Method and system for continuously verifying integrity of secure instructions during runtime

A method of enabling checking integrity of a secure computing device, the method comprising:

• obtaining, by a secure processor asynchronously from a system processor, a secure instruction image including an expected hash associated with an instruction block, the instruction block associated with a validation response and one or more instructions and located at one or more addresses of a system memory;
• storing, by the secure processor, the secure instruction image at a configuration register;
• and
• enabling a hardware controller of the secure processor to perform one or more hashing operations associated with the instruction block in response to a request by the system processor to obtain the instruction block located at addresses of a secure memory during runtime of a system processor;
• and
• enabling the hardware controller to perform the requesting the instruction block, the obtaining the instruction block, the obtaining the secure instruction image, and the storing the secure instruction image during runtime of the system processor,
• wherein the first validation response comprises loading a status register with at least one of the instructions associated with the instruction block, and
• wherein the system processor and the secure processor each enter and exit a configuration mode prior to the requesting the instruction block, and wherein the configuration mode allows a secure register to be modified by an external device.

A system for checking integrity of a secure computing device, the system comprising:

• a hardware controller of a secure processor including an enable input node and an interrupt input node, and configured to request an instruction block associated with one or more instructions and located at one or more addresses of a system memory, obtain, asynchronously from a system processor, an expected hash associated with the instruction block, and, in accordance with a determination that the expected hash matches a generated hash, generating a first validation response associated with the instruction block, the hardware controller enabled to request the instruction block, obtain the expected hash, the generating the hash of the instruction block, the obtaining the expected hash, and compare the expected hash with the generated hash during runtime of the system processor,
• wherein the first validation response comprises loading a status register with at least one of the instructions associated with the instruction block, and
• a bus master engine operatively coupled to the hardware controller, and configured to obtain the instruction block from the system memory, and buffer the obtained instruction block to a buffer memory;
• a hash engine operatively coupled to the buffer memory, and configured to generate, in response to the request for the instruction block located at addresses of a secure memory, the generated hash of the instruction block;
• a comparator operatively coupled to the hardware controller and the hash engine, and configured to compare the expected hash with the generated hash;
• wherein the system processor and the secure processor each enter and exit a configuration mode prior to the requesting the instruction block, and wherein the configuration mode allows a secure register to be modified by an external device.