Security devices, electronic devices and methods of operating electronic devices

An electronic device comprising:

• a central processing unit (CPU);
• a security device configured to receive a request from the CPU and to execute the request within an isolated execution environment with which the CPU does not intervene;
• and
• an external storage connected to the security device,
• wherein the security device comprises:
• a secure processor configured to provide the isolated execution environment;
• a mail box configured to transfer the request received from the CPU to the secure processor;
• a cryptographic block coupled to the secure processor through an internal bus, the cryptographic block being configured to perform one or more secure operations including a signature certification operation on secure data, an encryption/decryption operation on the secure data, and an integrity verification operation on the secure data, within the isolated execution environment,
• the cryptographic block including a direct memory access (DMA) circuit configured to control data access to the external storage;
• a secure DMA circuit coupled to the internal bus, the secure DMA circuit being configured to control the one or more secure operations within the isolated execution environment, wherein only the secure processor is configured to control the secure DMA circuit;
• an internal memory coupled to the internal bus, the internal memory being configured to store the secure data on which the one or more secure operations are performed;
• and
• a switching circuit including a plurality of switches, the switching circuit being configured to connect the internal memory, the cryptographic block, and a memory interface to each other in response to receiving a switching control signal from the secure processor, the memory interface connected to the external storage,
• wherein the DMA circuit is configured to store encrypted secure data and an encrypted first hash value in a memory region corresponding to consecutive addresses of a memory device in the external storage in response to receiving a start address from the secure processor.

A method of operating an electronic device, the electronic device including a central processing unit (CPU) and a security device, to receive a request from the CPU and to execute the request within an isolated execution environment with which the CPU does not intervene, the method comprising:

• powering-on the electronic device;
• performing, in a cryptographic block of the security device, a signature certification operation on a firmware image to store secure data in an internal memory of the security device;
• determining whether the electronic device enters into a low power mode;
• performing, in the cryptographic block in response to determining that the electronic device is entering into the low power mode, a secure back-up operation to encrypt the secure data using a hardware unique key of the electronic device to generate encrypted secure data, and to store the encrypted secure data in an external storage connected to the security device, without intervention of the CPU;
• and
• performing, in the cryptographic block in response to receiving a wake-up request from the CPU, a secure restoring operation to decrypt the encrypted secure data stored in the external storage using the hardware unique key to generate decrypted secure data, and to store the decrypted secure data in the internal memory, without an intervention of the CPU, wherein
• the storing the encrypted secure data in the external storage and the storing the decrypted secure data in the internal memory includes,
• controlling a switching circuit including a plurality of switches, the switching circuit being configured to connect the internal memory, the cryptographic block, and a memory interface to each other in response, using a switching control signal from the security device, the memory interface connected to the external storage;
• and
• storing the encrypted secure data and an encrypted first hash value in a memory region corresponding to consecutive addresses of a memory device in the external storage in response to receiving a start address from the security device.