X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=blobdiff_plain;f=docs%2F2_Architecture_Guides%2F2_Security_Blueprint%2F1_Hardware.md;fp=docs%2F2_Architecture_Guides%2F2.2_Security_Blueprint%2F1_Hardware%2FAbstract.md;h=328dd15e20c4e058035609352885ae8aa54abf03;hb=65bd017e8b8f9a06008266de46303c88a9ac51c8;hp=7fe806f1c694caa1e2781baf328e948486f5054f;hpb=7d32dd28e9b9fa97dd43bed13fb3050eb7ff8b3d;p=AGL%2Fdocumentation.git diff --git a/docs/2_Architecture_Guides/2.2_Security_Blueprint/1_Hardware/Abstract.md b/docs/2_Architecture_Guides/2_Security_Blueprint/1_Hardware.md similarity index 92% rename from docs/2_Architecture_Guides/2.2_Security_Blueprint/1_Hardware/Abstract.md rename to docs/2_Architecture_Guides/2_Security_Blueprint/1_Hardware.md index 7fe806f..328dd15 100644 --- a/docs/2_Architecture_Guides/2.2_Security_Blueprint/1_Hardware/Abstract.md +++ b/docs/2_Architecture_Guides/2_Security_Blueprint/1_Hardware.md @@ -1,11 +1,7 @@ --- -title: Introduction +title: Hardware --- -# Part 1 - Hardware - -## Abstract - The Automotive Grade Linux platform is a Linux distribution with **AGL** compliant applications and services. The platform includes the following hardware: @@ -41,42 +37,28 @@ The board must store hardcoded cryptographic keys in order to verify among others the _integrity_ of the _bootloader_. Manufacturers can use **HSM** and **SHE** to enhance the security of their board. - - Domain | Object | Recommendations -------------------- | ---------- | ---------------------------------- Hardware-Integrity-1 | Bootloader | Must control bootloader integrity. Hardware-Integrity-2 | Board | Must use a HSM. Hardware-Integrity-3 | RTC | Must not be alterable. - - -------------------------------------------------------------------------------- - - ## Certificates - - Domain | Object | Recommendations ---------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- Hardware-Certificate-1 | System | Shall allow storing dedicated certificates. Hardware-Certificate-2 | ECU | The ECU must verify the certification authority hierarchy. Hardware-Certificate-3 | System | Allow the modification of certificates only if the source can be authenticated by a certificate already stored or in the higher levels of the chain of trust. - - -------------------------------------------------------------------------------- ## Memory - - Domain | Object | Recommendations ----------------- | ---------- | ------------------------------------------------------------------------------------ Hardware-Memory-1 | ECU | The ECU shall never expose the unencrypted key in RAM when using cryptographic keys. Hardware-Memory-2 | Bootloader | Internal NVM only -Hardware-Module-3 | - | HSM must be used to secure keys. - - +Hardware-Module-3 | - | HSM must be used to secure keys. \ No newline at end of file