Initializing, maintaining, updating and recovering secure operation within an integrated system employing a data access control function

Abstract

Techniques are provided for initializing, maintaining, updating and recovering secure operation within an integrated system. The techniques, which employ a data access control function within the integrated system, include authenticating by a current level of software a next level of software within an integrated system. The authenticating occurs before control is passed to the next level of software. Further, an ability of the next level of software to modify an operational characteristic of the integrated system can be selectively limited via the data access control function. Techniques are also provided for initializing secure operation of the integrated system, for migrating data encrypted using a first key set to data encrypted using a second key set, for updating software and keys within the integrated system, and for recovering integrated system functionality following a trigger event.

Claims

1. A method of migrating data encrypted using a first key set to data encrypted using a second key set, said method comprising:

performing multiple writes of encrypted data using a first key set;

employing a usage counter to count each use of the first key set to write encrypted data; and

automatically transitioning to a second key set when the count of the usage counter exceeds a defined threshold, the automatically transitioning comprising:

modifying an access table to indicated that encrypted data in a current data location is to be decrypted using the first key set, and is to be re-encrypted using the second key set when undergoing storage to a new data location;

decrypting the encrypted data using the first key set;

re-encrypting, by a data access control function within an integrated system, the data using the second key set, wherein the decrypting and the re-encrypting comprise reading the encrypted data from the current data location, decrypting the encrypted data using the first key set, then writing the data as encrypted data to the new data location employing the second key set; and

modifying the access table further with the new data location being defined for encryption and decryption with the second key set.

2. The method of claim 1, wherein the data access control function comprises a hardware component of the integrated system.

3. The method of claim 1, wherein the decrypting is also performed by the data access control function of the integrated circuit.

4. The method of claim 1, further comprising retrieving for decryption, from storage associated with the integrated system, the data encrypted using the first key set.

5. The method of claim 1, wherein the data encrypted using the first key set is received from a source external to the integrated system.

6. The method of claim 5, wherein the decrypting is performed in software within the integrated system, and wherein the re-encrypting, by the data access control function, is performed in hardware of the integrated system.

7. The method of claim 6, wherein the second key set is unique to the integrated system.

8. A system of migrating data encrypted using a first key set to data encrypted using a second key set, said system comprising:

means for performing multiple writes of encrypted data using a first key set;

means for employing a usage counter to count each use of the first key set to write encrypted data; and

means for automatically transitioning to a second key set when the count of the usage counter exceeds a defined threshold, the means for automatically transitioning comprising:

means for modifying an access table to indicate that encrypted data in a current data location is to be decrypted using the first key set, and is to be re-encrypted using the second key set when undergoing storage to a new data location;

means for decrypting the encrypted data using the first key set;

means for re-encrypting, by a data access control function within an integrated system, the data using the second key set, wherein the decrypting and the re-encrypting comprise reading the encrypted data from the current data location, decrypting the encrypted data using the first key set, then writing the data as encrypted data to the new data location employing the second key set; and

means for modifying the access table further with the new data location being defined for encryption and decryption with the second key set.

9. The system of claim 8, wherein the data access control function comprises a hardware component of the integrated system.

10. The system of claim 8, wherein the means for decrypting is also performed by the data access control function of the integrated circuit.

11. The system of claim 8, further comprising means for retrieving for decryption, from storage associated with the integrated system, the data encrypted using the first key set.

12. The system of claim 8, wherein the data encrypted using the first key set is received from a source external to the integrated system.

13. The system of claim 12, wherein the means for decrypting is performed in software within the integrated system, and wherein the re-encrypting, by the data access control function, is performed in hardware of the integrated system.

14. The system of claim 13, wherein the second key set is unique to the integrated system.

15. At least one program storage device readable by a machine embodying at least one program of instructions executable by the machine to perform a method of migrating data encrypted using a first key set to data encrypted using a second key set, said method comprising:

performing multiple writes of encrypted data using a first key set;

employing a usage counter to count each use of the first key set to write encrypted data; and

automatically transitioning to a second key set when the count of the usage counter exceeds a defined threshold, the automatically transitioning comprising:

modifying an access table to indicated that encrypted data in a current data location is to be decrypted using the first key set, and is to be re-encrypted using the second key set when undergoing storage to a new data location;

decrypting the encrypted data using the first key set;

re-encrypting, by a data access control function within an integrated system, the data using the second key set, wherein the decrypting and the re-encrypting comprise reading the encrypted data from the current data location, decrypting the encrypted data using the first key set, then writing the data as encrypted data to the new data location employing the second key set; and

modifying the access table further with the new data location being defined for encryption and decryption with the second key set.

