Write-Once Register for Secure Boot Hash Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low power embedded devices face challenges in efficiently verifying firmware integrity and authenticity due to high computational intensity of digital signature calculations, which is exacerbated by limited energy resources and the need for secure storage of reference hashes during sleep cycles.
Innovation Solution
A low power embedded device employs a write-once register within an always-on power domain to store the reference hash, allowing for rapid boot process by skipping the calculation of the reference hash, reducing power consumption and hardware overhead, and ensuring secure storage and access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signature algorithm (DSA) is used to verify firmware authenticity, then security is improved, but computational time and power consumption increase
Solution Approach 1:
The reference hash is pre-calculated and stored in a write-once register during device manufacturing or initial setup. This preliminary action eliminates the need to recalculate the reference hash during each boot process, allowing the bootloader to directly compare the calculated firmware hash against the pre-stored reference hash, thereby reducing boot time while maintaining security
Solution Approach 2:
The patent extracts the reference hash calculation from the repeated boot process and performs it only once during initialization. The extracted reference hash is then stored in a write-once register, separating the heavy computational task from the routine verification process and enabling faster subsequent boot operations
2Reliability
If digital signature algorithm (DSA) is used to verify firmware authenticity, then security is improved, but power consumption increases
Solution Approach 1:
The reference hash is pre-calculated and stored in a write-once register during device manufacturing or initial setup. This preliminary action eliminates the need to recalculate the reference hash during each boot process, allowing the bootloader to directly compare the calculated firmware hash against the pre-stored reference hash, thereby reducing power consumption during boot operations
Solution Approach 2:
The patent uses a write-once register as a disposable storage medium for the reference hash. This register is programmed once with the pre-calculated reference hash and then locked, preventing further modifications. This approach is more energy-efficient than using programmable memory that would require repeated writing operations during firmware updates
3Adaptability or versatility
If reference hash is stored in programmable memory, then firmware updates are possible, but security against unauthorized access is reduced
Solution Approach 1:
The reference hash is pre-calculated and stored in a write-once register during device manufacturing or initial setup. This preliminary action establishes a secure baseline that cannot be modified, ensuring that any firmware update must maintain the same reference hash for authentication to succeed
Solution Approach 2:
The write-once register acts as an intermediary between the firmware update mechanism and the authentication process. It stores the reference hash in a manner that is accessible for verification but protected from modification, mediating between the need for firmware updates and the requirement for secure authentication
4Productivity
If hardware accelerator for DSA is added, then authentication speed is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the heavy computational task of reference hash calculation from the routine boot process and performs it only once during initialization. By storing the pre-calculated reference hash in a write-once register, the system eliminates the need for complex hardware accelerators during each boot, reducing hardware overhead while maintaining authentication speed
Solution Approach 2:
The patent uses a simple write-once register instead of expensive hardware accelerators for DSA operations. This register is programmed once with the reference hash and then locked, providing a low-cost, low-complexity solution that achieves fast authentication without requiring complex hardware infrastructure
Data Source
Figure 1
Figure 2
AI summary
The invention discloses a low power embedded device, which uses a write-once register to speed up the secure boot from sleep states of said device. The object of the invention to find a secure storage of the reference hash in low power embedded devices, which can be stored over sleep cycles of the device, and updates of the firmware of such devices are possible, and an unauthorized access to the storage must be prohibited will be solved by a low power embedded device comprising a special-purpose computing system, means for storing firmware of the device and a bootloader for verifying the integrity and authenticity of the firmware, whereas the bootloader checks a firmware hash of the firmware against a reference hash, wherein the reference hash is stored in a write-once register, which is part of an always on power domain of the embedded device.