Security Enclave Processor Boot Control via Hardware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the complexity and functionality of Systems on a Chip (SOCs) increase, ensuring the security and resistance to attacks on secure data becomes a significant challenge, particularly in portable devices used for financial transactions and data storage, where existing technologies lack effective isolation and control mechanisms for secure data processing.
Innovation Solution
Implementing a Security Enclave Processor (SEP) within the SOC, which is isolated from other processors and components, with strict hardware-controlled access, managing cryptographic keys, boot control, and power management to prevent unauthorized access and attacks, while maintaining a small 'attack surface' and supporting multiple tiers of trust and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a Security Enclave Processor (SEP) is implemented within the SOC to isolate and secure sensitive operations, then security and resistance to attacks on secure data are improved, but device complexity increases
Solution Approach 1:
The patent divides the SOC into distinct functional segments: the main application processor and the separate Security Enclave Processor (SEP). The SEP is further segmented into isolated functional units including cryptographic key management, secure boot control, and power management. This segmentation allows each component to operate independently with defined interfaces, improving security through isolation while managing complexity through modular design.
Solution Approach 2:
The patent implements a nested architecture where the SEP is embedded within the SOC structure, creating an SOC-within-SOC configuration. The SEP contains nested security layers including secure ROM for boot code, cryptographic hardware modules, and protected memory regions. This nested doll approach allows the secure subsystem to be integrated into the larger system while maintaining physical and logical isolation, thereby improving security without requiring a completely separate device.
2Reliability
If the SEP is isolated from other processors with strict hardware-controlled access, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent introduces a mailbox mechanism as an intermediary communication interface between the application processor and the isolated SEP. The mailbox provides a standardized, controlled channel for exchanging commands and data without compromising the isolation boundary. This intermediary allows the secure processor to receive requests for cryptographic operations, key management, and power control while maintaining strict access control, thus balancing security with operational capability.
3Reliability
If the secure ROM in the SEP is made smaller and inaccessible outside the SEP, then security is improved by reducing the attack surface, but manufacturing precision requirements increase
Solution Approach 1:
The patent extracts the critical security functions from the main processor and places them in a dedicated SEP with a minimized secure ROM. By taking out only the essential boot code and security-critical instructions into the secure ROM, the attack surface is reduced compared to a full processor ROM. The extraction approach allows the secure ROM to be implemented as a smaller, more tightly controlled memory component with enhanced manufacturing precision applied specifically to this critical element rather than the entire system.
Data Source
AI summary
An SOC implements a security enclave processor (SEP). The SEP may include a processor and one or more security peripherals. The SEP may be isolated from the rest of the SOC (e.g. one or more central processing units (CPUs) in the SOC, or application processors (APs) in the SOC). Access to the SEP may be strictly controlled by hardware. For example, a mechanism in which the CPUs/APs can only access a mailbox location in the SEP is described. The CPU/AP may write a message to the mailbox, which the SEP may read and respond to. The SEP may include one or more of the following in some embodiments: secure key management using wrapping keys, SEP control of boot and/or power management, and separate trust zones in memory.