Boot to Cloud Security Considerations with IoT
summary
Covers concrete decisions: use MCUboot plus its tooling (MCU manager and image tool) for immutable secure boot with optional serial recovery and a 32 KB bootloader, derive HKDF device-bound keys to avoid storing secrets, enforce mutual TLS with X.509 client auth and TLS 1.2 minimum for server and device identity, and follow a factory or late‑binding provisioning model. Shows a working open-source end-to-end demo called confidential AI POC using Zephyr and Trusted Firmware‑M that runs in QEMU and exercises bootstrap and certificate management.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:09Secure Boot
- 17:10Common Provisioning Scenarios
- 20:02Signpost: Open Provisioning Standards
- 20:58Best Practice: Storage-Free Key Derivation
- 28:56Basic TLS
- 33:12Basic Client Authentication
- 33:31Mutual TLS Sample Code
- 33:57COSE Payload Encryption
related talks
24mSecure and Encrypted Boot in Zephyr RTOS
21mSecure and Encrypted Boot in Zephyr RTOS
29mEnabling a secure IoT from design to deployment
45mBuilding a Secure IoT Device
05mmoves cyber security forward for IoT
43mDevice Security in IoT
18mBeyond the Default Password: Building Trustworthy IoT Products
26mHypervisors and IoT (IoT Secret Storage)