Monotonic Counter Refurbishment via Segmented Binary and OTP Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure computing devices with monotonic counters are often declared unusable after a security breach, leading to unnecessary device disposal and potential false positive security breaches, as the existing designs are too harsh in declaring security breaches and do not allow for the refurbishment of devices.
Innovation Solution
A secure computing device is configured with a monotonic counter that can be reclaimed after a security breach, utilizing a binary counter and a register of one-time programmable bits to maintain monotonic count values across power cycles and refurbishment, allowing the device to be refurbished and reused.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional secure computing devices are declared unusable after a security breach, then security reliability is improved, but device loss increases and usability deteriorates
Solution Approach 1:
The monotonic counter is segmented into two distinct parts: a binary counter that tracks count values and a separate register of one-time programmable bits that tracks security breach events. This segmentation allows the binary counter to be reset after a breach while the OTP register maintains the monotonic property, enabling device refurbishment without compromising security reliability.
Solution Approach 2:
After a security breach is detected, the binary counter is discarded (reset to zero) while the OTP register is preserved. The system recovers by using the preserved OTP register to generate new monotonic count values, allowing the device to be refurbished and reused without the need to discard the entire device.
2Reliability
If conventional secure computing devices are declared unusable after a security breach, then security integrity is improved, but ease of operation deteriorates
Solution Approach 1:
The system dynamically adapts its behavior based on security breach detection. When a breach is detected, the system transitions from normal operation to refurbishment mode, where the binary counter is reset and the OTP register is used to generate new monotonic values. This dynamic adaptation maintains security integrity while allowing the device to continue operating, improving ease of operation.
3Reliability
If a monotonic counter is implemented in a secure execution environment, then security trust is improved, but device complexity increases
Solution Approach 1:
The monotonic counter implementation is segmented into two independent components: a binary counter for tracking count values and an OTP register for tracking security events. This segmentation simplifies the overall implementation by allowing each component to have a specific, well-defined function, reducing the complexity of managing a single complex counter system.
Solution Approach 2:
The system uses a copy of the monotonic counter state stored in the OTP register to continue operation after a breach. Instead of maintaining a single complex counter state, the system creates a simplified copy in the OTP register that can be used to generate new count values, reducing the complexity of state management.
4Ease of operation
If false positive security breaches are minimized, then ease of operation is improved, but security reliability may deteriorate
Solution Approach 1:
The system implements feedback by continuously monitoring for security breaches and using this information to determine whether to reset the binary counter or preserve the OTP register. This feedback mechanism allows the system to distinguish between actual security breaches and false positives, maintaining both security reliability and ease of operation by only triggering refurbishment when necessary.
Data Source
AI summary
A secure computing device (14) includes a secure processing section (30) having a tamper detection circuit (58) and a monotonic counter (68). The tamper detection circuit (58) detects an event which suggests that the trust associated with the secure processing section (30) may have been compromised. When such an event is detected, a security breach is declared and trusted software (38) is disabled. After a security breach is declared, the monotonic counter (68) may be reclaimed. The monotonic counter (68) provides a monotonic count value (70) that includes an LSB portion (80) and an MSB portion (82). The LSB portion (80) is obtained from a binary counter (72). The MSB portion (82) is obtained from a register (84) of independent one-time-programmable bits. The monotonic counter (68) is reclaimed by programming one of the one-time programmable bits to guarantee that future counting of the monotonic counter will be monotonic relative to all past counting.