1
1
My company is developing a product that is basically a Linux PC with custom software in a fancy box.
Since it uses a commercial SSD for the filesystem, I'm worried that an unscrupulous customer could disassemble the unit, download all of our software off the SSD, and make their own system.
The obvious answer would be to use a BIOS HDD password, but the system has to boot completely unattended. Are there any options out there to encrypt our data, but still boot without entering any passwords? Maybe something related to the CPU serial number or MAC address?
If reverse-engineering the device is a concern to you, then why not assign a unique ID for each device manufactured and embedding that ID into the code so that it can be traced in the event someone does reverse-engineer it? – bwDraco – 2014-04-14T16:56:51.673
2I have never seen a Linux implementation, but what you are asking for is basically what the TPM was designed for. Does your system have a TPM? Theoretically the drive encryption keys go on the TPM, and theoretically cannot be extracted. (See bitlocker) – Zoredache – 2014-04-14T17:05:35.783