Secure boot, TEEs, different OSes and more
summary
Oniro implements a unified secure-boot and TEE approach across architectures by using UEFI on x86, U-Boot/EBBR on ARM and integrating OP-TEE to store UEFI variables (and OP-TEE/TEE support for enclaves). A software TPM running in QEMU validates workflows during development. The design enforces a per-platform root of trust chain (firmware → bootloader → kernel → verified components), adapts to ARM TrustZone, Intel SGX/SEV differences, and runs as a working prototype for multi‑OS embedded images.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 0:34About me
- 3:45Why secure boot
- 5:28Traditional platforms
- 6:06Who do you trust
- 7:43Embedded systems
- 8:52Secure boot
- 9:32Trusted platform modules
- 11:06Trusted execution environment
- 15:10TFA and TFM
- 16:23Enclave
- 17:26Secure encrypted virtualization
- 18:03What are TEEs
- 18:41Ufe
- 19:34Questions
related talks
40mWhat should I know about secure boot and TEEs?
11mOP-TEE open-source security for the mass-market
41mOP-TEE - Using TrustZone to Protect Our Own Secrets
40mOP-TEE: When Linux Loses Control
22mBoot Requirements and Strategies for the Edge
39mSoftware Supply Chain Security with Trusted Execution Environment Provisioning (T...
18mIoT Security's Toughest Challenges: Root of Trust, TEEs, & Firmware Updates
48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant Processors