Cisco ASR 5000 Series Administration Guide

APPENDIX F
Cisco Secure Boot
This appendix briefly describes the Cisco Secure Boot process and how it impacts image naming conventions.
It contains the following sections:
•
Fundamental Concepts, page 475
•
Secure Boot Overview, page 476
•
MIO2 Support for Secure Boot, page 476
•
Image Naming Conventions, page 476
•
Verifying Authenticity, page 476
Fundamental Concepts
Digital signing involves creating a unique digital signature for a given block of data such as software code
(often called code or image signing). The signature is created utilizing a hashing algorithm similar to a
checksum. Software code can be signed this way and checked at runtime to validate it has not been changed.
Typically the code gets a signature calculated by the code owner and this signature is then stored on the system
with the code. When the code later executes, it can self validate by using the same algorithm to create its own
signature and compare to the pre-computed stored signature, or some other system element can do this signature
calculation and check.
A Trusted Element in the scope of system software is a piece of code that is known to be authentic. Trusted
code is either immutable (stored in such a way to prevent modification) or sufficient validation mechanisms
are in place to insure its authenticity.
The Root of Trust is the lowest layer of the system at which a guaranteed trusted element exists. If the first
code executed on systems is immutable, it becomes the Root of Trust in that system.
A Chain of Trust is a series of Trusted Elements whereby each element in the chain is validated as "trusted"
by the element before it. A Chain of Trust starts with a Root of Trust element, which validates successive
element in the chain, and so on.
ASR 5500 System Administration Guide, StarOS Release 21.4
475

Cisco ASR 5000 Series Specifications

General

Brand	Cisco
Model	ASR 5000 Series
Category	Network Router
Language	English