In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus is an embedded-system device. The embedded-system device loads a first boot loader from a read only section of a storage device in an initialization process of the embedded-system device. The embedded-system device also loads, by the first boot loader, a public key from the read only section. The embedded-system device further generates a first verification code for static code and data stored in a first section of the storage device. The embedded-system device then decrypts, by the first boot loader, an encrypted signature stored in the first section by using the public key to obtain a second verification code. The embedded-system device determines integrity of the static code and data based on the first verification code and the second verification code.