Secure Element Memory Access Control via Loader Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure elements in electronic devices face challenges in ensuring the blank state of secure elements after resale, as the trust in the security of loaded software and the inability for end-users to choose their component integrator, leading to potential security breaches and adaptation issues with operating systems.
Innovation Solution
A secure element architecture with distinct security domains, including a primary and secondary loader program, authentication keys, and hardware firewalls, ensures the secure loading and authentication of software, preventing unauthorized access and data leakage, while allowing for full customization and secure erasure of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure element is provided blank by the manufacturer to a component integrator for loading software, then the component integrator can load trusted software with warranty, but the final client cannot choose the component integrator and cannot verify the blank state after resale
Solution Approach 1:
The patent applies preliminary action by embedding an authentication key in the secure element before the client receives it. This key enables the client to verify the blank state of the secure element independently, without needing to trust the component integrator. The verification capability is prepared in advance during manufacturing, allowing the client to perform self-verification later.
2Ease of operation
If the first loader program retains permanent access to the second area, then loading can be performed, but security is compromised as the loader can be used for attacks
Solution Approach 1:
The patent applies dynamics by making the access rights of the first loader program changeable over time. Initially, the loader has full access to load programs. After successful authentication of the loaded program, the access rights are dynamically modified to revoke the loader's ability to access the second area again. This temporal variation in permissions allows loading functionality while preventing subsequent attacks through the same loader.
Solution Approach 2:
The patent applies parameter changes by modifying the access right parameter of the first loader program. The access right transitions from a permissive state (allowing access to second area) to a restricted state (denying access). This parameter change is triggered by the authentication process, ensuring that once a program is verified, the loader cannot be reused for malicious purposes.
3Reliability
If multiple security domains are implemented with strict access control, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the secure element into distinct security domains: a first area containing the authentication key and first loader program, and a second area for loading programs. The bus access controller enforces strict access control between these segments. This segmentation isolates critical security functions from general program loading functions, enhancing security while maintaining manageable complexity through clear separation of duties.
Data Source
AI summary
The invention relates to a secure element device comprising at least one processor, at least one communication interface, at least one memory RAM and NVM and at least one bus access controller, wherein the bus access controller defines at least a first area PBL, a second area SBL and a secure area MZ. The first area comprises a first loader program capable of loading a program package in the second area. The secure area comprises an authentication key capable of authenticating the program package loaded in the second area. After authentication of the program package loaded in the second area, the access right of the first loader program is changed in such a way that a program in the first area can no more access the second area.