Secure Enclave Host-Client Code Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot methodologies are limited by the local processor's performance, storage, and security capabilities, making them vulnerable to attacks and fraudulent modifications, especially in cost-constrained devices where security is compromised.
Innovation Solution
A system and method where a host device, with greater security capabilities, performs controlled secure code authentication by transmitting challenges to client devices, verifying responses, and determining the authenticity of codes stored on these devices, thereby ensuring only authorized codes are executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If local secure boot is implemented using client-side processor, then security is improved, but device cost and complexity increase due to required computational ability and protection mechanisms
Solution Approach 1:
A secure enclave acts as an intermediary between the client device and host network, performing code authentication remotely. The enclave receives code from the client, verifies its authenticity using cryptographic signatures, and returns authentication results to the host, eliminating the need for complex local security mechanisms while maintaining network security.
Solution Approach 2:
The security verification function is extracted from the client device and relocated to a separate secure enclave. This extraction allows the client device to remain simple and cost-effective while the authentication capability resides in a dedicated security infrastructure that can be shared across multiple devices.
2Reliability
If local secure boot is implemented, then code authentication is performed, but performance is restricted by local processor capabilities
Solution Approach 1:
The secure enclave serves as a specialized intermediary optimized for cryptographic operations and code verification. By offloading these computationally intensive tasks to the enclave rather than using the general-purpose client processor, the system achieves both reliable authentication and improved performance through dedicated hardware acceleration.
3Reliability
If local secure boot is implemented, then boot code validation is performed, but storage and security are limited by local processor constraints
Solution Approach 1:
The authentication data and cryptographic verification capabilities are extracted from the client device and stored in the secure enclave. This allows the client device to use minimal local storage while the enclave provides centralized storage for code signatures and authentication credentials, enabling robust boot code validation without local storage constraints.
Data Source
AI summary
Systems, methods, circuits and computer-readable mediums for controlled secure code authentication are provided. In one aspect, a method performed by a host device includes transmitting a request to a client device, the request including a challenge for a property of a code stored within the client device, receiving a response to the request, the response comprising information associated with the property of the code, verifying correctness of the response based on the received information, and based on the verifying of the correctness of the response, determining that the code is an authorized code.