# US 12,008,106 B2 · Systems, methods, and devices for security attribute caching and accelerated wake times of secured environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,106 B2 - Document ID: US12008106B2 - Status: Granted - Kind: B2 - Application number: 17/501,922 - Filed: 2021-10-14 - Published: 2023-04-20 - Granted: 2024-06-11 - Earliest claimed: 2021-10-14 - Assignees: Cypress Semiconductor Corporation - Applicants: Cypress Semiconductor Corporation - Inventors: Victor Simileysky; Jacek Dobaczewski; Roman Baker - Web page: https://patentgrep.com/patent/US12008106B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 21/575: {Secure boot} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 21/72: in cryptographic circuits - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3247: {involving digital signatures} - G06F 2221/033: Test or assess software - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and devices authenticate operations for secured execution environments. Methods include performing, using one or more processing elements of a secured execution environment, a first cryptographic computation on a portion of code to generate a result. Methods also include determining, using the one or more processing elements, an authenticated version of a cryptographic value, the authenticated version of the cryptographic value being determined based on a signature computation and a second cryptographic computation that is an asymmetric cryptographic computation. Methods further include determining, using the one or more processing elements, if the result of the first cryptographic computation is verified based, at least in part, on a comparison with the authenticated version of the cryptographic value. ## Claims ### Claim 1 A method comprising: performing, using one or more processing elements of a secured execution environment, a first cryptographic computation on a portion of code to generate a result; determining, using the one or more processing elements, if a verified result is stored in a secured storage location; in response to determining that the verified result is stored, retrieving the verified result from the secured storage location; in response to determining that no verified result is stored, determining, using the one or more processing elements, an authenticated version of a cryptographic value, the authenticated version of the cryptographic value being determined based on a signature computation and a second cryptographic computation that is an asymmetric cryptographic computation; and determining, using the one or more processing elements, if the result of the first cryptographic computation is verified based, at least in part, on a comparison of the result with the verified result or the authenticated version of the cryptographic value. ### Claim 2 (depends on 1) The method of claim 1 further comprising: storing the result in a secured storage location included in the secured execution environment in response to determining that the result is verified. ### Claim 3 (depends on 2) The method of claim 2, wherein the result of the first cryptographic computation is determined to be verified based on the result matching the authenticated version of the cryptographic value. ### Claim 4 (depends on 3) The method of claim 3, wherein the first cryptographic computation is a hash computation. ### Claim 5 (depends on 1) The method of claim 1, wherein the first cryptographic computation is performed in response to a triggering event. ### Claim 6 (depends on 5) The method of claim 5, wherein the triggering event comprises an initiation of a boot operation, and wherein the portion of code is boot code. ### Claim 7 (depends on 5) The method of claim 5, wherein the triggering event is a request for a transition of at least the one or more processing elements from a sleep mode of operation to a wake mode of operation. ### Claim 8 (depends on 7) The method of claim 7, wherein the determining of the authenticated version of the cryptographic value further comprises: retrieving, using the processor, the authenticated version of the cryptographic value from a secured storage location, wherein the secured storage location is a secured cache. ### Claim 9 (depends on 8) The method of claim 8, wherein the retrieving the authenticated version of the cryptographic value from the secured storage location is performed in response to identifying the request for the transition to the wake mode. ### Claim 10 A system comprising: a nonvolatile memory configured to store a portion of code; a secured cache comprising one or more secured storage regions; and one or more processing elements included in a processor implemented in a secured execution environment, the processor being configured to: perform a first cryptographic computation on a portion of code to generate a result; determine if a verified result is stored in a secured storage location; in response to determining that the verified result is stored, retrieve the verified result from the secured storage location; in response to determining that no verified result is stored, determine an authenticated version of a cryptographic value, the authenticated version of the cryptographic value being determined based on a signature computation and a second cryptographic computation that is an asymmetric cryptographic computation; and determine if the result of the first cryptographic computation is verified based, at least in part, on a comparison of the result with the verified result or the authenticated version of the cryptographic value. ### Claim 11 (depends on 10) The system of claim 10, wherein the processor is further configured to: store the result in the secured cache in response to determining that the result is verified. ### Claim 12 (depends on 11) The system of claim 11, wherein the result of the first cryptographic computation is determined to be verified based on the result matching the authenticated version of the cryptographic value, and wherein the first cryptographic computation is a hash computation. ### Claim 13 (depends on 10) The system of claim 10, wherein the first cryptographic computation is performed in response to a triggering event, wherein the triggering event comprises an initiation of a boot operation, and wherein the portion of code is boot code. ### Claim 14 (depends on 10) The system of claim 10, wherein the first cryptographic computation is performed in response to a triggering event, and wherein the triggering event is a request for a transition of at least the one or more processing elements from a sleep mode of operation to a wake mode of operation. ### Claim 15 (depends on 14) The system of claim 14, wherein the determining of the authenticated version of the cryptographic value further comprises: retrieving, using the processor, the authenticated version of the cryptographic value from a secured storage location in response to identifying the request for the transition to the wake mode, wherein the secured storage location is a secured cache. ### Claim 16 A device comprising: a secured cache comprising one or more secured storage regions; and one or more processing elements included in a processor implemented in a secured execution environment, the processor being configured to: perform a first cryptographic computation on a portion of code to generate a result; determine if a verified result is stored in a secured storage location; in response to determining that the verified result is stored, retrieve the verified result from the secured storage location; in response to determining that no verified result is stored, determine an authenticated version of a cryptographic value, the authenticated version of the cryptographic value being determined based on a signature computation and a second cryptographic computation that is an asymmetric cryptographic computation; and determine if the result of the first cryptographic computation is verified based, at least in part, on a comparison of the result with the verified result or the authenticated version of the cryptographic value. ### Claim 17 (depends on 16) The device of claim 16, wherein the processor is further configured to: store the result in the secured cache in response to determining that the result is verified, wherein the result of the first cryptographic computation is determined to be verified based on the result matching the authenticated version of the cryptographic value, and wherein the first cryptographic computation is a hash computation. ### Claim 18 (depends on 16) The device of claim 16, wherein the first cryptographic computation is performed in response to a triggering event, wherein the triggering event comprises an initiation of a boot operation, and wherein the portion of code is boot code. ### Claim 19 (depends on 16) The device of claim 16, wherein the first cryptographic computation is performed in response to a triggering event, and wherein the triggering event is a request for a transition of at least the one or more processing elements from a sleep mode of operation to a wake mode of operation. ### Claim 20 (depends on 19) The device of claim 19, wherein the determining of the authenticated version of the cryptographic value further comprises: retrieving, using the processor, the authenticated version of the cryptographic value from a secured storage location in response to identifying the request for the transition to the wake mode, wherein the secured storage location is a secured cache.