Secure Boot Device Firmware Verification Timing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot mechanisms consume high energy and computational resources, leading to longer boot times and potential vulnerabilities to tampering and attacks.
Innovation Solution
A secure boot device and method that utilizes a counter, storage, and comparator to record and compare the time taken for firmware verification during the first and subsequent boots, determining whether the firmware is tampered with or the system is under attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing secure mechanisms verify hash value of firmware to prevent tampering, then security is improved, but energy consumption and computational load increase
Solution Approach 1:
The patent stores the first-time verification count value in advance during the initial firmware verification. This preliminary action allows subsequent verifications to simply compare against the stored value rather than performing full hash verification, significantly reducing energy consumption while maintaining security.
Solution Approach 2:
The patent creates a copy of the verification time characteristic (stored as first-time verification count value) and uses this copy for subsequent security checks. Instead of repeatedly performing the full verification computation, the system compares against the stored copy, reducing computational load and energy usage.
2Reliability
If existing secure mechanisms verify hash value of firmware to prevent tampering, then security is improved, but boot time increases
Solution Approach 1:
The verification time characteristic is measured and stored in advance during the first boot. Subsequent boots only require comparing the current verification count against the stored first-time value, dramatically reducing the time required for firmware verification while maintaining security assurance.
Solution Approach 2:
The patent uses a copy of the verification time characteristic (first-time verification count value) for rapid comparison in subsequent boots. This eliminates the need to recompute hash values multiple times, significantly reducing boot time while preserving security.
3Reliability
If another secure mechanism is added to prevent tampered firmware execution, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent makes the existing counter and comparator circuits multi-functional by having them perform both their original functions and the new firmware verification timing function. This approach enhances security without adding dedicated new hardware circuits, thereby minimizing increases in device complexity.
Solution Approach 2:
The patent merges the firmware verification timing function with the existing counter and comparator operations. By combining multiple functions into existing circuitry, the patent achieves enhanced security while avoiding the need for separate dedicated security circuits, thus limiting complexity growth.
Data Source
AI summary
A secure boot device includes a counter, a storage device and a comparator. The counter receives a clock. When the processor performs a verification of a firmware for the first time, the counter counts a first verification time taken by the processor to perform the verification of the firmware for the first time based on the clock to generate a first-time verification count value. When the processor performs the verification of the firmware for the non-first time, the counter counts a second verification time taken by the processor to perform the verification of the firmware at least once for the non-first time based on the clock to generate a count value. The storage device stores the first-time verification count value. The comparator is electrically connected to the counter and the storage device. When the processor performs the verification of the firmware for the non-first time, the comparator compares the count value with the first-time verification count value, and generates a comparison result. The comparison result is used to indicate whether the processor executes the firmware.