Microprocessor Boot Code Cryptographic Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems cannot establish a chain of trust that encompasses every instruction executed, as software that runs early in the boot process, such as BIOS, is easily subverted, allowing unauthorized access to sensitive information and system resources.
Innovation Solution
The solution involves altering the reset sequence of a programmable microprocessor to perform cryptographic verification of memory blocks before executing any instructions, using a one-way cryptographically secure hash function to verify data integrity and authenticity, thereby extending the trust boundary to include all user code executed in the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic verification is performed on all instructions, then trust chain strength is improved, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by performing cryptographic verification of boot code and system instructions before execution occurs. The verification process is initiated automatically during system boot-up, and verified instructions are stored in a trusted state ready for execution, eliminating the need for continuous verification during runtime and reducing operational complexity.
Solution Approach 2:
The patent segments the verification process into distinct phases: boot code verification, system instruction verification, and execution authorization. By dividing the verification task into separate stages rather than attempting to verify every instruction simultaneously, the system achieves comprehensive trust chain coverage while managing computational resources and system complexity.
2Speed
If BIOS instructions are trusted implicitly, then boot process speed is improved, but security vulnerability increases
Solution Approach 1:
The patent applies preliminary action by performing cryptographic verification of BIOS and boot code instructions before the system transitions to normal operation. This verification occurs during the boot process itself, ensuring that only authenticated instructions are executed while maintaining efficient boot-up timing through automated verification rather than manual intervention.
Solution Approach 2:
The patent introduces a cryptographic verification mechanism as an intermediary between the boot code and the execution process. This intermediary layer validates the authenticity and integrity of instructions before allowing them to execute, thereby preventing security vulnerabilities while maintaining the speed of the boot process through automated verification.
3Reliability
If verification is performed before instruction execution, then code security is improved, but execution time increases
Solution Approach 1:
The patent applies preliminary action by performing all necessary cryptographic verification of boot code and system instructions before the execution phase begins. By completing verification during the boot process and storing verified instructions in a trusted state, the system eliminates verification time during instruction execution, thereby maintaining code security without increasing runtime execution time.
Solution Approach 2:
The patent segments the verification and execution processes into distinct temporal phases: verification occurs during boot-up before execution begins. This segmentation allows verification to be performed once during system initialization rather than repeatedly during each instruction execution, significantly reducing the time impact on overall system operation while maintaining comprehensive code security.
Data Source
AI summary
Described herein is an alteration of the normal reset sequence of a programmable microprocessor to perform a cryptographic verification of a block of memory before executing any instructions from the memory. A programmable processor initializes its state, then computes and verifies a hash of a boot code region of memory before executing any user instructions in the memory. Systems using similar processors, and software to control such a processor's operation, are also described and claimed.