Back to results
US 12,182,298 B2Granted
System and method for performing trusted computing with remote attestation and information isolation on heterogeneous processors over open interconnect
AssigneeFiduciaedge Technologies Co., Ltd.
InventorsJohn Kar-Kin Zao, Ching-Chun Huang, Ching-Yao Huang
Life of this patent
Estimating the term…
Abstract
A system and method, for the assurance of authenticity, confidentiality and integrity of the executed programs, the analytic models and the processed data used by heterogeneous processing units such as graphic processing units (GPU), neural processing units (NPU) and video processing units (VPU), etc. that are connected to the central processing unit (CPU) through standard open interconnects such as Ethernet, USB and SPI, etc.
Claims23
A system, comprising:
- a first device comprising:
- a first processing resource set in a protected region of a hardware platform, comprising a first dedicated processor and a first crypto processor and a first protected memory segment;
- and
- a second processing resource set in an unprotected region of the hardware platform, comprising a second dedicated processor and a second protected memory segment;
- wherein,
- a trustworthy special-purpose operating system is executed in a trusted execution environment (TEE) instantiated in the first processing resource set, wherein a first trustworthy special-purpose service program is running with the support of the trustworthy special-purpose operating system in the trusted execution environment (TEE);
- and
- a trustworthy general-purpose operating system is executed in a trusted rich execution environment (T-REE) instantiated in the second processing resource set, wherein a first trustworthy general-purpose application program is running in the trusted rich execution environment (T-REE) with the support of the trustworthy special-purpose operating system, wherein the trusted rich execution environment (T-REE) is instantiated as a virtual machine in the second processing resource set, wherein, in response to the trusted rich execution environment (T-REE) is idle or deactivated, the virtual machine in which the trusted rich execution environment (T-REE) was instantiated is terminated and the second processing resource set is released whereas the second dedicated processor becomes an undedicated processor and the second protected memory segment becomes a part of a unprotected memory.
5 more elements
A method comprising:
- establishing a trusted execution environment (TEE) comprising a trustworthy special-purpose operating system, instantiated in a first processing resource set in a protected region of a hardware platform in a first device, during a first secure boot initiated by a first crypto processor after a power-up or a system reset of the first device, wherein the first processing resource set comprises a first dedicated processor and a first protected memory segment and the first crypto processor;
- and
- establishing a trusted rich execution environment (T-REE) comprising a trustworthy general-purpose operating system, instantiated as a virtual machine in a second processing resource set in an unprotected region of the hardware platform in the first device, during a second secure boot after the successful first secure boot of the trusted execution environment (TEE) in the first processing resource set, wherein the second processing resource set comprises a second dedicated processor and a second protected memory segment, wherein the trusted rich execution environment (T-REE) is instantiated as a virtual machine in the second processing resource set, wherein, in response to the trusted rich execution environment (T-REE) is idle or deactivated, the virtual machine in which the trusted rich execution environment (T-REE) was instantiated is terminated and the second processing resource set is released whereas the second dedicated processor becomes an undedicated processor and the second protected memory segment becomes a part of a unprotected memory.
Dependencies are inferred from the claim text.