Electronic Control Device Secure Boot and Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot technologies cannot simultaneously execute secure boot and encryption-related calculations.
Innovation Solution
An electronic control device with a tamper-resistant storage unit for secure boot and control keys, a processor for secure boot verification, and a calculation unit for encryption, along with a delegated verification unit that allows simultaneous execution of secure boot and encryption processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure boot verification is performed using a tamper-resistant verification unit, then security and tamper resistance are improved, but the ability to simultaneously perform encryption calculations is worsened due to resource contention
Solution Approach 1:
The verification unit is segmented into two distinct components: a tamper-resistant verification unit that performs secure boot verification, and a separate calculation unit that performs encryption calculations. This segmentation allows both functions to operate independently and simultaneously without resource contention, resolving the contradiction between security verification and calculation productivity.
2Reliability
If secure boot information is stored in a tamper-resistant storage unit, then security is improved, but the complexity of the system increases due to additional secure storage requirements
Solution Approach 1:
The secure boot information (secure boot program and verification key) is extracted from the general storage unit and stored separately in a dedicated tamper-resistant storage unit. This extraction isolates the security-critical data, providing enhanced protection while maintaining a clear separation between secure and non-secure storage functions, thereby managing system complexity through functional separation.
3Device complexity
If a single processor is used for both secure boot verification and encryption calculations, then device complexity is reduced, but the speed of simultaneous operation is worsened due to sequential processing
Solution Approach 1:
The processing functionality is segmented into two independent processing units: a verification unit dedicated to secure boot verification and a calculation unit dedicated to encryption calculations. Each unit has its own processor, allowing both verification and calculation operations to execute simultaneously at full speed without sequential processing delays, while maintaining relatively simple individual processor architectures.
Data Source
AI summary
An electronic control device includes a tamper storage unit that stores a secure boot key and a control key, and has tamper resistance, a processor that is able to execute a program, a verification unit that verifies a program by using the secure boot key, performs secure boot causing the processor to execute the program based on a result of the verification, and has tamper resistance, a calculation unit that performs calculation related to encryption using the control key, and has tamper resistance, and a general storage unit that stores a first program that implements a delegated verification unit to which authority of the secure boot is delegated from the verification unit and a second program that implements a control unit that uses the calculation unit, and does not have tamper resistance. The verification unit delegates the authority of the secure boot to the delegated verification unit to end the execution of the secure boot when the verification for the first program and the second program is successful and the processor is caused to execute the first program and the second program, the calculation unit starts an operation when the verification unit ends the execution of the secure boot, and the delegated verification unit is able to simultaneously execute processing with the calculation unit.