Embedded Controller Seed Key for Pre-OS Data Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Pre-operating system (pre-OS) environments lack comprehensive protection against physical attacks, as isolation from the central processing unit does not safeguard data from unauthorized physical access and manipulation.

Innovation Solution

Implementing an embedded controller (EC) with a permanently installed, unique seed key that generates encryption and signature keys, ensuring data confidentiality and integrity by encrypting data and storing integrity-verification tags, making it inaccessible and unattainable outside the EC, thus preventing decryption and tampering detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If pre-OS data is stored in isolated memory, then data is protected from software attacks, but data remains vulnerable to physical attacks

Engineering Contradiction:

Improvesoftware attack protectionVSAvoidphysical attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an embedded controller as an intermediary component between the pre-OS environment and the isolated memory. This EC contains a permanently installed seed key that serves as a mediator to generate encryption keys, creating an additional security layer that protects against physical attacks while maintaining the existing software attack protection through isolation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a permanently installed seed key is embedded in the EC, then data confidentiality and integrity are ensured, but device complexity increases

Engineering Contradiction:

Improvedata confidentiality and integrityVSAvoidEC structure complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by permanently installing the seed key in the embedded controller during manufacturing or initial setup. This pre-established security foundation enables automatic generation of encryption keys and integrity verification tags without requiring complex runtime key management, thereby ensuring data confidentiality and integrity while minimizing operational complexity.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11429722B2Data protection in a pre-operation system environment based on an embedded key of an embedded controller

Publication Date: 2022.08.30 HEWLETT PACKARD DEVELOPMENT COMPANY LP

AI summary

An example system with a pre-OS (Operating System) environment, the pre-OS environment includes a private memory that is isolated from a processor of the system. The pre-OS environment also includes an embedded controller (EC) coupled to the private memory, where the EC includes an embedded key. The EC is to execute instructions to generate an encryption key based on the embedded key; generate a signature key; obtain data; produce an integrity-verification tag based on a hash of the obtained data, where the hash employs the signature key; encrypt the obtained data based on the encryption key; store the encrypted data in the private memory; and store the integrity-verification tag in the private memory in association with the stored encrypted data.