Supply-Chain Security for Hardware and Software

Components, firmware, and dependencies are verified for provenance before they enter the plant, because a tampered part defeats every runtime control downstream.

The trust starts before install

Runtime security assumes the hardware and software are what they claim to be. If an FPGA arrives with a subverted boot ROM, or a dependency ships with a backdoor, downstream secure boot and attestation are anchored to a lie. Kronos treats the supply chain as part of the attack surface: it verifies provenance of hardware, firmware, and software before they reach the OT environment.

Controls across the chain

• Provenance and SBOMs for all software and firmware - see SBOM and provenance.
• Signed firmware and reproducible builds so a binary can be tied to reviewed source - see firmware signing.
• Trusted-supplier requirements and incoming inspection for security-critical hardware (FPGAs, HSMs, diode hardware).
• Device provisioning under Kronos control: keys and root-of-trust configuration are set in a controlled facility, not accepted from the vendor's defaults.
• ML models treated as supply-chain artifacts too - see ML model supply chain.

Anchoring the root of trust in-house

Because field secure boot depends on fused keys, those keys are provisioned by Kronos during a controlled manufacturing step rather than trusting factory defaults. This means a compromised vendor cannot pre-load a key it controls into a device destined for the reactor. The provisioning ceremony itself is under separation of duties.

Honest residual

Deep hardware implants (malicious silicon) are the hardest supply-chain threat and cannot be fully excluded by inspection alone; Kronos mitigates with trusted sourcing, attestation, and behavioral monitoring, and accepts a residual risk that is documented in the threat model. Design status: SBOM, signing, and provisioning workflows are implemented for the toolchain and twin; hardware inspection and vendor programs are defined for the FOAK procurement, which begins ahead of Q2 2027 construction.