Key extraction during secure boot

Patent metadata

Field	Value
Publication number	US-9755831-B2
Application number	US-201414161185-A
Country	US
Kind code	B2
Filing date	Jan 22, 2014
Priority date	Jan 22, 2014
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

One feature pertains to a method for extracting a secret key during a secure boot flow of an integrated circuit. Specifically, the secure boot flow includes powering ON a first volatile memory circuit to generate a plurality of initial logical state values, deriving secret data based on the plurality of initial logical state values, storing the secret data in a secure volatile memory circuit that is secured by a secure execution environment (SEE), clearing the plurality of initial logical state values in the first volatile memory circuit, executing a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and storing the secret key in the secure volatile memory circuit. The secure boot flow controls access to the first volatile memory circuit to secure the secret data and the plurality of initial logical state values from the insecure applications.

First claim

What is claimed is:

1. A method for operating a secure boot flow that controls access to a first volatile memory circuit of an integrated circuit to secure secret data from one or more insecure applications, the method comprising:
initializing a resource power management circuit coupled to a first volatile memory circuit;

powering ON the first volatile memory circuit to generate a plurality of initial logical state values, wherein the first volatile memory circuit is powered ON by the resource power management circuit and wherein the first volatile memory circuit is an insecure volatile memory circuit on the integrated circuit;
deriving the secret data, wherein the secret data includes the plurality of initial logical state values;
storing the secret data in a secure volatile memory circuit, the secure volatile memory circuit secured by a secure execution environment (SEE);
clearing the plurality of initial logical state values in the first volatile memory circuit so that the first volatile memory circuit no longer stores one or more of the plurality of initial logical state values;
executing an algorithm at the SEE to extract a secret key based on the secret data; and
storing the secret key in the secure volatile memory circuit,
wherein the first volatile memory circuit is configured to be reset exclusively by the resource power management circuit to prevent the one or more insecure applications from resetting the first volatile memory circuit and obtaining the plurality of initial logical state values, and wherein the resetting of the first volatile memory circuit causes execution of the secure boot flow of the integrated circuit, where the secure boot flow includes a primary boot loader, a first secondary boot loader, and a second secondary boot loader, and the secure boot flow establishes a chain of trust.

2. The method of claim 1 , wherein the secure boot flow secures the secret data and the plurality of initial logical state values from the one or more insecure applications by rendering the first volatile memory circuit inaccessible to the one or more insecure applications until at least after the plurality of initial logical state values have been cleared in the first volatile memory circuit.

3. The method of claim 2 , wherein the secure boot flow establishes the chain of trust by having the primary boot loader authenticate the first secondary boot loader before the first secondary boot loader executes, the first secondary boot loader authenticate the second secondary boot loader before the second secondary boot loader executes, and the second secondary boot loader authenticate the SEE, and
wherein the secret key is extracted and stored in the secure volatile memory circuit during the secure boot flow and prior to execution of the one or more insecure applications.

4. The method of claim 1 , wherein after clearing the first volatile memory circuit, the first volatile memory circuit is available for data storage for one or more insecure applications.

5. The method of claim 1 , wherein the SEE prevents insecure applications from accessing the secure volatile memory circuit.

6. The method of claim 1 , wherein the plurality of initial logical state values are substantially the same every time the first volatile memory circuit is powered ON.

7. The method of claim 1 , wherein the algorithm is based on at least one of a block code algorithm, a spreading code algorithm, and/or a repeat code algorithm.

8. The method of claim 1 , further comprising:
storing the secret data in a second volatile memory circuit prior to storing the secret data in the secure volatile memory circuit; and
clearing the secret data stored in the second volatile memory circuit after storing the secret data in the secure volatile memory circuit.

9. The method of claim 8 , wherein after clearing the secret data stored in the second volatile memory circuit, the second volatile memory circuit is available for data storage for one or more insecure applications.

10. The method of claim 1 , wherein the SEE controls access to the secret key by making it inaccessible to an insecure application, and the method further comprises:
receiving a request from the insecure application at the SEE for at least one of a secondary key and/or public data;
generating the secondary key and/or the public data at the SEE based on the secret key; and
providing the secondary key and/or the public data to the insecure application requesting the secondary key and/or the public data.

11. The method of claim 10 , wherein the secondary key and/or the public data is generated based on the secret key and other data provided by the insecure application.

12. The method of claim 1 , wherein the algorithm executed at the SEE to extract the secret key based on the secret data is further based on auxiliary data stored in a non-volatile memory circuit.

13. An integrated circuit comprising:
a first volatile memory circuit configured to generate a plurality of initial logical state values upon power ON, wherein the first volatile memory circuit is an insecure volatile memory circuit;
a secure volatile memory circuit secured by a secure execution environment (SEE); and
a processing circuit configured to execute a secure boot flow that controls access to the first volatile memory circuit to secure secret data from one or more insecure applications, the processing circuit communicatively coupled to the first volatile memory circuit and the secure volatile memory circuit, the processing circuit further configured to
initialize a resource power management circuit coupled to the first volatile memory circuit, the resource power management circuit configured to power ON the first volatile memory circuit,
derive the secret data, wherein the secret data includes the plurality of initial logical state values,
store the secret data in the secure volatile memory circuit,
clear the plurality of initial logical state values in the first volatile memory circuit so that the first volatile memory circuit no longer stores one or more of the plurality of initial logical state values,
execute an algorithm at the SEE to extract a secret key based on the secret data, and
store the secret key in the secure volatile memory circuit,
wherein the first volatile memory circuit is configured to be reset exclusively by the resource power management circuit to prevent the one or more insecure applications from resetting the first volatile memory circuit and obtaining the plurality of initial logical state values, and wherein the resetting of the first volatile memory circuit causes the processing circuit to execute the secure boot flow of the integrated circuit, where the secure boot flow includes a primary boot loader, a first secondary boot loader, and a second secondary boot loader, and the secure boot flow establishes a chain of trust.

14. The integrated circuit of claim 13 , wherein the processing circuit executes the secure boot flow by (i) deriving the secret data, (ii) storing the secret data, (iii) clearing the plurality of initial logical state values, (iv) executing the algorithm, and (v) storing the secret key.

15. The integrated circuit of claim 14 , wherein the secure boot flow secures the secret data and the plurality of initial logical state values from the one or more insecure applications by rendering the first volatile memory circuit inaccessible to the one or more insecure applications until at least after the plurality of initial logical state values have been cleared in the first volatile memory circuit.

16. The integrated circuit of claim 15 , wh

Assignees

• Qualcomm Inc

Inventors

• Laver Steven Douglas
• Guo Xu
• Rosenberg Brian Marc
• Jacobson David Merrill

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title