File System Security (Data at Rest & Integrity)

About the Course

What happens when someone removes the SD card from your IoT device? If the answer is “they read all the data and replace the firmware” — this training is for you.

Protecting data in embedded systems requires a multi-layered approach (Defense in Depth):

• Integrity — has my file system been modified offline?
• Confidentiality — is user data encrypted, even when someone has physical access?
• Hardware binding — are encryption keys useless on another device?

This training shows you how to answer “YES” to all these questions, leveraging the unique capabilities of the STM32MP1 platform: CRYP/HASH cryptographic accelerators, OTP memory with HUK, and Trusted Execution Environment (OP-TEE).

What we DON’T cover: Secure Boot and Chain of Trust — we assume the bootloader is already trusted (topic of a separate training).

🎯 Project Goal: “Hardened Data Partition”

During the course, we build a complete solution, not just configure individual tools. Participants will create a system that:

✓ Verifies rootfs integrity on every read — dm-verity with Merkle Tree

✓ Detects offline modification attempts — intentional “destructive test” on the SD card

✓ Encrypts user data partition — dm-crypt with LUKS or fscrypt

✓ Automatically unlocks disk without user password — Trusted Keys with OP-TEE

✓ Binds keys to hardware — key is useless on another processor instance (HUK)

✓ Uses hardware acceleration — AES-256 with CRYP, SHA-256 with HASH

📅 Training Program

DAY 1: The Hardware – Hardware Fundamentals and Cryptography in Linux

Before we encrypt disks, we need to understand what the silicon offers us. STM32MP1 is not a PC — it has dedicated cryptographic peripherals.

Module 1.1: STM32MP1 Security Architecture

• CRYP and HASH cryptographic peripherals — hardware capabilities
• Resource allocation between Secure World (OP-TEE) and Normal World (Linux)
• Impact of hardware acceleration on dm-verity and dm-crypt performance

Module 1.2: OTP Memory and Hardware Unique Key (HUK)

• BSEC controller and hardware key management
• HUK — unique processor secret as the security foundation
• Key isolation: Shadow Registers and ETZPC
• Lab: Device lifecycle state analysis

Module 1.3: Linux Crypto API — Abstraction Layers

• STM32 cryptographic drivers and their kernel integration
• Crypto API — unified interface for dm-crypt, fscrypt, TLS
• User space access: AF_ALG, OpenSSL engine
• Lab: Verifying hardware acceleration in Device Tree and /proc/crypto

Module 1.4: Benchmarking — Hardware vs Software

• When is hardware acceleration NOT faster? (small blocks, DMA overhead)
• Performance comparison: software vs hardware implementation
• Lab: Performance measurements and CPU load analysis

DAY 2: The Integrity – dm-verity and System Immutability

Mount -o ro is not enough. An attacker with physical access will replace your /bin/login. dm-verity is the solution.

Module 2.1: Integrity Theory and Attack Vectors

• Why the ro flag doesn’t protect against offline attacks and root-privileged malware?
• Merkle Tree — mathematical foundations of dm-verity

Module 2.2: dm-verity Architecture

• Hash tree structure and read-time verification mechanism
• Root Hash as the “summary” of the entire file system
• Implications for the update process

Module 2.3: Implementation in Yocto (meta-security)

• The dm-verity-img class and build process automation
• Hash tree storage strategies: Append Mode vs Separate Partition
• Lab: Configuring and building an image with dm-verity

Module 2.4: Trusted Root Hash Transfer

• Trust problem: how to protect Root Hash from replacement?
• Methods: initramfs vs kernel signature (Linux 5.4+)
• Impact on system boot time

Module 2.5: Destructive Test

• Lab: Image deployment and intentional data corruption
• Observing dm-verity’s reaction to manipulation

DAY 3: The Confidentiality – Data Encryption and Trusted Keys

We have integrity. Now confidentiality. But where do we get the key at boot if there’s no user?

Module 3.1: dm-crypt vs fscrypt — Architecture Choice

• Block encryption (dm-crypt/LUKS) vs file-level encryption (fscrypt)
• Comparison: metadata, key granularity, performance
• Recommendations for embedded systems

Module 3.2: dm-crypt with LUKS — Implementation

• LUKS1 vs LUKS2 — differences and choice for embedded
• The “Unattended Boot” problem in IoT
• Solution: hardware key binding
• Lab: Creating and configuring a LUKS volume

Module 3.3: Trusted Keys and OP-TEE — Hardware-Bound Key

• Trusted Keys mechanism: generation, sealing, unsealing
• Role of HUK — why is the blob useless on another device?
• Integration with Kernel Keyring and dm-crypt
• Lab: Key sealing and automatic volume unlocking at boot

Module 3.4: fscrypt — Granular Encryption

• Directory-level encryption in ext4
• Policies and per-directory key management
• Lab: Encrypting selected directories with user data

Module 3.5: Summary and Q&A

• Performance comparison of dm-crypt vs fscrypt on STM32MP1
• Key management in production: KMS, HSM, SSP
• Consultation on your own projects

💰 Pricing and Participation Models

I offer a flexible model tailored to the scope of knowledge needed.

Option A: INTEGRITY FOCUS (2 Days)

Ideal for teams that need integrity protection (dm-verity) but don’t require user data encryption.

Option B: FULL ENCRYPTION (3 Days) ⭐ Recommended

Complete training with data encryption and Trusted Keys. Essential for products processing personal data (GDPR) or requiring certification.

Promotion: By choosing the 3-day package upfront, you save €100 compared to adding the 3rd day separately.

Small teams: For teams smaller than 5 people - rates are negotiated individually.

🏆 Why is it worth it?

🛠️ Requirements

Hardware (provided):

• STM32MP157C-DK2 board
• 16GB microSD card (class 10)
• USB Type-C cable, USB-UART converter

Software:

• Ubuntu 20.04/22.04 LTS
• OpenSTLinux SDK (Kirkstone/Scarthgap)
• STM32CubeProgrammer

Participant knowledge:

• Linux basics (shell, mounting partitions)
• Yocto basics (building images)
• Device Tree concepts (helpful, not required)

🎁 Hardware stays with participants after the workshop!

Want to reserve a date for your team? Contact me to arrange details. Encrypt your data before someone else reads it.