NVIDIA Jetson security for production deployment

Published: January 2026 Last Updated: January 28, 2026 Reading Time: 25 minutes Target Audience: Edge AI Engineers, DevSecOps, Embedded Systems Architects

---

Why edge devices need their own security

A smart camera in a factory or a self-driving car on the road runs on a small computer, often an NVIDIA Jetson module. Unlike a desktop machine inside a locked building, these devices sit where anyone can reach them. The same modules run industrial automation, healthcare diagnostics and smart-city infrastructure.

Why does security matter here?

• Physical access: Someone could literally touch and try to hack the device
• Sensitive data: These devices often process private information (faces, license plates, medical scans)
• No IT support nearby: They need to protect themselves without a human watching over them
• Critical operations: If hacked, they could cause physical damage (stop a production line, crash a vehicle)

What the sections below cover:

1. Lock down the boot process - Make sure only your approved software can run on the device
2. Protect your containers - Keep your AI applications isolated and secure
3. Secure communications - Encrypt all data going in and out
4. Update safely - Push new software without bricking the device
5. Trust no one - Implement zero-trust architecture where every access is verified

Everything below is built on JetPack 6.x and on published security practice from 2024 and 2025.

---

Table of contents

1. Secure boot and trusted execution
2. Container security for edge AI
3. Network security architecture
4. Firmware security and OTA updates
5. Hardware security module integration
6. Encryption at rest and in transit
7. Vulnerability management
8. Zero-trust architecture for edge
9. Security hardening checklist

---

1. Secure boot and trusted execution

Understanding the chain of trust

Secure Boot on NVIDIA Jetson establishes a hardware-rooted chain of trust that prevents execution of unauthorized code from the moment power is applied. The root-of-trust originates in on-die BootROM code that authenticates boot components using Public Key Cryptography (PKC) keys stored in write-once-read-multiple fuse devices.

Supported Cryptographic Standards:

• Jetson Orin series: RSA-3K keys only
• Jetson Xavier series: RSA-2K/RSA-3K support
• Hash algorithms: SHA-256, SHA-384, SHA-512

Implementing secure boot

Step 1: generate secure boot keys

# Generate RSA-3K key pair for Jetson Orin
openssl genrsa -out rsa_priv.pem 3072

# Extract public key
openssl rsa -in rsa_priv.pem -outform PEM -pubout -out rsa_pub.pem

# Generate PKC key hash for fuse programming
# NVIDIA recommends using HSM for production key generation
python3 $L4T_DIR/bootloader/tegraflash.py \
    --chip 0x23 \
    --cmd "pkc_hash rsa_priv.pem pkc_hash.bin"

Step 2: fuse programming for secure boot

# WARNING: Fuse burning is IRREVERSIBLE
# Factory Secure Key Provisioning (FSKP) burns the public key hash

# Generate fuse configuration
cat > fuse_config.xml << 'EOF'
<?xml version="1.0"?>
<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="PublicKeyHash" size="48" value="YOUR_PKC_HASH_HEX"/>
    <fuse name="SecurityMode" size="4" value="0x3"/>
    <fuse name="OdmLock" size="4" value="0x1"/>
</genericfuse>
EOF

# Burn fuses (PRODUCTION ONLY - IRREVERSIBLE)
sudo ./flash.sh --cmd "burnfuses" -u rsa_priv.pem jetson-agx-orin-devkit mmcblk0p1

OP-TEE: Open Portable Trusted Execution Environment

OP-TEE provides ARM TrustZone-based isolation. It creates two execution environments:

1. Non-Secure Environment (NSE): Normal world where Linux runs
2. Secure Environment: Trusted Applications (TAs) with hardware-protected memory

OP-TEE Version in JetPack 6.x: v4.2.0

Deploying trusted applications

// Example: Secure key storage Trusted Application
// File: ta/secure_key_storage.c

#include <tee_internal_api.h>
#include <tee_internal_api_extensions.h>

#define TA_SECURE_KEY_CMD_STORE    0
#define TA_SECURE_KEY_CMD_RETRIEVE 1
#define TA_SECURE_KEY_CMD_DELETE   2

TEE_Result TA_CreateEntryPoint(void)
{
    DMSG("Secure Key Storage TA initialized");
    return TEE_SUCCESS;
}

TEE_Result TA_InvokeCommandEntryPoint(void *sess_ctx,
    uint32_t cmd_id, uint32_t param_types,
    TEE_Param params[4])
{
    switch (cmd_id) {
    case TA_SECURE_KEY_CMD_STORE:
        return store_key_secure(param_types, params);
    case TA_SECURE_KEY_CMD_RETRIEVE:
        return retrieve_key_secure(param_types, params);
    default:
        return TEE_ERROR_BAD_PARAMETERS;
    }
}

UEFI secure boot configuration

JetPack 6.x supports UEFI Secure Boot with customizable Platform Key (PK), Key Exchange Key (KEK), and db/dbx databases.

