How do you establish that code running on a remote device or accelerator is what you deployed?

The problem

Physical access defeats software controls. A device an attacker holds can be disassembled, its storage read, its firmware replaced. Software running on it cannot prove its own integrity, because the compromised software would be the thing making the claim.

Trust has to originate in hardware.

The chain

• A hardware root of trust — immutable boot code and keys in silicon, which the attacker cannot replace.
• Measured boot, where each stage measures the next before executing it and records the measurement in a tamper-resistant register.
• Remote attestation, where the device signs the measurement chain with a hardware-held key so the platform can verify what actually booted before granting access.
• Attestation as an authorisation input, not merely a log entry. A device failing attestation should receive restricted or no access — otherwise the mechanism produces evidence nobody acts on.
• Sealed storage, so secrets are released only to a known-good software state and extracting the storage yields nothing usable.

What it does and does not cover

It establishes what booted. It does not establish that the running system has stayed uncompromised — runtime compromise after a valid boot is outside its scope and needs separate runtime integrity monitoring.

Nor does it help if the signed image itself is malicious, which is why the update signing key is the most security-critical asset in the system and why build provenance matters as much as the attestation chain.

The operational realities

Key management is the hard part: the signing key compromises the fleet if leaked, and losing it makes the fleet unupdatable. Hardware security modules, split control and a tested rotation procedure are required rather than advisable.

And attestation failures need a defined response. A firmware bug can cause a fleet-wide failure, so the platform needs an ability to distinguish that from an attack and a controlled path to restore service without simply disabling the check.