Flash Storage Code Integrity Validation via Snippet Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Execute in place (XIP) from flash storage introduces security challenges as existing verification methods at run-time can degrade performance and create attack vectors for malicious code injection.
Innovation Solution
A device with a controller and a data integrity engine that determines a hash value for executable code during boot, extracts a subset of data bits to form a snippet, and stores it locally. At run-time, the integrity of the code is validated by comparing a hash value of the code to the stored snippet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full data verification is performed at run-time, then code integrity security is improved, but performance degrades and latency increases
Solution Approach 1:
The patent segments the code verification process by dividing the code into blocks and selecting only specific bits (snippets) from each block for verification rather than verifying all data bits. This segmentation approach maintains security by verifying critical portions while reducing the overall verification burden, thus improving performance without compromising code integrity security.
Solution Approach 2:
The patent extracts only essential portions of the code data for verification by selecting specific bits based on a bit pattern to form snippets. This extraction principle reduces the volume of data requiring run-time verification from the entire code block to just critical snippets, thereby reducing latency and improving performance while maintaining adequate security verification.
2Reliability
If full data verification is performed at run-time, then code integrity security is improved, but storage overhead and latency increase
Solution Approach 1:
The verification process is segmented to focus only on critical snippets rather than entire code blocks. This segmentation reduces the time required for verification by limiting the scope to essential portions, thereby reducing latency while maintaining code integrity security.
Solution Approach 2:
The patent applies partial verification by checking only a subset of code bits (snippets) rather than performing excessive full verification. This partial action approach provides sufficient security for critical portions while avoiding the time penalty of complete verification, thus reducing latency.
3Productivity
If code is executed from flash storage without verification, then performance is improved, but security vulnerabilities increase
Solution Approach 1:
The patent performs preliminary verification during the boot sequence by determining hash values and selecting snippet bits before normal operation begins. This preliminary action ensures that verification is completed in advance, allowing secure code execution from flash storage during runtime without performance degradation, while addressing security vulnerabilities proactively.
Solution Approach 2:
The system performs self-verification by comparing run-time hash values against previously stored snippet values. This self-service mechanism enables the system to autonomously verify code integrity without external intervention, maintaining performance while reducing security vulnerabilities through continuous self-checking.
Data Source
AI summary
In some examples, a method includes determining, during a boot sequence of a controller, a hash value for data of a block of a flash storage device, the block including executable code, determining a bit pattern based on a randomly generated number, extracting a subset of data bits of the hash value according to the bit pattern to obtain a snippet, and storing the snippet to a secure storage device.