# Generate UEFI Secure Boot keys
# Platform Key (PK)
openssl req -new -x509 -newkey rsa:2048 -keyout PK.key -out PK.crt \
    -days 3650 -nodes -subj "/CN=Jetson Platform Key/"

# Key Exchange Key (KEK)
openssl req -new -x509 -newkey rsa:2048 -keyout KEK.key -out KEK.crt \
    -days 3650 -nodes -subj "/CN=Jetson KEK/"

# Database Key (db)
openssl req -new -x509 -newkey rsa:2048 -keyout db.key -out db.crt \
    -days 3650 -nodes -subj "/CN=Jetson DB Key/"

# Convert to ESL format for UEFI
cert-to-efi-sig-list -g $(uuidgen) PK.crt PK.esl
sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth

# Flash with UEFI Secure Boot enabled
sudo ./flash.sh --uefi-keys PK.key,KEK.key,db.key \
    --uefi-enc \
    jetson-agx-orin-devkit mmcblk0p1

---

2. Container security for edge AI

NVIDIA Container Runtime configuration

JetPack includes NVIDIA Container Runtime with Docker integration, which runs GPU-accelerated containers. Production deployments need the daemon itself hardened.

Secure Docker daemon configuration

// /etc/docker/daemon.json
{
    "default-runtime": "nvidia",
    "runtimes": {
        "nvidia": {
            "path": "nvidia-container-runtime",
            "runtimeArgs": []
        }
    },
    "storage-driver": "overlay2",
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "10m",
        "max-file": "3"
    },
    "live-restore": true,
    "userland-proxy": false,
    "no-new-privileges": true,
    "seccomp-profile": "/etc/docker/seccomp-profile.json",
    "icc": false,
    "userns-remap": "default",
    "tls": true,
    "tlscacert": "/etc/docker/ca.pem",
    "tlscert": "/etc/docker/server-cert.pem",
    "tlskey": "/etc/docker/server-key.pem",
    "tlsverify": true
}

Container security best practices

# Dockerfile for secure Jetson AI application
FROM nvcr.io/nvidia/l4t-ml:r36.2.0-py3

# Run as non-root user
RUN groupadd -r aiapp && useradd -r -g aiapp aiapp

# Install only necessary packages
RUN apt-get update && apt-get install -y --no-install-recommends \
    libopencv-dev \
    && rm -rf /var/lib/apt/lists/*

# Set secure permissions
COPY --chown=aiapp:aiapp ./app /app
WORKDIR /app

# Drop all capabilities except those required
# GPU access requires specific capabilities
USER aiapp

# Health check for container orchestration
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
    CMD python3 -c "import torch; assert torch.cuda.is_available()"

# Read-only root filesystem where possible
ENTRYPOINT ["python3", "inference_server.py"]

Kubernetes on edge with K3s

For fleet deployments, K3s provides lightweight Kubernetes with GPU support.

# k3s-gpu-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: nvidia-device-plugin
  namespace: kube-system
data:
  config: |
    version: v1
    flags:
      migStrategy: none
    sharing:
      mps:
        enabled: false
      timeSlicing:
        enabled: true
        resources:
        - name: nvidia.com/gpu
          replicas: 4
---
# Pod Security Policy for AI workloads
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: jetson-ai-restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: true

NVIDIA Container Toolkit security update (September 2024)

NVIDIA released critical security updates for Container Toolkit. Ensure you're running the latest version:

# Check current version
nvidia-container-cli --version

# Update to latest secure version
sudo apt-get update
sudo apt-get install nvidia-container-toolkit

# Verify security patches
dpkg -l | grep nvidia-container

---

3. Network security architecture

Firewall configuration for Jetson Platform Services

NVIDIA provides reference firewall rules through Jetson Platform Services. Customize these for your deployment.

