Welcome
Intro to Apple platform security
Hardware security and biometrics
System security
- System security overview
- Secure boot
  - Boot process for iPad and iPhone devices
  - Memory safe iBoot implementation
  - Mac computers with Apple silicon
  - Intel-based Mac computers
- Signed system volume security
- Secure software updates
- Background Security Improvements
- Operating system integrity
- Device pairing and connection security
- BlastDoor for Messages and IDS
- Lockdown Mode security
- Overview of additional macOS system security capabilities
- System security for watchOS
- Random number generation
- Communicating emergency information using satellites
- Apple Security Research Device
Encryption and Data Protection
- Encryption and Data Protection overview
- Quantum-secure cryptography with Apple devices
- Passcodes and passwords
- Data Protection
- FileVault
  - Volume encryption with FileVault
  - Managing FileVault
- How Apple protects users personal data
  - Protecting app access to user data
  - Protecting access to user health data
- Digital signing and encryption
App security
- App security overview
- App code signing process
- App security in iOS, iPadOS and visionOS
- App security in macOS
- Supporting extensions
- Secure features in the Notes app
- Secure features in the Shortcuts app
Services security
- Services security overview
- Apple Account and Managed Apple Account
  - Apple Account security
  - Managed Apple Account security
- iCloud
- Passcode and password management
- Apple Pay
- Using Apple Wallet
  - Access using Apple Wallet
  - Access key types
  - Car key security
    - Car key security
    - Car key transactions
  - Adding travel and eMoney cards to Apple Wallet
  - IDs in Apple Wallet
    - IDs in Apple Wallet
    - Security of IDs in Apple Wallet
- iMessage
- Secure Apple Messages for Business
- FaceTime security
- Find My
  - Find My security
  - Locating missing devices
- Continuity
Network security
Developer kit security
Secure device management
Glossary
Document revision history
Copyright and trademarks

Peripheral processor security in Mac computers

All modern computing systems have many built-in peripheral processors dedicated to tasks such as networking, graphics, power management and more. These peripheral processors are often single-purpose and are much less powerful than the primary CPU. Built-in peripherals that dont implement sufficient security become an easier target for attackers to exploit, through which they can persistently infect the operating system. Having infected a peripheral processor firmware, an attacker could target software on the primary CPU or directly capture sensitive data (for example, an Ethernet device could see the contents of packets that arent encrypted).

Whenever possible, Apple works to reduce the number of peripheral processors necessary and avoid designs that require firmware. When separate processors with their own firmware are required, efforts are taken to help ensure an attacker cant persist on that processor by verifying the processor in one of two ways:

Running the processor so that it downloads verified firmware from the primary CPU on startup
Having the peripheral processor implement its own secure boot chain to verify the peripheral processor firmware every time the Mac starts up

Apple works with vendors to audit their implementations and enhance their designs to include desired properties such as:

Ensuring minimum cryptographic strengths
Ensuring strong revocation of known bad firmware
Turning off debug interfaces
Signing the firmware with cryptographic keys that are stored in Apple-controlled hardware security modules (HSMs)

In recent years, Apple has worked with some external vendors to adopt the same Image4 data structures, verification code and signing infrastructure used by Apple silicon.

When storage-free operation or storage plus secure boot is an option, the design mandates that firmware updates be cryptographically signed and verified before the persistent storage can be updated.

Published Date: 18 February 2021

Previous Trust caches Next Rosetta 2 on a Mac with Apple silicon

Helpful?

Yes No

Apple Platform Security

Peripheral processor security in Mac computers

Apple Footer