Hardware Security Processor for Set-Top Box Code Integrity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Television service providers face security vulnerabilities in their set-top boxes, allowing unauthorized access and repurposing, as existing software-based security measures are prone to hacking and inflexible, hindering the value realization of subsidized equipment.

Innovation Solution

Implementing hardware-based security through a security processor that performs continuous integrity checks on software applications by generating and comparing hashes, ensuring only trusted code is executed, and triggering interrupts to enforce security actions such as rebooting if unauthorized changes are detected.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If software-based security measures are used in television receivers, then flexibility to provide functionality is improved, but security against hacking and unauthorized access deteriorates

Engineering Contradiction:
Improveflexibility to provide functionalityVSAvoidsecurity against hacking
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The system divides security functionality into separate security processors that are distinct from the main application processors. Each security processor is responsible for specific security tasks such as code authentication and integrity checking, while application processors handle flexible software functionality. This segmentation allows software flexibility to be maintained in application processors while dedicated hardware security processors provide robust protection against hacking.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Security processors act as intermediary components between the trusted hardware domain and the untrusted software domain. They authenticate code before execution and perform continuous integrity checks, serving as a mediator that allows flexible software operation while enforcing security boundaries. This intermediary layer prevents direct access to security-critical functions by unauthorized software.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If hardware-based security checks are continuously performed, then security reliability is improved, but processing time and system performance deteriorate

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

Instead of continuous security checking that would impede performance, the system implements periodic integrity checks at strategically chosen points in the execution flow. Security processors authenticate code at boot time and perform intermittent checks during operation, such as after interrupt service routines. This periodic approach maintains security reliability while minimizing impact on processing time by checking only when necessary.

Inventive Principle:
Principle #19Periodic action

Solution Approach 2:

The system performs code authentication and integrity verification in advance before code execution begins. Security processors authenticate application code, interrupt service routine code, and library code before they are allowed to execute. This preliminary security verification prevents the need for continuous checking during execution, as once authenticated, code can run without constant interruption, thus maintaining both security and performance.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If security checks are performed on all software code, then security coverage is improved, but system complexity and computational overhead deteriorate

Engineering Contradiction:
Improvesecurity coverageVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system applies different security verification strategies to different types of code based on their risk profiles. Critical code such as interrupt service routines and boot code undergo rigorous authentication and continuous monitoring. Less critical application code undergoes authentication at load time but experiences less intensive monitoring during execution. This differentiated approach provides comprehensive security coverage while reducing overall system complexity by not applying uniform strict checking to all code.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The system implements security checks at strategically selected critical points rather than attempting to verify every single instruction continuously. Key verification points include code loading, interrupt entry points, and library function calls. By focusing security resources on these partial but critical locations, the system achieves adequate security coverage without the prohibitive complexity and overhead of exhaustive continuous checking of all code paths.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP3563578B1Forced execution of authenticated code
Publication Date: 2023.08.23 DISH TECHNOLOGIES LLC
  • EP3563578B1 patent drawingFigure 1
  • EP3563578B1 patent drawingFigure 2
  • EP3563578B1 patent drawingFigure 3

AI summary

Described herein are systems and methods for providing hardware based security to software applications in a television receiver. The system can include a television receiver having a trusted hardware environment that includes a security processor and a standard environment that includes an application processor. The security processor can ensure that at least a portion of the software application executed by the application processor is secure. A portion of the software application code can be placed in an interrupt service routine memory space. During execution of the software application, the security processor can security check the portion of the software application in the interrupt service routine memory space, making it trusted code. The security processor can force the application processor to execute the trusted code by triggering an interrupt. Such forced execution can allow the security processor to not only ensure that code is trusted, but that it is executed.