Multi-Core Storage Attestation Using MPU Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices lack comprehensive attestation operations to detect falsification of code data across all memory areas, limiting security against hacking.
Innovation Solution
A storage device with multiple cores, each containing memory protection units (MPUs) and a trust core that performs attestation operations on all MPUs, generating and transmitting hash results to a host device for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attestation operation is performed only on RO area, then detection scope is limited, but system complexity is reduced
Solution Approach 1:
The trust core is designed to perform attestation operations universally across all memory areas (RO, RW, and other regions) rather than being limited to RO area only. This multi-functional capability allows the same trust core to handle attestation for code data, runtime data, and other memory contents, thereby improving security coverage without proportionally increasing system complexity
Solution Approach 2:
The memory space is segmented into multiple regions (RO area, RW area, and other areas), and the attestation operation is applied selectively to each segment based on its security requirements. This allows comprehensive security coverage while managing complexity through structured segmentation of attestation scopes
2Measurement precision
If attestation operation covers whole memory area, then detection capability is improved, but processing time increases
Solution Approach 1:
The system performs attestation operations selectively on specific memory areas (RO, RW, and other regions) based on security requirements rather than uniformly across all memory. This partial action approach focuses computational resources on critical areas, improving detection capability where needed while avoiding unnecessary processing time on less critical memory regions
Solution Approach 2:
The attestation operation parameters are dynamically adjusted based on memory area type and security requirements. Different hash generation configurations and measurement scopes are applied to different memory regions, optimizing the balance between detection precision and processing time for each specific area
Data Source
AI summary
A storage device includes a plurality of cores respectively including a plurality of memory protection units (MPUs) and a trust core configured to in response to receiving a measurement command from a host device, acquire MPU information of each of the plurality of MPUs, generate a hash result of the plurality of cores based on the MPU information of each of the plurality of MPUs, and transmit the hash result of the plurality of cores to the host device.