#!/bin/bash
# jetson_firewall_hardening.sh

# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# Default policies: deny all incoming, allow outgoing
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# SSH access (restrict to management network)
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

# Inference API (HTTPS only)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Prometheus metrics (internal only)
iptables -A INPUT -p tcp --dport 9090 -s 10.0.0.0/8 -j ACCEPT

# Block NVIDIA DeepStream default ports from external access
iptables -A INPUT -p tcp --dport 8554 -s ! 127.0.0.1 -j DROP  # RTSP
iptables -A INPUT -p tcp --dport 8080 -s ! 10.0.0.0/8 -j DROP  # HTTP

# Rate limiting for DDoS protection
iptables -A INPUT -p tcp --syn -m limit --limit 10/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# Log dropped packets (for security monitoring)
iptables -A INPUT -j LOG --log-prefix "JETSON_FW_DROP: " --log-level 4

# Save rules
iptables-save > /etc/iptables/rules.v4

# IPv6 hardening (if not needed, disable entirely)
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

Network segmentation for edge AI

# Network policy for Kubernetes deployments
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ai-inference-isolation
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: inference-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: monitoring
    ports:
    - protocol: TCP
      port: 9090
  # Block all other egress (air-gapped inference)
  - to: []

TLS configuration for edge services

# secure_inference_server.py
import ssl
from fastapi import FastAPI
import uvicorn

app = FastAPI()

# TLS 1.3 configuration
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ssl_context.minimum_version = ssl.TLSVersion.TLSv1_3
ssl_context.load_cert_chain(
    certfile='/etc/ssl/certs/jetson-server.crt',
    keyfile='/etc/ssl/private/jetson-server.key'
)
# Enable client certificate verification (mTLS)
ssl_context.verify_mode = ssl.CERT_REQUIRED
ssl_context.load_verify_locations('/etc/ssl/certs/ca-bundle.crt')

# Secure cipher suites
ssl_context.set_ciphers('TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256')

@app.get("/health")
async def health_check():
    return {"status": "healthy"}

@app.post("/inference")
async def run_inference(data: dict):
    # Your secure inference logic here
    pass

if __name__ == "__main__":
    uvicorn.run(
        app,
        host="0.0.0.0",
        port=443,
        ssl_keyfile='/etc/ssl/private/jetson-server.key',
        ssl_certfile='/etc/ssl/certs/jetson-server.crt',
        ssl_ca_certs='/etc/ssl/certs/ca-bundle.crt',
        ssl_cert_reqs=ssl.CERT_REQUIRED
    )

---

4. Firmware security and OTA updates

A/B redundant update architecture

NVIDIA Jetson supports A/B slot-based updates for brick-free, atomic updates. This is critical for remote edge deployments.

# Check current boot slot
nvbootctrl get-current-slot

# List all slots and their status
nvbootctrl dump-slots-info

# Trigger slot switch after successful update
nvbootctrl set-active-boot-slot 1

Secure OTA implementation

# secure_ota_client.py
import hashlib
import hmac
import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.x509 import load_pem_x509_certificate
import subprocess
import os

class SecureOTAClient:
    def __init__(self, server_url: str, device_id: str):
        self.server_url = server_url
        self.device_id = device_id
        self.ca_cert = '/etc/ota/ca-bundle.crt'
        self.device_cert = '/etc/ota/device.crt'
        self.device_key = '/etc/ota/device.key'

    def check_for_updates(self) -> dict:
        """Check OTA server for available updates with mTLS"""
        response = requests.get(
            f"{self.server_url}/api/v1/updates/{self.device_id}",
            cert=(self.device_cert, self.device_key),
            verify=self.ca_cert,
            timeout=30
        )
        return response.json()

    def verify_update_signature(self, update_path: str, signature: bytes) -> bool:
        """Verify update package signature using RSA-3K"""
        with open('/etc/ota/update-signing-key.pub', 'rb') as f:
            public_key = serialization.load_pem_public_key(f.read())

        with open(update_path, 'rb') as f:
            update_data = f.read()

        try:
            public_key.verify(
                signature,
                update_data,
                padding.PSS(
                    mgf=padding.MGF1(hashes.SHA384()),
                    salt_length=padding.PSS.MAX_LENGTH
                ),
                hashes.SHA384()
            )
            return True
        except Exception as e:
            print(f"Signature verification failed: {e}")
            return False

    def apply_update(self, update_path: str) -> bool:
        """Apply verified update to inactive slot"""
        # Get inactive slot
        result = subprocess.run(
            ['nvbootctrl', 'get-current-slot'],
            capture_output=True, text=True
        )
        current_slot = int(result.stdout.strip())
        target_slot = 1 if current_slot == 0 else 0

