Embedded Controller Memory Protection via Masking Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for protecting data in embedded controllers within system-on-chip (SoC) are vulnerable to unauthorized access and tampering, with cost-sensitive designs relying on obscurity and more expensive hardware-based solutions being unfeasible due to computational power limitations.
Innovation Solution
A system and method that uses masking logic to control access to memory in embedded controllers, enabling access through a 'pass-through' control value during power-on-reset (POR) and disabling access with a read-protect bit that can only be cleared by a full power cycle, ensuring secure execution of initialization code and protection of secret data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strong cryptographic techniques or hardware TPM are used to protect secret data, then security against unauthorized access is improved, but device complexity and cost increase
Solution Approach 1:
The patent segments the memory access control into multiple stages: initial unrestricted access during POR, then progressive restriction as the embedded controller executes initialization code. The masking logic is segmented to apply different mask values at different execution stages, allowing simple yet effective security without complex cryptographic hardware.
Solution Approach 2:
The patent applies preliminary action by pre-configuring the masking logic with predetermined mask values that automatically activate at specific points during system initialization. The read-protect bit is set in advance to trigger automatic masking, preventing unauthorized access before it can occur without requiring real-time cryptographic verification.
2Device complexity
If simple obscurity is used to protect secret data, then device complexity is reduced, but security against determined attacks deteriorates
Solution Approach 1:
The patent implements dynamic access control where the masking logic transitions from a pass-through state (no masking) during initial execution to a protected state (full masking) after the read-protect bit is set. This dynamic state change provides adaptive security that strengthens protection as the system initializes, maintaining simplicity while improving security posture over time.
3Reliability
If cryptographic algorithms are used to protect data, then security is improved, but computational power requirements increase beyond embedded controller capabilities
Solution Approach 1:
The patent introduces masking logic as an intermediary component between the embedded controller and the secret data in memory. This intermediary applies bitwise masking operations that are computationally trivial compared to cryptographic algorithms, yet provide effective security by preventing unauthorized reading of secret data without requiring significant computational resources.
Data Source
AI summary
System and method for protecting data in a system including a main processor, an embedded controller, and a memory. In response to a power-on-reset (POR), access to the memory is enabled, e.g., access by the embedded controller. First data is read from the memory (e.g., by the embedded controller) in response to the enabling, where the first data are usable to perform security operations for the system prior to boot-up of the main processor. The first data are used, e.g., by the embedded controller, to perform one or more security operations for the system, then access to the memory, e.g., by the embedded controller, is disabled, where after the disabling the memory is not accessible, e.g., until the next POR initiates enablement.