SECURITY BAKEDINTO THESILICON
Hardware-rooted trust for connected embedded products.
Ankh builds defense in depth from the first boot vector through cloud communication — HSMs, ARM TrustZone-A/M secure world partitioning, ECDSA P-256 secure boot chains, AES-128/256 flash encryption, TRNG-based key provisioning with X.509 certificate injection at manufacturing, OTP anti-rollback counters, and JTAG debug lock. We apply OWASP IoT Top 10, PSA Certified Level 1/2, and GSMA IoT Security Guidelines, validated with hands-on penetration testing against the physical device.
What We Secure
Secure Boot Chain Design
ECDSA P-256 or RSA-3072 multi-stage boot chains anchored in the SoC ROM — each stage verifies the next, OTP-fused public key hash values ensuring the trust anchor cannot be overwritten in the field.
TrustZone-A/M Partitioning
TrustZone-A and TrustZone-M (Cortex-M33/M55) secure world partitioning isolating sensitive code and keys from the normal-world application — SAU/IDAU memory map configuration, trusted application development, and OP-TEE or custom secure monitor integration.
Hardware Security Module Integration
ATECC608B, SE050, and SLB9672 TPM integrated for key storage, cryptographic acceleration, and device attestation — with host-side HAL, I2C/SPI driver, and certificate chain management keeping private keys out of software-accessible memory.
Flash Encryption at Rest
AES-128/256 transparent flash encryption using SoC-integrated encryption engines (ESP32, STM32 AES/FMC, nRF9160 KMU) — key provisioning into hardware key registers ensures the encryption key is never accessible via software read.
Secure Key Provisioning & Device Identity
TRNG-generated device keys injected into hardware key slots, X.509 certificates signed by a product CA, and secure boot public key hash fused into OTP — provisioning station toolchain and audit trail prevent key extraction at the production line.
Secure OTA Firmware Updates
Signature verification of update packages, anti-rollback via monotonic OTP/eFuse counters, encrypted transport (TLS 1.3 or DTLS 1.2), and atomic update with verified rollback — integrated with SUIT manifest or MCUboot.
Firmware Anti-Rollback (OTP/eFuse)
Monotonic OTP fuse counters preventing downgrade attacks that re-expose patched vulnerabilities — counter scheme design, fuse programming toolchain, and secure boot integration enforcing version checks before transferring control to the application.
Side-Channel Attack Mitigation
SPA/DPA and timing side-channels mitigated via constant-time implementations, power supply decoupling hardening, and dummy operation insertion — validated with oscilloscope-based power analysis on target hardware before production.
Binary Hardening & Penetration Testing
Stack canaries, NX/XN bit enforcement, ASLR where the MMU supports it, and format string elimination — with structured penetration testing covering JTAG/SWD probing, UART console exploitation, memory bus snooping, and network-layer attacks.
How We Work
Threat Modeling & Security Architecture
STRIDE threat modeling applied to the product's data flow diagram, with DREAD scoring across identified assets (keys, firmware IP, user data) and threat actors. The security architecture document defines trust boundaries, required hardware security primitives, and control objectives driving all subsequent hardware and firmware decisions.
Hardware Security Design Review
SoC TrustZone/HSM capabilities, secure element isolation, and JTAG/SWD fuse lockdown are finalized before firmware begins — these constrain the debug workflow for the entire program. Schematic and layout are reviewed for side-channel exposure: decoupling near crypto operations and glitch injection risk at supply regulators.
Secure Boot & Root of Trust Implementation
BL1/BL2 signature verification uses mbedTLS or a hardware PKE accelerator, with OTP fuse programming for the public key hash and anti-rollback counter. The boot chain is tested against known-bad images—wrong signature, invalid version, truncated image—verifying each error case hard-faults rather than silently boots.
