Mainboard Startup Verification for Trusted Peripheral Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to adequately verify the security of peripherals connected to electronic devices during the startup process, making them vulnerable to attacks that can compromise information security.
Innovation Solution
A mainboard for security verification is deployed in electronic devices, equipped with a verification unit and a channel management unit, which work together to send verification instructions, obtain configuration information, and verify it against stored data, ensuring that only trustworthy devices are allowed to start the electronic device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security processor is added to validate security parameters in the mainboard, then security validation capability is improved, but device complexity increases
Solution Approach 1:
A dedicated security processor is introduced as an intermediary component between the existing CPU and memory subsystem. This security processor receives memory encryption requests from the CPU, performs security parameter validation, and communicates with the PUF module for authentication. By inserting this intermediary layer, the patent achieves security validation capability without requiring fundamental redesign of the mainboard architecture, thus resolving the contradiction between improved security and increased complexity.
2Reliability
If security parameters are validated before memory allocation, then security reliability is improved, but processing time increases
Solution Approach 1:
The security processor performs preliminary validation of security parameters before memory allocation requests are fully processed. By validating security parameters in advance and caching authentication results, the system ensures that when actual memory allocation occurs, the security checks are already completed or can be quickly verified, thereby reducing the time penalty associated with security validation.
Solution Approach 2:
The security validation process is designed to operate continuously in the background rather than blocking memory allocation operations. The security processor validates parameters asynchronously where possible, and maintains authentication states that allow for rapid subsequent validations, ensuring that security checks do not create repeated time penalties for each memory operation.
3Reliability
If existing mainboards are upgraded with security validation, then security capability is improved, but upgrading complexity increases
Solution Approach 1:
The security validation functionality is segmented into a separate, modular security processor component that can be independently added to existing mainboards. This segmentation allows manufacturers to produce upgrade kits containing only the necessary security processor and associated firmware, rather than requiring complete mainboard replacements. The modular approach simplifies the upgrading process by enabling incremental integration of security capabilities into legacy systems.
Data Source
Figure 1~2A
Figure 2B
Figure 3
AI summary
This specification discloses a mainboard for security verification, a security verification method and apparatus, and a medium. A verification unit connected to a channel management unit and a channel management unit connected to each device to be verified are disposed. After an electronic device is powered on, the verification unit is controlled to send a verification instruction for the device to be verified to the channel management unit, configuration information of the device to be verified is obtained according to the received verification instruction by using the channel management unit, and the configuration information is returned to the verification unit. Then the verification unit verifies the received configuration information according to stored verification information. After verification succeeds, the electronic device is controlled to start. The configuration information of the device to be verified is sent by using the channel management unit to the verification unit for verification, so as to implement security verification on a device to be verified disposed inside the electronic device and/or a device to be verified externally connected to the electronic device in a start process of the electronic device, thereby ensuring information security.