Description

TECHNICAL FIELD

This invention relates generally to data request handling and transfer of data within an integrated system, and more particularly, to techniques, implemented at least partially via a data access control function of an integrated system, for initializing, maintaining, updating and recovering secure operation of the integrated system.

BACKGROUND OF THE INVENTION

Multiple master functions are today being commonly integrated onto a single system chip. When initially defining an architecture for the integration of multiple discrete components onto a single chip, access to external devices can be an issue. For example, an MPEG video decoder system often employs external memory for various data areas, or buffers such as frame buffers. This external memory is conventionally implemented using either DRAM or SDRAM technology.

Two approaches are typical in the art for accessing off-chip devices. In a first approach, each on-chip functional unit is given access to the needed external device(s) through a data bus dedicated to that particular unit. Although locally efficient for accessing the external device, globally within the integrated system this approach is less than optimal. For example, although each function will have complete access to its own external memory area, there is no shared access between functions of the integrated system. Thus, transferring data from one memory area to another memory area of the system is often needed. This obviously increases data transfers and can degrade performance of the overall system, i.e., compared with a shared memory system.

Another approach is to employ a single common bus within the integrated system which allows one or more functional units of the system to communicate to external devices through a single port. Although allowing the sharing of devices, one difficulty with this approach concerns controlling access to content or other sensitive data in the integrated system. For example, when using a large common memory pool in an integrated design, it becomes difficult to prevent unauthorized access to protected memory spaces, such as compressed data supplied by a transport demultiplexer to a decoder of a set-top box. This is especially true for a system where the programming interface is open and outside development is encouraged. Each of the functional masters should be able to access the memory space and it is not possible to differentiate whether an access is from a trusted master or an outside request, e.g., coming through an untrusted or open master.

In addition, when working with a system-on-chip design with multiple functional masters using shared memory, it is desirable to provide a mechanism for protecting the data from unauthorized access, particularly when the data comprises the device's system programming code. More particularly, facilitating initialization of a secure operating environment begins by ensuring that the system code is secure and performs the functions intended. In order to guarantee a secure operating environment, therefore, the integrated system should be activated or booted in a secure mode.

In view of the above, various needs exist in the art for enhanced data access control approaches for an integrated system. More particularly, needs exist for techniques to initialize, maintain, update and recover secure operation of an integrated system.

SUMMARY OF THE INVENTION

The shortcomings of the prior art are overcome and additional advantages are provided through the provision of a method for migrating data encrypted using a first key set to data encrypted using a second key set. This method includes: decrypting data encrypted using the first key set; and re-encrypting, by a data access control function within the integrated system, the data using a second key set. Advantageously, by re-encrypting using the data access control function, the encryption of the data is unique to the integrated system.

In a further aspect, a method of recovering integrated system functionality following a trigger event is provided. This method includes automatically establishing a reduced level of functionality within the integrated system following a tamper detection trigger event; and allowing for full functional recovery of the integrated system through a user selectively employing a trusted recovery procedure.

Systems and computer program products corresponding to the above-summarized methods are also disclosed herein.

Advantageously, the secure operation techniques disclosed herein can be used to initialize, maintain, update and/or recover a secure operating environment within an integrated system. More particularly, the techniques presented provide an ability to limit updates to operational characteristics maintained by a data access control function. The operational characteristics may include one or more of a key set, an access table, an access level, and access parameters employed by different levels of software within the integrated system. This ability to limit updates provides the different levels of software with hierarchical security privileges.

The techniques presented herein further provide an ability to make updates in the field in a secure manner, including the use of version numbers to prevent replay of an older version of software or other data. Also presented is an ability to migrate encrypted data from a first key set to a second key set as part of a key management process, and/or for importing protected data from other systems. Further, an ability to provide functionality is described, notwithstanding that the integrated system has entered a tamper triggered state. Specifically, limited functionality with no access to secret data and applications can be automatically provided, as well as a mechanism for recovering full functionality with limited service facility dependency.

Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:

FIG. 1 depicts one example of a typical integrated device employing common memory access through a memory subsystem;

FIG. 2 depicts one embodiment of an access control function implemented within a secure memory subsystem of an integrated device, in accordance with an aspect of the present invention;

FIG. 3 illustrates a problem recognized and addressed by the secure operating techniques described herein, in accordance with an aspect of the present invention;

FIG. 4 depicts one embodiment of a technique for facilitating secure operation of an integrated device having multiple levels of software, in accordance with an aspect of the present invention;

FIG. 5 depicts one embodiment of a process applying the techniques of FIG. 4 to an access table associated with a data access control function of an integrated system, in accordance with an aspect of the present invention;

FIG. 6 depicts one embodiment of a process for loading code into an integrated system, in accordance with an aspect of the present invention;

FIG. 7A depicts one example of a process for initially storing encrypted boot code in an integrated system, in accordance with an aspect of the present invention;

FIG. 7B depicts one example of a process for copying the encrypted code stored by the process of FIG. 7A from volatile memory to non-volatile memory, in accordance with an aspect of the present invention;

FIG. 8 depicts one embodiment of a process for authenticating levels of software and passing control between levels of software, as well as for updating boot code when a boot code update is available, in accordance with an aspect of the present invention;

FIG. 9 depicts one embodiment of initialization signals passing between components of an integrated system with an access control function in a secured state, in accordance with an aspect of the present invention;

FIG. 10 depicts one embodiment of a process for securely updating a level of software within an integrated system having multiple levels of software, in accordance with an aspect of the present invention;

FIG. 11 depicts one embodiment of a process for managing and updating a key set employed by a data access control function of an integrated systems, in accordance with an aspect of the present invention;

FIG. 12A depicts one embodiment of a process for receiving encrypted data for storage within an integrated system, in accordance with an aspect of the present invention;

FIG. 12B depicts one embodiment of a process for retrieving the stored encrypted data of FIG. 12A and decrypting the data in software using secure code, in accordance with an aspect of the present invention;

FIG. 12C depicts one embodiment of a process for re-encrypting the decrypted data using access control hardware for storage in secure memory, in accordance with an aspect of the present invention; and

FIG. 13 depicts one embodiment of a process for recovering integrated circuit functionality following a tamper trigger event occurring within a computing environment of the integrated system, in accordance with an aspect of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

FIG. 1 depicts a conventional integrated device, generally denoted 100, having multiple internal functional masters 1101, 1102, 1103 . . . 110n. Master 1101 is shown as a processor, having a processor core 112 and a memory management unit 114. Internal masters 1101, 1102, 1103 . . . 110n connect in this example to a memory subsystem 120, which includes bus control logic 130 of a shared bus. Those skilled in the art will understand that although shown within the memory subsystem, bus control 130 could alternatively reside outside of subsystem 120.

Bus control unit 130 coordinates and consolidates requests to slaves in the integrated device. For example, a first slave might comprise an external bus controller 140 which is connected to an external non-volatile memory 150, such as flash memory, having an open memory portion 155. A second slave, memory controller 160 connects to external volatile memory 170, such as SDRAM or DRAM. Memory 170 includes an open memory portion 175. In general, functions share a common memory pool in this integrated design in order to minimize memory costs, and to facilitate transfer of data between functions. As such, all internal masters have equal access to both non-volatile and volatile memory, and both storage spaces are labeled open, meaning that there are no limits on data access.

Typically, non-volatile memory is used for persistent storage, wherein data should be retained even when power is removed. This memory may contain the boot code, operating code, such as the operating system and drivers, and any persistent data structures. Volatile memory is used for session oriented storage, and generally contains application data as well as data structures of other masters. Since volatile memory is faster than non-volatile memory, it is common to move operating code to volatile memory and execute instructions from there when the integrated device is operational.

Note that in a typical system such as presented in FIG. 1, there are several security risks. Namely,

1. The behavior of the processor can be controlled by modifying the operating code or data structures, and internal data or operation can be compromised.

2. In certain cases, such as a communication controller, etc., an internal master can be controlled by an external source, and can be used to compromise internal code or data since memory is shared.

3. Debug and development tools that are used in software development can be used to modify or monitor the processor's behavior.

4. A given master can unintentionally corrupt or compromise the operation of another internal master since memory is shared.

The solution presented herein to the above-noted security risks involves providing an access control function disposed within the data path between the bus control and the slave devices. This access control function can use (in one embodiment) characteristics of the internal bus that connects the functional masters to the slave devices to allow each request for access to be further qualified based on a set of secure control information, and if desired, to be prevented. Advantageously, this access control function provides the ability to differentiate accesses by which master is making the data request, as well as where the data is stored, and then to either grant or limit access accordingly, or to otherwise qualify the access. Additional access control functionality is also described herein in accordance with other aspects of the present invention.

FIG. 2 illustrates one embodiment of a system, generally denoted 200, which includes an access control function 240 in accordance with an aspect of the present invention. System 200 again includes multiple functional masters 2101 . . . 210n which communicate via a bus control 230 with one or more slaves 250 & 270. In this case, access control function 240 intercedes in the data path between bus control 230 and slaves 250 & 270. As an alternate embodiment, bus control unit 230 could reside outside of the secure memory subsystem unit. As shown, a first slave device comprises an external bus controller 250, and a second slave device comprises a memory controller 270. In this context, the combination of the bus control unit, access control unit and external controllers form the secure memory subsystem 220. As a result, the external address space defined as non-volatile memory 260 and volatile memory 280 can be further divided into open area 262 and secure area 264, as well as open area 282 and secure area 284, respectively. In this use, "secure" implies that masters 2101 . . . 210n can only access a space as defined in the access control unit 240. Note that the access control function controls all accesses to both open and secure areas.