Key Provisioning Station Design
Device-unique key pairs are generated, certificates signed via the station HSM, private keys written to hardware registers, and OTP fuses burned — all in a single pass. Key material never exists outside the HSM boundary, satisfying ISO 27001 and IEC 62443 audit requirements.
Firmware Security Hardening
Hardening covers compilation flags (stack canaries, FORTIFY_SOURCE, -fPIE), secure coding review for TOCTOU race conditions in OTA state machines, bounds checking on all externally-controlled lengths, and MPU region configuration to isolate RTOS tasks. All cryptographic operations are audited to confirm vetted library implementations—not ad-hoc code.
Penetration Testing & Certification Support
Physical testing covers JTAG/SWD probing, UART brute force, power glitch, and flash bus monitoring; network testing covers TLS, API auth bypass, OTA replay, and parser injection. Findings include CVSS v3.1 scores and code-level remediation; PSA Certified Level 1/2 evidence packages are a standard deliverable.
Defense in Depth Across Every Attack Surface
TrustZone-M: Secure World on Cortex-M33
SAU/IDAU divide memory and peripherals into Secure, Non-Secure Callable, and Non-Secure regions — hardware-preventing a fully compromised RTOS from reading key material. A minimal PSA FF-M secure partition manager exposes cryptographic services and attestation token generation via veneer functions, with TRNG and OTP accessible only from secure world.
Firmware DevelopmentSecure Key Provisioning at Manufacturing Scale
Key pairs are generated inside the target secure element, CSRs signed in the station HSM, and certificates plus OTP fuse values programmed in a single pass — private key material never exists in software. The provisioning database logs serial number, certificate fingerprint, and HSM audit reference per device.
Systems IntegrationAnti-Rollback: Why Monotonic Counters Matter
Signature verification alone cannot prevent downgrade attacks — a valid older image restores every patched vulnerability. Ankh designs the monotonic counter scheme (contiguous eFuse bit-field, 32–128 increments), boot loader enforcement checking the counter before execution transfer, and OTA service integration advancing the counter atomically after new firmware is verified.
OTA Firmware
Hardware-rooted trust for connected embedded products.
Embedded Security Across Ankh's Product Range
Security requirements differ by product category — medical devices face HIPAA and IEC 62443, industrial equipment faces physical tamper scenarios, and consumer wearables face mass-market software exploit attempts. We calibrate security architecture to the actual threat model.
Medical Devices
IEC 62443-4-2 SL2, FDA cybersecurity guidance, PHI encryption at rest, secure OTA with rollback
View ProductIndustrial Equipment Monitoring
Physical tamper response, OPC-UA secure channel, IEC 62443 zone-and-conduit model
View ProductWearable Electronics
Secure BLE pairing, on-device health data encryption, TrustZone-M key isolation
View ProductCold Chain Monitoring
Chain-of-custody data integrity via ECDSA log signatures, tamper-evident sensor sealing
View ProductWireless Communication
DTLS 1.2 over CoAP, PSK provisioning, replay-protected command channels
View ProductAI Vision Systems
Model IP protection via encrypted inference engine, secure enclave for license enforcement
View ProductPOS & Kiosk Hardware
PCI PTS hardware security requirements, anti-skimming protections, secure key injection
View ProductData Loggers
ECDSA-signed log archives, secure boot for data integrity assurance, tamper-evident fusing
View ProductSmart Home Automation
Matter/Thread PSK authentication, secure commissioning, credential rotation enforcement
View ProductRuggedized Devices
JTAG lock for field-deployed units, zeroize-on-tamper for classified data handling
View ProductSecurity Architecture Before Component Selection
A microcontroller lacking flash encryption or SWD pads exposed outside the enclosure — discovered after PCB layout — means a hardware respin. Threat modeling before schematic capture settles TrustZone support, secure element BOM line, and JTAG lockdown strategy before the firmware team writes a line of boot code.
