Secure Communication Channel via Public Key Boot Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face challenges in securely communicating between trusted and untrusted security boundaries, where sensitive data must be protected from unauthorized access during the booting process, leading to user dissatisfaction due to potential data exposure.
Innovation Solution
The implementation of public/private key pairs during the booting process, where the private key is provided to the operating system module of a trusted security boundary and the public key to a secure cryptoprocessor, establishing a secure communication channel while ensuring data inaccessibility to untrusted boundaries, using a boot measurement system to verify the security state and generate measurements for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If communication is allowed between different security boundaries, then device functionality and user satisfaction are improved, but data security is compromised due to potential unauthorized access
Solution Approach 1:
The system segments the computing device into multiple security boundaries (first security boundary with trusted code, second security boundary with untrusted code) and assigns different access rights to each. Data is partitioned so that only the trusted security boundary can access sensitive data, while the untrusted boundary operates with restricted access. This segmentation allows communication functionality across boundaries while maintaining security isolation through enforced access control policies.
2Reliability
If data is protected from untrusted security boundaries, then data security is improved, but communication functionality between security boundaries deteriorates
Solution Approach 1:
The system introduces an intermediary access control mechanism that mediates communication between security boundaries. The access control policy acts as a gatekeeper, evaluating communication requests from the untrusted security boundary and granting permission only when security conditions are met. This intermediary enables controlled communication functionality while maintaining data security protection.
3Measurement precision
If public key is provided to boot measurement system with secure cryptoprocessor, then security verification is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary security verification during the boot process by providing the public key to the boot measurement system before the untrusted code executes. The secure cryptoprocessor measures and verifies the integrity of the trusted code in the first security boundary during boot, establishing security credentials in advance. This preliminary action ensures security verification is completed before potential threats can compromise the system, reducing the need for continuous complex monitoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
During booting of a computing device, multiple security boundaries are generated. A security boundary refers to a manner of operation of a computing device or a portion of the computing device, with a program executing in one security boundary being prohibited from accessing data and programs in another security boundary. As part of booting the computing device measurements of (e.g., hash values or other identifications of) various modules loaded and executed as part of booting the computing device are maintained by a boot measurement system of the computing device. Additionally, as part of booting the computing device, a public/private key pair of one of the security boundaries is generated or otherwise obtained. The private key of the public/private key pair is provided to the one security boundary, and the public key of the public/private key pair is provided to the boot measurement system.