Protected Mode for Securing COTS Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commercial off-the-shelf (COTS) devices lack robust security features, making them vulnerable to various threats and unable to provide high levels of assurance for sensitive data, especially when used for secure communications and processing.
Innovation Solution
Implementing a dual boot approach with a Secure OS that operates in a protected mode, restricting access to volatile memory and hardware resources, and using a trusted monitor to validate the device's state, ensuring the Secure OS remains unchanged and malware-free.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If COTS devices are used for everyday operations, then device functionality and ease of operation are improved, but security and reliability deteriorate
Solution Approach 1:
The system segments device operation into two distinct modes: unprotected mode for everyday functionality and protected mode for secure operations. This segmentation allows COTS devices to maintain full functionality for general use while providing enhanced security for sensitive operations, resolving the contradiction between ease of operation and security reliability.
2Reliability
If protected mode is implemented with static operational image, then security and reliability are improved, but device complexity increases
Solution Approach 1:
A trusted monitor acts as an intermediary component that validates the static operational image and enforces protected mode operations. This intermediary provides the necessary security assurance while managing the complexity, as the trusted monitor handles the complex validation and enforcement tasks rather than requiring the entire system to be redesigned for security.
3Reliability
If volatile memory is restricted in protected mode, then security is improved, but loss of information increases
Solution Approach 1:
The system extracts and preserves essential session information in a protected manner when transitioning to protected mode. By selectively taking out critical data that needs to be maintained while restricting access to volatile memory, the system achieves both security improvement and information preservation, resolving the contradiction between security and information loss.
Data Source
AI summary
Methods and systems are disclosed for testing and/or validating that an untrusted device is operating according to an expected state or configuration. The methods and systems may be designed such that the volatile memory of the untrusted device is brought to a known state for validation, for example upon ingress to or egress from a protected mode of operation. The device may execute a first operating system when operating outside of the protected mode. Upon determining to transition to protected mode, an operational image of a second operating system may be loaded into the device. The device may write a pattern to unused memory for validation. The device may receive a first challenge request from a trusted monitor (TM). In order to be successfully validated, the device may answer the challenge correctly within a given response window based on the current state of its volatile memory.