What is OCI hardware root of trust?
In the traditional cloud model, firmware security is often based on "hope"—the hope that the previous tenant didn't leave a malicious rootkit in the motherboard's BIOS.
Oracle Cloud Infrastructure (OCI) eliminates this risk with its Hardware Root of Trust (RoT). This is a security-first architectural feature designed to ensure that every time you rent a server, it is in a "pristine," factory-fresh state.
The OCI Hardware Root of Trust is a physically separate, custom-built security module manufactured to Oracle's strict specifications. It acts as the "anchor" for the entire server's security.
Unlike software-based security, which can be bypassed if the OS is compromised, the Hardware RoT is immutable. It sits outside the main CPU’s reach and is the only component trusted to verify and install the server's firmware.
The most critical role of the RoT occurs during the transition between tenants. When a customer releases a Bare Metal instance, OCI doesn't just "delete the files." It initiates a hardware-level reset:
Hardware Wipe: The RoT card triggers a command to physically wipe all mutable storage on the server, including local NVMe drives and flash memory.
Firmware Re-Installation: The RoT card communicates with a secure Oracle-managed repository to download "known-good" versions of every piece of firmware on the host (BIOS, BMC, NIC, etc.).
Signature Verification: Before a single line of firmware code is allowed to execute, the RoT verifies its cryptographic signature. If the signature doesn't match Oracle’s "golden image," the server will not boot.
Power Cycle: The RoT forces a physical power cycle to ensure no residual data remains in volatile memory (RAM).
Traditional "Rootkits" and "Bootkits" are terrifying because they hide in the firmware, beneath the Operating System. They can survive a hard drive format and even a BIOS update if the update process itself is compromised.
By using a Hardware Root of Trust, OCI prevents these "permanent" infections:
No Persistence: Even the most sophisticated firmware-level malware is deleted and replaced by a clean image before the next customer ever logs in.
Hardware-Enforced: Because the RoT card is the only thing that can "unlock" the firmware for writing, a hacker on the host CPU cannot lock themselves in or prevent the wipe process.
While the Hardware RoT ensures the server is clean before it reaches you, OCI's Shielded Instances use the Root of Trust (and the on-board TPM) to keep it secure while you use it.
Secure Boot: Uses the RoT-verified UEFI to ensure only signed, authorized bootloaders and OS kernels can start.
Measured Boot: Takes a "fingerprint" of the entire boot sequence and stores it in the TPM (Trusted Platform Module). You can check this fingerprint against a "Golden Image" to verify that your OS hasn't been tampered with.
| Security Layer | Traditional Cloud | OCI with Hardware RoT |
| Trust Basis | Trust the previous user's cleanup. | Trust the Oracle-built hardware. |
| Firmware Integrity | Software-verified (Can be spoofed). | Hardware-verified (Cryptographically signed). |
| Tenant Transition | Logical wipe (OS/Disk only). | Physical wipe (Firmware/BIOS/Disk/RAM). |
| APTs/Rootkits | Can persist across users. | Destroyed during re-provisioning. |
"In OCI, the Hardware Root of Trust ensures that every Bare Metal server you provision is exactly as it was when it left the factory. It’s the difference between moving into a house that was 'cleaned' and moving into a house where the walls were literally rebuilt to ensure no hidden bugs were left behind."