Mobile Security System and Method

• US 20110154032A1
• Filed: 02/25/2011
• Published: 06/23/2011
• Est. Priority Date: 11/18/2005
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: MAURO, Anthony Patrick II
• Granted Patent: US 8,499,171 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

A system and method for providing a secure environment for mobile telephones and other devices are disclosed. The system and method may utilize trust zoning, layered memory, and a secure matrix model having, for example, a memory protection module for protecting memory; a secure debug module for ensuring security of the debug module; a secure file system module for protecting the secure file system; and a trusted time source module for protecting components. Embodiments of the present invention may protect against security attacks on a variety of hardware and software components while permitting suitable levels of accessibility for developmental and maintenance purposes.

Claims

1. A security system for a mobile device having a plurality of components including a secure file system, the security system comprising:

a plurality of modules, each module in the plurality of modules securing at least one component in the plurality of components, the plurality of modules including a secure file system module for protecting the secure file system;

the secure file system module including a mobile device-specific hardware key; and

an on-chip, non-volatile memory for storing the mobile device-specific hardware key.

2. The security system of claim 1, wherein the plurality of components further comprises memory and a debug module.

3. The security system of claim 2, wherein the plurality of modules further comprise:

a memory protection module for protecting memory;

a secure debug module for ensuring security of the debug module; and

a trusted time source module for protecting at least one component in the plurality of components.

4. The security system of claim 2, wherein the memory protection module further comprises at least one element selected from a group consisting essentially of a predetermined number of main memory protection unit blocks;

modem processor memory management unit;

a modem subsystem secure mode multiplexer block;

an application digital signal processor memory protection unit;

direct memory access controller security features; and

general purpose input/output expansion interface security features.

5. The security system of claim 4, wherein the main memory memory protection unit blocks further comprise at least one element selected from a group consisting essentially of a first memory protection unit;

a second memory protection unit;

a peripheral memory protection unit; and

a NAND memory protection unit.

6. The security system of claim 4, wherein the peripheral memory protection unit further comprises at least one element selected from a group consisting essentially of security violation indication;

configuration registers and status registers;

security identification sideband signal receipt.

7. The security system of claim 2, wherein the NAND memory protection unit further comprises at least one element selected from group consisting essentially of NAND flash memory page protection;

configuration registers; and

status registers.

8. The security system of claim 4, wherein the direct memory access controller security features further comprise at least one element selected from a group consisting essentially of an embedded memory protection unit;

at least one shadow register; and

a security identification.

9. The security system of claim 4, wherein the general purpose input/output expansion interface security features further comprise at least one element selected from a group consisting essentially of at least one shadow register and at least one bitmask.

10. The security system of claim 3, wherein the memory protection module further comprises at least one element selected from a group consisting essentially of main memory;

peripheral memory and flash memory.

11. The security system of claim 10, wherein main memory further comprises at least one main memory partition selected from a group consisting essentially of a distributed mass storage system partition;

a distributed mass storage system externalized state partition;

at least one video frame buffer partition;

at least one partition; and

at least one application digital signal processor partition.

12. The security system of claim 10, wherein peripheral memory further comprises at least one peripheral memory partition selected from a group consisting essentially of a direct memory access controller secure peripheral partition;

a non-direct memory access controller secure peripheral partition;

a general purpose input/output expansion interface shadow registers partition;

at least one direct memory access controller shadow register partition; and

at least one application digital signal processor partition.

13. The security system of claim 12, wherein flash memory further comprises at least one partition selected from a group consisting essentially of a distributed mass storage system partition and a read-only third party operating system partition.

14. The security system of claim 3, wherein the secure debug module further comprises at least one element selected from a group consisting essentially of modem supervisory mode controller private instructions;

a test interface controller;

modem automated resource manager debug; and

provision of hardware key fuses and security control fuses.

15. The security system of claim 3, wherein the secure debug module further comprises at least one element selected from a group consisting essentially of an modem supervisory mode terminal access point controller;

a modem automated resource manager;

a test interface controller multiplexer; and

a joint test action group mode multiplexer.

16. The security system of claim 15, wherein the modem automated resource manager further comprises a single input pin for controlling access to debug capabilities.

17. The system of claim 15, wherein the joint test action group mode multiplexer further comprises access capabilities to the modem supervisory mode;

the modem automated resource manager;

an application automated resource manager or a combination thereof.

18. The security system of claim 3, wherein the secure file system module further comprises a cryptography engine block and a direct memory access controller block.

19. The security system of claim 3, wherein the secure file system module further comprises a disabling fuse that, when blown, disables the programming functionality for hardware key fuses.

20. The security system of claim 3, wherein the trusted time source module further comprises modules selected from a group consisting essentially of a module for keeping a local time reference while network time sources are unavailable;

a module for periodically saving and restoring time in external, non-volatile memory; and

a module for synchronizing a local time with a source of network time.

21. The security system of claim 20, wherein the module for keeping a local time reference further comprises a sleep controller circuit.

22. The security system of claim 21, wherein the sleep control circuit further comprises a timer.

23. The security system of claim 20, wherein the source of network time further comprises an element selected from a group consisting essentially of code division multiple access and global positioning satellite.

24. The security system of claim 3, further comprising a security mode control module having at least one register selected from a group consisting essentially of a boot mode register;

a first debug register;

a second debug register;

a first hardware register; and

a second hardware register.

25. The security system of claim 24, wherein the first debug register further comprises a terminal access point control register.

26. The security system of claim 24, wherein the second debug register further comprises a debug control register.

27. The security system of claim 24, wherein the first hardware register further comprises a hardware key register.

28. The security system of claim 24, wherein the second hardware register further comprises a secure debug enable chain register.