        # Apply update using NVIDIA's l4t_initrd_flash
        result = subprocess.run([
            'sudo', '/usr/sbin/nv_update_engine',
            '--install', update_path,
            '--slot', str(target_slot)
        ], capture_output=True, text=True)

        if result.returncode == 0:
            # Mark new slot as active
            subprocess.run([
                'nvbootctrl', 'set-active-boot-slot', str(target_slot)
            ])
            return True
        return False

    def rollback_on_failure(self):
        """Automatic rollback if health check fails post-update"""
        # This should be called from systemd service on boot
        health_ok = self.run_health_checks()
        if not health_ok:
            result = subprocess.run(
                ['nvbootctrl', 'get-current-slot'],
                capture_output=True, text=True
            )
            current_slot = int(result.stdout.strip())
            fallback_slot = 1 if current_slot == 0 else 0
            subprocess.run([
                'nvbootctrl', 'set-active-boot-slot', str(fallback_slot)
            ])
            subprocess.run(['reboot'])

Rollback protection

Prevent downgrade attacks by enabling anti-rollback counters:

# Enable rollback protection in BCT
# This prevents flashing older, potentially vulnerable firmware

# View current rollback counter
cat /sys/firmware/efi/efivars/RollbackProtection-*

# Rollback protection is managed through UEFI Secure Boot
# Keys must be updated atomically with firmware updates

---

5. Hardware security module integration

Firmware TPM (fTPM) on Jetson Orin

JetPack 6.1+ introduced firmware-based TPM 2.0 support. It removes the need for discrete TPM hardware and provides:

• Device attestation
• Secure key storage
• Measured boot
• Sealed storage

fTPM provisioning

# Verify fTPM is available
tpm2_getcap properties-fixed | grep -i manufacturer

# Initialize TPM
tpm2_clear

# Create primary key under storage hierarchy
tpm2_createprimary -C o -g sha384 -G ecc384 -c primary.ctx

# Create attestation key
tpm2_create -C primary.ctx -g sha384 -G ecc384 \
    -u ak.pub -r ak.priv -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|sign"

# Load attestation key
tpm2_load -C primary.ctx -u ak.pub -r ak.priv -c ak.ctx

# Make attestation key persistent
tpm2_evictcontrol -C o -c ak.ctx 0x81010002

Using TPM for TLS key protection

# tpm_tls_integration.py
import subprocess
import tempfile
from cryptography.hazmat.primitives import serialization

class TPMKeyManager:
    def __init__(self, tpm_handle: str = "0x81010001"):
        self.handle = tpm_handle

    def create_tls_key(self) -> bytes:
        """Create TLS private key protected by TPM"""
        with tempfile.NamedTemporaryFile(suffix='.pem') as f:
            # Generate key inside TPM
            subprocess.run([
                'tpm2_create', '-C', self.handle,
                '-g', 'sha256', '-G', 'rsa2048',
                '-u', 'tls_key.pub', '-r', 'tls_key.priv',
                '-a', 'fixedtpm|fixedparent|sensitivedataorigin|userwithauth|decrypt|sign'
            ], check=True)

            # Load key
            subprocess.run([
                'tpm2_load', '-C', self.handle,
                '-u', 'tls_key.pub', '-r', 'tls_key.priv',
                '-c', 'tls_key.ctx'
            ], check=True)

            # Export public key for certificate signing
            subprocess.run([
                'tpm2_readpublic', '-c', 'tls_key.ctx',
                '-f', 'pem', '-o', f.name
            ], check=True)

            with open(f.name, 'rb') as key_file:
                return key_file.read()

    def sign_with_tpm(self, data: bytes) -> bytes:
        """Sign data using TPM-protected key"""
        with tempfile.NamedTemporaryFile() as data_file, \
             tempfile.NamedTemporaryFile() as sig_file:
            data_file.write(data)
            data_file.flush()

            subprocess.run([
                'tpm2_sign', '-c', 'tls_key.ctx',
                '-g', 'sha256', '-s', 'rsassa',
                '-o', sig_file.name, data_file.name
            ], check=True)

            with open(sig_file.name, 'rb') as f:
                return f.read()

