Hardware Lock Mechanism for Firmware Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current device security measures, such as password protection, are inadequate in preventing Time of Check to Time of Use (TOC/TOU) attacks on electronic devices, as firmware stored in nonvolatile memory can be compromised by unauthorized access, even after initial authentication.
Innovation Solution
A hardware-based lock mechanism is introduced, utilizing an arbitrator to manage access to resources by creating and enforcing exclusive lock IDs, ensuring only authorized agents can access the resource, thereby preventing unauthorized access and TOC/TOU attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password protection is used to prevent unauthorized access to firmware, then some level of firmware protection is provided, but the protection is weak and can be compromised by external attackers
Solution Approach 1:
The patent replaces software-based password protection with a hardware-based lock mechanism. The hardware lock unit physically controls access to the firmware in nonvolatile memory, making it impossible for external attackers to compromise the security through software attacks. The lock unit contains circuitry that physically prevents access unless the correct lock ID is provided, transforming security from a software logic problem to a hardware physical problem.
2Duration of action of stationary object
If firmware is stored in nonvolatile memory for persistent storage, then firmware can be retained and updated, but the firmware can be accessed and updated by multiple agents including potential attackers
Solution Approach 1:
The hardware lock unit acts as an intermediary between multiple agents (CPU cores, Power Management Controller, sideband firmware) and the firmware in nonvolatile memory. The arbitrator component of the lock unit mediates access requests by checking whether the requesting agent possesses the correct lock ID. Only authenticated agents with matching lock IDs can access or update the firmware, while preventing unauthorized agents from accessing even though the firmware remains persistently stored in nonvolatile memory.
3Ease of repair
If a sideband firmware is used to repair accessed or damaged firmware, then firmware recovery is enabled, but the sideband firmware itself can be accessed and utilized by attackers
Solution Approach 1:
The hardware lock mechanism dynamically controls access to firmware based on the current lock state and the identity of the requesting agent. When firmware is in a locked state, only agents with the correct lock ID can access it, including sideband firmware. The lock state can be changed from locked to unlocked only by authenticated agents, and when unlocked, the lock ID is updated. This dynamic control ensures that sideband firmware can only repair firmware when it is authenticated, preventing attackers from utilizing the sideband firmware as an attack vector.
Data Source
AI summary
A new approach is proposed to support a hardware-based lock mechanism having a hardware-based lock unit associated with a resource, wherein the lock is utilized by an arbitrator to arbitrate between multiple agents requesting access to the resource. When a first agent requests access to resource in unlocked state, the arbitrator creates a lock ID and set a locked state indicating that the resource is locked. The lock ID is provided to the first agent, which now has exclusive control over the resource. The arbitrator ensures that any agent with the same ID may access the resource. When a second agent requests access to the resource with a lock ID to the arbitrator, it is granted access to the resource if the lock ID provided matches the one stored on the lock unit. If there is a mismatch between the lock IDs, access to the resource is denied.