Security booting from Serial

Hi,

I've been reading through the documentations available and could not find how to secure somehow when the boot procedure is interrupted with a password.

Anybody with a serial USB cable can change the boot order and use after, the service stick to extract the EMMC image!!!

Many thanks in advanced

Secure booting involves several changes to the image and also firmware at this stage. You can see most of them on https://github.com/siemens/meta-iot2050/ in the master branch when configuring secure boot with secure storage. The feature is almost done but not yet released, therefore also not yet fully documented. Brief summary of the concept:

• establish root of trust from the first-stage loader (SE Boot, that one is already signed and validated on Advanced devices) over TF-A + OP-TEE, U-Boot, unified kernel image (kernel, initramfs, device tree) to dm-verity protected root file system
• encrypt modifiable persistent data on mass storage device via device-specific key
• lock down firmware to only boot signed UEFI payload and to not provide a command line interface anymore
  

Many thanks for the answer.

Do you know when this feature can be officially ready?? I have several units that are going to be installed soon and I'm worried about if someone could backup freely the installed image.

DS