Trusted Diagnostic Module for Secure Remote Debugging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Closed commodity devices, such as smartphones and IoT devices, pose a challenge for debugging and maintenance due to their sealed nature and lack of internal debug ports, making it difficult to access hardware or software states without physical opening, which hinders failure analysis and repair.
Innovation Solution
A remote debugging system utilizing a Trusted Diagnostic Module (TDM) within the device, operating in a secure execution environment, authenticates external devices and provides read/write access to memories and registers via shared communication interfaces like USB, Bluetooth, or Wi-Fi, enabling secure and invasive debugging without opening the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a dedicated debug port (e.g., JTAG) is added to the device, then debugging access is improved, but device complexity and manufacturing cost increase
Solution Approach 1:
The patent reuses existing communication interfaces (USB, Bluetooth, Wi-Fi) that are already present in the device for their primary purposes, and makes them available for debugging functions as well. This eliminates the need for a dedicated debug port while maintaining full debugging capability through the same physical interface used for data communication.
Solution Approach 2:
The patent combines debugging functionality with existing communication modules by integrating a debug agent into the application processor that can operate over standard communication protocols. This merging of functions allows the same hardware interface to serve both communication and debugging purposes, reducing overall device complexity.
2Reliability
If the device is sealed/closed, then device appearance and protection are improved, but debugging access deteriorates
Solution Approach 1:
The patent introduces a debug agent software component that acts as an intermediary between the external debugger and the device's internal systems. This software-based intermediary enables debugging access through existing sealed communication interfaces without requiring physical opening of the device, thus maintaining both protection and accessibility.
Solution Approach 2:
The patent replaces the mechanical/physical access method (opening the device to reach JTAG ports) with a software-based communication method. By using software agents and protocol-based access over wireless or wired communication interfaces, debugging is achieved without any physical modification to the sealed device structure.
3Reliability
If authentication is implemented for debug sessions, then security is improved, but debugging process complexity increases
Solution Approach 1:
The patent implements authentication mechanisms that are automatically handled by the debug agent software without requiring manual intervention or complex external verification processes. The authentication credentials are verified through standardized protocols integrated into the debugging workflow, allowing security to be enforced automatically as part of the connection establishment process rather than as a separate complex procedure.
Data Source
AI summary
Systems, devices, and techniques relating to remote debugging are described. A described device includes a first processor core configured to provide an application execution environment, memory coupled with the first processor core; a second processor core configured to provide a secure execution environment; and a communication interface coupled with the first processor core and the second processor core, the communication interface being configured to communicate with external devices, the communication interface being shared at least between the application execution environment and the secure execution environment. The second processor core can be configured to monitor the application execution environment of the first processor core, determine whether to allow a debug session with an external device, via the communication interface, based on credentials received from the external device, and provide, via the debug session, read and write access to the memory and one or more registers of the first processor core.