Runtime Security Execution Monitor for Power-Constrained Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in maintaining runtime security assurances similar to secure boot processes, especially in power-constrained devices, where security checks are needed on demand and fault injection attacks are prevalent, without substantial resource overhead.
Innovation Solution
A runtime security system with a shared core, execution monitor, timer, policy table, and state machine that verifies and manages secure boot and service requests, ensuring secure access to cryptographic keys and assets while minimizing power consumption and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security services are provided continuously in prior systems, then security assurance is maintained, but power consumption increases substantially
Solution Approach 1:
The execution monitor activates security monitoring only during specific periods when secure services are requested, rather than continuously. The monitor enters a low-power state between security operations, significantly reducing power consumption while maintaining security assurance when needed.
Solution Approach 2:
The system dynamically transitions between different operational states - active monitoring mode when security services are required and low-power standby mode otherwise. This dynamic state management allows the system to adapt power consumption to actual security needs.
2Reliability
If immutable security processes are executed at boot time, then root-of-trust is established, but security state must remain powered until chip shutdown
Solution Approach 1:
The security state and cryptographic materials are pre-loaded into secure memory during the boot process when power is available. Once loaded, the execution monitor can quickly re-access these pre-positioned security assets without requiring continuous power to the entire security subsystem, enabling rapid activation and deactivation.
3Reliability
If execution monitoring is implemented, then security verification is enhanced, but device complexity increases
Solution Approach 1:
The execution monitor serves as an intermediary component between the shared core and security assets. It provides the necessary security verification functions without requiring complex modifications to the existing shared core architecture, thereby enhancing security while limiting the increase in overall device complexity.
Solution Approach 2:
The security monitoring function is segmented into a separate execution monitor module with its own state machine and control logic, independent from the main shared core. This segmentation allows the monitoring functionality to be added without significantly complicating the core processor design.
4Productivity
If shared core executes multiple processes with varying trust levels, then resource utilization improves, but security protection becomes more difficult
Solution Approach 1:
The execution monitor applies different security verification rules and monitoring strictness levels based on the trust level of each process executing on the shared core. High-trust processes receive standard monitoring while low-trust processes undergo more rigorous verification, providing appropriate security protection tailored to each process's risk level.
Data Source
Figure 1
Figure 2~3
Figure 4A~5
AI summary
A runtime security system, including: a shared core configured to execute processes having varying levels of trustworthiness configured to receive security services requests; an execution monitor configured to monitor the execution of the shared core further comprising a timer, a policy table, and an execution monitor state machine; secure assets including cryptographic keys; and immutable security service functions configured to enable access to the secure assets in response to secure services requests; wherein the execution monitor is configured to: detect that the shared core has received a secure boot request; verify that the secure boot request is valid; allow the shared core to securely boot when the secure boot request valid.