Skip to main content

Capabilities · Security Engineering

Hardware-rooted security, from boot ROM to field update.

Secure boot chains, Arm TrustZone partitioning, HSM integration, crypto libraries and engineering support for ISO/SAE 21434, UNECE R155 and the EU Cyber Resilience Act, for embedded products built in India.

  1. 01 What we secure
  2. 02 How we work
  3. 04 How to start
01

Six pieces of a device that can be trusted.

Each card lights where it sits on a secure device, from the root of trust in the boot ROM to the update server and the obligations that last the product’s whole life.

A secure embedded device: the boot chain of trust, TrustZone partitions, HSM key store, crypto library and update server, and the lifecycle obligations, numbered as on the capability cards chain of trust → Boot ROM root of trust 1 Bootloader verifies next 2 Firmware signed image Application running HSM key store 4 TrustZone Secure world keys · crypto · boot safety functions Non-secure world application · RTOS connectivity 3 Crypto library · TLS AES · SHA · ECC · RSA · hw accel 5 Signing · OTA server signed images · A/B update 6 product lifecycle ISO/SAE 21434 · R155 7 EU CRA · SBOM 8
A secure device, end to end · numbered as on the cards
  1. Root of trust

    Secure boot chain

    Every stage verifies the next, from the boot ROM to the application.

    • ROM-to-application chain of trust
    • Firmware image signing and verification
    • Anti-rollback counters and version enforcement
    • Secure OTA update with A/B failover

    emSecure & emBoot-Secure →

  2. Arm Cortex

    TrustZone and TEE configuration

    Hardware-enforced isolation between secure and non-secure worlds.

    • SAU and IDAU set-up on Cortex-M23, M33 and M55
    • Secure and non-secure memory and peripheral partitioning
    • Trusted Firmware-A integration on Cortex-A
    • Inter-world calls and mailbox design
  3. Keys

    HSM integration

    Keys kept in tamper-resistant hardware, crypto offloaded to it.

    • On-chip HSM and secure element drivers
    • Key provisioning and device identity in production
    • SHE and EVITA-class HSM use for automotive
    • Hardware acceleration for AES, RSA and ECC

    Flasher Secure →

  4. Algorithms

    Crypto library integration

    The right algorithms, the right library, and keys that stay put.

    • SEGGER emCrypt and silicon-vendor crypto libraries
    • Algorithm selection and key-management architecture
    • Side-channel hardening
    • TLS and DTLS configuration for connected devices

    emCrypt →

  5. Vehicles

    Automotive cybersecurity: ISO/SAE 21434 and UNECE R155

    Engineering support for OEMs and suppliers through threat analysis and type approval.

    • Threat analysis and risk assessment (TARA)
    • Cybersecurity concept and requirements
    • CSMS documentation support for R155
    • Vulnerability management and incident-response planning

    UNECE R155 and R156 →

  6. EU market

    EU Cyber Resilience Act readiness

    For products with digital elements sold in the EU.

    • CRA obligation analysis and gap assessment
    • Secure development lifecycle
    • Vulnerability disclosure and handling processes
    • SBOM generation and technical documentation

    EU CRA →

02

Security designed in, not bolted on.

It starts with what an attacker would want and ends with a plan for vulnerabilities found after launch. Hover a stage to find it on the line.

Threat model · Architect · Implement · Verify and maintain
01 Threat model 02 Architect 03 Implement 04 Verify and maintain
  1. 01

    Threat model

    Assets
    keys, firmware, data, functions
    Analysis
    TARA, attack paths, risk
    Obligations
    ISO/SAE 21434, R155, CRA

    What needs protecting, and from what

  2. 02

    Architect

    Trust
    boot chain, keys, identity
    Isolation
    TrustZone, MPU, HSM
    Update
    signing, A/B, rollback

    A design that can be reviewed

  3. 03

    Implement

    Crypto
    emCrypt
    Production
    Flasher Secure

    Keys provisioned, images signed

  4. 04

    Verify and maintain

    Static analysis
    Klocwork, Perforce QAC
    Unit test
    TESSY
    In the field
    SBOM, vulnerability handling

    Evidence, and a plan for after launch

Related: Embedded software · RTOS development · Functional safety · Compliance

03

The tools that sign, store and check.

Secure-boot and crypto libraries, a production programmer that keeps keys protected, and the static analysis and unit testing that produce the evidence, all supplied and supported by GSAS.

04

Three ways to start.

Have GSAS secure the device, support the engineering behind your compliance work, or supply the tools your own team uses.

  1. 01

    A security project

    Boot, isolation, keys, crypto

    Tell us the silicon and what has to be protected. GSAS designs and implements the boot chain, partitions, key handling and update path, and hands back the design and the evidence.

  2. 02

    Compliance engineering

    ISO/SAE 21434 · R155 · EU CRA

    Engineering support for the technical side of your compliance work: threat analysis, cybersecurity concepts, SBOMs, vulnerability handling and the documentation behind them.

