Secure processing unit systems and methods

• US 7,930,360 B2
• Filed: 08/19/2008
• Issued: 04/19/2011
• Est. Priority Date: 08/20/1999
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Sibert, W. Olin
• Primary Examiner(s): SHIN, KYUNG H
• Application Number:
  US12/194,465
• Publication Number:
  US 20090055612A1
• Time in Patent Office: 973 Days
• Field of Search: 709/216, 711/152, 705/80, 380/225
• US Class Current: 709/216
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2212/1044 Space efficiency improvement
• CPC Class Codes: G06Q 50/188 Electronic negotiation
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A hardware Secure Processing Unit (SPU) is described that can perform both security functions and other information appliance functions using the same set of hardware resources. Because the additional hardware required to support security functions is a relatively small fraction of the overall device hardware, this type of SPU can be competitive with ordinary non-secure CPUs or microcontrollers that perform the same functions. A set of minimal initialization and management hardware and software is added to, e.g., a standard CPU/microcontroller. The additional hardware and/or software creates an SPU environment and performs the functions needed to virtualize the SPU'"'"'s hardware resources so that they can be shared between security functions and other functions performed by the same CPU.

Claims

1. A secure processing unit, the secure processing unit including:

an internal memory unit;

a processor including a memory management unit and a plurality of security registers, the memory management unit further including a level-one page table, the level-one page table including a plurality of level-one page table entries, wherein the level-one page table entries each correspond to at least one level-two page table, and wherein the level-one page table entries each contain a predefined attribute, the predefined attribute being operable to indicate to the memory management unit whether entries in a corresponding level-two page table may designate certain predefined memory regions;

tamper detection and response logic;

an interface to external systems or components;

one or more buses for connecting the internal memory unit, the processor, the tamper detection and response logic, and the interface to external systems and components; and

a tamper-resistant housing.

2. A secure processing unit as in claim 1, in which the internal memory unit includes:

secure random access memory;

secure non-volatile memory;

secure read-only memory.

3. A secure processing unit as in claim 2, in which the secure non-volatile memory is powered by a battery.

4. A secure processing unit as in claim 3, in which the secure non-volatile memory contains at least one cryptographic key.

5. A secure processing unit as in claim 4, in which the internal memory unit includes:

a unique identifier for the secure processing unit;

a private cryptographic key, a public cryptographic key;

and a cryptographic certificate linking the unique identifier and the public cryptographic key.

6. A secure processing unit as in claim 1, including:

access control data, the access control data being operable to indicate whether access to predefined memory regions is restricted to certain software components or processor modes.

7. A secure processing unit as in claim 6, in which the access control data are stored in a critical address register, the critical address register comprising one of the processor security registers.

8. A secure processing unit as in claim 1, whereby level-two page tables that may not designate the predefined memory regions are not stored in the internal memory unit.

9. An information appliance, the information appliance comprising:

a memory unit;

a secure processing unit, the secure processing unit including;

a tamper resistant packaging;

tamper detection and response logic;

a secure memory unit;

a processing unit, including a memory management unit and a plurality of processor security registers, the memory management unit further including a level-one page table and a plurality of level-two page tables, the level-one page table including a plurality of level-one page table entries and the level-two page table including a plurality of level-two page table entries, wherein the level-one page table entries each correspond to at least one level-two page table, and wherein the level-one page table entries each contain a predefined attribute, the predefined attribute beingoperable to indicate to the memory management unit whether a corresponding level-two page table may designate certain predefined memory regions; and

,

a bus for connecting the memory unit and the secure processing unit;

wherein the secure processing unit is operable to perform both secure processing operations and at least some processing operations performed by a conventional information appliance processing unit.

10. An information appliance as in claim 9, in which the information appliance is selected from the group comprising:

a television set-top box, a portable audio player, a portable video player, a cellular telephone, a personal computer, and a workstation.

11. An information appliance as in claim 9, in which the secure processing unit is the information appliance'"'"'s primary processing unit.

12. An information appliance as in claim 9, in which the secure processing unit is the information appliance'"'"'s only processing unit.

13. An information appliance as in claim 9, in which the secure processing unit includes:

a critical address register, the critical address register containing a plurality of access control bits, the access control bits being operable to indicate whether access to associated memory regions is restricted to predefined software components or processor modes.

14. An information appliance as in claim 13, in which the critical address register comprises one of the processor security registers.

15. An information appliance as in claim 9, in which level-two page tables that may not designate the predefined memory regions are stored in the memory unit, and wherein the level-one page table and the level-two page tables that may designate the predefined memory regions are stored in the secure memory unit.

16. In a system including a secure processing unit, the secure processing unit comprising an internal memory unit and a processor, and the processor including a memory management unit and a plurality of processor security registers, the memory management unit further including a level-one page table and a plurality of level-two page tables, the level-one page table including a plurality of level-one page table entries and the level-two page table including a plurality of level-two page table entries, wherein the level-one page table entries each correspond to at least one level-two page table, and wherein the level-one page table entries each contain a predefined attribute, the predefined attribute being operable to indicate to the memory management unit whether a corresponding level-two page table may designate certain predefined memory regions, a method for controlling access to the internal memory unit, the method comprising:

(a) obtaining a request to access a portion of memory in the internal memory unit;

(b) checking critical address protection data stored in at least one of said processor security registers to determine whether the portion of memory is subject to critical access protection; and

(c) granting the request if the portion of memory is not subject to critical access protection.

17. A method as in claim 16, further including:

(b)(1) determining whether the processor is operating in a predefined mode; and

(c)(1) granting the request if the processor is operating in the predefined mode.

18. A method as in claim 17, in which the predefined mode is a supervisor mode.