Control mechanisms for data processing devices

A data processing device comprising a processing unit, memory circuitry having a trusted region and a less-trusted region, communications circuitry and a watchdog of the trusted region having a watchdog timer associated therewith, wherein the data processing device is configured to:

• generate, at the trusted region, a challenge communication;
• encrypt, at the trusted region, the challenge communication;
• pass, from the trusted region to the less-trusted region, the encrypted challenge communication;
• sending, from the less-trusted region to a remote device, the encrypted challenge communication;
• receive, at the less-trusted region, an encrypted response communication from the remote device, wherein the encrypted response communication comprises verification data and command data, and wherein the command data comprises one or more instructions to cause the watchdog to perform one or more actions in response to the one or more instructions and where the verification data comprises a response to the challenge communication;
• pass, from the less-trusted region to the trusted region, the encrypted response communication from the remote device;
• decrypt, at the trusted region, the encrypted response communication from the remote device;
• verify the verification data at the watchdog;
• initiate an action by the watchdog when the response to the challenge corresponds to an expected solution to the challenge, wherein the command data in the communication from the remote device specifies the action to be initiated.

A non-transitory, computer-readable storage medium storing at least one computer program configured to control a data processing device having a trusted region and a less-trusted region to:

• generate, at the trusted region, a challenge communication;
• encrypt, at the trusted region, the challenge communication;
• pass, from the trusted region to the less-trusted region, the encrypted challenge communication;
• sending, from the less-trusted region to a remote device, the encrypted challenge communication;
• receive, at the less-trusted region, an encrypted response communication from the remote device, wherein the encrypted response communication comprises verification data and command data, and wherein the command data comprises one or more instructions to cause a watchdog associated with the data processing device to perform one or more actions in response to the one or more instructions and where the verification data comprises a response to the challenge communication;
• pass, from the less-trusted region to the trusted region, the encrypted communication from the remote device;
• decrypt, at the trusted region, the encrypted response communication from the remote device;
• verify the verification data at the watchdog;
• initiate an action by the watchdog when the response to the challenge corresponds to an expected solution to the challenge, wherein the command data in the communication from the remote device specifies the action to be initiated.

A method of activating a functionality on a data processing device having a trusted region and a less-trusted region, the method comprising:

• generating, at the trusted region of the data processing device, a request communication comprising a request to access a restricted functionality of the data processing device, the request communication further comprising a challenge;
• encrypting, at the trusted region, the request communication;
• passing, from the trusted region to the less-trusted region, the encrypted request communication;
• sending, from the less-trusted region to a remote device, the encrypted request communication;
• transmitting, from the less-trusted region to a remote device, the request communication;
• receiving, at the less-trusted region, an encrypted authorisation communication from the remote device, wherein the authorisation communication comprises verification data and command data, and wherein the command data comprises one or more instructions to cause a watchdog associated with the trusted region to activate the restricted functionality at the data processing device in response to the one or more instructions and where the verification data comprises a response to the challenge communication;
• verifying the verification data at the watchdog;
• initiating an operation by the watchdog when the response to the challenge corresponds to an expected solution to the challenge, wherein the operation comprises activating the restricted functionality at the data processing device in accordance with the one or more instructions.