Trustworthy Secure and Measured Boot on a Raspberry Pi 4

Abstract

The Raspberry Pi is a widely used platform deployed across numerous domains, including Industry 4.0 environments. This places requirements on hardware and software in terms of IT and OT security. The whole platform has to be secured in a way that integrity and trustworthiness can be guaranteed – even when it is deployed in uncontrolled environments and operating outside the manufacturer’s physical control. Currently, that often is not the case and basic Trusted Computing concepts are not implemented in Raspberry Pi-based platforms. The presented approach enables entities such as SIEM systems and backend services to make use of the established Trusted Computing mechanism Remote Attestation to verify the integrity of a Raspberry Pi 4 and its software. Remote Attestation, in turn, depends on Measured Boot to record integrity measurements (hash values) of each boot stage into a TPM 2.0. However, the Raspberry Pi 4 official bootloader supports Secure Boot only. It neither provides Measured Boot functionality nor integrates with a TPM 2.0, preventing the establishment of a hardware-anchored measurement chain required for Remote Attestation. To address these limitations, this paper proposes a method that combines Secure Boot with Measured Boot to enable Remote Attestation on the Raspberry Pi 4. This combination establishes a complete Chain of Trust. While it comes with some shortfalls and cannot defend against sophisticated hardware-based attacks, it still results in a much higher security level for the Raspberry Pi. The proposed concept makes use of the official bootloader’s Secure Boot to load a signed second stage custom bootloader image based on U-Boot. Following that, U-Boot acts as the Measurement Root of Trust and measures the subsequent boot stages into the PCRs of a TPM 2.0. Although the proposal builds upon existing technologies, their integration into the Raspberry Pi boot chain has not been available in this form. The security enhancements have a significant impact on many use cases involving Raspberry Pi-based hardware, including industrial devices. It is particularly worth considering if the hardware platform already integrates a TPM 2.0 chip.