End-to-End Security Ownership
A verified OTA mechanism without anti-rollback, an mTLS API issuing non-expiring tokens, a provisioning flow logging keys to plaintext — cross-boundary failures siloed teams miss. Owning hardware, firmware, cloud authentication, and manufacturing provisioning simultaneously surfaces these gaps at design review, not penetration testing.
Hands-On Embedded Penetration Testing
Ankh's hardware security lab runs JTAG/SWD enumeration, power glitch injection, SPI flash bus monitoring, and BLE protocol fuzzing against the actual target device. Penetration test reports include CVSS v3.1 scores, full reproduction procedures, and code-level remediation guidance immediately actionable by your firmware team.
Deliverables
Threat Model & Security Architecture Document
STRIDE threat model covering all assets and attack vectors, plus a security architecture document defining trust boundaries, required controls, and hardware primitive requirements.
Secure Boot Chain Implementation
Boot stage firmware with ECDSA P-256 or RSA-3072 verification, OTP fuse programming scripts, and test evidence of known-bad image rejection across all error cases.
TrustZone Secure Partition Manager
PSA FF-M secure partition manager source with secure service APIs, SAU/IDAU configuration, and normal-world client library for cryptographic and attestation services.
Key Provisioning Station Toolchain
Provisioning tool source code, HSM ceremony documentation, database schema, and audit log format — with station qualification procedures and golden-unit validation scripts.
Firmware Security Hardening Report
Static analysis results, TOCTOU and bounds-checking code review findings, and compiler hardening configuration — all findings categorized by severity with remediation status.
Penetration Test Report
Physical and network pen test findings with CVSS v3.1 scores, reproduction procedures, attack tree diagrams, and prioritized remediation guidance — suitable for regulatory submission.
PSA Certified Evidence Package
Security model documentation, implementation notes, and test results mapped to PSA Certified Level 1 or Level 2 requirements.
Secure OTA Integration
OTA firmware with signature verification, anti-rollback enforcement, encrypted transport, and atomic update with verified rollback — test procedures cover downgrade rejection and interrupted update recovery.
All security deliverables include the source artifacts, test evidence, and documentation needed to support regulatory submissions and security certifications.
Often Paired With Embedded Security
Firmware Development
Secure boot chain and TrustZone trusted application development integrated with the full firmware architecture.
ExploreOTA Firmware
Secure OTA pipeline with signature verification, anti-rollback, encrypted transport, and MCUboot or SUIT manifest integration.
ExploreElectronics Design
Hardware security architecture review — secure element placement, SWD lockdown strategy, and power analysis hardening in PCB layout.
ExploreAPI Platform Development
Device identity and X.509 certificate chain integration with cloud MQTT/HTTPS endpoints and OAuth 2.0 device authorization flows.
ExploreWork That Demonstrates the Standard
PSA Certified Level 2 Medical IoT Gateway
Ankh designed the full security architecture for a Cortex-M33 with TrustZone-M — PSA FF-M secure partition manager isolating AES key storage from the RTOS, ATECC608B provisioning, and ECDSA P-256 secure boot with monotonic anti-rollback counter. Penetration testing surfaced two medium-severity TOCTOU vulnerabilities in the OTA state machine; both were remediated before submission, and PSA Certified Level 2 was awarded on first attempt.
Read the Case StudySecure Firmware Platform for Industrial Sensor Network
Ankh implemented TrustZone-M for session key isolation, ESP32-S3 flash encryption, DTLS 1.2 over CoAP, and MCUboot OTA with SUIT manifest for 10,000 sensor nodes — JTAG locked and UART console disabled via CI-enforced compile flags. An independent red team assessment found zero critical or high-severity vulnerabilities after Ankh's internal penetration testing resolved all issues.
Read the Case StudyReady to build a product attackers cannot own?Security architecture decisions made now cost far less than breach response later.
Whether you need a full security architecture design, a penetration test of an existing product, or help achieving PSA Certified or GSMA IoT Security compliance, start with a threat model.