Secure Boot Processing Chip with Unified Memory Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure boot technologies for processors are inadequate in providing comprehensive protection against both physical and software attacks, particularly during the boot process and executable code updates, which can be compromised by power failures or malicious interventions.
Innovation Solution
A unified solution that integrates features of a Trusted Platform Module (TPM), Hardware Security Module (HSM), and Root of Trust (RoT) into a processing chip, utilizing a Key Management Unit (KMU) and Unified Memory Controller (UMC) to ensure secure boot, encrypt executable code, and manage updates securely, even in the presence of power failures or physical attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure boot technology is implemented for processors, then security against physical and software attacks is improved, but the system becomes more complex and vulnerable to power failure compromises
Solution Approach 1:
The patent combines TPM, HSM, and RoT features into a unified secure boot processor that integrates key management, cryptographic operations, and secure execution environments into a single device, reducing overall system complexity while maintaining comprehensive security functionality
Solution Approach 2:
The secure boot processor is designed to perform multiple security functions including key generation, cryptographic verification, secure boot execution, and update validation within a single device, eliminating the need for separate dedicated hardware components for each function
2Reliability
If executable code is encrypted for secure storage, then security is improved, but the time required for code verification and execution increases
Solution Approach 1:
The system performs preliminary cryptographic verification of encrypted executable code during the secure boot process before full execution, using pre-loaded verification keys and algorithms to quickly validate code integrity without requiring complete decryption and analysis of the code
Solution Approach 2:
The patent replaces traditional mechanical code verification methods with cryptographic verification mechanisms that use mathematical algorithms to validate code integrity, significantly reducing verification time compared to conventional checksum or hash-based approaches
3Reliability
If comprehensive security measures are implemented during boot process, then protection against malicious interventions is improved, but the boot process duration increases
Solution Approach 1:
The secure boot process is divided into distinct sequential stages including initial化和 key loading, code verification, and execution, allowing each stage to be optimized independently and enabling parallel processing of verification tasks to reduce overall boot time while maintaining comprehensive security checks
Data Source
AI summary
Techniques in electronic systems, such as in systems including a processing chip and one or more external memory chips, provide improvements in one or more of system security, performance, cost, and efficiency. The processing chip includes immutable hardware enabled to securely boot one or more CPUs of the processing chip to execute code stored in a non-volatile one of the external memory chips, and to update the code. An update to the code is written to a portion of one of the external memory chips that is not accessible to the CPUs, and the immutable hardware copies the update to the non-volatile memory chip. The update is encrypted with a public portion of a key possessed by an entity sending the update, and a private portion of the key, used to decrypt code stored in the non-volatile memory chip, is unique to and solely possessed by the processing chip.