安全的物联网：第2部分，安全启动，“信任的根”为嵌入式设备资料下载

　　The only solution to protect against attacks that try to breach the casing （i.e.， the hardware） of an electronic device is to use a microcontroller that starts executing software from an internal， immutable memory （note that not every microcontroller has this setup and capability）。 The software stored in the microcontroller is considered inherently trusted （i.e.， the root of trust） because it cannot be modified. Such impregnable protection can be achieved using read-only memory （ROM）。 Alternatively， flash （EEPROM） memory internal to the microcontroller can also be used to store the root-of-trust software， if suitable security exists. Either there is a fuse mechanism to make this flash memory nonmodifiable （as a ROM） once the software has been written into it， or there is a proper authentication mechanism that allows only authorized persons to write the root-of-trust software in flash memory. If this early software can be modified without control， trust cannot be guaranteed. “Early” means that it is the first piece of software executed when the microcontroller is powered on. Hence， the requirement for inherent trustworthiness of this initial software. If this software is trustworthy， then it can be used for verifying the signature of the application before relinquishing the control of the microcontroller. It is like a castle built on strong foundations.