1. What is secure boot

2. Important principles to build a secure boot architecture

3. Design challenge for embedded developers

1. What is secure boot?

Secure Boot is a security mechanism used in embedded microcontrollers and FPGAs to ensure that the system only executes trusted code. It is a critical component in protecting embedded systems from malicious attacks and unauthorized code execution. Its purpose is to ensure that only authentic firmware is executed when a device starts. When a device powers on, it does not immediately execute the firmware stored in Flash memory. Instead, a trusted boot component, typically an immutable Boot ROM, first verifies the firmware using a digital signature.

If the signature is valid, the firmware is executed. If verification fails, the boot process stops or enters a recovery mode. This process establishes a chain of trust, where each software stage verifies the next before handing over execution.

2. Important principles to build a secure boot architecture

Modern MCUs, FPGAs and SoC FPGAs provide many of the hardware building blocks required for Secure Boot, such as Boot ROMs, OTP memory, secure key storage and cryptographic accelerators. However, these features alone do not create a complete secure boot implementation.

Following principles are most important for a secure boot architecture:

• Hardware Root of Trust: Every Secure Boot implementation starts with an immutable Hardware Root of Trust (HRoT), typically a Boot ROM with a trusted public key or key hash stored in protected hardware such as OTP memory or eFuses. This forms the foundation of the entire security architecture.

• Code Signing and Verification: Before release, firmware is digitally signed using the manufacturer's private signing key. During startup, the device verifies the signature using the corresponding public key stored on the device. This ensures both the authenticity of the firmware and its integrity, preventing unauthorized modifications.

• Chain of Trust: After the first component has been authenticated, each verified boot stage authenticates the next before transferring execution. This Chain of Trust continues until the complete software stack has been validated. The same principle is typically applied during secure firmware updates to ensure that only trusted software can be installed.

3. Design challenges for embedded developers

Implementing Secure boot involves more than adding signature verification. Common design challenges include selecting an appropriate Hardware Root of Trust, protecting signing keys, defining a secure recovery strategy and ensuring that firmware updates cannot bypass the Chain of Trust.

Another common misconception is that FPGA bitstream authentication alone protects the entire system. While it secures the hardware configuration, additional verification is still required for any software executed after configuration, such as bootloaders or application firmware.

A secure boot implementation is only as strong as its weakest link. Building a complete Chain of Trust from immutable hardware to the final application is therefore essential for protecting modern embedded systems.

Secure boot and update package

Building a Secure Boot architecture involves much more than enabling a security feature in your FPGA or MCU. It requires a complete Chain of Trust, from the Hardware Root of Trust and bootloader to firmware authentication, secure updates and rollback protection.

Explore how the KiviCore Secure Boot & Secure Updates Package helps embedded product teams design and implement production-ready Secure Boot architectures for FPGA, SoC FPGA, ASIC and MCU-based systems.