Clock integrity verification and protection in an integrated circuit (IC)
An integrated circuit (IC), including multiple functional units for performing operations of the integrated circuit, provides security of a clock configuration at least during security operations. The IC includes a clock management subsystem for providing one or more clock signals to the functional units. The clock management subsystem is reconfigurable to adjust characteristics of the clock signal(s) or to select from among multiple clock sources from which the clock management subsystem generates the clock signal(s). The IC also includes a security subsystem for performing security operations within the IC and coupled to the clock management system to prevent alteration of a configuration of the clock management subsystem while the security operations are performed. The clock management subsystem performs a clock integrity check in response to the security operations before the security operations are performed. The security operations are not performed if the clock integrity check fails.
1 . An integrated circuit, comprising:
a clock control circuit for providing one or more clock signals to digital circuits within the integrated circuit, wherein the clock control circuit is reconfigurable to adjust characteristics of the one or more clock signals or to select from among multiple clock sources from which the clock control circuit generates the one or more clock signals; and
a security processing circuit for performing security operations within the integrated circuit in response to commands to perform the security operations, wherein the security processing circuit is coupled to the clock control circuit to prevent alteration of a configuration of the clock control circuit while the security operations are performed, wherein the clock control circuit performs a clock integrity check in response to receiving the commands to perform the security operations by verifying that stored register values that select the configuration of the clock control circuit are set to valid values before the security operations are performed, wherein the security operations are not performed if the clock integrity check fails, and wherein the security processing circuit performs the security operations in response to the commands if the clock integrity check succeeds.
2 . The integrated circuit of claim 1 , wherein the configuration of the clock control circuit includes one or more of clock selection logic or clock divider/multiplier values.
3 . The integrated circuit of claim 1 , wherein the security processing circuit prevents alteration of the configuration of the clock control circuit by asserting a dynamic lock over one or more registers within the integrated circuit that hold the stored register values, according to an operating mode of the integrated circuit that indicates that one or more of the security operations are to be performed.
4 . The integrated circuit of claim 3 , wherein the clock integrity check includes a check of values that control one or more selectable clock frequencies of corresponding ones of the digital circuits, wherein the security operations include processing of a critical transfer operation for which a subset of the one or more selectable clock frequencies is permissible, wherein the security subsystem prevents writing of the stored register values that correspond to impermissible clock frequencies.
5 . The integrated circuit of claim 1 , wherein the security processing circuit further performs a check of a signature stored in association with a prior write to the stored register values, to verify that the configuration of the clock control circuit was set by a trusted device, and wherein the security operations are only performed if the check indicates that the configuration of the clock control circuit was set by the trusted device.
6 . The integrated circuit of claim 1 , wherein the clock integrity check confirms characteristics of a clock source from which the one or more clock signals are generated, and wherein the security processing circuit prevents performance of the security operations if the clock integrity check indicates that characteristics of the clock source are not acceptable.
7 . The integrated circuit of claim 5 , wherein the characteristics of the external clock source include one or more of a frequency of the external clock source, a minimum pulse width of the external clock source, an amplitude of the external clock source and a voltage offset of the external clock source.
8 . The integrated circuit of claim 6 , wherein the configuration of the control circuit includes selection of the clock source as between an external clock source and an internal clock source, and wherein the clock control circuit prevents selection of the external clock source while the security operations are being performed.
9 . The integrated circuit of claim 1 , wherein the integrated circuit is a camera control integrated circuit incorporating the bus interface controller, the clock control circuit, and the security processing circuit.
10 . The integrated circuit of claim 1 , wherein the clock control circuit performs one or more further clock integrity checks during performance of the security operations.
11 . A method of ensuring integrity of one or more clock signals in an integrated circuit during security operations, the method comprising:
providing one or more clock signals to digital circuits within the integrated circuit from a clock control circuit, wherein the clock control circuit is reconfigurable to adjust characteristics of the one or more clock signals or to select from among multiple clock sources from which the clock control circuit generates the one or more clock signals;
receiving commands to perform the security operations; and
responsive to receiving the commands, performing security operations within the integrated circuit, while preventing alteration of a configuration of the clock control circuit while the security operations are performed, and by performing a clock integrity check that stored register values that select the configuration of the clock control circuit are set to valid values in response to the receiving of the commands to perform the security operations before the security operations are performed, wherein the security operations are not performed if the clock integrity check fails, and wherein the security operations are performed in response to the commands if the clock integrity check succeeds.
12 . The method of claim 11 , wherein the configuration of the clock control circuit includes one or more of clock selection logic or clock divider/multiplier values.
13 . The method of claim 11 , wherein the preventing alteration of the configuration of the control circuit asserts a dynamic lock over one or more registers within the integrated circuit that hold the stored register values, according to an operating mode of the integrated circuit that indicates that one or more of the security operations are to be performed.
14 . The method of claim 13 , wherein the clock integrity check includes a check of values that control one or more selectable clock frequencies of corresponding ones of the digital circuits, wherein the security operations include processing of a critical transfer operation for which a subset of the one or more selectable clock frequencies is permissible, wherein the preventing alteration prevents writing of the stored register values that correspond to impermissible clock frequencies.
15 . The method of claim 11 , further comprising checking a signature stored in association with a prior write to the stored register values to verify that the configuration of the clock control circuit was set by a trusted device, and wherein the security operations are only performed if the check indicates that the configuration of the clock control circuit was set by the trusted device.
16 . The method of claim 11 , wherein the clock integrity check confirms characteristics of a clock source from which the one or more clock signals are generated, and responsive to the clock integrity check indicating that characteristics of the clock source are not acceptable, preventing performance of the security operations.
17 . The method of claim 16 , wherein the characteristics of the clock source include one or more of a frequency of the clock source, a minimum pulse width of the clock source, an amplitude of the clock source and a voltage offset of the clock source.
18 . The method of claim 16 , wherein the configuration of the clock control circuit includes selection of the clock source as between an external clock source and an internal clock source, and wherein the clock control circuit prevents selection of the external clock source while the security operations are being performed.
19 . The method of claim 11 , wherein the integrated circuit is a camera control integrated circuit incorporating the bus interface controller, the clock control circuit.
20 . The method of claim 11 , further comprising performing one or more further clock integrity checks during the performing of the security operations.