Trust Transference from Trusted to Untrusted Processor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern embedded systems with multiple processors often lack secure boot mechanisms for secondary processors due to cost constraints, leaving them vulnerable to unauthorized software, and existing solutions are complex and expensive to implement.
Innovation Solution
A method is introduced where a trusted processor verifies and boots securely, then transfers trust to a field programmable device, which in turn verifies and boots an untrusted processor, establishing a chain of trust without requiring expensive secure processors across the entire system by using cryptographic keys and digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure boot mechanisms are implemented for all processors in a multi-processor system, then system security is improved, but system cost increases
Solution Approach 1:
The system divides processors into two categories: trusted processors that implement secure boot mechanisms and untrusted processors that do not. The trusted processor segment performs security verification functions for the entire system, while untrusted processors handle non-critical functions, eliminating the need to secure every processor individually.
Solution Approach 2:
A trusted processor acts as an intermediary between the secure boot loader and untrusted processors. The trusted processor verifies the integrity of boot loaders and firmware for untrusted processors through cryptographic validation, transferring trust without requiring the untrusted processors to have built-in security features.
2Reliability
If secure boot mechanisms are implemented for all processors, then security against unauthorized software is improved, but device complexity increases
Solution Approach 1:
The system segments the security function to be performed only by trusted processors rather than distributing security requirements across all processors. This segmentation allows untrusted processors to be simpler while maintaining overall system security through the trusted processor's verification activities.
Solution Approach 2:
The trusted processor performs multiple functions including its own secure boot operation, verification of the field programmable device's firmware, and validation of boot loaders for untrusted processors. This multi-functionality consolidates security responsibilities into a single processor type.
3Reliability
If expensive secure processors are used across the entire system, then trust verification capability is improved, but cost increases
Solution Approach 1:
The system applies different quality levels to different processors based on their functional requirements. Trusted processors have high security capabilities with secure boot mechanisms, while untrusted processors have basic functionality without expensive security features. This local differentiation optimizes cost while maintaining necessary trust verification capabilities.
Solution Approach 2:
The trusted processor creates and distributes cryptographic verification data (such as signed firmware images and validated boot loaders) to untrusted processors. This copying of trust credentials allows untrusted processors to operate securely without having the expensive secure hardware themselves.
Data Source
AI summary
A trusted processor is pre-booted using a secure pre-boot loader integrated with the trusted processor. The trusted processor verifies whether an external boot loader is valid, and when valid, the trusted processor is booted using the external boot loader, thereby enabling trusted operation of the trusted processor. The trusted processor verifies whether a firmware image for a field programmable device is valid, and when valid, a firmware image loading process for the field programmable device is triggered. When the firmware image loading process is triggered, the firmware image is loaded into the field programmable device and the field programmable device is released to execute of the firmware image. The field programmable device verifies whether an external boot loader for an untrusted processor is valid, and when valid, the untrusted processor is booted using the external boot loader for the untrusted processor, thereby enabling trusted operation of the untrusted processor.