Hardware Root of Trust
XAPP1309 (v1.0) March 7, 2017
7
www.xilinx.com
Figure 5
shows three possible system setups. The strongSwan software running on an Ubuntu
server does both the remote attestation and the network security. The Ethernet connection can
be either direct from the PC to the Avnet board or dynamic host configuration protocol (DHCP)
using Ethernet wall sockets. In (a), the server is run on an Ubuntu installation on either
VirtualBox or VMware on the PC. In (b), an Ubuntu-based PC runs the strongSwan server. In (c),
the server runs on an Amazon web server (AWS). Xilinx does not provide the AWS account.
The reference system provides methods for a measured boot of a single client, providing
remote attestation of early load software (BootROM, FSBL) which is new functionality for
embedded systems. An actual connected system has multiple embedded devices, and the
strongSwan server measures all Linux partitions loaded, not just the early load software.
Hardware Root of Trust
In Zynq-7000 AP SoCs, the HROT is based on the first code executed by the ARM® CPU0 at
power-on. The code is stored in on-chip, metal-masked ROM, and is referred to as BootROM
code. BootROM code is immutable, and its principle function is to perform device initialization
and load the FSBL into read/writable on-chip memory (OCM). Neither the BootROM nor the
OCM are accessible at device pins. The BootROM Configuration Flowchart figure in
Zynq-7000
All Programmable SoC Technical Reference Manual
(UG585)
[Ref 1]
provides the flow of the
BootROM code functionality. If secure boot is specified, the BootROM authenticates the FSBL
using the RSA-2048 standard prior to execution of the FSBL. The Zynq-7000 AP SoC HROT is
enhanced by adding a TPM to the embedded platform. The TPM provides partition
measurements, cryptographic functions, and secure key storage for keys used by the Zynq-7000
AP SoC.
X-Ref Target - Figure 5
Figure 5:
Reference System Hardware Setup Options
Laptop
Virtual Box
Ubuntu
strongSwan
IIoT
Starter Kit
Laptop
Ubuntu
strongSwan
IIoT Starter Kit
Laptop
AWS
strongSwan
IIoT
Starter Kit
(a)
(b)
(c)
MicroZed
MicroZed
MicroZed
730
730
730
Server
Client
X18732-030617
