Secure SoC with Hidden Bus for IoT Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SoC technologies face challenges in preventing security attacks, particularly in hardware modules, as they often require secure OS or libraries that incur performance overhead, making it difficult for small CPU cores in IoT devices to satisfy real-time security requirements.
Innovation Solution
A semiconductor chip with a processor core and two bus groups, where the second bus is physically isolated for secure operations, using a hidden bus implemented with ASR commands and a PUF for authentication, and a shadow stack for secure data processing, enabling secure mode activation upon authentication or security violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TrustZone technology is used to separate secure and normal worlds, then security is improved, but device complexity increases due to virtual core separation and monitor mode requirements
Solution Approach 1:
The system is divided into two distinct execution environments: secure mode and normal mode. The processor core can operate in either mode, with each mode having dedicated resource groups (first resource group for secure mode, second resource group for normal mode). This segmentation allows security isolation without requiring full virtualization of all processor components, reducing overall complexity compared to TrustZone's approach of separating entire virtual cores.
2Reliability
If secure OS or libraries are used to prevent security attacks, then security is improved, but performance overhead increases making it difficult for small CPU cores to satisfy real-time requirements
Solution Approach 1:
The invention extracts and removes the secure OS and security library layers that typically mediate between applications and secure hardware resources. Instead, it provides direct access to secure resources through the second bus for authenticated applications in normal mode. This extraction eliminates the performance overhead of secure OS context switching and library function calls while maintaining security through hardware-enforced access control and the authentication module.
3Reliability
If physical isolation of secure resources is implemented, then security is improved, but device complexity increases due to separate bus requirements
Solution Approach 1:
The invention merges the secure and normal resource groups onto a single physical bus infrastructure. The processor core can access either the first resource group (secure mode) or second resource group (normal mode) through the same bus, eliminating the need for completely separate physical buses. This merging reduces device complexity while maintaining security through logical isolation via mode-based access control and the authentication module that prevents unauthorized access to the first resource group.
Data Source
AI summary
Disclosed is a secure semiconductor chip. The semiconductor chip is, for example, a system-on-chip. The system-on-chip is operated by connecting normal IPs to a processor core included therein via a system bus. A secure bus, which is a hidden bus physically separated from the system bus, is separately provided. Security IPs for performing a security function or handling security data are connected to the secure bus. The secure semiconductor chip can perform required authentication while shifting between a normal mode and a secure mode.