Blogs›Cloudflare›Arm Secure Boot Chain Enhancement

Arm Secure Boot Chain Enhancement

posts

2020–2023

Cloudflare has enhanced its secure boot capabilities for Arm-based servers by implementing a Single Domain Secure Boot (SDSB) mechanism. This builds upon the Arm Trusted Firmware (ATF) Secure Boot process, allowing for cryptographic validation of the UEFI firmware using a hardware root of trust stored in eFuses. This provides a more robust security chain for Arm servers, similar to their existing solutions for x86 platforms.

2023

Armed to Boot: an enhancement to Arm's Secure Boot chain

1/25/2023

This post details the implementation of Single Domain Secure Boot (SDSB) for Cloudflare's Arm server fleet, specifically using Ampere Altra Max CPUs. It explains the limitations of the standard Arm Trusted Firmware (ATF) Secure Boot for server environments and how SDSB extends the trust anchor to the UEFI firmware by incorporating a hash of Cloudflare's public signing key into the SoC's eFuses. The process involves generating certificates, customizing firmware with ODMs, signing UEFI images, and provisioning eFuses during manufacturing.

2020

Anchoring Trust: A Hardware Secure Boot Story

11/17/2020

This post details Cloudflare's implementation of AMD's Platform Secure Boot (PSB) for its servers, establishing a hardware root of trust (HRoT) that precedes UEFI firmware-based trust. It explains the boot process, the limitations of UEFI secure boot against firmware attacks, and how PSB leverages the AMD Platform Security Processor (PSP) and an on-chip Boot ROM to authenticate the System ROM image before CPU reset. The post also outlines the Public Key Infrastructure (PKI) setup, including ODM and AMD signing keys, and the structure of the Certificate Signing Request (CSR) for BIOS signing keys.