Dual-Code Firmware Restoration via Secure Store Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing trust in a server's firmware state becomes challenging, especially in cloud models where the server's history is unknown, as the chain of trust is easily broken, making it difficult to reestablish a trusted root.
Innovation Solution
The system employs a dual-code storage approach with a secure code store and an operational code store, where the secure code store is isolated during normal operation and accessed only in secure mode to restore a trusted firmware state by overwriting the operational code with a replacement version.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a cloud model is used to rent physical servers, then resource utilization and scalability are improved, but the reliability of firmware state is worsened because the server's history is unknown and the chain of trust is broken
Solution Approach 1:
The code storage is segmented into two separate code stores: a secure code store that stores only self-contained secure code and an operational code store that stores operational code. This segmentation allows the secure code to remain isolated and protected while the operational code can be updated and modified, thus maintaining firmware trust in cloud environments while enabling resource utilization benefits
Solution Approach 2:
A controller acts as an intermediary between the secure code store and the operational code store. The controller executes secure code or operational code based on system configuration and can switch between modes. This intermediary manages the transition between secure mode (for restoration) and normal operational mode, ensuring that the chain of trust is maintained even in cloud rental scenarios
2Reliability
If the secure code store is isolated during normal operation, then the security and trustworthiness of firmware are improved, but the device complexity is worsened due to dual-code storage and mode switching mechanisms
Solution Approach 1:
The controller serves multiple functions: it can execute secure code from the secure code store, execute operational code from the operational code store, switch between these modes, and manage the restoration process. This multi-functionality reduces the need for separate dedicated hardware components for each function, thereby managing complexity while maintaining security
Solution Approach 2:
The system includes a restoration mechanism that can automatically restore the operational code store from the secure code store when needed. The controller, when executing secure code, can identify and overwrite operational code with replacement versions from the secure code store, enabling self-service restoration without external intervention and reducing operational complexity
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Operations include restoring a trusted system firmware state. A system stores a set of self-contained secure code in a secure code store. The system stores a set of operational code in an operational code store. The system executes the secure code or the operational code upon system start up, depending whether the system is configured in a secure mode, or in a normal operational mode. When the system is configured in secure mode, the system executes the secure code. In secure mode, the system also overwrites a current version of the operational code stored in the operational code store with a replacement version of the operational code referenced by the secure code. When the system is configured in normal operational mode, the system executes the operational code. During normal operation, the secure code store is electrically isolated.