littlehsm
Software-defined HSM SDK for embedded devices & IoT security

Hardware-Grade Security.Zero New Chips Required.

Secure CCTV/NVR systems, smart meters, and EV batteries with a software-only HSM SDK — tamper-evident storage, anti-rollback protection, and zero plaintext key persistence, out of the box.

Access Security Evaluation Hub Enterprise Registration
Software-only SDK Vendor-agnostic Tamper-evident storage
littlehsm architecture: three software modules on top of your existing hardware YOUR APPLICATION Your firmware or application code Crypt-Bridge Encrypting data Vault-Bridge Securing storage Trust-Bridge Managing keys YOUR EXISTING MCU / SoC / BOARD ESP32, BeagleBone, or your own Linux target Software-only — no new chips required
Application ProcessorsBare-Metal MCUsEmbedded LinuxAutomotive SystemsIoT FleetsSecure BootTEE Architecture
Application ProcessorsBare-Metal MCUsEmbedded LinuxAutomotive SystemsIoT FleetsSecure BootTEE Architecture

Core Production Pillars

A modular security stack, isolated by design.

ECOSYSTEM BETA

Crypt-Bridge

A unified software layer that simplifies cryptographic integration, shielding your application firmware from underlying processor differences.

  • Processor Independence: Switch hardware or cryptographic backends easily without rewriting your core application logic.
  • Cert-Ready Blueprint: Designed around industry-proven standards to streamline functional security certifications.
  • Kernel-Backed Primitives: Delegates crypto operations to Linux AF_ALG or vetted mbedTLS backends instead of reimplementing primitives in application code.
  • Seamless SDK Fit: Clean, compile-ready interfaces that drop straight into existing bare-metal or OS firmware pipelines.
Early access program active
ECOSYSTEM BETA

Vault-Bridge

A lightweight storage manager designed to safeguard sensitive variables, cryptographic keys, and parameters on raw flash memory.

  • Tamper Prevention: Cryptographically binds metadata to storage variables, preventing offline memory modification.
  • Storage Compaction: Reclaims space from stale records over time, keeping raw flash usage bounded without manual maintenance.
  • Power-Fail Safeguards: Dual-bank transactional writes are designed to survive sudden loss-of-power events without leaving a torn or corrupted record.
  • Replay Protection: Automatically secures storage records between runs to neutralize session intercepts and key reuse.
Early access program active
ECOSYSTEM BETA

Trust-Bridge

The trust coordinator that owns every key decision — deriving, authorizing, and revoking keys so your application code never touches raw key material directly.

  • Root-of-Trust Isolation: Enforces strict separation between application handles and raw hardware-rooted keys, re-derived fresh on every boot.
  • Boot-Sealed Revocation: Ties key derivation to verified boot state, so tampered firmware loses access to previously encrypted data.
  • Signature-Gated Officer Model: Every key-management command is verified fresh, inline, with zero cached authentication state.
Early access program active

Compliance Readiness

Built to accelerate your security certifications.

As cybersecurity mandates tighten for smart devices, automotive telemetry, and critical infrastructure, compliance is driven by robust architecture. LittleHSM delivers the foundational key isolation, tamper-evident storage, and cryptographic integrity that security evaluators test for — ensuring your team builds bulletproof security first and accelerates certification workflows seamlessly.

Tamper-Evident Storage
Anti-Rollback Protection
Cert-Ready Architecture

Key Isolation

Application code never touches raw key material. Keys are hardware-derived, session-scoped, and revocable through a signature-gated officer model.

Storage Integrity

Inline AEAD metadata wrapping, dual-bank transactional writes, and hardware-anchored monotonic counters prevent tampering and corruption.

Self-Contained Execution

Zero external execution dependencies. Runs natively on your existing MCU or Linux board with no additional hardware or external chips required.

Certification Readiness

Architected to meet stringent device-level security baselines including STQC, BIS, and AIS frameworks, streamlining formal evaluation workflows.

Coming Next

Closing the trust chain.

Actively in engineering right now — next in the queue, not gated behind a future contract.

IN DEVELOPMENT

Secure Boot

A real First-Stage-Verifier that gates execution before Trust-Bridge derives any key — the piece that makes boot-sealed revocation mean something. Tier A (hardware-rooted) on ESP32-C6, Tier B (integrity-verification-only) on Linux targets.

IN DEVELOPMENT

OTA Rekey

Signed, replay-protected OTA commands already run in production today. This adds automatic re-wrapping of keys across a firmware update, so a routine signed update no longer invalidates locally encrypted data as a side effect.

Locked Roadmap

Version 2.0+ Enterprise Roadmap Extension

Hardware TrustZone (TZ) Execution Backends
Discrete Platform TPM Integrity Integrations
Automotive-Grade AUTOSAR SHE Protocol Adapters

Advanced structural modules are systematically deferred to the V2+ Enterprise lifecycle. Engineering pipelines for these architectures are triggered strictly upon the execution of named client integration contracts.

Technical FAQ

Questions engineers actually ask.

See littlehsm running against your workload.

Our solutions engineers walk your team through a live environment mapped to your compliance and latency requirements.

Request Enterprise Demo Browse Resources