SoC Encryption Engine Isolating Biometric Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems fail to securely isolate sensitive data, such as biometric information, from being accessed by unauthorized subsystems within an operating system, leading to potential security breaches.
Innovation Solution
Implementing encryption engines on Systems on a Chip (SoCs) that perform in-line data encryption as data is received for storage, using encryption keys associated with a security subsystem to ensure that biometric or sensitive data remains encrypted and inaccessible to other subsystems, even if they have access to the SoC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in clear text form in persistent storage, then subsystems can access the data easily, but security is compromised and unauthorized subsystems can access sensitive information
Solution Approach 1:
The patent segments the storage system into multiple encrypted partitions, each accessible only by specific subsystems with appropriate credentials. The storage device is divided into secure and non-secure partitions, with biometric data isolated in encrypted regions that prevent unauthorized access while maintaining system functionality.
Solution Approach 2:
The patent introduces an encryption engine as an intermediary component between subsystems and persistent storage. This encryption engine encrypts data before storage and decrypts it for authorized access, acting as a security mediator that prevents direct access to clear text data while enabling legitimate operations.
2Reliability
If encryption is implemented for all data storage, then data security is improved, but processing overhead and storage performance are reduced
Solution Approach 1:
The patent performs encryption operations during the data writing process itself, rather than as a separate post-processing step. The encryption engine encrypts data in-line as it is being stored to persistent storage, and decrypts data in-line during retrieval, eliminating additional processing delays and maintaining storage throughput.
Solution Approach 2:
The encryption engine is integrated directly into the storage controller subsystem, allowing the storage system to perform encryption and decryption operations autonomously without requiring external processing resources. This self-contained approach eliminates the performance overhead that would result from external encryption processing.
3Reliability
If access controls are implemented to prevent unauthorized subsystem access, then security is improved, but system complexity and access management overhead increase
Solution Approach 1:
The patent implements partition-specific encryption where each storage partition has its own encryption credentials and access controls tailored to the specific security requirements of that partition. Biometric data partitions use stronger access controls than non-sensitive partitions, allowing security to be optimized locally without uniformly increasing system complexity.
Solution Approach 2:
The patent combines multiple security functions including encryption, authentication, and access control into a single integrated encryption engine. This consolidation reduces system complexity by eliminating the need for separate security subsystems while maintaining comprehensive access control capabilities.
Data Source
AI summary
An example method for execution on a system on a chip (SoC) having a plurality of subsystems includes receiving, by a storage controller from a subsystem of the plurality of subsystems, a command to fetch, from a local memory, task descriptor data comprising access parameters for accessing a storage device, the access parameters including a storage device address; obtaining, by an encryption engine of the SoC, the command to fetch the task descriptor data; determining, by the encryption engine based on an access rule, whether the subsystem has sufficient privilege to access the storage device address; in response to determining that the subsystem has sufficient privilege to access the storage device, encrypting, source data in the local memory according to an encryption key associated with the subsystem; and providing the encrypted source data to the storage controller for writing to the storage device at the storage device address.