Secure Application RTC Updates for Tamper-Resistant Timekeeping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure systems face vulnerabilities due to tampering of real-time clocks (RTC) used for time-sensitive operations, leading to reduced security and increased power consumption.
Innovation Solution
A system is implemented with a shared RTC between secure and non-secure applications, where the secure application maintains a trusted clock record during low-power mode by performing clock updates and initializations, while preventing non-secure application modifications during low-power mode, using secure and non-secure communication links.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a real-time clock is used for time-sensitive operations, then time reference is provided, but the system becomes susceptible to tampering and security is reduced
Solution Approach 1:
The system divides the application into secure and non-secure portions, with the secure application maintaining exclusive control over RTC updates. This segmentation ensures that only authenticated time references can be written to the RTC, preventing tampering by non-secure applications while still allowing the RTC to provide time references to both application types.
Solution Approach 2:
The secure application acts as an intermediary between the non-secure application and the RTC. The non-secure application requests time updates through the secure application, which verifies the request and performs the RTC update only after authentication. This intermediary mechanism prevents direct tampering while maintaining functional access.
2Reliability
If a dedicated secure clock is implemented, then security is improved, but power consumption increases
Solution Approach 1:
The RTC serves multiple functions: it provides time references to both secure and non-secure applications, and it can be updated by either the secure application (for secure operations) or the non-secure application (when authenticated). This multi-functionality eliminates the need for separate secure and non-secure clocks, reducing overall power consumption while maintaining security.
Solution Approach 2:
The secure application periodically updates the RTC with authenticated time references from external sources, making the system self-sufficient for maintaining secure timekeeping. This eliminates the need for continuous operation of dedicated secure clock hardware, allowing the system to enter low-power states when updates are not immediately needed.
3Measurement precision
If the non-secure application can update the RTC freely, then clock calibration is possible, but security is compromised
Solution Approach 1:
The system performs authentication of the non-secure application before allowing RTC updates. The secure application verifies the credentials of the non-secure application in advance, and only permits time updates if authentication succeeds. This preliminary security check ensures that calibration can be performed by authorized applications while preventing malicious tampering.
4Reliability
If the secure application operates continuously in normal mode, then secure time reference is maintained, but power consumption increases
Solution Approach 1:
The secure application operates in periodic cycles, alternating between normal mode (when secure operations are needed) and low-power mode (when secure time reference can be maintained from previous authenticated updates). The system enters low-power mode after successful authentication and exits to normal mode when secure time-sensitive operations require fresh time references, optimizing the balance between security and power consumption.
Data Source
AI summary
A system comprising a real time clock, RTC, and a processor configured to execute a secure application to provide a secure clock and configured to operate in a first low-power-mode and a first normal-mode, and a non-secure application configured to perform a clock modification procedure and configured to operate in a second low-power-mode and a second normal-mode, the system configured to perform a secure clock initialisation procedure comprising obtaining a record of a current time from the RTC based on a transition from the first low-power-mode to the first normal-mode, wherein the secure application is configured to perform a clock update procedure including updating the RTC with a secure record of the current time and wherein the system is further configured to prevent performing the clock modification procedure after the clock update procedure has been performed.