System and method for securing executable code
AssigneeBroadcom Corporation
InventorMark Buer
Life of this patent
Estimating the term…
Abstract
A system and method for the secure storage of executable code and the secure movement of such code from memory to a processor. The method includes the storage of an encrypted version of the code. The code is then decrypted and decompressed as necessary, before re-encryption in storage. The re-encrypted executable code is then written to external memory. As a cache line of executable code is required, a fetch is performed but intercepted. In the interception, the cache line is decrypted. The plain text cache line is then stored in an instruction cache associated with a processor.
Claims8
A system for secure execution of processor instructions, the system comprising:
- a processor;
- an instruction cache in communication with said processor;
- a memory controller in communication with said instruction cache;
- and
- a security controller in communication with said instruction cache and configured to
- decrypt, using a first key, an encrypted first block of data comprising executable code,
- decrypt an encrypted second block of data by executing said executable code in said first block, and
- encrypt said second block on a per instruction basis,
- wherein said memory controller is configured to intercept fetches of instructions to be executed by said processor, and fetch an instruction of said second block encrypted on a per instruction basis;
- and
- wherein said security controller is further configured to decrypt said fetched instruction to obtain a resulting instruction, and load said resulting instruction into said instruction cache to be executed by said processor.
A system for secure execution of processor instructions, the system comprising:
- a first memory containing boot code and an image encrypted with a first key;
- a secure embedded processor system, comprising:
- a processor;
- an instruction cache in communication with said processor;
- a memory controller in communication with said instruction cache;
- and
- a security controller in communication with said instruction cache;
- and
- a second memory, external to said secure embedded processor system, in communication with said first memory, said memory controller, and said security controller,
- such that said image encrypted with said first key is transferred to said second memory, decrypted, and re-encrypted using a second key, and such that a cache line of said image encrypted with said second key is then read from said second memory, decrypted with said second key, and stored in said instruction cache for execution by said processor,
- wherein said security controller comprises:
- logic for re-encrypting said image using the Advanced Encryption Standard (AES) algorithm;
- and
- logic for decrypting said cache line using said AES algorithm;
- and
- wherein said logic for re-encrypting said image uses an address of said second memory as an initialization vector (IV) for said AES algorithm, wherein said address corresponds to the location in said second memory of said cache line;
- and
- said logic for decrypting said cache line uses said address as said IV.
Dependencies are inferred from the claim text.