Project Cerberus
summary
Project Cerberus is a microcontroller-based hardware root of trust that interposes between CPUs and SPI flash to enforce digital signatures, measured boot and NIST 800-193 guidelines. It masters the flash bus, filters SPI transactions so unused flash regions become unreadable, verifies and logs firmware measurements, and supports a binary platform firmware manifest to allow fleet roll‑forward/rollback without blowing fuses. It includes AES/SHA/public‑key accelerators, TRNG/PTRF/secure element storage, hierarchical attestation for PCIe devices, automatic recovery workflows and alerting; the ASIC is built and working but its secure element is not yet certified.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:58Open Compute Project
- 2:27Project Olympus
- 2:58Open Source Momentum...
- 3:16More Open Building Blocks Followed
- 3:55Open Hardware Security
- 6:21The Cloud Firmware Threat Vectors
- 8:06Firmware Attack Surface
- 9:07Guiding Principles for Firmware Security
- 10:03The Current State of Industry Servers
- 11:14Introducing Project Cerberus A set of platform requirements
- 11:46Project Cerberus Hardware Root-of-Trust
- 12:56What is the Cerberus ASIC • Dedicated security microprocesso
- 14:23Interpose Interface
- 16:38Protection
- 18:54Recovery
- 20:50Platform Trust Hierarchy Scalable security architecture • Motherboard contains master
- 21:49Platform Attestation • Single Platform Measurement
- 22:47Cerberus - Security Controller
- 25:14Cerberus - Platform Firmware Manifest (PEM)
related talks
39mSecuring firmware: Secure and Trusted boot in OpenBMC
45mBuilding a Secure IoT Device
51mTrusted Firmware M : Secure Storage
43mDevice Security in IoT
29mEnabling a secure IoT from design to deployment
32mSecure programming and provisioning
53mSecure Embedded Linux Product - A Success Story
26mKeynote: Trusted Firmware – Build Security Collaboratively