Extended Security

Extended Security adds hardware-backed protection for stored operating-system, application, and device data. The meta-orchestraos-crypt layer provides device-bound storage encryption and integrates the supported gateway’s secure firmware, kernel, and early-boot storage handling.

Capabilities and Contents

  • Encrypted system and application storage: rootfs slots, application slots, and persistent data reside in encrypted LVM.

  • Hardware-backed key protection: CAAM integration on EIG-M, EIG-M-DIN, and EIG-MA; ELE/OP-TEE-backed AES-XTS integration on EIG-XS.

  • Early-boot storage access: initialization and unlock support before the selected system starts.

  • Provisioning safeguards: integration with the shared LVM flow and its storage-policy hooks.

  • Platform integration: image, kernel, and secure-firmware components for the supported hardware.

Scope and Integration

The extension complements the authenticated boot, signed updates, and access policies described in OrchestraOS Security Architecture. Boot filesystems and the provisioning partition remain outside encrypted LVM. The normal A/B system and application layout is retained, with persistent data shared across rootfs updates. Hardware key protection and provisioning state form part of the device’s storage lifecycle.

For signing artifacts with keys held by an external HSM, see NetHSM Signing.

Build manifests, backend selection, configuration variables, key-storage policy, compatibility constraints, and hardware checks are documented in README.md in the meta-orchestraos-crypt repository.

The layer is available under a separate commercial license. Contact sales@cthings.co for access and licensing information.