OrchestraOS Security Architecture

The security measures implemented in OrchestraOS are summarized in the table below.

Security features

Security Feature	Domain	Description
Chain of trust at boot	Booting process	Ensures that only signed kernel and U-Boot (bootloader) images can be loaded into memory. Verification is performed by a hardware cryptographic peripheral provided by the chip vendor (for example, on NXP platforms this may use CAAM and fused keys).
Secure world (ARM Trusted Firmware, OP-TEE/TEE)	Booting process	Enables a Trusted Execution Environment (TEE) for trusted applications and security services. It isolates secure workloads from the non-secure Linux environment to protect secrets and sensitive operations.
Encrypted LVM partition	Data storage	Provides an additional layer of protection for proprietary application data and sensitive runtime assets (e.g., certificates and secrets) stored on persistent storage.
TPM2 support	Secrets handling	Optional TPM2 support, including a PKCS#11 interface and TPM2-TSS Python bindings that can be used by applications for secure key management and cryptographic operations.
OrchestraD	Application	OrchestraD is a daemon that provides a secure channel for remote control, provisioning, and telemetry between the device and the Orchestra Platform (see the documentation page).