Skip to content

Security: neuraparse/neuraos

Security

docs/security.md

NeuralOS Security Best Practices

Overview

NeuralOS is designed with security as a core principle. This document outlines security features and best practices for deploying NeuralOS in production environments.

Security Architecture

1. Secure Boot Chain

Boot Verification:

ROM Code (Immutable)
    ↓ Verify signature
U-Boot (Signed)
    ↓ Verify signature
Linux Kernel (Signed)
    ↓ Verify integrity
Root Filesystem (dm-verity)

Implementation:

# Enable secure boot in U-Boot
setenv bootdelay -2
setenv verify yes

# Kernel command line with dm-verity
root=/dev/mapper/root ro rootfstype=ext4 \
dm-mod.create="root,,,ro,0 $(cat /sys/block/mmcblk0p2/size) verity 1 \
/dev/mmcblk0p2 /dev/mmcblk0p3 4096 4096 $(cat /sys/block/mmcblk0p2/size) 1 \
sha256 $(cat /root-hash.txt)"

2. Model Security

Encrypted Models:

// Encrypt model with AES-256-GCM
openssl enc -aes-256-gcm -in model.tflite -out model.enc \
    -K $(cat key.hex) -iv $(cat iv.hex)

// Decrypt at runtime in NPIE
npie_model_load_encrypted(ctx, &model, "model.enc", key, iv);

Model Signing:

# Sign model with private key
openssl dgst -sha256 -sign private_key.pem -out model.sig model.tflite

# Verify signature before loading
openssl dgst -sha256 -verify public_key.pem -signature model.sig model.tflite

3. Network Security

Firewall Configuration:

# Default deny
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (change port from default)
iptables -A INPUT -p tcp --dport 2222 -j ACCEPT

# Allow NPIE API (local only)
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT

# Save rules
iptables-save > /etc/iptables.rules

TLS/SSL:

# Generate self-signed certificate
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

# Use mbedTLS for lightweight TLS
BR2_PACKAGE_MBEDTLS=y

4. eBPF Security Policies

Example eBPF LSM:

// Restrict model file access
SEC("lsm/file_open")
int BPF_PROG(restrict_model_access, struct file *file) {
    const char *filename = file->f_path.dentry->d_name.name;
    
    // Only allow NPIE daemon to access .tflite files
    if (strstr(filename, ".tflite") || strstr(filename, ".onnx")) {
        uid_t uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
        if (uid != NPIE_UID) {
            return -EPERM;
        }
    }
    
    return 0;
}

Best Practices

1. System Hardening

Disable Unnecessary Services:

# Disable unused services
/etc/init.d/S50telnet stop
rm /etc/init.d/S50telnet

# Use SSH key authentication only
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
echo "PermitRootLogin prohibit-password" >> /etc/ssh/sshd_config

Read-Only Root Filesystem:

# Mount root as read-only
mount -o remount,ro /

# Use overlay for writable directories
mount -t overlay overlay -o lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work /mnt

Kernel Hardening:

# Kernel parameters
sysctl -w kernel.dmesg_restrict=1
sysctl -w kernel.kptr_restrict=2
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.tcp_syncookies=1

2. User Management

Principle of Least Privilege:

# Create dedicated user for NPIE
adduser -D -H -s /bin/false npie

# Run NPIE daemon as npie user
su -s /bin/sh npie -c '/usr/bin/npie-daemon'

Disable Root Login:

# Lock root account
passwd -l root

# Use sudo for administrative tasks
adduser admin
adduser admin wheel
echo "%wheel ALL=(ALL) ALL" > /etc/sudoers.d/wheel

3. Data Protection

Encrypt Sensitive Data:

# Use dm-crypt for data partition
cryptsetup luksFormat /dev/mmcblk0p3
cryptsetup luksOpen /dev/mmcblk0p3 data
mkfs.ext4 /dev/mapper/data
mount /dev/mapper/data /data

Secure Deletion:

# Securely delete files
shred -vfz -n 3 sensitive_file.txt

4. Monitoring and Logging

System Logging:

# Configure syslog
echo "*.* /var/log/messages" >> /etc/syslog.conf

# Log NPIE events
npie-cli config set logging.level debug
npie-cli config set logging.file /var/log/npie.log

Intrusion Detection:

# Monitor failed login attempts
grep "Failed password" /var/log/messages

# Monitor file integrity
find /opt/neuraparse/models -type f -exec sha256sum {} \; > /var/checksums.txt

5. OTA Updates

Secure Update Process:

# Dual partition A/B system
# Partition A: /dev/mmcblk0p2 (active)
# Partition B: /dev/mmcblk0p3 (inactive)

# Download update (verify signature first)
wget https://updates.neuraparse.com/neuraos-update.img.sig
wget https://updates.neuraparse.com/neuraos-update.img

# Verify signature
openssl dgst -sha256 -verify update_key.pub \
    -signature neuraos-update.img.sig neuraos-update.img

# Flash to inactive partition
dd if=neuraos-update.img of=/dev/mmcblk0p3 bs=4M

# Update bootloader to use new partition
fw_setenv boot_partition 3

# Reboot
reboot

Rollback on Failure:

# In U-Boot, check boot count
if test ${boot_count} -gt 3; then
    # Rollback to previous partition
    setenv boot_partition 2
    saveenv
fi

Security Checklist

Pre-Deployment

  • Enable secure boot
  • Sign all firmware components
  • Enable dm-verity for root filesystem
  • Change default passwords
  • Disable unnecessary services
  • Configure firewall rules
  • Enable TLS for network communication
  • Encrypt sensitive data partitions
  • Set up secure logging
  • Configure OTA update mechanism

Runtime

  • Monitor system logs regularly
  • Update firmware and packages
  • Rotate SSH keys periodically
  • Audit user accounts
  • Check file integrity
  • Monitor network traffic
  • Review eBPF policies
  • Test backup and recovery

Incident Response

  • Document security incidents
  • Isolate compromised devices
  • Analyze logs and forensics
  • Patch vulnerabilities
  • Update security policies
  • Notify stakeholders

Compliance

Standards

NeuralOS can be configured to meet various security standards:

  • IEC 62443 - Industrial automation and control systems security
  • ISO/IEC 27001 - Information security management
  • NIST Cybersecurity Framework - Risk management
  • GDPR - Data protection and privacy (EU)
  • HIPAA - Healthcare data security (US)

Certifications

For safety-critical applications, consider:

  • Common Criteria (CC) - Security evaluation
  • FIPS 140-2/3 - Cryptographic module validation
  • DO-178C - Airborne systems (aviation)
  • ISO 26262 - Automotive functional safety

Resources

Contact

For security issues, please contact:

Do not disclose security vulnerabilities publicly until they have been addressed.

There aren't any published security advisories