Boot security of integrated circuit device
AssigneeAmazon Technologies, Inc.
InventorRene Ernesto Henriquez Garcia
Life of this patent
Estimating the term…
Abstract
Techniques for measuring firmware at the point and time of execution are described. Hardware logic can be implemented in a processing unit that is tasked with executing firmware code to make on-the-fly measurements of the instructions being executed by the processing unit. For example, an instruction register that stores instructions being executed by the processing unit can be monitored to obtain a set of instructions corresponding to the firmware being executed. Firmware verification circuitry can be implemented to compute a cryptographic measurement of the instructions being executed to verify the authenticity of the firmware.
Claims18
An integrated circuit device comprising:
- a non-volatile memory configured to store firmware for execution during a boot sequence;
- and
- a processor having:
- fetch circuitry configured to read the firmware from the non-volatile memory during the boot sequence;
- instruction decoder circuitry configured to decode the firmware into processor instructions;
- execution circuitry configured to execute the processor instructions;
- an instruction register configured to sequentially store each of the processor instructions corresponding to the firmware;
- and
- firmware verification circuitry including an accumulation register, the firmware verification circuitry configured to sequentially perform, for each of the processor instructions corresponding to the firmware, operations including:
- combining the processor instruction stored in the instruction register with a value stored in the accumulation register to generate a hash input value;
- applying a hash function to the hash input value to compute a hash value;
- and
- updating the accumulation register with the hash value,
- wherein an accumulated hash value stored in the accumulation register corresponding to a last processor instruction of the firmware is used as a cryptographic measurement of the firmware to verify that the firmware executed by the processor is valid, and
- wherein the firmware verification circuitry is disabled in response to a completion indication indicating that execution of the firmware is complete.
A method comprising:
- obtaining a set of instructions from an instruction register of a processing unit of an integrated circuit device, the set of instructions corresponding to firmware being executed by the processing unit during a boot sequence;
- for each instruction in the set of instructions, sequentially performing, by firmware verification circuitry, operations including:
- computing a hash value based on the instruction and a value stored in an accumulation register;
- and
- updating the accumulation register with the hash value;
- providing an accumulated hash value stored in the accumulation register corresponding to a last instruction of the set of instructions as a cryptographic measurement of the firmware;
- receiving a completion indication indicating that execution of the firmware is complete;
- and
- in response to receiving the completion indication, disabling the firmware verification circuitry.
An integrated circuit device comprising:
- an accumulation register;
- combinational logic circuitry having a first input coupled to the accumulation register and a second input coupled to an instruction register, the combinational logic circuitry configured to generate an output that combines a value stored in the accumulation register with an instruction stored in the instruction register;
- and
- hash calculation circuitry configured to compute a hash value of the output of the combinational logic circuitry, and update the accumulation register with the hash value,
- wherein the hash calculation circuitry is enabled in response to a reset indication indicating a start of firmware execution, and is disabled in response to a completion indication indicating that the firmware execution is complete.
Dependencies are inferred from the claim text.