IoT SoC Sleep Wakeup Authentication via AON Key Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in detecting attacks during sleep mode, as most modules are turned off, making it difficult to detect modifications, replacements, or damage to data in memory, which can lead to serious harm.
Innovation Solution
A method and system that accelerate the startup speed of IoT devices from sleep mode by calculating and comparing authentication keys using cryptographic algorithms, ensuring secure boot and detection of attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete secure boot process is performed upon waking from sleep mode, then security is ensured through full authentication verification, but startup speed is significantly reduced
Solution Approach 1:
The patent divides the secure boot authentication process into two segments: a fast authentication path for sleep mode wake-up and a complete authentication path for cold boot. The fast path uses pre-stored authentication data in AON memory for quick verification, while the complete path performs full secure boot verification. This segmentation allows the system to achieve fast startup when security requirements are met without compromising overall security.
Solution Approach 2:
The patent performs preliminary authentication actions before entering sleep mode by pre-calculating and storing authentication data (hash values of firmware images, configuration data) in the AON memory. This preliminary action enables the fast authentication path to verify security status quickly upon wake-up without performing the complete secure boot process, thus resolving the contradiction between security and startup speed.
2Use of energy by moving object
If all modules including CPU are turned off in sleep mode to save power, then power consumption is reduced, but ability to detect attacks on memory data is lost
Solution Approach 1:
The patent introduces an intermediary fast authentication mechanism that operates with minimal power consumption during sleep mode wake-up. This intermediary path uses pre-stored authentication data and a simplified verification process to detect potential attacks without requiring full CPU operation. If attacks are detected, the system then performs the complete secure boot process, thus maintaining attack detection capability while minimizing power consumption during normal sleep operations.
Solution Approach 2:
The AON memory stores authentication data that enables the system to self-verify its security status upon wake-up without requiring external intervention or full system activation. The fast authentication path allows the system to independently detect attacks by comparing current firmware hashes with pre-stored hashes, maintaining security monitoring capability with minimal power consumption.
3Speed
If fast authentication is used upon wake-up to improve startup speed, then startup speed is accelerated, but security verification may be compromised
Solution Approach 1:
The patent implements a feedback mechanism where the result of fast authentication determines whether to proceed with normal operation or trigger a complete secure boot process. The fast authentication path provides immediate feedback on security status, and based on this feedback, the system either wakes up normally or initiates a complete secure boot verification, thus ensuring security is not compromised while maintaining fast startup when conditions permit.
Solution Approach 2:
The patent applies partial authentication action in the fast path by verifying only critical security elements (firmware image hashes, configuration data) rather than performing the complete secure boot sequence. This partial verification is sufficient for most wake-up scenarios and provides fast startup speed, while the system reserves the capability to perform excessive (complete) authentication if the partial verification fails or security concerns arise.
Data Source
AI summary
A method for accelerating sleep startup speed is provided. The method may include determining that a system-on-chip (SoC) is under a sleep mode; determining that a wake-up condition is met; calculating a second authentication key based on data stored in a flash memory of the SoC using a cryptographic algorithm; comparing the second authentication key with a first authentication key, wherein the first authentication key is associated with a secure boot of the SoC and obtained from an Always On (AON) memory of the SoC; and in response to a comparison result that the first authentication key is the same as the second authentication key, waking the SoC up from the sleep mode.