Address-Dependent Encryption Processor for Embedded Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing embedded systems face challenges in securing data from malware attacks, particularly in preventing decryption of sensitive information stored in external ROMs, as encryption processors constantly decrypt data regardless of the execution address, leading to potential leakage of plaintext data.
Innovation Solution
A processor system with an encryption processor that registers address ranges and performs encryption or decryption based on the execution address, ensuring that data remains encrypted when accessed from outside the registered address range, thereby preventing unauthorized access and data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the encryption processor constantly performs decryption processing when accessing the external ROM, then the system can execute programs from RAM, but the encrypted data can be seen in a decrypted state leading to security vulnerability
Solution Approach 1:
The patent applies local quality by making the decryption behavior address-dependent. The encryption processor decrypts data only when the access address falls within a registered execution address range, and maintains encryption when the address is outside this range. This localized decryption approach allows legitimate program execution from RAM while preventing unauthorized access to encrypted data, thus resolving the contradiction between execution flexibility and data security.
2Object-affected harmful factors
If encryption processing is applied to all data stored in external ROM, then physical attack resistance is improved, but system complexity increases due to constant decryption requirements
Solution Approach 1:
The patent applies dynamics by making the encryption/decryption state dynamic and conditional rather than static and constant. The encryption processor dynamically adjusts its behavior based on the current execution address, switching between decryption and encryption modes as needed. This dynamic approach maintains security against physical attacks while reducing system complexity by eliminating the need for constant decryption processing.
Data Source
AI summary
A processor includes a CPU core and an encryption processor which includes an address registration region, wherein, after power is supplied, a startup program which is stored into a memory after encryption and executed at startup registers an address range of the memory in which encrypted concealment data is stored into the address registration region, and wherein the encryption processor decrypts the startup program and the concealment data and transfers to the CPU core when an execution address of the CPU core is within the address range registered in the address registration region, and transfers the startup program and the concealment data to the CPU core without decryption when the execution address of the CPU core is not within the address range registered in the address registration region.