Secure Processor Backup Restore Without CPU Intervention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for backing up and restoring sensitive data in electronic devices, such as mobile devices, are time-consuming and insecure, especially when entering and exiting low power modes, and require CPU intervention, which can compromise data integrity and device security.
Innovation Solution
Incorporating a security device with a secure processor, cryptographic IP, secure DMA circuit, and internal memory that operates in an isolated environment, allowing secure data operations like encryption, decryption, and integrity verification without CPU intervention, using a hardware unique key for secure back-up and restoring operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If known techniques for backing up and restoring sensitive data are used, then data security can be maintained, but the operations take a considerable amount of time which reduces performance
Solution Approach 1:
The system is divided into a secure processor that handles only security-critical operations (backup/restore of sensitive data) and a CPU that handles general processing. This segmentation allows the secure processor to operate independently with dedicated hardware resources, enabling fast secure operations without burdening the main CPU, thus resolving the contradiction between security reliability and performance productivity.
Solution Approach 2:
A secure DMA circuit is introduced as an intermediary component that enables direct data transfer between the secure processor and external storage without CPU intervention. This intermediary mechanism allows the secure processor to perform backup and restore operations independently, achieving both high security (through isolated processing) and high performance (through direct memory access bypassing the CPU bottleneck).
2Ease of operation
If CPU intervention is used for secure operations, then data can be accessed and processed, but the security is compromised and data corruption risk increases
Solution Approach 1:
The secure processor is extracted as a separate, isolated execution environment from the main CPU system. Sensitive data operations are taken out from the general-purpose CPU and confined to this dedicated secure enclave. The secure processor maintains controlled access to external storage through the secure DMA circuit, enabling data accessibility while preventing unauthorized CPU intervention that could compromise security or corrupt data.
Solution Approach 2:
Different parts of the system have different security properties: the secure processor and its associated DMA circuit operate in a high-security isolated environment for sensitive data, while the rest of the system operates with standard access controls. This local quality differentiation allows easy operation for authorized secure data access while maintaining strong security guarantees through the isolated execution environment.
3Use of energy by stationary object
If frequent power mode transitions are implemented, then power consumption is reduced, but secure data backup and restore operations become more frequent increasing time loss
Solution Approach 1:
The secure hardware processor and secure DMA circuit replace the software-based backup/restore mechanism that would run on the CPU. This hardware substitution enables autonomous, rapid secure data operations that execute independently during power mode transitions. The hardware-based solution eliminates the time-consuming software processing overhead, allowing frequent power mode transitions with minimal time loss for secure data management.
Data Source
AI summary
A security device includes a secure processor, a mail box, a cryptographic intellectual property (IP), a secure direct memory access (DMA) circuit, and an internal memory. The secure processor provides an isolated execution environment. The mail box transfers a request from a CPU to the secure processor. The cryptographic IP performs one or more secure operations, including a signature certification operation, an encryption/decryption operation, and an integrity verification operation, on secure data within the isolated execution environment and without intervention of the CPU. The secure DMA circuit controls the one or more secure operations within the isolated execution environment, wherein only the secure processor is configured to control the secure DMA circuit. The internal memory stores the secure data on which the one or more secure operations are performed. The cryptographic IP includes a DMA circuit configured to control data access to an external storage.