Abstract: A device comprises a processor arranged to automatically execute boot code upon start-up or reset. The boot code comprises a code authentication procedure to verify whether additional code is authenticated for execution on the processor. A separate security unit comprises a private unlock key and cryptography logic configured to use the private unlock key to sign a portion of data, thereby generating a signed unlock file for supply to a storage location. The processor is arranged to access the unlock file from the storage location, making it available without requiring connection to the security unit. The boot code further comprises an unlocking authentication procedure configured to check for the unlock file in the storage location, and if available to verify whether the unlock file is authenticated for use on the processor based on its signature, so as to de-restrict the boot authentication procedure on condition of verifying the unlock file.

Abstract: A device comprises a processor arranged to automatically execute boot code upon start-up or reset. The boot code comprises a code authentication procedure to verify whether additional code is authenticated for execution on the processor. A separate security unit comprises a private unlock key and cryptography logic configured to use the private unlock key to sign a portion of data, thereby generating a signed unlock file for supply to a storage location. The processor is arranged to access the unlock file from the storage location, making it available without requiring connection to the security unit. The boot code further comprises an unlocking authentication procedure configured to check for the unlock file in the storage location, and if available to verify whether the unlock file is authenticated for use on the processor based on its signature, so as to de-restrict the boot authentication procedure on condition of verifying the unlock file.