Controlling security state of commercial off the shelf (COTS) system

1. A method for secure booting, the method comprising:

receiving a public key from a security device;

validating the security device by comparing the received public key with a hash code;

in response to the security device being successfully validated, receiving custom boot codes from the security device and storing the custom boot codes in a microprocessor, wherein the custom boot codes are received only after successful validation of the security device, and further wherein the microprocessor is located in a programmable memory of a primary processor;

programming the programmable memory by executing the custom boot codes; and

executing a boot sequence of the primary processor by the programmable memory.

2. The method of claim 1 , wherein the security device comprises a Hardware Root of Trust (HRoT) device.

3. The method of claim 1 , wherein the microprocessor comprises a Secure Device Manager (SDM).

4. The method of claim 1 , wherein the programmable memory comprises a Field-Programmable Gate Array (FPGA).

5. The method of claim 1 , further comprising:

monitoring, by the security device; boot sequence of the primary processor.

6. The method of claim 1 , further comprising:

filtering, by the security device, messages to and from the primary processor.

7. The method of claim 1 , wherein programming the programmable memory further comprises:

loading, authenticating, decrypting and programming programmable logic of the programmable memory; and

loading, authenticating, decrypting and transmitting image of the programmable memory to a Platform Controller Hub (PCH).

8. The method of claim 1 , wherein the security device, the primary processor, and the programmable memory are connected through a Peripheral Component Interconnect Express (PCIe) bus.

9. The method of claim 1 , wherein the custom boot codes comprise Physically Unclonable Function (PUF) to protect the custom boot codes.

10. The method of claim 9 , wherein the PUF is encrypted by a secure key stored in the security device, and is decrypted by the secure key to protect the custom boot codes.

11. The method of claim 1 , wherein the custom boot codes are encrypted with Advanced Encryption Standard (AES).

12. The method of claim 1 , wherein executing the boot sequence of the primary processor comprises:

executing a Unified Extensible Firmware Interface (UEFI) boot sequence for the primary processor.

13. A system for secure hooting, the system comprising:

a primary processor comprising a Field-Programmable Gate Array (FPGA); and

a security device;

wherein the primary processor is configured to:

receive a public key from the security device;

validate the security device by comparing the received public key with a hash code;

in response to the security device is-being successfully validated, receive custom boot codes from the security device and store the custom boot codes in a Secure Device Manager (SDM), wherein the custom boot codes are received only alter successful validation of the security device, and further wherein the SDM is located in the FPGA;

program the FPGA by executing the custom boot codes; and

execute a boot sequence for the primary processor by the programmed FPGA.

14. The system of claim 13 , wherein the security device, the primary processor, and the FPGA are connected through a Peripheral Component Interconnect Express (PCIe) bus.

15. The system of claim 13 , wherein the primary processor further comprises a BootROM, wherein the BootROM executes the custom boot codes stored in the SDM.

16. The system of claim 13 , wherein the primary processor further comprises a Platform Controller Hub (PCH).

17. The system of claim 16 , wherein the FPGA and the PCH are connected via an emulated Quad Serial Peripheral Interface (QSPI).

18. The system of claim 13 , wherein the security device comprises a Hardware Root of Trust (HRoT) device.