Hardware Security Processor for Set-Top Box Code Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Television service providers face security vulnerabilities in their set-top boxes, allowing unauthorized access and repurposing, as existing software-based security measures are prone to hacking and inflexible, hindering the value realization of subsidized equipment.
Innovation Solution
Implementing hardware-based security through a security processor that performs continuous integrity checks on software applications by generating and comparing hashes, ensuring only trusted code is executed, and triggering interrupts to enforce security actions such as rebooting if unauthorized changes are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software-based security measures are used in television receivers, then flexibility to provide functionality is improved, but security against hacking and unauthorized access deteriorates
Solution Approach 1:
The system divides security functionality into separate security processors that are distinct from the main application processors. Each security processor is responsible for specific security tasks such as code authentication and integrity checking, while application processors handle flexible software functionality. This segmentation allows software flexibility to be maintained in application processors while dedicated hardware security processors provide robust protection against hacking.
Solution Approach 2:
Security processors act as intermediary components between the trusted hardware domain and the untrusted software domain. They authenticate code before execution and perform continuous integrity checks, serving as a mediator that allows flexible software operation while enforcing security boundaries. This intermediary layer prevents direct access to security-critical functions by unauthorized software.
2Reliability
If hardware-based security checks are continuously performed, then security reliability is improved, but processing time and system performance deteriorate
Solution Approach 1:
Instead of continuous security checking that would impede performance, the system implements periodic integrity checks at strategically chosen points in the execution flow. Security processors authenticate code at boot time and perform intermittent checks during operation, such as after interrupt service routines. This periodic approach maintains security reliability while minimizing impact on processing time by checking only when necessary.
Solution Approach 2:
The system performs code authentication and integrity verification in advance before code execution begins. Security processors authenticate application code, interrupt service routine code, and library code before they are allowed to execute. This preliminary security verification prevents the need for continuous checking during execution, as once authenticated, code can run without constant interruption, thus maintaining both security and performance.
3Reliability
If security checks are performed on all software code, then security coverage is improved, but system complexity and computational overhead deteriorate
Solution Approach 1:
The system applies different security verification strategies to different types of code based on their risk profiles. Critical code such as interrupt service routines and boot code undergo rigorous authentication and continuous monitoring. Less critical application code undergoes authentication at load time but experiences less intensive monitoring during execution. This differentiated approach provides comprehensive security coverage while reducing overall system complexity by not applying uniform strict checking to all code.
Solution Approach 2:
The system implements security checks at strategically selected critical points rather than attempting to verify every single instruction continuously. Key verification points include code loading, interrupt entry points, and library function calls. By focusing security resources on these partial but critical locations, the system achieves adequate security coverage without the prohibitive complexity and overhead of exhaustive continuous checking of all code paths.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein are systems and methods for providing hardware based security to software applications in a television receiver. The system can include a television receiver having a trusted hardware environment that includes a security processor and a standard environment that includes an application processor. The security processor can ensure that at least a portion of the software application executed by the application processor is secure. A portion of the software application code can be placed in an interrupt service routine memory space. During execution of the software application, the security processor can security check the portion of the software application in the interrupt service routine memory space, making it trusted code. The security processor can force the application processor to execute the trusted code by triggering an interrupt. Such forced execution can allow the security processor to not only ensure that code is trusted, but that it is executed.