Secured Embedded Linux Platform Build Training | Ac6 Training

ac6-training, un département d'Ac6 SAS
EN
✓EnglishFrench
go-up

ac6 › ac6-training › Programming › Safety and security › Secured Embedded Linux Platform Build
Inquire
SEC8Secured Embedded Linux Platform Build

Objectives

  • Implementing secure boot
  • Verifying the authenticity of system components before they are loaded and executed.
  • Ensure the authenticity and integrity of the bootloader, kernel
  • Implements the Trusted Boot
  • Provides a secure environment for the secure monitor firmware
  • Run OP-TEE on secure environment that runs alongside the main operating system
Labs are conducted on QEMU ARM-based board
  • C Language knowledge (see for example our L2 training course)
  • Embedded Linux Build knowledge (see for example our D1 training course)
  • You may be interested also by the SEC9 Advanced Embedded Linux Security course
  • You may be interested also by the SEC1 Secure Development for Embedded System course
  • You may be interested also by the SEC2 Advanced Embedded Systems Security course
  • Training manuals and software exercises
  • One Linux PC for two trainees
  • One target platform for two trainees
  • Total: 2 days
  • From 40% to 50% of training time is devoted to practical activities
  • Theoretical course
    • Printed and PDF material in English.
    • Trainer assistance throughout.
  • Practical activities (40-50% of duration)
    • Code examples, exercises and solutions.
    • One PC (one per two beyond six trainees) with target board if needed; install manual provided on-site.
  • Downloadable preconfigured VM to redo the labs afterwards.
  • Each session starts with a trainee check-in.
  • Any embedded systems engineer or technician with the above prerequisites.
  • Prerequisites are checked before the training.
  • Progress is assessed by the trainer through the practical exercises, and by quizzes for sections without exercises.
  • Each trainee receives a completion certificate.
  • If a prerequisite gap appears, alternative or additional training is offered.

Course Outline

  • Linux history
  • Linux architecture and modularity
  • Linux system components
  • The various licenses used by Linux (GPL, LGPL, etc)
  • Low-level boot
    • Boot on NOR
    • Boot on NAND
    • Boot on SD/MMC/eMMC
    • Multistage Boot
    • Why do we need a trusted boot chain
  • Security Concerns
    • Confidentiality and Integrity
    • Tampering Prevention
    • Compliance and Certification
Exercise:  Boot the platform with the prebuilt image
  • Secure Boot concept
    • The chain of trust
    • Complete secure boot process
  • Key Management
    • Introduction to key management
    • Cryptographic algorithms and key types
    • Key storage options: Hardware-based and software-based
    • Key management processes: Generation and revocation of keys
    • ARM-based platforms hardware features overview
    • Secure Monitor
    • Secure World
    • Trusted Execution Environment
    • Secure Boot on RISCV and X86_64
    • Cryptographic Accelerators
  • Software Solutions
    • Open source
    • Proprietary
Exercise:  Generate keys that are going to be used for platform encryption
  • U-Boot
    • Capabilities and features
    • Configuration, customization, and compilation
    • U-Boot SPL as First-Stage Boot Loader (SSBL)
    • Role of u-boot in the trusted boot chain
    • How U-Boot verifies the authenticity of the images it loads
    • Configuration options for securing the boot process
    • Interaction with the secure world and Trusted Execution Environment
    • Signing U-boot
  • Arm Trusted Firmware (ATF)
    • Overview and features
    • ATF Boot flow
    • Services
    • Build and deploy
  • Other platform specific components
Exercise:  Build and boot the platform with U-boot as FSBL and SSBL
Exercise:  Build and Boot the platform with ATF as FSBL and U-boot as SSBL
  • Introduction to Linux kernel
    • Source code
    • Configuration
    • Compilation
  • FIT (Flattened Image Tree) Image
    • What is FIT and why is it used
    • Advantages of using FIT image
    • Configuration
    • Building a Secure FIT Image
  • Kernel Configuration for a Secure Linux Platform
    • Configuration options for secure boot in the Linux kernel
    • Access Control Configuration overview
Exercise:  Create a secured FIT Linux image
  • Tips for hardening and securing a rootfs
    • Minimizing the rootfs
    • Strong authentication
    • Keep software updated
    • Using initramfs
  • Read-only root filesystem
    • Introduction to read-only root filesystem
    • Purpose and benefits
    • Overview of the different solutions available
    • SquashFS
    • CramFS: Small memory footprint
    • OverlayFS-based read-only root filesystem
    • UnionFS-based read-only root filesystem
  • Considerations when choosing a read-only root filesystem solution
    • Evaluation based on use case, security, performance, and compatibility
  • Encrypting Update Images
    • Securely update Linux platform using Mender
Exercise:  Create a read-only file system using SquashFS
  • Introduction to OP-TEE
  • Key Features
  • Hardware, software, and firmware requirements
  • Architecture of OP-TEE
    • Components, modules, and communication channels
  • Use Cases
    • Secure storage
    • Secure communication
    • Secure execution of applications
  • OP-TEE build and deployment
    • Setting up the environment
    • Configuration of OP-TEE
    • Compilation of OP-TEE
  • Comparison to other TEE solutions
  • Trusted Applications (TA) on OP-TEE
    • The role of a TA in a secure system
    • Writing a Trusted Application
    • Loading and executing a Trusted Application within the OP-TEE runtime
    • Debugging and testing Trusted Applications
    • Communication between Trusted Applications and normal world applications
    • Best practices for creating secure Trusted Applications
Exercise:  Build and install OP-TEE
Exercise:  Write a TA application that communicates with a normal world application
Duration
2 days
Inquiry

This course can be scheduled upon request. Click the 'Inquire' button to contact us.

More

To book a training session or for more information, please contact us on info@ac6-training.com.

Registrations are accepted till one week before the start date for scheduled classes. For late registrations, please consult us.

You can also fill and send us the registration form

This course can be provided either remotely, in our Paris training center or worldwide on your premises.

Scheduled classes are confirmed as soon as there is two confirmed bookings. Bookings are accepted until 1 week before the course start.

Last update of course schedule: 27 June 2026

Booking one of our trainings is subject to our General Terms of Sales

Related Courses