METHODS AND APPARATUS FOR PROVIDING DATA SECURITY

• US 20110162082A1
• Filed: 03/08/2011
• Published: 06/30/2011
• Est. Priority Date: 04/08/2004
• Status: Active Grant

• Current Assignee: Texas Instruments, Inc.
• Original Assignee: Texas Instruments, Inc.
• Inventors: Shankar, Narendar, Paksoy, Erdal, Redin, Sven-Inge
• Granted Patent: US 8,978,146 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

An electronic circuit includes a more-secure processor having hardware based security for storing data. A less-secure processor eventually utilizes the data. By a data transfer request-response arrangement between the more-secure processor and the less-secure processor, the more-secure processor confers greater security of the data on the less-secure processor. A manufacturing process makes a handheld device having a storage space, a less-secure processor for executing modem software and a more-secure processor having a protected application and a secure storage. A manufacturing process involves generating a per-device private key and public key pair, storing the private key in a secure storage where it can be accessed by the protected application, combining the public key with the modem software to produce a combined software, signing the combined software; and storing the signed combined software into the storage space. Other processes of manufacture, processes of operation, circuits, devices, wireless and wireline communications products, wireless handsets and systems are disclosed and claimed.

Claims

1. A method of providing data security comprising the steps of:

storing data in a first memory of a first processor having hardware-based security;

operating a second processor to authenticate the data in the first processor; and

operating the first processor to send the data from the memory of the first processor to a second memory external to the first processor.

2. The method claimed in claim 1 wherein the second memory is accessible by the second processor and said operating the first processor step includes sending the data in a confidential manner whereby more secure inter-processor communication occurs.

3. The method claimed in claim 1 wherein the operating second processor to authenticate is performed after the operating first processor to send the data.

4. The method claimed in claim 1 wherein the operating second processor to authenticate is performed approximately concurrently with the operating first processor to send the data.

5. The method claimed in claim 1 wherein the second memory is associated with the second processor.

6. The method claimed in claim 1 wherein the operating first processor to send data also leaves the data in the memory of the first processor.

7. The method claimed in claim 1 wherein the operating the second processor with the first processor protects the operations of the second processor from unauthorized modification in a manner enhanced by the first processor.

8. The method claimed in claim 1 further comprising operating the second processor to send a challenge to the first processor prior to said operating the first processor to send data.

9. The method claimed in claim 1 further comprising operating the second processor to send a challenge to the first processor prior to said operating the first processor to send data, and the operating the first processor to send data includes operating the first processor to also reply with data responsive to the challenge.

10. The method claimed in claim 1 further comprising operating the first processor to authenticate the data before said operating the second processor to authenticate the data.

11. The method claimed in claim 1 wherein the operating the first processor to send data transfers the data inside a handset.

12. Apparatus for data security comprising:

a first processor having hardware-based security;

a first memory coupled to said first processor and having data stored in said memory;

a second processor having a second memory and operable to authenticate data from said first processor; and

a second memory external to said first processor, said first processor operable to send the data from said first memory to said second memory external to said first processor.

13. The apparatus claimed in claim 12 wherein said second memory is accessible by said second processor and said first processor is coupled to software that directs sending of the data in a confidential manner.

14. The apparatus claimed in claim 12 wherein said second processor is coupled to software that establishes authentication by said second processor of the data after the data is sent by said first processor.

15. The apparatus claimed in claim 12 further comprising security monitoring logic coupled to monitor said first processor.

16. The apparatus claimed in claim 15 wherein said second processor has increased security even though said security monitoring logic is coupled to monitor only said first processor.

17. The apparatus claimed in claim 12 wherein said second memory is coupled to and includes a memory space write-protected from said second processor.

18. The apparatus claimed in claim 12 wherein said second processor is operable to send a challenge to said first processor prior to said first processor sending data.

19. The apparatus claimed in claim 18 wherein said first processor is operable to also reply with data based on the challenge.

20. The apparatus claimed in claim 12 wherein said second processor is operable to authenticate the data before said first processor authenticates the data.

21. The apparatus claimed in claim 12 wherein said first processor and said second processor are physically associated in a device selected from the group consisting of 1) handheld device, 2) personal computer, 3) digital subscriber line (DSL) telecommunication unit, 4) wireless local area network (WLAN) device, 5) gateway unit, 6) wireless base station.

22. The apparatus claimed in claim 12 further comprising a radio frequency unit responsive to said second processor.

23. The apparatus claimed in claim 12 wherein the data includes digital rights management data.

24. The apparatus claimed in claim 12 wherein the data includes subscriber-related information.