Control Unit Trusted Execution Environment Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control units for safety-critical applications lack integration of security and safety standards, as trusted execution environments are typically developed without adhering to safety standards, posing challenges in combining security and safety domains effectively.
Innovation Solution
A control unit with a processor and memory that switches between trusted and non-trusted states, utilizing a system monitor to control access and interrupts, and a safety module to manage privilege levels and resource allocation, ensuring compliance with both security and safety standards by isolating hardware resources and managing interrupts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a trusted execution environment is implemented without adhering to safety standards, then security properties are improved, but safety compliance deteriorates
Solution Approach 1:
The system is segmented into two distinct execution environments: a trusted execution environment for security-critical functions and a non-trusted environment for standard applications. This segmentation allows each environment to operate under different standards (security vs. safety) while sharing the same physical hardware resources, resolving the contradiction between security implementation and safety compliance
Solution Approach 2:
A system monitor acts as an intermediary between the trusted and non-trusted execution environments. It controls transitions between environments, manages resource allocation, and ensures that safety standards are maintained while allowing security properties to be enforced in the trusted environment. The monitor enables both security and safety requirements to coexist by mediating their interactions
2Device complexity
If hardware resources are shared between trusted and non-trusted systems, then device complexity is reduced, but security isolation deteriorates
Solution Approach 1:
The system dynamically switches between trusted and non-trusted execution environments based on operational requirements. The processor can transition between states, and the system monitor dynamically manages resource allocation and access control. This dynamic approach maintains strong security isolation when needed while allowing resource sharing to reduce hardware complexity when the trusted environment is not active
3Reliability
If interrupts are routed through the trusted system, then security control is improved, but system responsiveness deteriorates
Solution Approach 1:
The system extracts and handles time-critical interrupt processing in the non-trusted environment, while the trusted environment maintains security control through periodic monitoring and validation. Critical interrupt response functions are separated from security verification functions, allowing fast response to external events while maintaining security oversight through the system monitor
Data Source
Figure 1~3
Figure 4~5
AI summary
The present invention relates to a control unit (1) comprising a processor (3) and a memory (5) connected to the processor the processor comprising a first state and a second state and being adapted to switch between the first state and the second state, wherein in the first state a non-trusted system (24) is active and in the second state a trusted system (22) is active, wherein the control unit comprises a system monitor (26) controlling the activation of the first state and the second state, the memory (5) including a first portion (42) assigned to the trusted system (22) and a second portion (44) assigned to the non-trusted system (24), wherein the system monitor (26) is adapted to inhibit the access of the non-trusted system (24) to the first portion (42) of the memory (5), wherein the trusted system (22) includes a safety module (30) and at least one trusted module (32, 34), the at least one trusted module (32, 34) being loaded in a chain of trust and running on the safety module (30), wherein the safety module (30) being adapted to control access of the at least one trusted module to predefined areas (56, 60) of the second portion (44) of the memory.