Skip to main content
Contact Nelix Partner with Nelix
Trust

Secure Boot

A measured chain, not one gate at power-on

Each stage is measured into TrustCore before it runs. The result is a reportable configuration, and authentic but superseded images are refused.

RTL in progress Pre-silicon
Status
RTL in progress
Model
Measured boot with verification
Rollback control
Monotonic counter per release
Recovery
Signed fallback, same measured path
Anchor
TrustCore per-die identity

Design targets · not measured silicon results

Partner with Nelix All mechanisms
Trust domain Trusted compute
Nelix trusted compute domain Floorplan with four nested planes: board domain, package, die, and a central trust island for device identity, measurement and signing. Compute, memory, sensor I/O, metrology, crypto and telemetry route into a ring bus. Only signed data leaves through an attestation export port. Board domain Package Die Die extent Package extent Compute Bounded array Memory Measured store I/O phy Sensor ingress Metrology Sense & sample Crypto Sign & seal Telemetry Signed export Ring bus Trust island Root of trust Key slots Identity · measure · sign Port signed Attestation export Nothing else crosses
  • Trust boundary
  • Supporting logic
  • Signed data in flight
Secure Boot · labelled architecture
Infrastructure equipment in the field conditions this mechanism is designed for
Field condition the mechanism is specified against
PROBLEM

A signature check at reset says nothing about now

Verified boot answers one question at one instant. It leaves no lasting record of what loaded, and a signed but withdrawn image can reopen a fixed hole if anti-rollback is absent.

While running Runtime verification
Continuous runtime verification A conceptual die floorplan for continuous measurement. An always-on measurement engine occupies the left of the die, with a four-phase cycle beneath it: sample, hash, extend, compare. To its right a recessive band shows workload activity in three lanes of uneven task footprints. A sample bus runs under the band and a comb of taps drops from it into a digest chain of linked cells, one per epoch, which the light extends from left to right. One epoch is flagged and re-measured. Beneath the chain the measured history stacks downward in rows that fade as they age, and the chain has no entry from its left end, so the record can only be extended and never rewound. Fresh evidence leaves through a port on the right edge. Operating die · power on Measure engine Always on Sampler Hash macro Every epoch not only at boot Sample Hash Extend Compare Workload activity L0 L1 L2 Sample bus Rolling digest E0 E1 E2 E3 E4 E5 E6 No rewind Re-measure Measured history E6 E5 E4 E3 Fresh quote Measurement continues for as long as the device runs
  • Measured epoch
  • Flagged for re-measure
  • Light = the digest being extended
Boot-time proof goes stale, so measurement continues while the device works and the evidence an operator asks for is always current.
Measure, then hand over · design intent
APPROACH

Measure, then hand over

Each stage is hashed and extended into an append-only register before control transfers. A monotonic counter blocks rollback; a signed recovery image stays on the same measured path.

ORDER OF OPERATIONS

Sequence

Order is the mechanism, and nothing here is optional.

Sequence Secure Boot
The enforced order of operations, 6 steps from first to last Sequence diagram with a trunk on the left edge. Steps in order: Reset; Measure; Verify; Extend; Hand over; Report. Gate ticks sit between steps; the last step is the only exit. Enforced order 01 Reset Immutable boot code inside TrustCore starts first 02 Measure Next stage image is hashed in full before execution 03 Verify Signature and minimum counter value are checked 04 Extend Digest extends into the append-only register 05 Hand over Control transfers; the stage repeats for what it loads 06 Report Accumulated measurement feeds attestation and policy No step may be skipped The enforced order of operations, 6 steps from first to last Sequence diagram with a trunk on the left edge. Steps in order: Reset; Measure; Verify; Extend; Hand over; Report. Gate ticks sit between steps; the last step is the only exit. 01 Reset Immutable boot code inside TrustCore starts first 02 Measure Next stage image is hashed in full before execution 03 Verify Signature and minimum counter value are checked 04 Extend Digest extends into the append-only register 05 Hand over Control transfers; the stage repeats for what it loads 06 Report Accumulated measurement feeds attestation and policy
  • Ordered step
  • Only exit
Each step taps the trunk once; the gates between them are why the order holds.
Semiconductor die macro
Semiconductor die macro
PROPERTIES

What follows from the diagram

  1. Stage-by-stage measurement

    The record covers the whole chain, not only the first image

  2. Append-only register

    Later code cannot rewrite earlier measurements

  3. Anti-rollback counter

    Authentic superseded images fail a monotonic check

  4. Measured recovery

    Fallback boots are distinguishable from normal boots

Engage

Reviewing this mechanism?

The specification can still change. That stops being true after tape-out.

Partner with Nelix All mechanisms
RELATED