External HSM integration

For high-security deployments, integrate external HSMs:

# pkcs11-config.yaml for external HSM
# Supports Thales Luna, AWS CloudHSM, Azure HSM
pkcs11:
  library: /usr/lib/aarch64-linux-gnu/softhsm/libsofthsm2.so
  slot: 0
  pin_env: HSM_PIN

key_mappings:
  tls_server_key:
    label: "jetson-tls-key"
    type: EC
    curve: secp384r1
  signing_key:
    label: "jetson-code-sign"
    type: RSA
    size: 3072

---

6. Encryption at rest and in transit

LUKS disk encryption

Jetson Linux provides disk encryption based on Linux Unified Key Setup (LUKS) with hardware-accelerated AES-XTS via the Tegra Security Engine.

Automated disk encryption setup

# Generate encryption keys during provisioning
# Keys are derived from hardware-unique values via OP-TEE

# Flash with disk encryption enabled
sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
    --external-device nvme0n1p1 \
    -c tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
    --emc-fuse-dev-params tegra234-br-bct-diag-boot.dts \
    --network usb0 \
    -p "-c bootloader/generic/cfg/flash_t234_qspi_sdmmc_enc.xml" \
    --showlogs jetson-agx-orin-devkit mmcblk0p1

# Verify encryption is active
sudo dmsetup status | grep crypt
lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT,TYPE

Key derivation architecture

The encryption key derivation happens entirely in the secure world:

Secure storage for credentials

# secure_credential_store.py
from optee_client import TEESession, TrustedApplication
import json
import os

class SecureCredentialStore:
    """Store credentials in OP-TEE Secure Storage"""

    TA_UUID = "f4e750bb-1437-4fbf-8785-8d3580c34994"  # Example TA UUID

    def __init__(self):
        self.session = TEESession()
        self.ta = self.session.open_ta(self.TA_UUID)

    def store_credential(self, key: str, value: bytes) -> bool:
        """Store credential in secure world"""
        # TA command: STORE_CREDENTIAL = 0x01
        result = self.ta.invoke_command(
            0x01,
            params=[
                (TEESession.PARAM_TYPE_MEMREF_INPUT, key.encode()),
                (TEESession.PARAM_TYPE_MEMREF_INPUT, value)
            ]
        )
        return result.success

    def retrieve_credential(self, key: str) -> bytes:
        """Retrieve credential from secure world"""
        # TA command: RETRIEVE_CREDENTIAL = 0x02
        output_buffer = bytearray(4096)
        result = self.ta.invoke_command(
            0x02,
            params=[
                (TEESession.PARAM_TYPE_MEMREF_INPUT, key.encode()),
                (TEESession.PARAM_TYPE_MEMREF_OUTPUT, output_buffer)
            ]
        )
        if result.success:
            return bytes(output_buffer[:result.output_size])
        raise ValueError(f"Failed to retrieve credential: {key}")

    def rotate_credentials(self, key: str, new_value: bytes) -> bool:
        """Atomically rotate credential"""
        # TA command: ROTATE_CREDENTIAL = 0x03
        result = self.ta.invoke_command(
            0x03,
            params=[
                (TEESession.PARAM_TYPE_MEMREF_INPUT, key.encode()),
                (TEESession.PARAM_TYPE_MEMREF_INPUT, new_value)
            ]
        )
        return result.success

Data-in-transit security

# nginx.conf for edge inference gateway
# Strong TLS configuration

server {
    listen 443 ssl http2;
    server_name inference.edge.local;

    # TLS 1.3 only
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    # Certificate and key (consider TPM-backed)
    ssl_certificate /etc/ssl/certs/jetson-server-chain.crt;
    ssl_certificate_key /etc/ssl/private/jetson-server.key;

    # Client certificate verification (mTLS)
    ssl_client_certificate /etc/ssl/certs/client-ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/ca-chain.crt;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;

    location /v1/inference {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header X-Client-Cert $ssl_client_cert;
        proxy_set_header X-Client-DN $ssl_client_s_dn;
    }
}

---

7. Vulnerability management

Software bill of materials (SBOM) generation

# Generate SBOM for Jetson deployment using Syft
syft dir:/opt/nvidia --output spdx-json > jetson-sbom.spdx.json

# Scan for vulnerabilities using Grype
grype sbom:jetson-sbom.spdx.json --output json > vulnerabilities.json

# For Yocto-based builds, use meta layer scanning
# CVE-Check is built into BitBake
bitbake -c cve_check core-image-minimal

