From unauthenticated netboot to CRA-ready industrial gateways: measured boot and remote attestation on bare-metal RISC-V
Cloud-enabled industrial gateways bridging Modbus field equipment to HTTPS/MQTT backends over VPN are directly in scope of the most demanding requirements made by the EU Cyber Resilience Act (CRA): deployed unattended in accessible locations, holding the VPN and cloud credentials that make them a pivot into both OT and cloud networks, and re-imaged over the network. Yet the network-boot tooling this lifecycle relies on executes unauthenticated images by design, in direct conflict with the CRA's software-integrity and secure-update requirements. Even signed images cannot answer the question an unattended fleet poses: how does an operator know, remotely and continuously, that a deployed gateway runs the software that was shipped?
This session demonstrates an end-to-end, fully open-source answer on RISC-V. Building on an already-released bare-metal programming framework and network-boot framework, we construct a complete trust chain: a minimal, PMP-protected firmware layer as the trusted base; authenticated network boot with signature verification and anti-rollback, doubling as the CRA-mandated secure update path; DICE-style measured boot providing device identity without requiring a TPM; and RATS-based remote attestation that gates release of VPN and MQTT credentials on proven platform state. A tampered device cannot even join the network. Attestation reference values are derived from reproducible builds of the boot chain, tying platform verification to the SBOM and supply-chain transparency the CRA expects of manufacturers and integrators. This technical session distills lessons learned building and releasing these frameworks, from the pitfalls of key derivation without a hardware root of trust to what breaks when netboot signing is integrated in real-world provisioning workflows.
The session concludes with a scripted QEMU demonstration that shows (i) a tampered image rejected at boot-time, and (ii) a verified gateway completing attestation, receiving its credentials, and publishing Modbus telemetry to an MQTT broker. This demonstration provides a practical mapping from each mechanism in an open-source stack to the CRA obligations it addresses.
Talk contributors:
Nick Kossifidis (mick@ics.forth.gr | Research Engineer at FORTH - Greece)
Manolis Marazakis (maraz@ics.forth.gr | Staff Research Scientist at FORTH - Greece)
Manolis Marazakis is a Principal Staff Research Scientist at the Institute of Computer Science, FORTH (Greece). His research interests are in architectures and efficient systems software, mainly resource management and storage I/O middleware, for high-performance servers in datacenter environments. He has contributed to the design, implementation and performance analysis of several system prototypes for HPC, data analytics, multi-tenant workloads, and the convergence of HPC and Cloud infrastructures. He is the coordinator of the HIGHER project (https://higher-project.eu) that is creating and validating open-source designs for high-density rack-scale systems supporting cloud and edge services.