Enhanced security of power management communications and protection from side channel attacks

Patent metadata

Field	Value
Publication number	US-9721093-B2
Application number	US-201514740639-A
Country	US
Kind code	B2
Filing date	Jun 16, 2015
Priority date	Jun 16, 2015
Publication date	Aug 1, 2017
Grant date	Aug 1, 2017

Abstract

Systems, apparatuses and methods may provide for detecting a request to access a power management register and conducting, via a power management security interface, a runtime credential exchange with a source of the request. Additionally, the request may be denied if the runtime credential exchange is unsuccessful. In one example, a plug event is detected, via a dedicated side channel, with respect to a debug port. A noise analysis may be conducted of one or more power rails in response to the plug event, wherein policy based counter noise may be generated on at least one of the one or more power rails at runtime if the noise analysis identifies a potential security attack.

First claim

We claim:

1. A system comprising:
a power source to supply power to the system; a plurality of circuit blocks;
one or more power rails coupled to the power source and the plurality of circuit blocks;
a debug port; and
a power management integrated circuit including:
a power management register associated with one or more of the plurality of circuit blocks,
a request handler to detect a request to access the power management register,
an authenticator to conduct, via a power management security interface, a runtime credential exchange with a source of the request,
a policy enforcer to deny the request if the runtime credential exchange is unsuccessful,
a port monitor to detect, via a dedicated side channel, a plug event with respect to the debug port,
a noise monitor to conduct a noise analysis of the one or more power rails in response to the plug event, and
a noise generator to generate policy based counter noise on at least one of the one or more power rails at runtime if the noise analysis identifies a potential security attack.

2. The system of claim 1 , further including a trusted execution environment, wherein the power management integrated circuit includes:
a boot detector to detect a boot event, wherein the authenticator is to conduct, in response to the boot event, a boot time credential exchange via the power management security interface and the trusted execution environment,
a policy loader to load policy information from the trusted execution environment to local policy storage if the boot time credential exchange is successful, and
an interrupt handler to register an interrupt search routine with the dedicated side channel of the debug port if the boot time credential exchange is successful.

3. The system of claim 1 , wherein the power management integrated circuit further includes:
a local policy storage, and
a policy retriever to retrieve policy information from the local policy storage, wherein the request is to be denied based on the policy information and the policy information includes one or more of action identifiers, credential data or power thresholds.

4. The system of claim 1 , wherein the policy enforcer is to grant the request if the runtime credential exchange is successful.

5. The system of claim 1 , wherein the power management register is to include power consumption information.

6. An apparatus comprising:
an integrated circuit comprising:
a request handler to detect a request to access a power management register;
an authenticator to conduct, via a power management security interface, a runtime credential exchange with a source of the request;
a policy enforcer to deny the request if the runtime credential exchange is unsuccessful;

a port monitor to detect, via a dedicated side channel, a plug event with respect to a debug port;
a noise monitor to conduct a noise analysis of one or more power rails in response to the plug event; and a noise generator to generate policy based counter noise on at least one of the one or more power rails at runtime if the noise analysis identifies a potential security attack.

7. The apparatus of claim 6 , further including:
a boot detector to detect a boot event, wherein the authenticator is to conduct, in response to the boot event, a boot time credential exchange via the power management security interface and a trusted execution environment;
a policy loader to load policy information from the trusted execution environment to local policy storage if the boot time credential exchange is successful; and
an interrupt handler to register an interrupt service routine with the dedicated side channel of the debug port if the boot time credential exchange is successful.

8. The apparatus of claim 6 , further including a policy retriever to retrieve policy information from local policy storage, wherein the request is to be denied based on the policy information and the policy information includes one or more of action identifiers, credential data or power thresholds.

9. The apparatus of claim 6 , wherein the policy enforcer is to grant the request if the runtime credential exchange is successful.

10. The apparatus of claim 6 , wherein the power management register is to include power consumption information.

11. A method comprising:
detecting a request to access a power management register;
conducting, via a power management security interface, a runtime credential exchange with a source of the request;
denying the request if the runtime credential exchange is unsuccessful;
detecting, via a dedicated side channel, a plug event with respect to a debug port;
conducting a noise analysis of one or more power rails in response to the plug event; and
generating policy based counter noise on at least one of the one or more power rails at runtime if the noise analysis identifies a potential security attack.

12. The method of claim 11 , further including:
detecting a boot event;
conducting, in response to the boot event, a boot time credential exchange via the power management security interface and a trusted execution environment;
loading policy information from the trusted execution environment to local policy storage if the boot time credential exchange is successful; and
registering an interrupt service routine with the dedicated side channel of the debug port if the boot time credential exchange is successful.

13. The method of claim 11 , further including retrieving policy information from local policy storage, wherein the request is denied based on the policy information and the policy information includes one or more of action identifiers, credential data or power thresholds.

14. The method of claim 11 , further including granting the request of the runtime credential exchange is successful.

15. The method of claim 11 , wherein the power management register includes power consumption information.

16. At least one non-transitory computer readable storage medium comprising a set of instructions, which when executed by a computing system, cause the computing system to:
detect a request to access a power management register;
conduct, via a power management security interface, a runtime credential exchange with a source of the request;
deny the request if the runtime credential exchange is unsuccessful;
detect, via a dedicated side channel, a plug event with respect to a debug port;
conduct a noise analysis of one or more power rails in response to the plug event;
and generate policy based counter noise on at least one of the one or more power rails at runtime if the noise analysis identifies a potential security attack.

17. The at least one non-transitory computer readable storage medium of claim 16 , wherein the instructions, when executed, cause a computing system to:
detect a boot event;
conduct, in response to the boot event, a boot time credential exchange via the power management security interface and a trusted execution environment;
load policy information from the trusted execution environment to local policy storage if the boot time credential exchange is successful; and
register an interrupt service routine with the dedicated side channel of the debug port if the boot time credential exchange is successful.

18. The at least one non-transitory computer readable storage medium of claim 16 , wherein the instructions, when executed, cause a computing system to retrieve policy information from local policy storage, and wherein the request is to be denied based on the policy information and the policy information includes one or mo

Assignees

• Intel Corp

Inventors

• Poornachandran Rajesh
• Smith Ned M

Classifications

• G06F21/575

  Secure boot · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/755 Primary

  with measures against power attack · CPC title