Humanoid Security Platform — System Architecture

QEMU aarch64 virt, ARM TrustZone, OP-TEE, fTPM, EROFS dm-verity, and Secure mTLS

Humanoid Security Platform — System Architecture QEMU aarch64 virt, ARM TrustZone, OP-TEE, fTPM, EROFS dm-verity, and Secure mTLS Immutable BootROM · Hardware Root of Trust · Hardware / QEMU Virt Platform · RoT (EL3) Immutable BootROM Hardware Root of Trust RoT (EL3) Virtual eMMC RPMB · Replay-Protected Storage · Hardware / QEMU Virt Platform · Replay Proof Virtual eMMC RPMB Replay-Protected Storage Replay Proof TF-A (BL31) · Secure Monitor / PSCI · TrustZone Secure World (EL3 / S-EL1 / S-EL0) · EL3 TF-A (BL31) Secure Monitor / PSCI EL3 OP-TEE Core · Trusted OS Kernel · TrustZone Secure World (EL3 / S-EL1 / S-EL0) · S-EL1 OP-TEE Core Trusted OS Kernel S-EL1 fTPM 2.0 TA · ms-tpm-20-ref Engine · TrustZone Secure World (EL3 / S-EL1 / S-EL0) · S-EL0 TA fTPM 2.0 TA ms-tpm-20-ref Engine S-EL0 TA PKCS#11 TA · Isolated Key Storage · TrustZone Secure World (EL3 / S-EL1 / S-EL0) · S-EL0 TA PKCS#11 TA Isolated Key Storage S-EL0 TA Hardened L4T Kernel · Linux 6.x + KSPP · Normal World (Non-Secure EL1 / EL0 REE) · NS-EL1 Hardened L4T Kernel Linux 6.x + KSPP NS-EL1 Authenticated Initramfs · Root Hash Verifier · Normal World (Non-Secure EL1 / EL0 REE) · Early REE Authenticated Initramfs Root Hash Verifier Early REE EROFS + dm-verity · Immutable Read-Only Rootfs · Normal World (Non-Secure EL1 / EL0 REE) · Tamper-Proof EROFS + dm-verity Immutable Read-Only Rootfs Tamper-Proof Humanoid mTLS Client · OpenSSL 3.x Provider · Normal World (Non-Secure EL1 / EL0 REE) · Secure Client Humanoid mTLS Client OpenSSL 3.x Provider Secure Client Attestation Agent · tpm2-tools Quote + IMA Log · Normal World (Non-Secure EL1 / EL0 REE) · Quote Client Attestation Agent tpm2-tools Quote + IMA Log Quote Client Cloud Fleet Manager · Mutual TLS 1.3 Server · Cloud Infrastructure · Control Center Cloud Fleet Manager Mutual TLS 1.3 Server Control Center Attestation Verifier · Remote Integrity Verification · Cloud Infrastructure · Zero-Trust Gate Attestation Verifier Remote Integrity Verification Zero-Trust Gate Verify BL31 Load BL32 Secure NVRAM Dispatch TA Dispatch TA Jump BL33 SMC /dev/tee0 Unpack Verify & Mount C_Sign (SMC) tpm2_quote TLS 1.3 mTLS Quote + IMA Log Hardware / QEMU Virt Platform TrustZone Secure World (EL3 / S-EL1 / S-EL0) Normal World (Non-Secure EL1 / EL0 REE) Cloud Infrastructure Legend Frontend Backend Database Cloud Security