Secure Boot Verification with Halted Open Subsystem
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot procedures in computing systems are vulnerable to runtime attacks, allowing attackers to bypass verification processes and gain control by exploiting limited secure component resources, which can compromise the integrity of the system.
Innovation Solution
Implementing a secure sub-system that independently verifies and executes boot firmware, while keeping the open sub-system in a halted state until verification is complete, using cryptographic algorithms to ensure secure execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the open sub-system executes boot firmware during boot procedure, then the boot process can proceed, but attackers can take control of the open sub-system and bypass verification
Solution Approach 1:
The system is divided into two independent sub-systems: an open sub-system for normal operations and a secure sub-system for verification. The secure sub-system independently verifies boot firmware cryptographic signatures before the open sub-system executes the firmware, preventing attackers from compromising the execution process while maintaining normal boot functionality.
Solution Approach 2:
The secure sub-system performs verification actions before the open sub-system executes boot firmware. By预先 verifying cryptographic signatures and establishing security credentials in advance, the system ensures that only authenticated firmware can be executed, preventing runtime attacks.
2Reliability
If secure component resources are limited, then the secure verification process may be compromised, but using more resources increases security
Solution Approach 1:
Resources are segmented between two sub-systems with different security levels. The secure sub-system contains dedicated verification resources (cryptographic modules, secure storage) isolated from the open sub-system, ensuring that limited resources are protected and cannot be accessed by attackers controlling the open sub-system.
Solution Approach 2:
The secure sub-system acts as an intermediary between the boot firmware and the open sub-system. It verifies firmware signatures and controls execution permissions, preventing direct access to secure resources by the open sub-system or potential attackers.
3Ease of operation
If the open sub-system is accessible during boot, then normal operations can proceed, but attackers can exploit this access to gain control
Solution Approach 1:
The secure sub-system performs preliminary verification and establishes security credentials before the open sub-system becomes accessible for firmware execution. This preliminary security establishment prevents attackers from exploiting open sub-system accessibility to compromise the system.
Solution Approach 2:
Security verification and credential establishment are performed in advance by the secure sub-system before the open sub-system executes any firmware. This ensures that even when the open sub-system is accessible, it operates under verified security constraints.
Data Source
AI summary
Protection for a secure boot procedure can be provided in addition to cryptographic verification of boot firmware associated with the boot procedure. While the boot firmware is being verified and executed at a secure sub-system, an open sub-system can be put into a halt state, during which the open sub-system is prevented from performing the boot procedure. The open sub-system is still prevented from performing the boot procedure even if the boot firmware is verified and/or executed unless the open sub-system is put into the resume state again.