I have a BeagleBone Black which is programmed to start a NodeJS server on boot. The BeagleBone contains software that my company does not want to share. Is it possible to prevent any user from stealing the software on the eMMc? (By doing things like disabling the SD card reader or something)

What i've done already is disabling the HDMI output, but someone is still able to insert a SD card, boot up another version of Debian and copying the files to an usb stick. I thought about something like disk encryption, but then the BeagleBone would not be able to start unless you enter a password, so that destroys the whole purpose.

closed as unclear what you're asking by RalfFriedl, Rui F Ribeiro, Romeo Ninov, Mr Shunz, Stephen Harris Apr 25 at 23:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Welcome to the the Unix and Linux stack exchange! Please review the Help Center to get information on how to best post to the site. Take the Tour if you are not familiar with how this site works. To get to your question, what have you tried so far? What is not working? What constitutes an acceptable answer? Please edit your post to include these details. Thank you! – kemotep Apr 24 at 13:04

The BeagleBone was designed to be a hobbyist computer, so there are many ways to get into it (netboot, usb etc) and lots of helpful documentation on the Internet.

While there are some security-through-obscurity things you can do, the feature you are looking for is called "secure boot". Secure boot makes use of cryptographic methods to ensure the machine boots an OS that it is authorized to run. Similar techniques can be applied to protect applications. It's probably not impossible to break into a secure boot machine, but it's certainly harder.

Secure boot is often implemented with a Trusted Platform Module or TPM. While some TI systems-on-a-chips do support secure boot, AM335x support is weak and poorly documented (and it still needs a TPM).

At least one vendor offers a TPM on a BeagleBone cape. The CryptoCape's developer also has a nice explanation of the secure boot process. Another option would be to look into an AM335x-based single-board computer with a TPM.

Bear in mind that secure boot does make development more difficult, as it's easy to mess something up and brick the machine. There are also those who have philosophical objections to trusted computing. While I personally feel the concern about software theft is overrated, there is certainly a need for a trusted execution environment in a wide variety of fields (e.g. life safety systems).

Not the answer you're looking for? Browse other questions tagged or ask your own question.