Anchoring Trust: A Hardware Secure Boot Story
Nov 17, 2020Derek Chamorro, Ryan Chow
Summary
This post introduces Cloudflare's implementation of hardware secure boot using AMD's Platform Security Boot (PSB) on their servers. It details the boot process, the limitations of UEFI secure boot against firmware attacks, and how PSB, anchored in immutable hardware (AMD PSP), provides a more robust root of trust by authenticating the initial BIOS/UEFI code before execution. It also outlines the Public Key Infrastructure (PKI) and build process involved in establishing this hardware-rooted integrity.
More from the Hardware Infrastructure & Performance Optimization trail
- How we reduced core unit boot time from hours to minutes
- A one-line Kubernetes fix that saved 600 hours a year
- Launching Cloudflare’s Gen 13 servers- trading cache for cores for 2x edge compute performance
- Inside Gen 13- how we built our most powerful server yet
- So long, and thanks for all the fish- how to escape the Linux networking stack