Encrypted Software Application Management in SoC Memory Zones
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing system on a chip (SoC) technologies fail to guarantee the confidentiality of software applications' instructions and data both between applications and with respect to the operating system, as memory protection units are ineffective against corrupted operating systems.
Innovation Solution
Encrypting software application instructions and data, storing them in memory zones with identical access rights, and using a symmetric-key block cipher algorithm for secure decryption and encryption, ensuring that only authorized components can interpret and store the encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory protection units are used to isolate software applications, then application isolation is improved, but confidentiality is compromised when the operating system is corrupted
Solution Approach 1:
An encryption/decryption unit is introduced as an intermediary between the memory protection unit and the application software. This unit encrypts application instructions and data in storage memory, and only decrypts them when the memory protection unit verifies intactness. The encryption/decryption unit acts as a mediator that prevents direct access to plaintext applications, thereby maintaining confidentiality even when the operating system is corrupted.
Solution Approach 2:
The patent changes the state of application data from plaintext to encrypted form. By encrypting application instructions and data, the confidentiality parameter is improved. The system dynamically changes the encryption/decryption state based on integrity verification results, ensuring that only verified applications are decrypted and executed, thus preventing confidentiality breaches from corrupted operating systems.
2Object-affected harmful factors
If applications are encrypted to ensure confidentiality, then security is improved, but access complexity increases
Solution Approach 1:
The memory protection unit is given multiple functions: it not only performs the traditional memory isolation function but also verifies application intactness and controls the encryption/decryption unit. This multi-functionality reduces the need for separate dedicated integrity verification components, thereby managing access complexity while maintaining security.
Solution Approach 2:
The encryption/decryption unit automatically manages the encryption and decryption of applications based on integrity verification results from the memory protection unit. The system self-regulates the decryption process without requiring manual intervention, reducing operational complexity while ensuring security. The unit only decrypts verified applications, automatically preventing access to corrupted software.
3Reliability
If integrity verification is performed before decryption, then execution security is improved, but processing time increases
Solution Approach 1:
The memory protection unit performs integrity verification of applications before they are decrypted by the encryption/decryption unit. This preliminary action ensures that only intact applications are decrypted and executed, preventing wasted processing time on corrupted software. The verification happens in advance, so the decryption unit only processes verified applications, optimizing the overall execution time while maintaining security.
Data Source
AI summary
An embodiment integrated circuit comprises a first memory zone having a first level of access rights that is configured to store at least one first software application containing encrypted instructions, means for verifying the integrity of the first software application, an encryption/decryption means, for example a first logic circuit, that is configured to decrypt the encrypted instructions which are considered to exhibit integrity, a processing unit that is configured to execute the decrypted instructions, the first logic circuit being further configured to encrypt the data generated by the execution operation and a second means, for example a second logic circuit, that is configured to store the encrypted data in a second memory zone having a second level of access rights that is identical to the first level of access rights.