Secure Boot Using Dual-Key Authentication and Controller Lockdown
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing boot mechanisms for computer systems face security vulnerabilities due to compromised authentication keys, which are difficult to update and require complex hardware and BootROM code for key-chain operations, limiting flexibility and security in firmware upgrades.
Innovation Solution
Implementing a system that uses two separate digital signatures for firmware authentication, where a fixed boot key is used by the processor and an updatable key is used by a separate controller, allowing for secure verification and update of firmware without altering the fixed boot key, and employing a hardware lockdown mechanism to prevent unauthorized updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single authentication key is stored in hardware fuses, then the boot authentication can be performed, but the key cannot be updated easily and security is compromised when the key is leaked
Solution Approach 1:
The authentication system is segmented into two separate keys: a fixed boot key stored in hardware fuses and an updatable key stored in updateable memory. This segmentation allows the boot key to remain secure and immutable while the updatable key can be refreshed periodically, resolving the contradiction between security and update capability.
Solution Approach 2:
A secondary controller is introduced as an intermediary authentication entity that performs verification using the updatable key. This intermediary handles the burden of key updates, allowing the main processor to continue using the fixed boot key without modification, thus enabling key updates without compromising the core authentication mechanism.
2Reliability
If complex hardware and BootROM code are used for key-chain operations, then authentication can be performed, but the device complexity increases
Solution Approach 1:
The complex key-chain operations and updatable key management are extracted from the main processor's BootROM and transferred to a separate secondary controller. This extraction simplifies the main system's BootROM while maintaining comprehensive authentication functionality through the dedicated secondary controller.
3Reliability
If the fixed boot key is used for authentication, then secure boot can be achieved, but the key cannot be updated to respond to security threats
Solution Approach 1:
The authentication system incorporates dynamic key updates by introducing an updatable key that can be periodically refreshed, contrasting with the static fixed boot key. This dynamic element allows the system to adapt to new security threats while maintaining the stability and security of the fixed boot key for fundamental authentication.
Data Source
AI summary
A computer chip, such as an System on chip (SOC), can receive firmware updates having two separate signatures; a first of the signatures is used to authenticate the firmware using a processor within the computer chip, and a second of the signatures is used by a controller, separate from the processor. A first key, used by the processor to authenticate the firmware, can be a boot key that is hardwired in the computer chip. A second key, used by the controller, can be a key that is provided to the controller at any time and is updatable. The controller can suspend the processor so that the controller can perform a first authentication of the firmware using the second signature and the second key. If the authentication is successful, the controller can release the processor, which then uses the first key and the first signature to perform a second authentication.