Secure Booting System Using Symmetric Key Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure booting systems require a hardware accelerator for public key-based encryption algorithms, which is not feasible for devices like eMMC and UFS due to size and cost constraints, leading to a need for a method to quickly perform secure booting without such accelerators.
Innovation Solution
A secure booting method and system that uses a firmware release server and an electronic device sharing a secret value, where the device executes ROM code to verify the boot loader and firmware using endorsement images, enabling symmetric key-based secure booting without a hardware accelerator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key-based encryption algorithm is used for secure booting, then security verification is improved, but processing time increases and hardware complexity increases
Solution Approach 1:
The verification process is segmented into two distinct phases: (1) endorsement image verification using symmetric key algorithm in ROM code before boot loader execution, and (2) firmware verification using public key algorithm in boot loader after execution. This segmentation allows the time-critical symmetric key verification to occur during initialization while deferring the computationally intensive public key verification to later execution, thereby reducing overall booting time while maintaining security.
Solution Approach 2:
The endorsement image is pre-generated and pre-verified using symmetric key algorithm before the boot loader is executed. This preliminary verification action establishes a trusted execution environment early in the boot process, allowing subsequent public key verification to proceed more efficiently and reducing the total time required for secure booting.
2Productivity
If hardware accelerator is added for public key-based encryption algorithm, then processing speed is improved, but device size and cost increase
Solution Approach 1:
The endorsement image acts as an intermediary that enables the system to use symmetric key algorithms (which are fast and do not require hardware accelerators) for the initial verification phase. This intermediary mechanism allows embedded devices with limited resources to achieve secure booting without requiring expensive hardware acceleration for public key operations.
Solution Approach 2:
The system changes the algorithmic parameter from public key-based encryption to symmetric key-based hash-based message authentication code (HMAC) for the initial verification phase. This parameter change enables faster processing without hardware accelerators, as symmetric key algorithms are computationally less intensive and can be efficiently implemented in software on resource-constrained embedded devices.
3Loss of time
If symmetric key-based verification is used instead of public key-based verification, then processing time is reduced, but security mechanism changes
Solution Approach 1:
The system employs asymmetric verification mechanisms at different stages: symmetric key HMAC verification for endorsement images in the ROM code phase, and public key verification for firmwares in the boot loader phase. This asymmetric approach allows the system to optimize for speed where possible (symmetric key) while maintaining strong security where required (public key), resolving the contradiction between verification time and security mechanism integrity.
Data Source
AI summary
A booting system includes a firmware release server, an electronic device configured to execute a boot loader and first firmware distributed from the firmware release server, the electronic device including at least one processor, a first storage unit configured to store a secret value shared with the firmware release server, a read-only memory (ROM) configured to store a ROM code executable in booting, a second storage unit configured to store the boot loader and the first firmware, where the ROM code, when executed, causes the at least one processor to perform a verification operation on the boot loader based on the secret value and a first endorsement image received from the firmware release server, and where the boot loader is configured to perform a verification operation on the first firmware based on a second endorsement image received from the firmware release server.