Automated CVE scanning pipeline

# .gitlab-ci.yml for Jetson security scanning
stages:
  - build
  - security-scan
  - deploy

security-scan:
  stage: security-scan
  image: registry.example.com/security-scanner:latest
  script:
    # Kernel configuration analysis
    - python3 /opt/tools/kernel_hardening_checker.py \
        --config ${CI_PROJECT_DIR}/kernel/.config \
        --output kernel-security-report.json

    # CVE scanning with Timesys Vigiles or similar
    - vigiles-cli scan \
        --manifest ${CI_PROJECT_DIR}/buildhistory/target-sdk/license.manifest \
        --kernel-config ${CI_PROJECT_DIR}/kernel/.config \
        --output vigiles-report.json

    # Container image scanning
    - trivy image --severity HIGH,CRITICAL \
        --format json \
        --output trivy-report.json \
        ${CONTAINER_IMAGE}

    # Fail on critical vulnerabilities
    - |
      CRITICAL_COUNT=$(jq '.Results[].Vulnerabilities | map(select(.Severity == "CRITICAL")) | length' trivy-report.json | paste -sd+ | bc)
      if [ "$CRITICAL_COUNT" -gt 0 ]; then
        echo "Found $CRITICAL_COUNT critical vulnerabilities"
        exit 1
      fi
  artifacts:
    reports:
      container_scanning: trivy-report.json
    paths:
      - kernel-security-report.json
      - vigiles-report.json

Continuous monitoring

# security_monitor.py
import subprocess
import json
import logging
from datetime import datetime
import requests

class JetsonSecurityMonitor:
    def __init__(self, alert_webhook: str):
        self.alert_webhook = alert_webhook
        self.logger = logging.getLogger(__name__)

    def check_secure_boot_status(self) -> dict:
        """Verify secure boot chain integrity"""
        result = subprocess.run(
            ['fuse-check', '--verify-sb'],
            capture_output=True, text=True
        )
        return {
            'secure_boot_enabled': 'ENABLED' in result.stdout,
            'chain_verified': result.returncode == 0
        }

    def check_disk_encryption(self) -> dict:
        """Verify disk encryption is active"""
        result = subprocess.run(
            ['dmsetup', 'status'],
            capture_output=True, text=True
        )
        encrypted_volumes = [
            line for line in result.stdout.split('\n')
            if 'crypt' in line
        ]
        return {
            'encryption_active': len(encrypted_volumes) > 0,
            'encrypted_volumes': encrypted_volumes
        }

    def check_tpm_health(self) -> dict:
        """Check TPM/fTPM status"""
        try:
            result = subprocess.run(
                ['tpm2_getcap', 'properties-variable'],
                capture_output=True, text=True, timeout=10
            )
            return {
                'tpm_available': result.returncode == 0,
                'tpm_healthy': 'TPM2_PT_LOCKOUT_COUNTER' in result.stdout
            }
        except subprocess.TimeoutExpired:
            return {'tpm_available': False, 'error': 'TPM timeout'}

    def run_security_audit(self) -> dict:
        """Complete security audit"""
        audit_results = {
            'timestamp': datetime.utcnow().isoformat(),
            'secure_boot': self.check_secure_boot_status(),
            'disk_encryption': self.check_disk_encryption(),
            'tpm': self.check_tpm_health(),
        }

        # Alert on security issues
        issues = []
        if not audit_results['secure_boot']['secure_boot_enabled']:
            issues.append("Secure boot is DISABLED")
        if not audit_results['disk_encryption']['encryption_active']:
            issues.append("Disk encryption is INACTIVE")
        if not audit_results['tpm']['tpm_available']:
            issues.append("TPM is unavailable")

        if issues:
            self.send_alert(issues)

        return audit_results

    def send_alert(self, issues: list):
        """Send security alert"""
        requests.post(self.alert_webhook, json={
            'severity': 'critical',
            'source': 'jetson-security-monitor',
            'issues': issues,
            'timestamp': datetime.utcnow().isoformat()
        })

---

8. Zero-trust architecture for edge

Principles for edge zero-trust

The core principle of "never trust, always verify" is especially critical for edge AI devices that:

1. Operate in physically accessible locations
2. Connect to potentially hostile networks
3. Process sensitive data locally
4. May be offline for extended periods

