Remote Attestation of Control Nodes

Before the plant will speak to an edge FPGA, the node must prove - with a signed measurement - that it is running exactly the firmware policy expects.

Trust, but verify continuously

Secure boot ensures a node runs only signed firmware; remote attestation lets the rest of the plant confirm which signed firmware, and that it has not been rolled back to a known-vulnerable version. Each node accumulates a measurement of its boot chain (see secure boot) into a protected register and can produce a signed quote of that measurement on demand. A verifier compares the quote to a golden value for the node's role.

The attestation exchange

# Verifier side: gate all access on a fresh, matching quote
def attest(node):
    nonce = random_nonce()                       # anti-replay
    quote = node.quote(nonce)                     # signed by device key
    if not verify_sig(quote, node.ek_pub):        # genuine device?
        return REJECT
    if quote.nonce != nonce:                       # fresh, not replayed?
        return REJECT
    if quote.measurement != golden(node.role):    # expected firmware?
        return REJECT
    if quote.fw_version < policy.min_version:      # no rollback
        return REJECT
    return ACCEPT

Coupled to identity issuance

Attestation is not a one-time gate. Because control-node certificates are short-lived (see zero-trust identity), every renewal re-runs attestation. A node whose firmware is tampered mid-operation fails its next renewal within hours and is cut off; peers stop accepting its mTLS sessions and the supervisor treats it as failed and drives toward a safe state. This continuous re-verification is what turns a static boot check into an ongoing property of the running plant.

Freshness and rollback protection

Two properties beyond a matching measurement are essential. A nonce ensures the quote is fresh, so an attacker cannot replay a previously valid quote from a since-tampered node. A monotonic firmware-version check ensures a validly signed but older, known-vulnerable image is rejected even though its signature verifies - a valid signature never means a safe artifact. Both are enforced by the verifier before any actuation path is opened to the node, and both feed the decision-audit lineage so that every accepted node's attested state is on the record.

Truth table of the decision

Design status

The attestation protocol, nonce handling, rollback protection, and verifier are implemented against development boards and the twin. Production device endorsement keys and the golden-measurement registry are provisioned during the FOAK build; attestation is not yet gating a live reactor's actuators.