SoC Secure Environment Without MMU Using Sealed Non-Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deeply embedded systems lack a secure environment for hypervisor execution without Memory Management Units (MMUs) and virtual memory, necessitating a solution for secure isolation and protection of intellectual property and resources.
Innovation Solution
A secure environment is established using embedded non-volatile memory to configure security parameters, which are sealed to prevent access by the processor, and a lightweight security hypervisor scheme is implemented to create two virtual environments for separating trusted and untrusted code, with specific use models like sandbox, secure services, and pure isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms (supervisor vs user mode, MPU) are used, then basic protection is provided, but true isolation and separation are not achieved
Solution Approach 1:
The system is divided into distinct secure and non-secure worlds with separate execution environments. The secure world contains protected code and data in dedicated memory regions, while the non-secure world runs application code. This segmentation achieves true isolation without requiring full virtualization complexity.
Solution Approach 2:
The patent introduces a new dimension of security by implementing a dual-world execution model that operates alongside the traditional supervisor/user mode. This adds a layer of isolation in the security domain without fundamentally changing the existing processor architecture, avoiding the complexity of full virtualization.
2Reliability
If two separate processors are used for security and normal operations, then isolation is achieved, but cost and complexity increase
Solution Approach 1:
The patent merges security functionality into a single processor by implementing secure and non-secure worlds within one CPU core. The processor can switch between worlds using security state machines and memory management units, eliminating the need for separate security and application processors while maintaining isolation.
Solution Approach 2:
The single processor is designed to be universal by supporting multiple execution modes (secure world, non-secure world, supervisor mode, user mode). The same hardware resources are shared across different security contexts through controlled access mechanisms, reducing the need for dedicated hardware for each function.
3Reliability
If MMU and virtual memory are implemented for secure hypervisor execution, then security isolation is improved, but device cost and complexity increase
Solution Approach 1:
The patent extracts the essential security isolation functionality from the full MMU/virtual memory system. Instead of implementing complete virtual memory management, the system uses a simplified memory protection mechanism that provides only the necessary isolation for secure code execution, removing unnecessary complexity.
Solution Approach 2:
The memory protection mechanism is applied locally to specific secure memory regions rather than implementing global virtual memory management. The MPU is configured to protect only the critical secure code and data segments, providing targeted security without the overhead of system-wide virtualization.
4Adaptability or versatility
If supervisor vs user mode or MPU is used for security, then basic protection is provided, but resource sharing and virtualized environment are limited
Solution Approach 1:
The patent introduces a secure monitor as an intermediary layer between the secure and non-secure worlds. This mediator manages resource sharing by controlling access to shared peripherals and memory, enabling versatile resource utilization while maintaining security through enforced access policies.
Data Source
AI summary
A secure environment is established within a system on a chip (SoC) without the use of a memory management unit. A set of security parameters is produced by a configuration program executed by a processor within the SoC that is read from a first non-volatile memory within the SoC. A set of stored parameters is created in a committable non-volatile memory within the SoC by writing the set of security parameters into the committable non-volatile memory. The committable non-volatile memory is sealed so that that it cannot be read or written by the processor after being sealed. The stored parameters can then be accessed only by control circuitry. Security circuitry within the SoC is configured using the stored parameters each time the SoC is initialized and thereby enforces the secure environment within the SoC.