Is there a board readily available able that has a bootable RO media?

[RodneyFulk]

I am researching a possible project where I need to use read only media to boot from and run the main OS from. Think of a LiveCD type of setup. This project will be a network appliance and I am looking for ways to make the OS read only since this appliance will be accessible to hackers.

Basically the intent is that a PC will communicate with the board through a serial console or over the OTG port. The board will be connected to the network and I need the OS to be RO to prevent unauthorized modifications to the OS.

I am using the idea of a LiveCD as my model.

For this particular application I need less than 8gig of storage.

In essence the PC will monitor the i.MX6 board via the otg/console connection and when it sees no action from the board it will attempt to reset the board. I want the OS up and running very quickly but need the protection of a RO partition as mentioned. I am thinking some sort of mechanism where the OS can be updated via flashing or have some sort of hardware write protect switch so the OS media would be RO except when I desire to update it.

[RodneyFulk]

Looking at the Riot board it looks like it will fit the bill. If I am reading the documents correctly it is showing the SD is using MMC2, uSD is using MMC3 and eMMC is using MMC4. I am assuming these are the ports you mentioned. Would be nice if they had a variant that uses the quad or quad + versions of the i.mx6 processor instead of the solo but checking into it this board will do all that I need. And for the applications that I plan to use it for the board should work well even if it is a solo processor.  And the software I want to run on it supports that board so it is a win all the way around.

Again thanks for the suggestion.

Rodney

[RodneyFulk]

So any board with eMMC support should support this write protect mode? Such as the Nitrogen Max board from boundary devices?

I will be in physical control of the box so physical access protection won't be necessary. Reason for the need for protection is this box will be used during hacker competitions and I want to make it very difficult for someone to control the box from the network side. The intent is that a simple reboot will be all that is needed once the write protect is enabled to thwart a hacker changing configurations or installing software . I will likely also use an SD card for the things that need writing.

[art]

To make the hardware write protection feature accessible, the corresponding hardware WP pin should be physically accessible. Also, please note that only the SD1 and SD2 ports of the i.MX6 series processors have this feature implemented. Unfortunately, for unclear reason, none of the NXP or Boundary Devices boards use this hardware write protection feature (these boards use the SD3 and SD4 ports, that don't have this feature implemented, to access SD and eMMC devices, and use the SD1 and SD2 port related pins for some other purposes). However, if (as you said) the physical protection of the board is not a problem, seems that you can use the RIoT board by Element14:

https://www.element14.com/community/community/designcenter/single-board-computers/riotboard

It has a SD card socket on the SD2 port that can be used as a boot device and can be write protected using the hardware write protection feature of the SD2 port with the regular 'Lock' switch of an SD card. For storage operations, the on-board eMMC device on the SD4 port can be used.

Best Regards,

Artur

[RodneyFulk]

This sounds exactly what I am looking for. So I can use a standard SD card, put my OS on this card, when I want to update the system I turn off the write protect then turn it back on when complete. And setup the eMMC device as the "scratch" drive for anything needing to be written to the drive for.

I will have to do further research on how to properly boot such a system and run the system but atleast I have a good idea on where to start hardware wise. Thank you very much for your help!  I will be picking up a riotboard and start playing with that functionality.

[art · Accepted solution]

The adequate solution for your security requirement seems to use an eMMC memory as the boot media and enable the hardware write protection on the corresponding SD Host port of the i.MX6 processor. The write protection can be enabled by the hardware Write Protection (WP) pin and, for example, hidden external switch. Also, to enhance the protection against unauthorised access, the whole board can be enclosed to a protected box with some mechanical tamper detection switch/protection wire, and the on-chip tamper detection feature of the i.MX6 processor can be used to signal an unauthorised access.

Have a great day,
Artur

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------