeline. These results indicate that robust boot-time firmware security is provided to the commodity IoT microcontrollers without our special hardware or external secure firmware.