Secure Boot

Secure Boot and Chain of Trust are implemented via the NXP i.MX8X SoC AHAB feature. For secure boot detailed information, please read the NXP AN12312 document.

AHAB uses digital signatures to prevent unauthorized software execution during boot. If malware compromises the boot sequence, sensitive data, services, and network access can be affected.

Authentication uses public key cryptography: images are signed offline with private keys and verified on the i.MX processor using corresponding public keys. The public keys are embedded in the SCFW binary (which is part of the imx-boot image), and the SRK (Super Root Key) hash is programmed into SoC fuses to establish the root of trust.

Images that are unsigned or signed with incorrect keys will not boot, preventing tampering with deployed software.

Once the Linux kernel is running, secure boot ends.

D7 SDK

Development and Release images differ by design, balancing ease of use during development with restricted, secure images for deployment.

Development images contain additional tools aiming to help developers during everyday tasks.
Release images do not allow root login, the rootfs is read-only and has fewer tools installed. The integrity of the root-only rootfs is verified with dm-verity.

See Release vs Development Images for more information.

Software Updates

Software updates are signed and verified by SWUpdate. Customers will be able to customise their software update keys via custom SDKs. Contact us for more information.

Compliance

We aim to comply with the Cyber Resilience Act (CRA) and Radio Equipment Directive (RED) via EN 18031.

Technical Documentation

Contact

For questions about Secure Boot implementation or to discuss your specific requirements:

Email: SDK support
Documentation: https://www.veethree.com/docs/d7/latest

Table of Contents