A detailed description of the access control function of unit 240 is included in the above-incorporated application entitled "Control Function Employing A Requesting Master ID And A Data Address To Qualify Data Access Within An Integrated System". Further, the above-incorporated application describes in detail the use of an access table 248 and an encryption/decryption function 249 in qualifying requests for data based on an access level of the functional master requesting the data and the address of the data requested.

Briefly described, a request from a master granted control by the bus control unit is sent to the access control unit, along with the requested address and associated controls (e.g., read or write, etc.). The access table is used by the access control function to compare the requested address, master id, and read or write indicator to a definition of allowed access capability for that master. The given request can either be blocked (terminated), allowed in the clear, or allowed with encryption/decryption. If the requested transfer is allowable, then the bus signals are propagated to the slaves, and access parameters associated with the request based on the access table are sent to the encryption/decryption engine, i.e., if encryption/decryption is applicable. The encryption/decryption engine can be used to encrypt write data as the data is transferred to a given slave, or decrypt read data as the data is returned from a given slave using the associated access parameters.

In addition to the functions of qualifying data access based on the requesting, master id and the address of the request, the concept of adding a security state machine 242 to the access control function to, for example, control operation of the access table 248 and encryption/decryption function 249 is described in the above-incorporated application entitled "Control Function With Multiple Security States For Facilitating Secure Operation Of An Integrated System". On-chip storage 243 is also used in conjunction with the security state machine 242 to hold a substitute boot address 245 and a master key set 246. This storage is persistent in that values are retained even when general power is removed. As a result, once initialized, these values can be used from session to session until specifically reset or erased with a change in security state as described hereinbelow.

The security state machine of the data access control function can be one state of multiple possible security states, including a null state and a secured state. In the secured state, the control function replaces a standard boot code address associated with the request for boot code with a substitute boot code address. The substitute boot code address addresses an encrypted version of boot code, which is then decrypted by the control function employing a master key set held in the persistent storage. When in the null state, the master key set is erased.

As a further enhancement of the above-described data access control function, the concept of adding a control capability to selectively authenticate requested data is described in the above-incorporated application entitled "Control Function Implementing Selective Transparent Data Authentication Within An Integrated System". This selective authentication can be transparent to the functional master of the integrated device initiating the data request. The requested data can either comprise code or data that is stored in encrypted form in external memory. (Note that "data" is generically used herein in places, including the claims, to refer to code or data.) While the encryption capabilities of the above-described data access control function prevent direct observation and modification of data, the integrity check function adds the ability to further verify that the encrypted value is the same value that was written to memory originally.

In one embodiment, an integrity check function in accordance with an aspect of the present invention works in conjunction with the access table and access parameters described in the above-incorporated applications. Address ranges that are to be associated with authenticated data can be indicated by an additional parameter in the access table. The integrity check function 245 determines the location of integrity values in memory based on the requested data transfer, and also calculates and compares the integrity values as described below.

Briefly summarized, the processes can be divided into pre-storage and post-storage steps, for example:

Pre-Storage

• Inventors
  Foster, Eric M.; Hall, William E.; Rosu, Marcel C.;
• Assignee
  International Business Machines Corporation (Armonk, NY)
• Published
  Oct-18-2005
• Current US Classes:
  380/201
  380/277
  713/161
  713/165
  713/171
  713/193
• Application #
  691632
• International Classes
  H04L 009/00; G06F 011/30
• Field of Search
  713/153 713/168 713/193 713/171 713/161 713/165 380/277 380/201
• Examiner
  Barron, Jr.; Gilberto
• Agent
  Steinberg, Esq.; William H., Radigan, Esq.; Kevin P., Heslin Rothenberg Farley & Mesiti, P.C.
• US Patent References:
  4168396
  4465901
  4797853
  4920483
  4951249
  5144659
  5421006
  5440713
  5464087
  5491827
  5561817
  5602536
  5647017
  5703952
  5757919
  5778316
  5805706
  5809230
  5825878
  5841868
  5887131
  5893921
  5912453
  5918007
  5935247
  5940513
  6021476
  6023510
  6052763
  6101543
  6116402
  6182142
  6182217
  6230269
  6311255
  6577734