Measured Boot Secure Link Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing a secure communication link between devices connected via an interconnect is challenging due to potential security threats, such as external access to internal address spaces and the risk of compromised certificate authorities.
Innovation Solution
A modified measured boot approach is used to authenticate devices by treating the identity of another device as a boot stage, generating self-signed digital certificates, and extending certificate chains with measurements from the other device, ensuring secure communication through cryptographic techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If devices are connected via an interconnect to enhance performance, then system performance and functionality are improved, but security threats increase due to external access to internal address spaces
Solution Approach 1:
The patent introduces an interconnect fabric as an intermediary layer between devices, which provides both performance enhancement through parallel communication and security through controlled access mechanisms. The fabric acts as a mediator that enables high-speed data exchange while preventing direct unauthorized access to internal address spaces through its inherent access control architecture.
2Ease of operation
If a central certificate authority is used to validate device identities, then authentication is simplified, but security risks increase if the certificate authority is compromised
Solution Approach 1:
The patent segments the centralized certificate authority model into distributed trust anchors embedded in each device's secure element. Instead of relying on a single external CA, each device possesses its own cryptographic identity and verification capability, distributing the trust function across multiple independent units. This eliminates the single point of failure while maintaining authentication simplicity through standardized cryptographic protocols.
Solution Approach 2:
Each device performs self-authentication using its own embedded cryptographic credentials stored in secure elements. The devices independently verify each other's identities without requiring external CA intervention, enabling mutual authentication that is both simple to operate and resistant to centralized compromise. The secure elements autonomously manage cryptographic operations and protect private keys.
3Productivity
If measured boot approach is used to log measurements without verifying integrity, then boot process continues without halting, but chain of trust establishment becomes more complex requiring central management entity verification
Solution Approach 1:
The patent performs preliminary measurement logging during the boot process without requiring immediate verification, allowing the boot sequence to continue uninterrupted. The measurements are captured and stored in secure elements as the system boots, deferring the verification and attestation process to a later stage when a central management entity can validate the accumulated measurements without causing boot delays.
Data Source
AI summary
A modified measured boot approach is utilized for establishing a secure communication link between two devices. Each device may execute a respective boot process until the device reaches the stage responsible for establishing the communication link with the other device. Each device may exchange its respective self-signed certificate and extend its certificate chain with the self-signed certificate received from the other device. A secure link can be established using the public key of the other device as a based key for a key exchange protocol.