Electronic system having integrity verification device

Patent metadata

Field	Value
Publication number	US-9703960-B2
Application number	US-201514638862-A
Country	US
Kind code	B2
Filing date	Mar 4, 2015
Priority date	Mar 7, 2014
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Provided are an electronic system, an integrity verification device, and a method of performing an integrity verification operation. The electronic system includes: a memory device; a processor configured to provide a plurality of configuration records corresponding to a plurality of verification data stored in the memory device, each of the configuration records including a start address, a data length, and a reference hash value for a corresponding verification data; and an integrity verification device configured to: store the configuration records, select a configuration record, directly access the memory device to read verification data, corresponding to the selected configuration record, based on the start address and the data length included in the selected configuration record, perform a hash operation on the verification data to obtain a verification hash value, and output an interrupt signal based on the verification hash value and the reference hash value comprised in the selected configuration record.

First claim

What is claimed is:

1. An electronic system, comprising:
a memory device configured to store a plurality of verification data;
a processor configured to provide a plurality of configuration records respectively corresponding to the plurality of verification data, each of the plurality of configuration records comprising a start address, a data length, and a reference hash value for a corresponding verification data; and
an integrity verification device configured to:
store the plurality of configuration records provided by the processor,
select a configuration record among the plurality of configuration records,
directly access the memory device to read verification data, which corresponds to the selected configuration record, from among the plurality of verification data stored in the memory device based on the start address and the data length comprised in the selected configuration record,
perform a hash operation on the read verification data to obtain a verification hash value, and
selectively output an interrupt signal based on the obtained verification hash value and the reference hash value comprised in the selected configuration record,

wherein the integrity verification device comprises:
a controller configured to store the plurality of configuration records, select the configuration record, and output the start address and the data length comprised in the selected configuration record,
a first-input first-output (FIFO) memory,
a direct memory accessor (DMA) configured to read, from the memory device, the verification data, which corresponds to the start address and the data length output by the controller, and to store the read verification data in the FIFO memory, and
a hash engine configured to perform the hash operation on the stored verification data, which is stored in the FIFO memory, based on the data length output by the controller to obtain the verification hash value; and

wherein the controller outputs the interrupt signal in response to the obtained verification hash value being different from the reference hash value comprised in the selected configuration record,
wherein the processor performs, on each of the plurality of verification data, a hash operation, from among a plurality of predetermined hash operations, to obtain a corresponding reference hash value;
wherein each of the plurality of configuration records further comprises hash type information indicating a type of a hash operation performed to obtain the corresponding reference hash value,
wherein the controller provides the hash type information comprised in the selected configuration record to the hash engine, and
the hash engine performs the hash operation, which corresponds to the hash type information received from the controller, on the corresponding verification data to obtain the verification hash value.

2. The electronic system of claim 1 , wherein:
the integrity verification device further comprises a timer configured to output a read start signal at every threshold time interval; and
in response to receiving the read start signal from the timer, the DMA performs a burst read operation on the memory device to read the verification data from the memory device.

3. The electronic system of claim 2 , wherein:
the processor provides a value of the threshold time interval to the controller; and
the controller provides, to the timer, the value of the threshold time interval provided by the processor.

4. An electronic system, comprising:
a memory device configured to store a plurality of verification data;
a processor configured to:
obtain a descriptor table comprising a plurality of configuration records respectively corresponding to the plurality of verification data, each of the plurality of configuration records comprising a start address, a data length, and a reference hash value for a corresponding verification data,
store the descriptor table in the memory device, and
provide a descriptor record comprising a descriptor start address, a descriptor length, and a descriptor reference hash value corresponding to the descriptor table; and
an integrity verification device configured to:
store the descriptor record provided by the processor,
perform an integrity verification operation on the descriptor table by directly accessing the memory device to read the descriptor table from the memory device based on the descriptor start address and the descriptor length comprised in the descriptor record, performing a hash operation on the descriptor table to obtain a descriptor verification hash value, and comparing the descriptor verification hash value with the descriptor reference hash value comprised in the descriptor record, and
in response to the descriptor verification hash value being the same as the descriptor reference hash value comprised in the descriptor record, perform an integrity verification operation on the plurality of verification data, which are stored in the memory device, based on the plurality of configuration records comprised in the descriptor table to selectively output an interrupt signal,
wherein the integrity verification device comprises:
a controller configured to store the descriptor record, and output the descriptor start address and the descriptor length comprised in the descriptor record;
a first-input first-output (FIFO) memory;
a direct memory accessor (DMA) configured to read the descriptor table from the memory device based on the descriptor start address and the descriptor length output by the controller, and provide the read descriptor table to the FIFO memory and the controller; and
a hash engine configured to perform the hash operation on the descriptor table, which is stored in the FIFO memory, based on the descriptor length output by the controller to obtain the descriptor verification hash value, and

wherein the controller outputs the interrupt signal in response to the obtained descriptor verification hash value being different from the descriptor reference hash value comprised in the descriptor record.

5. The electronic system of claim 4 , wherein, in response to the descriptor verification hash value being the same as the descriptor reference hash value comprised in the descriptor record, the integrity verification device selects a configuration record among the plurality of configuration records comprised in the descriptor table, directly accesses the memory device to read verification data, which corresponds to the selected configuration record, from among the plurality of verification data stored in the memory device based on the start address and the data length comprised in the selected configuration record, performs a hash operation on the read verification data to obtain a verification hash value, and outputs an interrupt signal in response to the obtained verification hash value being different from the reference hash value comprised in the selected configuration record.

6. The electronic system of claim 4 , wherein:
the processor performs, on the descriptor table, a hash operation, from among a plurality of predetermined hash operations, to obtain the descriptor reference hash value;
the descriptor record further comprises descriptor hash type information indicating a type of a hash operation performed to obtain the descriptor reference hash value;
the controller provides the descriptor hash type information comprised in the descriptor record to the hash engine; and
the hash engine performs the hash operation, which corresponds to the descriptor hash type information provided by the controller, on the descriptor table to obtain the descriptor verification hash value.

7. The electronic system of claim 4 , wherein:
in response to the descriptor verification hash value being the same as th

Assignees

• Samsung Electronics Co Ltd

Inventors

• Hong Tong-Pyo
• Kim Kyung-Ae
• Park Jae-Chul
• Youm Yun-Ho
• Lee Heon-Soo
• Lee Hye-Soo

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F2221/2139

  Recurrent verification · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title