PMIC Challenge-Response Control Against SoC Voltage Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing system-on-chip (SoC) security features are vulnerable to hacking, particularly through manipulation of supply voltage, which can lead to unexpected behavior and compromise safety in vehicle systems.
Innovation Solution
A power management integrated circuit (PMIC) is configured to share a key with the SoC, generating challenges and comparing responses to ensure authenticity, and in case of mismatch, applies a reset or controls power and clock domains to mitigate potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security features are implemented in SoC to protect against hacking, then security protection is improved, but the system becomes vulnerable to voltage manipulation attacks that can bypass these security measures
Solution Approach 1:
The patent introduces a voltage monitor as an intermediary component between the PMIC and the SoC. This monitor continuously monitors the supply voltage and compares it against expected values, acting as a mediator that can detect voltage manipulation attempts and trigger security responses independent of the SoC's authentication state, thereby preventing voltage-based attacks from bypassing security features
Solution Approach 2:
The system performs preliminary voltage verification before allowing full operational access. The voltage monitor continuously checks voltage levels in advance, and the PMIC is configured to detect voltage deviations and trigger security measures (such as resetting the SoC or preventing certain operations) before malicious code can execute and bypass security mechanisms
2Adaptability or versatility
If the PMIC is made accessible to allow external power supply connection, then power management flexibility is improved, but the security features can be bypassed by removing or disabling the PMIC
Solution Approach 1:
The patent implements feedback mechanisms where the voltage monitor continuously provides information about actual voltage conditions back to the PMIC. The PMIC uses this feedback to detect when external power sources are connected or when voltage levels deviate from expected ranges, and automatically triggers security responses such as resetting the SoC or disabling certain functions, thereby maintaining security integrity while allowing power management flexibility
Solution Approach 2:
The system prepares counter-measures in advance against PMIC removal or disabling attacks. The voltage monitor and PMIC are configured to detect attempts to bypass the PMIC (such as connecting external power sources or manipulating voltage lines) and automatically execute pre-programmed security responses, preventing the bypass before it can compromise security features
3Reliability
If challenge-response authentication is implemented between PMIC and SoC, then access control is improved, but the system may experience operational disruptions when voltage deviations occur
Solution Approach 1:
The patent segments the power management system into distinct functional domains: a monitoring domain (voltage monitor), a control domain (PMIC), and a processed domain (SoC). This segmentation allows the voltage monitor and PMIC to operate independently and trigger security responses without necessarily disrupting the entire SoC operation. Only when actual security threats are detected does the system intervene, maintaining operational continuity during normal voltage variations while preserving access control during actual attacks
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A power management integrated circuit (PMIC) and method of operating a PMIC is described. The PMIC is configured to be coupled to a system on chip (SoC) including a number of power and clock domains. Each of the PMIC and the SoC have a shared key. The PMIC is configured to generate a challenge, output the challenge to the SoC and generate an expected-challenge-response determined from the challenge and the shared key. The PMIC is further configured to receive a challenge-response from the SoC and compare the challenge response with the expected-challenge-response. If the challenge response is different to the expected response, the PMIC may (i) apply a reset to the SoC, (ii) supply power to a subset of the SoC power domains and/or (iii) enable clocks of a subset of SoC clock domains.