# US 10,482,258 B2 · Method for securing runtime execution flow > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,258 B2 - Document ID: US10482258B2 - Status: Granted - Kind: B2 - Application number: 15/719,637 - Filed: 2017-09-29 - Published: 2019-04-04 - Granted: 2019-11-19 - Earliest claimed: 2017-09-29 - Assignees: NXP USA, Inc. - Applicants: NXP USA, Inc. - Inventors: Lawrence Loren Case; Aditi Dinesh Shah - Web page: https://patentgrep.com/patent/US10482258B2 ## CPC - G06F 21/575: {Secure boot} - G06F 9/4406: {Loading of operating system} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - G06F 1/24: Resetting means - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A runtime security system, including: a shared core configured to execute processes having varying levels of trustworthiness configured to receive security services requests; an execution monitor configured to monitor the execution of the shared core further comprising a timer, a policy table, and an execution monitor state machine; secure assets including cryptographic keys; and immutable security service functions configured to enable access to the secure assets in response to secure services requests; wherein the execution monitor is configured to: detect that the shared core has received a secure boot request; verify that the secure boot request is valid; allow the shared core to securely boot when the secure boot request valid. ## Claims ### Claim 1 A runtime security system, comprising: a shared core configured to execute processes having varying levels of trustworthiness configured to receive security services requests; an execution monitor configured to monitor the execution of the shared core further comprising a timer, a policy table, and an execution monitor state machine; secure assets including cryptographic keys; and immutable security service functions configured to enable access to the secure assets in response to secure services requests, wherein the execution monitor is configured to: detect that the shared core has received a secure boot request; verify that the secure boot request is valid during a temporary window of access based upon a state of the execution monitor, a received command, and a requestor ID: and allow the shared core to securely boot when the secure boot request is valid; wherein the execution monitor is further configured to set the timer related to an expected reaction time of the shared core to the secure boot request. ### Claim 2 (depends on 1) The runtime security system of claim 1, wherein the execution monitor is further configured to monitor an entry point of an instruction sequence of the secure boot request. ### Claim 3 (depends on 1) The runtime security system of claim 1, wherein the execution monitor is further configured to: detect that the shared core has received a non-maskable secure services request; verify that an instruction related to the non-maskable secure services request is valid; and set a privilege level of the instruction based upon a policy evaluation using the policy table. ### Claim 4 (depends on 3) The runtime security system of claim 3, wherein the execution monitor is further configured to revert the privilege level to a different trust level once the non-maskable secure services request has been completed. ### Claim 5 (depends on 3) The runtime security system of claim 3, wherein the execution monitor is further configured to set the timer related to an expected reaction time of the shared core to the non-maskable secure services request. ### Claim 6 (depends on 3) The runtime security system of claim 3, wherein the shared core receives security assets based upon the set privilege level. ### Claim 7 A runtime security system, comprising: a shared core configured to execute processes having varying levels of trustworthiness configured to receive non-maskable security services requests; an execution monitor configured to monitor the execution of the shared core further comprising a timer, a policy table, and an execution monitor state machine; secure assets including cryptographic keys; and immutable security service functions configured to enable access to the secure assets in response to non-maskable secure services requests, wherein the execution monitor is configured to: detect that the shared core has received a non-maskable secure services request; verify that an instruction related to the non-maskable secure services request is valid during a temporary window of access based upon a state of the execution monitor, a received command, and a requestor ID: and set a privilege level of the instruction based upon a policy evaluation using the policy table; wherein the execution monitor is further configured to set the timer related to an expected reaction time of the shared core to the non-maskable secure services request. ### Claim 8 (depends on 7) The runtime security system of claim 7, wherein the execution monitor is further configured to monitor an entry point of an instruction sequence of the non-maskable secure services request. ### Claim 9 (depends on 7) The runtime security system of claim 7, wherein the execution monitor is further configured to revert the privilege level to a different trust level once the non-maskable secure services request has been completed. ### Claim 10 (depends on 7) The runtime security system of claim 7, further comprising: a handshake queue configured to perform a handshake protocol with a system sending secure services requests to the shared core. ### Claim 11 (depends on 7) The runtime security system of claim 7, further comprising: a queue with ID configured to receive security services requests and the requestor ID from a system and provide the security services requests to the shared core based upon the requestor ID. ### Claim 12 (depends on 7) The runtime security system of claim 7, further comprising: a system security monitor configured to provide an integrity indicator to the execution monitor based upon a tamper or integrity issued indication. ### Claim 13 A method of monitoring a shared core configured to perform functions having varying levels of trustworthiness by an execution monitor, wherein the execution monitor includes a timer, a policy table, and an execution monitor state machine, the method comprising: receiving a secure boot request by a shared core; detecting, by the execution monitor, that the shared core has received the secure boot request; verifying that the secure boot request is valid during a temporary window of access based upon a state of the execution monitor, a received command, and a requestor ID: and allowing the shared core to securely boot when the secure boot request is valid; setting, by the execution monitor, the timer related to an expected reaction time of the shared core to the non-maskable secure services request. ### Claim 14 (depends on 13) The method of claim 13, further comprising: receiving a non-maskable secure services request by the shared core; detecting, by the execution monitor, that the shared core has received a non-maskable secure services request; verifying, by the execution monitor, that an instruction related to the non-maskable secure services request is valid; and setting, by the execution monitor, a privilege level of the instruction based upon a policy evaluation using the policy table. ### Claim 15 (depends on 14) The method of claim 14, wherein the shared core receives security assets based upon the set privilege level. ### Claim 16 (depends on 14) The method of claim 14, further comprising; reverting, by the execution monitor, the privilege level to an un-trusted level once the non-maskable secure services request has been completed.