Electronic Device Firmware Protection via Dual-Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting firmware in electronic devices from hacking are complex and vulnerable to unauthorized access, as they require differentiation between cryptographic keys associated with processor circuitry, leading to potential security breaches during firmware download and distribution.
Innovation Solution
An electronic device design that employs a first non-volatile memory for storing encrypted firmware using a global key, with an application circuit including a decryption unit and a local key unit to decrypt and re-encrypt the data using a unique local key, ensuring secure storage and preventing unauthorized access by overwriting the encrypted data with locally generated encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cryptographic key not uniquely associated with the processor circuitry is used to decrypt firmware, then the firmware can be decrypted, but the control flow becomes complex and hardware design becomes complex
Solution Approach 1:
The patent segments the cryptographic key into two parts: a first key part stored in a first storage unit and a second key part stored in a second storage unit. The processor retrieves both key parts, combines them to form the complete cryptographic key, and then uses this key to decrypt the firmware. This segmentation eliminates the need for complex control flow and hardware design while maintaining secure firmware decryption.
2Reliability
If encryption techniques are used to protect firmware from hacking, then security is improved, but the firmware download and distribution process becomes more complex
Solution Approach 1:
The patent performs preliminary encryption of the firmware with the cryptographic key before the firmware is downloaded to the flash memory. Additionally, the second key part is预先 stored in the second storage unit during device manufacturing. This preliminary action ensures that the firmware is protected during download and distribution without adding complexity to the process, as the decryption mechanism is already in place.
3Ease of operation
If firmware is stored in flash memory for easy access, then firmware retrieval is simplified, but the firmware becomes vulnerable to unauthorized copying and hacking
Solution Approach 1:
The patent applies preliminary encryption to the firmware before storing it in the flash memory. The encrypted firmware is saved in the flash memory, and during operation, the processor retrieves the encrypted firmware and decrypts it using the cryptographic key formed by combining both key parts. This approach maintains easy firmware retrieval while protecting against unauthorized copying and hacking.
Solution Approach 2:
The patent introduces the cryptographic key as an intermediary between the encrypted firmware in flash memory and the processor. The key acts as a mediator that enables secure decryption of the firmware without exposing the firmware to unauthorized access during storage and retrieval operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An electronic device (100) includes a first non-volatile memory (110) and an application circuit (120). The first non-volatile memory (110) stores first encrypted data (ED1) encrypted with a global key (GK1). The application circuit (120) includes a second non-volatile memory (121), a decryption unit (122), a local key unit (123) and an encryption unit (124). The second non-volatile memory (121) stores the global key (GK1). The decryption unit (122) retrieves the global key (GK1) from the second non-volatile memory (121) and decrypts the first encrypted data (ED1) with the global key (GK1) to generate plain data (PD1). The local key unit (123) generates or stores a local key (LK1). The encryption unit (124) encrypts the plain data (PD1) with the local key (LK1) to generate second encrypted data (ED2) and overwrites the first encrypted data (ED1) in the first non-volatile memory (110) with the second encrypted data (ED2).