Isolated Execution Environment for External Memory Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
External memory data is vulnerable to malicious attacks and damage due to its location outside the chip, lacking sufficient security mechanisms compared to data stored inside the chip.
Innovation Solution
A method and system utilizing an isolated execution environment in a system-on-a-chip, where data is encrypted with a private key, hashed, and stored in external memory, with integrity checks and authentication processes to ensure security, involving a processor that generates and manages keys and hash values within a dedicated memory space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data is stored in external memory to expand storage capacity, then storage space is increased, but security against malicious attacks and data theft deteriorates
Solution Approach 1:
The system segments the memory architecture into internal memory (on-chip) and external memory (off-chip), with different security levels. Critical data is stored in internal memory with hardware-based security, while external memory provides expanded storage capacity. This segmentation allows the system to gain additional storage space while maintaining security for sensitive data through the isolated execution environment and encryption mechanisms.
Solution Approach 2:
An isolated execution environment (IEE) acts as an intermediary between the main system and external memory. The IEE includes a dedicated processor that encrypts data before writing to external memory and decrypts/validates data before reading from it. This intermediary layer provides security protection without preventing the system from utilizing external memory's expanded storage capacity.
2Reliability
If data is encrypted and hashed before storage to enhance security, then data protection is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by generating encryption keys and hashing algorithms in advance within the isolated execution environment. Hash values are pre-computed and stored alongside encrypted data, so that during read operations, the system can quickly verify data integrity by comparing pre-stored hash values with newly computed hashes, reducing processing time during critical operations.
Solution Approach 2:
The isolated execution environment provides self-service security functions by automatically performing encryption, decryption, and integrity verification without requiring main system intervention. The dedicated processor within the IEE handles all cryptographic operations independently, minimizing the time the main system needs to wait for security-processing tasks to complete.
3Reliability
If an isolated execution environment is implemented with encryption and authentication mechanisms, then data security is enhanced, but system complexity increases
Solution Approach 1:
The complex security functions (encryption, decryption, authentication, integrity verification) are extracted from the main system and placed into a separate isolated execution environment. This extraction consolidates security-related complexity into a dedicated module, allowing the main system to interact with external memory through simplified interfaces while the IEE handles the complex cryptographic operations independently.
Solution Approach 2:
The isolated execution environment is designed as a universal security module that handles multiple functions: encryption/decryption of data, generation and management of cryptographic keys, computation and verification of hash values for integrity checking, and authentication of programs. By consolidating these diverse security functions into a single multi-functional unit, the system manages complexity more effectively than having separate mechanisms for each security operation.
Data Source
AI summary
A method for protecting data in an external memory based on an isolated execution environment is provided. The method is used in a processor in the isolated execution environment of a system-on-a-chip. The method includes: accessing an output command of a main system processor in a main system of the system-on-a-chip; reading first data from a shared memory in the main system according to the output command; encrypting the first data with a private key and generating encrypted first data; and outputting the encrypted first data to the external memory.