Implementation framework

# zero_trust_edge.py
from dataclasses import dataclass
from typing import Optional
import jwt
import hashlib
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.backends import default_backend

@dataclass
class DeviceIdentity:
    device_id: str
    hardware_attestation: bytes
    software_measurement: bytes
    certificate_chain: list

class ZeroTrustEdgePolicy:
    def __init__(self):
        self.policy_version = "2.0"
        self.required_attestation_claims = [
            'secure_boot_enabled',
            'disk_encryption_active',
            'firmware_version',
            'software_hash'
        ]

    def verify_device_identity(self, identity: DeviceIdentity) -> bool:
        """Verify device identity through hardware attestation"""
        # Verify certificate chain
        if not self._verify_certificate_chain(identity.certificate_chain):
            return False

        # Verify hardware attestation (TPM quote)
        if not self._verify_tpm_attestation(identity.hardware_attestation):
            return False

        # Verify software measurement against known-good values
        if not self._verify_software_integrity(identity.software_measurement):
            return False

        return True

    def generate_access_token(
        self,
        identity: DeviceIdentity,
        requested_resources: list,
        duration_seconds: int = 300
    ) -> str:
        """Generate short-lived access token for verified device"""
        # Minimal privilege - only grant access to requested resources
        claims = {
            'device_id': identity.device_id,
            'resources': self._filter_allowed_resources(requested_resources),
            'exp': datetime.utcnow() + timedelta(seconds=duration_seconds),
            'attestation_time': datetime.utcnow().isoformat()
        }
        return jwt.encode(claims, self.signing_key, algorithm='ES384')

    def continuous_verification(self, session_id: str) -> bool:
        """Continuously verify device state during session"""
        # Re-verify at intervals, not just at connection time
        current_state = self._get_device_state(session_id)

        # Check for anomalies
        if self._detect_behavioral_anomaly(current_state):
            self._revoke_session(session_id)
            return False

        # Verify measurements haven't changed
        if not self._verify_runtime_integrity(current_state):
            self._revoke_session(session_id)
            return False

        return True

Network microsegmentation

# Calico network policy for zero-trust edge
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: jetson-zero-trust-default-deny
spec:
  selector: all()
  types:
  - Ingress
  - Egress
  ingress:
  - action: Deny
  egress:
  - action: Deny
---
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: inference-service-policy
  namespace: production
spec:
  selector: app == 'inference-server'
  types:
  - Ingress
  - Egress
  ingress:
  # Only allow verified API gateway
  - action: Allow
    protocol: TCP
    source:
      selector: app == 'api-gateway'
      namespaceSelector: name == 'ingress'
    destination:
      ports:
      - 8080
  egress:
  # Only allow metrics export
  - action: Allow
    protocol: TCP
    destination:
      selector: app == 'prometheus'
      namespaceSelector: name == 'monitoring'
    destination:
      ports:
      - 9090
  # DNS resolution
  - action: Allow
    protocol: UDP
    destination:
      ports:
      - 53

---

9. Security hardening checklist

Pre-deployment security verification

#!/bin/bash
# jetson_security_checklist.sh

echo "=== NVIDIA Jetson Production Security Checklist ==="
echo "Date: $(date)"
echo ""

# 1. Secure Boot Verification
echo "[1/10] Checking Secure Boot status..."
if fuse-check --verify-sb 2>/dev/null | grep -q "ENABLED"; then
    echo "  [PASS] Secure Boot is enabled"
else
    echo "  [FAIL] Secure Boot is NOT enabled"
fi

# 2. Disk Encryption
echo "[2/10] Checking Disk Encryption..."
if dmsetup status 2>/dev/null | grep -q "crypt"; then
    echo "  [PASS] Disk encryption is active"
else
    echo "  [FAIL] Disk encryption is NOT active"
fi

# 3. TPM/fTPM Status
echo "[3/10] Checking TPM status..."
if tpm2_getcap properties-fixed 2>/dev/null | grep -q "TPM2"; then
    echo "  [PASS] TPM is available and functional"
else
    echo "  [FAIL] TPM is NOT available"
fi

# 4. Firewall Status
echo "[4/10] Checking Firewall configuration..."
if iptables -L INPUT -n 2>/dev/null | grep -q "DROP"; then
    echo "  [PASS] Firewall default policy is DROP"
else
    echo "  [WARN] Firewall may not be properly configured"
fi

