Hardware Security Module for Memory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for controlling memory access on electronic devices are insecure when relying solely on software measures, as they are vulnerable to hacking and software bugs, and hardware mechanisms that require processors with 'secure' and 'non-secure' states are not applicable to all processors.
Innovation Solution
An electronic device with a processor, memory, memory controller, and hardware security module connected via a bus system, where the hardware security module adds a secure-state signal to requests from the processor to control access to secure memory regions, allowing secure and non-secure states without requiring the processor to support these states inherently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software measures are used to restrict access to memory regions, then ease of implementation is improved, but security is worsened due to vulnerability to hacking and software bugs
Solution Approach 1:
A hardware security module is introduced as an intermediary component between the processor and the memory system. This module intercepts memory access requests from the processor, verifies security credentials, and either permits or blocks access to secure memory regions. This intermediary approach maintains security through hardware-based verification while keeping the processor design simple and compatible with existing architectures.
2Reliability
If hardware mechanisms with secure and non-secure processor states are used, then security is improved, but device complexity and processor requirements are worsened
Solution Approach 1:
The security functionality is segmented from the processor into a separate hardware security module. This segmentation allows the processor to remain simple and compatible with existing designs, while the security module independently handles authentication and access control. The system is divided into secure and non-secure components without requiring the entire processor to implement complex security states.
Solution Approach 2:
The hardware security module is designed to work with existing processor architectures without requiring them to support secure/non-secure states. It provides universal security functionality that can be applied to various processor types, making the security mechanism broadly applicable while maintaining simplicity in the processor design.
3Reliability
If processors with inherent secure and non-secure states are used, then security control is improved, but adaptability to different processor designs is worsened
Solution Approach 1:
The hardware security module serves as an intermediary that translates processor memory access requests into security verification operations. It interfaces with the existing processor architecture through standard memory access protocols, providing security control without requiring the processor to understand or implement secure/non-secure state concepts. This intermediary layer enables processor compatibility while maintaining security control.
Data Source
AI summary
An electronic device comprises a processor, a memory, a memory controller for controlling access to the memory, a hardware security module, and a bus system, to which the processor, the memory controller, and the hardware security module are connected. The hardware security module uses its connection to the bus system to detect requests on the bus system that are sent by the processor. The hardware security module has a secure state and a non-secure state. When in the secure state, the hardware security module adds a secure-state signal to requests sent by the processor over the bus system. The memory controller determines whether memory-access requests include the secure-state signal, and denies access to a secure region of the memory in response to receiving memory-access requests that do not include the secure-state signal.