METHOD AND APPARATUS FOR INCLUDING ARCHITECTURE FOR PROTECTING MULTI-USER SENSITIVE CODE AND DATA

• US 20120102333A1
• Filed: 12/22/2010
• Published: 04/26/2012
• Est. Priority Date: 10/20/2010
• Status: Active Grant

• Current Assignee: Advanced Micro Devices, Inc.
• Original Assignee: Advanced Micro Devices, Inc.
• Inventors: Wong, Daniel W.
• Granted Patent: US 8,489,898 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/72 in cryptographic circuits

Abstract

A secure execution environment for execution of sensitive code and data including a secure asset management unit (SAMU) is described. The SAMU provides a secure execution environment to run multiple instances of separate program code or data code associated with copy protection schemes established for content consumption. The SAMU architecture allows for hardware-based secure boot and memory protection and provides on-demand code execution for multiple instances of separate program code or data provided by a host processor. The SAMU may boot from an encrypted and signed kernel code, and execute encrypted, signed code. The hardware-based security configuration facilitates the prevention of vertical or horizontal privilege violations.

Claims

1. A method for providing a secure execution environment for multiple instances of separate program code or data, comprising:

offloading multiple instances of separate code or data from a host processor to a secure asset management unit (SAMU) in an encrypted format for authenticating and for maintaining confidentiality of the multiple instances of separate code or data.

2. The method of claim 1, wherein the offloading includes creating an encrypted binary boot image with a random key generated in a signing tool for each instance of the multiple instances of separate code or data.

3. The method of claim 2, wherein the encrypted binary boot image is encrypted for the SAMU and is provided as a secure kernel and a secure application for the SAMU.

4. The method of claim 3, wherein a user installs the encrypted binary boot image and presents the encrypted binary boot image to the SAMU on demand.

5. The method of claim 4, further comprising:

validating the encrypted binary boot image for integrity before configuring a decryption key for use with the SAMU using a boot read only memory (ROM).

6. The method of claim 5, further comprising:

generating a decryption key at the boot ROM for use with the SAMU; and

passing control to the encrypted binary boot image in response to a positive validation.

7. The method of claim 6, wherein after a positive validation and execution of the secure kernel, an application for providing access to content detects availability of the SAMU hardware and the secure kernel generates a context for the application and validates the integrity of the application.

8. The method of claim 7, wherein a code decryption key for each of the multiple instances of separate code or data for the application is restored by the secure kernel in response to a positive validation for use with the context created with a kernel image.

9. The method of claim 8, further comprising:

generating a data cipher key randomly for the application at the secure kernel for each of the multiple instances of separate code or data in response to a positive validation of the kernel image.

10. The method of claim 5, wherein no SAMU service is exposed if there is a negative validation, and the application reverts to a software-based protection scheme.

11. A system for providing a secure execution unit for multiple instances of separate program code or data, comprising:

a host processor configured to execute a plurality of applications including code or data;

a secure asset management unit (SAMU) configured to execute program code, wherein the SAMU is connected to the host processor and is configured to offload multiple instances of separate code or data from the host processor in an encrypted format for authenticating and for maintaining confidentiality of the multiple instances of separate code or data.

12. The system of claim 11, wherein the SAMU is further configured to create an encrypted binary boot image with a random key generated in a signing tool as part of the offloading multiple instances of separate code or data.

13. The system of claim 12, wherein the encrypted binary boot image is encrypted for the SAMU and provided as a secure kernel and a secure application for SAMU.

14. The system of claim 12, wherein a user installs the encrypted binary boot image and presents the encrypted binary boot image to the SAMU on demand.

15. The system of claim 14, wherein the SAMU is further configured to validate the encrypted binary boot image for integrity before configuring a decryption key for use with the SAMU using a boot read only memory (ROM).

16. The system of claim 15, wherein the boot ROM is further configured to generate a decryption key for use with the SAMU and to pass control to the encrypted binary boot image in response to a positive validation.

17. The system of claim 16, wherein after a positive validation and execution of the secure kernel, an application for providing access to content detects availability of the SAMU hardware and the secure kernel generates a context for the application and validates the integrity of the application.

18. The system of claim 17, wherein a code decryption key for each of the multiple instances of separate code or data for the application is restored by the secure kernel in response to a positive validation for use with the context created with a kernel image.

19. The system of claim 18, further configured to:

generate a data cipher key randomly for the application at the secure kernel for each of the multiple instances of separate code or data in response to a positive validation of the kernel image.

20. The system of claim 16, wherein no SAMU service is exposed if there is a negative validation, and the application falls back on software based protection scheme for authentication.

21. A computer-readable storage medium storing a set of instructions for execution by one or more processors to facilitate manufacture of a secure asset management unit (SAMU), the SAMU configured to:

execute program code; and

offload multiple instances of separate code or data from a processor in an encrypted format to authenticate and to maintain confidentiality of the multiple instances of separate code or data.

22. The computer-readable storage medium of claim 21, wherein the instructions are hardware description language (HDL) instructions used for the manufacture of a device.