Smart, inter-connected devices are chaining worldwide networks into configurable services. However, this new avenue is prone to security and trust challenges, leaving the chain as good as its weakest link.

To make an embedded product safe from malicious attacks the hardware and software present in the device must work together to enable robust security countermeasures.

This solution brief tries to

  • Propose Challenges and Approach for delivering proactive security to withstand known and zero-day attacks.
  • Define Architecture, Security, and Device Maintenance for an ARM 64 based secure gateway reference design (Cybersecurity @edge) using Cavium™ Octeon Tx (81xx) SoC and MontaVista’s Carrier Grade eXpress (CGX) Linux.

MontaVista Carrier Grade eXpress provides necessary software tools and supports to help custom designs, by:

  • Confidentiality: Enabling “Root of Trust”, with “Secure Boot” & “Secure Update” using Hardware (TrustZone TEE, TPM) for encryption key management. Network Security features (SSH, IPSEC, Firewalls & DPI including platform-specific Hardware Off-loads) and/or “Block Level” encryption using dm_crypt rootFS.
  • Integrity: Integrity here means not just unchanged, but "unchangeable", or "immutable" and it requires a system-wide “Root of Trust” to ensure this. Linux Kernel security subsystem provides for an Integrity Measurement Architecture (IMA), which focuses on the validation of file integrity before these files are loaded (and perhaps executed). Alongside IMA is the Extended Verification Module (EVM) subsystem, which provides protection against tampering the hashes themselves
  • Access-Control: Linux Kernel Security (SELinux vs AppArmor vs Grsecurity) provide a mechanism for supporting access control security policies, including Mandatory Access Control (MAC). In addition, MontaVista CGX incorporates continuous Vulnerability (CVEs) tracking and updating to ensure a hardened Linux distribution that is regularly maintained.