# 5. SSH Hardening
echo "[5/10] Checking SSH configuration..."
if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
    echo "  [PASS] Root login via SSH is disabled"
else
    echo "  [FAIL] Root login via SSH may be enabled"
fi

if grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
    echo "  [PASS] Password authentication is disabled"
else
    echo "  [WARN] Password authentication may be enabled"
fi

# 6. Container Runtime Security
echo "[6/10] Checking Container Runtime..."
if docker info 2>/dev/null | grep -q "userns"; then
    echo "  [PASS] User namespace remapping is enabled"
else
    echo "  [WARN] User namespace remapping may not be configured"
fi

# 7. Kernel Security Features
echo "[7/10] Checking Kernel security features..."
if cat /proc/sys/kernel/randomize_va_space | grep -q "2"; then
    echo "  [PASS] ASLR is fully enabled"
else
    echo "  [FAIL] ASLR is not fully enabled"
fi

if cat /proc/sys/kernel/kptr_restrict | grep -q "[12]"; then
    echo "  [PASS] Kernel pointer restriction is enabled"
else
    echo "  [WARN] Kernel pointers may be exposed"
fi

# 8. Automatic Updates
echo "[8/10] Checking update configuration..."
if systemctl is-enabled apt-daily-upgrade.timer 2>/dev/null | grep -q "enabled"; then
    echo "  [INFO] Automatic security updates are enabled"
else
    echo "  [WARN] Automatic updates may not be configured"
fi

# 9. Audit Logging
echo "[9/10] Checking audit logging..."
if systemctl is-active auditd 2>/dev/null | grep -q "active"; then
    echo "  [PASS] Audit daemon is running"
else
    echo "  [WARN] Audit daemon is not running"
fi

# 10. Service Hardening
echo "[10/10] Checking unnecessary services..."
UNSAFE_SERVICES="telnet rsh rlogin rexec"
for svc in $UNSAFE_SERVICES; do
    if systemctl is-active $svc 2>/dev/null | grep -q "active"; then
        echo "  [FAIL] Unsafe service running: $svc"
    fi
done
echo "  [PASS] No known unsafe services detected"

echo ""
echo "=== Security Checklist Complete ==="

CIS Benchmark compliance

For Ubuntu-based Jetson deployments, apply CIS Level 2 hardening:

# Install Ubuntu Security Guide for CIS compliance
sudo apt-get install ubuntu-advantage-tools
sudo ua enable usg

# Apply CIS Level 2 Server profile
sudo usg fix cis_level2_server

# Generate compliance report
sudo usg audit cis_level2_server --output /var/log/cis-audit-$(date +%Y%m%d).html

---

What to settle before the first device ships

Jetson security in production is layered, and the bottom layer has to be in place before the hardware leaves the bench:

1. Hardware root of trust: enable Secure Boot and fuse programming before deployment. It cannot be done retroactively on devices already in the field.

2. OP-TEE and fTPM: JetPack 6.1+ supplies a Trusted Execution Environment and TPM 2.0 support with no additional hardware to buy.

3. Encryption: LUKS for data at rest, TLS 1.3 and mTLS in transit. The Tegra Security Engine does the AES work, which keeps the performance cost small.

4. Continuous verification: zero-trust here means device attestation that repeats, not authentication that happens once at enrollment.

5. Vulnerability management: SBOM generation and CVE scanning inside the CI/CD pipeline. The Cyber Resilience Act (2026) mandates this for EU markets.

6. Update path: A/B redundant partitions with signed OTA updates, so a failed update still leaves a bootable slot.

None of it is easy to revisit once a fleet is in the field. The fuse burn in step one is irreversible by design.

---

References and further reading

Official NVIDIA documentation

• NVIDIA Jetson Linux Developer Guide - Security
• JetPack 6.2.1 Release Notes
• OP-TEE Documentation
• Firmware TPM Guide
• Disk Encryption Guide

Security standards

• NIST SP 800-207 Zero Trust Architecture
• CIS Benchmarks for Ubuntu Linux
• TCG TPM 2.0 Specification

Third-party solutions

• Mender OTA for Jetson
• Spectro Cloud Palette for Jetson
• SecEdge SEC-TPM

Community resources

• JetsonHacks Security Articles
• NVIDIA Developer Forums - Jetson Security
• RidgeRun Platform Security Manual

---

This article was researched and written in January 2026. Security recommendations evolve rapidly; always consult the latest NVIDIA documentation and security advisories for your specific JetPack version.