.. _os-extended-security:

#################
Extended Security
#################

Extended Security adds hardware-backed protection for stored operating-system,
application, and device data. The ``meta-orchestraos-crypt`` layer provides
device-bound storage encryption and integrates the supported gateway's secure
firmware, kernel, and early-boot storage handling.

Capabilities and Contents
=========================

- **Encrypted system and application storage:** rootfs slots, application
  slots, and persistent data reside in encrypted LVM.
- **Hardware-backed key protection:** CAAM integration on EIG-M, EIG-M-DIN,
  and EIG-MA; ELE/OP-TEE-backed AES-XTS integration on EIG-XS.
- **Early-boot storage access:** initialization and unlock support before the
  selected system starts.
- **Provisioning safeguards:** integration with the shared LVM flow and its
  storage-policy hooks.
- **Platform integration:** image, kernel, and secure-firmware components for
  the supported hardware.

Scope and Integration
=====================

The extension complements the authenticated boot, signed updates, and access
policies described in :ref:`os-security-architecture`. Boot filesystems and the
provisioning partition remain outside encrypted LVM. The normal A/B system and
application layout is retained, with persistent data shared across rootfs
updates. Hardware key protection and provisioning state form part of the
device's storage lifecycle.

For signing artifacts with keys held by an external HSM, see
:ref:`os-nethsm-signing`.

Build manifests, backend selection, configuration variables, key-storage policy,
compatibility constraints, and hardware checks are documented in ``README.md``
in the ``meta-orchestraos-crypt`` repository.

The layer is available under a separate commercial license. Contact
sales@cthings.co for access and licensing information.