Skip to main content
Contact Nelix Partner with Nelix
Infrastructure controller

InfraCore

Trusted control for critical infrastructure

A secure infrastructure controller for industrial, telecom, government, and sovereign systems requiring attestation, lifecycle security, and deterministic operation. Planned platform, not shipping.

Planned Pre-silicon
Partner with Nelix Product roadmap
Advanced package

Advanced package

Trust domain Trusted compute
Nelix trusted compute domain Floorplan with four nested planes: board domain, package, die, and a central trust island for device identity, measurement and signing. Compute, memory, sensor I/O, metrology, crypto and telemetry route into a ring bus. Only signed data leaves through an attestation export port. Board domain Package Die Die extent Package extent Compute Bounded array Memory Measured store I/O phy Sensor ingress Metrology Sense & sample Crypto Sign & seal Telemetry Signed export Ring bus Trust island Root of trust Key slots Identity · measure · sign Port signed Attestation export Nothing else crosses
  • Trust boundary
  • Supporting logic
  • Signed data in flight
InfraCore · architecture, design intent
ARCHITECTURE

Read the architecture

Each state is entered explicitly, failure is a defined transition rather than an absence, and what is drawn is specified rather than measured.

While running Runtime verification
Continuous runtime verification A conceptual die floorplan for continuous measurement. An always-on measurement engine occupies the left of the die, with a four-phase cycle beneath it: sample, hash, extend, compare. To its right a recessive band shows workload activity in three lanes of uneven task footprints. A sample bus runs under the band and a comb of taps drops from it into a digest chain of linked cells, one per epoch, which the light extends from left to right. One epoch is flagged and re-measured. Beneath the chain the measured history stacks downward in rows that fade as they age, and the chain has no entry from its left end, so the record can only be extended and never rewound. Fresh evidence leaves through a port on the right edge. Operating die · power on Measure engine Always on Sampler Hash macro Every epoch not only at boot Sample Hash Extend Compare Workload activity L0 L1 L2 Sample bus Rolling digest E0 E1 E2 E3 E4 E5 E6 No rewind Re-measure Measured history E6 E5 E4 E3 Fresh quote Measurement continues for as long as the device runs
  • Measured epoch
  • Flagged for re-measure
  • Light = the digest being extended
Boot-time proof goes stale, so measurement continues while the device works and the evidence an operator asks for is always current.
Mechanism context · design intent
MECHANISMS

What holds, and why

  1. Attested operation

    Device identity and runtime state that can be verified before trust is granted

  2. Lifecycle security

    Secure boot and lifecycle controls for long-lived field equipment

  3. Deterministic control

    Control paths designed for environments that cannot tolerate undefined failure

  4. Shared trust foundation

    Built on the same TrustCore architecture as the rest of the platform family

Interposer stack
Interposer stack
DESIGN TARGETS

Specification

Pre-silicon. Architecture specified; RTL in progress; FPGA next. Figures are design targets, not measured silicon results.

InfraCore design targets
Status Planned platform
Target applications Industrial, telecom, government, sovereign systems
Trust anchor TrustCore
Production silicon Not shipping
Where it fits
  • Industrial controllers
  • Telecom infrastructure nodes
  • Government compute appliances
  • Sovereign edge systems
Engage

Talk to the design team

The specification is still open to review.

Partner with Nelix Product roadmap
RELATED