Embedded Security

Hardware Root-of-Trust:

The Medusa2 SPU includes a cryptographic co-processor with ultra-secure hardware-based cryptographic key storage and cryptographic countermeasures which strengthens protection against any potential software-related backdoor weakness. 

Nebulon SPUs use secure boot capabilities to ensure that the lowest levels of nebOS are not tampered with and that only trusted nebOS firmware from Nebulon loads at startup. In nebOS, security begins in immutable code that is part of its CPU and laid down during card fabrication. This ensures the SPU only boots using firmware which is authentic and properly signed by Nebulon.

End-to-end Encryption:

Encryption is always-on in-flight and at-rest with zero-touch, hardware-assisted key management. Dedicated AES hardware engines power line-speed encryption as data is accessed. As Nebulon smartInfrastructure uses a scale-out architecture, each SPU in a nPod participates in data encryption and decryption using their own AES hardware engine. The SPU in the application server encrypts data as it is written. Similarly, the SPU in the application server decrypts data as it is read. This ensures that data is protected as it enters or leaves the Secure Enclave without exposing plaintext data to the network.