  3. 03

    The security tool chain

    SEGGER and Perforce

    Secure-boot and crypto libraries, secure production programmers and static analysis, from GSAS in India, with INR quotes, GST invoices and local support.

05

Shipping a connected device? Start with the boot ROM.

Tell us the silicon, the market and what must be protected. GSAS replies from Bengaluru with scope and a proposal: threat model, boot chain, isolation, keys and the evidence to go with them.

sales@gsasindia.com +91 80 6590 1783

Embedded security engineering with GSAS in India

What security engineering does GSAS do for embedded products?

Secure boot chains, Arm TrustZone and TEE configuration, HSM integration and key provisioning, crypto library integration, and engineering support for ISO/SAE 21434, UNECE R155 and the EU Cyber Resilience Act.

Can GSAS build a secure boot chain for our device?

Yes. GSAS implements a chain of trust from the boot ROM to the application: image signing and verification, anti-rollback counters, and secure OTA updates with A/B failover, using SEGGER emSecure and emBoot-Secure or the silicon vendor’s own mechanisms.

Which processors does GSAS configure TrustZone on?

Arm Cortex-M23, Cortex-M33 and Cortex-M55 through SAU and IDAU configuration, and Cortex-A devices with Trusted Firmware-A, including secure and non-secure memory and peripheral partitioning.

Does GSAS help with UNECE R155 and ISO/SAE 21434?

GSAS supports OEMs and suppliers with threat analysis and risk assessment, cybersecurity concepts and requirements, CSMS documentation support and vulnerability management planning. Type approval itself rests with the vehicle manufacturer.

When does the EU Cyber Resilience Act apply?

Under Article 71(2), the Article 14 reporting obligations apply from 11 September 2026 and the Regulation applies in full from 11 December 2027. GSAS helps manufacturers with gap assessment, secure development, vulnerability handling, SBOMs and technical documentation.

Can we buy the security tools from GSAS?

Yes. GSAS supplies SEGGER emSecure, emCrypt and Flasher Secure as an authorized SEGGER engineering partner in India, and Perforce Klocwork and QAC and Razorcat TESSY, with INR quotes and GST invoices.

Security Engineering Insights

Indian embedded engineer integrating SEGGER emCrypt AES-GCM and ECDSA primitives into a Cortex-M smart meter firmware build
emCrypt SEGGER

SEGGER emCrypt: Cryptographic Primitives for Indian Custom-Crypto Teams on Cortex-M

How Indian product teams use SEGGER emCrypt, AES, SHA, HMAC, ECC, RSA, ChaCha20-Poly1305, as a commercial, portable-C cryptographic primitives library on STM32, i.MX RT, Nordic, Renesas, and Microchip Cortex-M targets.

15 Apr 2026 · 9 min read
Indian embedded engineer signing firmware with SEGGER emSecure-RSA on a Cortex-M bootloader workstation
emSecure SEGGER

SEGGER emSecure-RSA and emSecure-ECDSA for Indian Secure Boot on Cortex-M

How Indian product teams use SEGGER emSecure-RSA and emSecure-ECDSA to sign firmware offline in Bengaluru and verify it on Cortex-M bootloaders in the field, with Flasher Secure tying the factory floor together.

15 Apr 2026 · 9 min read
Indian industrial gateway running SEGGER emSSH server accepting a remote management SSH session from a Bengaluru solar-farm NOC engineer
emSSH SEGGER

SEGGER emSSH: Secure Remote Management for Indian Industrial Gateways on Cortex-M

How Indian industrial gateway OEMs use SEGGER emSSH, a commercial SSH-2 server library, for secure remote management, SCP log retrieval, and fleet automation of deployed Cortex-M products across Indian solar farms, factories, and transport networks.

15 Apr 2026 · 9 min read
SEGGER Flasher Secure and HSM root-of-trust programming workflow at an Indian OEM secure programming line
Security Engineering SEGGER

SEGGER Flasher Secure + HSM: Root-of-Trust Programming for Indian OEMs

How Indian OEMs combine SEGGER Flasher Secure with an HSM, Thales, Utimaco, nCipher, YubiHSM, or AWS CloudHSM Mumbai, to build a proper root-of-trust programming pipeline for smart meters, EV chargers, medical devices, and automotive Tier-1 production.

15 Apr 2026 · 11 min read
SEGGER Flasher Secure production programmer on an Indian defence electronics manufacturing line
Flasher SEGGER

Programming Encrypted Firmware at Indian Contract Manufacturers: A SEGGER Flasher Secure Walkthrough for Defence, Medical, and Automotive IP Owners

How Indian OEMs program firmware at contract manufacturing lines without exposing plaintext, SEGGER Flasher Secure, Flasher Secure Server (FSS), and authorized flashing for defence (iDEX, DGQA), medical (CDSCO, ISO 13485), and automotive IP owners.

14 Apr 2026 · 8 min read