Establishes a hardware-backed chain of trust spanning boot, operation, updates, and recovery to protect mission-critical computing platforms.
Protects mission data with encryption, signing, and hardwarerooted key management, ensuring confidentiality and integrity from collection to delivery.
Developed and maintained through cybersecurity processes aligned with leading international standards, regulations, and assurance frameworks.
Layered Secure Boot Chain: FPGA → UEFI/BIOS → Kernel
Hardware Root of Trust: FPGA eFuse based AES and ESA/ECDSA keys. AMD fTPM secure boot
Zero Trust: APU/OS isolated from FPGA; only allows signed updates for critical FPGA functionality
Compartmentalization: AppArmor MAC enforcement, per-channel SDMA permissions
Memory & Disk Encryption: TSME encrypts DDR transparently, disk encryption keys are held in fTPM
Tamper-Proof Audit Logging: Security events flow APU → FPGA → MRAM in AES-GCM sealed slots
Secure OTA Update & Recovery: Signed updates with ZFS rollback
OS & Service Hardening: DISA-STIG compliance, systemd sandboxing of all services
FPGA Source Data Signing: Sensor data signed in the FPGA before reaching the APU, and/or signed in APU after pre-processing by Unibap LOOM
In-Stream Downlink Encryption:Real-time FPGA AES-GCM encryption on data streams
FPGA AES-GCM Crypto Engine: In-fabric signing and encryption without key exposure
High-Throughput SHA-3 Hashing: Hashing at 100 Gbps+ for data integrity verification
APU AES-NI Acceleration: >40 GB/s AES-256-GCM encryption throughput
Post-Quantum Cryptography Support: ML-KEM-1024 key exchange
Active Key Zeroization: Trigger for instant wipe of all plaintext operational keys
Ground-to-FPGA Signed Configuration: Ground-signing of configuration changes that alter critical platform configuration
Encrypted Audit Log Export: Sealed MRAM log slots exported directly with per-entry authentication