Computing device, with data protection
View Patent ↗Computing device with a processing system including a plurality of user sub-systems, a plurality of user sub-system identifiers respectively identifying one user sub-system of the plurality of user sub-systems, a processor configured to run the processing system, a cryptography unit configured to provide at least one cryptographic mechanism, a cryptography unit secret key assigned to the cryptography unit, and a binder configured to bind the cryptography unit secret key to the user sub-system identifier of a currently running user sub-system.
1. A computing device, comprising:
a processing system comprising a plurality of user sub-systems, wherein the processing system is based on a micro-kernel system, and each user sub-system is located within a respective micro-kernel user compartment;
a plurality of user sub-system identifiers respectively identifying one user sub-system of the plurality of user sub-systems;
a processor configured to run the processing system;
a cryptography unit configured to provide at least one cryptographic mechanism;
a cryptography unit secret key assigned to the cryptography unit; and
a binder configured to bind the cryptography unit secret key to the user sub-system identifier of a currently running user sub-system to generate a user sub-system-specific cryptographic unit secret key,
wherein when a micro-kernel user compartment instructs the cryptography unit to provide a cryptographic mechanism, the cryptographic unit is configured to during this mechanism bind the cryptography unit secret key with the user sub-system identifier of the currently running user sub-system.
2. The computing device of claim 1 , wherein each micro-kernel user compartment comprises a software application, operating system software, or a combination of a software application and operating system software.
3. The computing device of claim 1 , wherein the cryptography unit is a hardware crypto engine.
4. The computing device of claim 1 , wherein the cryptography unit provides at least one cryptographic mechanism of a group of cryptographic mechanisms selected from the group consisting of authentication, encryption, digital signature, and cryptographic hash value generation.
5. The computing device of claim 3 , wherein the cryptography unit secret key is stored in the hardware crypto engine.
6. The computing device of claim 3 , wherein the user sub-system identifier of the currently running user sub-system is stored in the hardware crypto engine.
7. The computing device of claim 1 , further comprising at least one memory.
8. The computing device of claim 7 , wherein the user sub-system identifier of the currently user sub-system is stored in a portion of the memory that is accessible only by the cryptography unit.
9. The computing device of claim 1 , further comprising at least one memory interface configured to connect at least one external memory to the computing device.
10. The computing device of claim 1 , wherein the binder operates on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system to generate a user sub-system specific cryptography unit secret key.
11. The computing device of claim 10 , wherein the binder operates on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system according to a predefined logic function.
12. The computing device of claim 10 , wherein the binder operates on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system according to an Exclusive OR function.
13. A computing device, comprising:
a micro-kernel based processing system comprising a plurality of user sub-systems, wherein each user sub-system is located within a respective micro-kernel user compartment;
a plurality of user sub-system identifiers respectively identifying one user sub-system of the plurality of user sub-systems;
a processor configured to run the processing system;
a cryptography circuit configured to provide at least one cryptographic mechanism;
a cryptography circuit secret key assigned to the cryptography circuit; and
an operator configured to operate on the cryptography circuit secret key and the user sub-system identifier of a currently running user sub-system to generate a user sub-system specific cryptography circuit secret key,
wherein when a micro-kernel user compartment instructs the cryptography circuit to provide a cryptographic mechanism, the cryptographic unit binds the cryptography circuit secret key with the user sub-system identifier of the currently running user sub-system.
14. The computing device of claim 13 , wherein each micro-kernel user compartment comprises a software application, operating system software, or a combination of a software application and operating system software.
15. The computing device of claim 13 , wherein the cryptography circuit is a hardware crypto engine.
16. The computing device of claim 13 , wherein the cryptography circuit provides at least one cryptographic mechanism of a group of cryptographic mechanisms selected from the group consisting of authentication, encryption, digital signature, and cryptographic hash value generation.
17. The computing device of claim 15 , wherein the cryptography circuit secret key is stored in the hardware crypto engine.
18. The computing device of claim 15 , wherein the user sub-system identifier of the currently running user sub-system is stored in the hardware crypto engine.
19. The computing device of claim 13 , further comprising at least one memory.
20. The computing device of claim 19 , wherein the user sub-system identifier of the currently running user sub-system is stored in a portion of the memory that is accessible only by the cryptography circuit.
21. The computing device of claim 13 , further comprising at least one memory interface for connecting at least one external memory to the computing device.
22. The computing device of claim 13 , wherein the operator operates on the cryptography circuit secret key and the user sub-system identifier of the currently running user sub-system according to a predefined logic function.
23. The computing device of claim 22 , wherein the binder operates on the cryptography circuit secret key and the user sub-system identifier of the currently running user sub-system according to an Exclusive OR function.
24. A method for operating a computing device, comprising:
executing a user sub-system using a processing system comprising a plurality of user sub-systems, wherein the processing system is based on a micro-kernel system, and each user sub-system is located within a respective micro-kernel user compartment;
providing a plurality of user sub-system identifiers respectively identifying one user sub-system of the plurality of user sub-systems; and
executing a cryptography unit providing at least one cryptographic mechanism while executing the user sub-system, wherein the executing of the cryptography unit comprises binding the user sub-system identifier of a currently running user sub-system to a cryptography unit secret key being assigned to the cryptography unit to generate a user sub-system-specific cryptographic unit secret key,
wherein when a micro-kernel user compartment instructs the cryptography unit to provide a cryptographic mechanism, the cryptographic unit binds the cryptography unit secret key with the user sub-system identifier of the currently running user sub-system.
25. The method of claim 24 , wherein each micro-kernel user compartment comprises a software application, operating system software, or a combination of a software application and operating system software.
26. The method of claim 24 , wherein a hardware crypto engine is used as the cryptography unit.
27. The method of claim 24 , wherein the cryptography unit provides at least one cryptographic mechanism of a group of cryptographic mechanisms selected from the group consisting of authentication, encryption, digital signature, and cryptographic hash value generation.
28. The method of claim 26 , wherein the cryptography unit secret key is stored in the hardware crypto engine.
29. The method of claim 26 , wherein the user sub-system identifier of the currently running user sub-system is stored in the hardware crypto engine.
30. The method of claim 24 , wherein the user sub-system identifier of the currently running user sub-system is stored in a portion of a memory that is only accessible by the cryptography unit.
31. The method of claim 24 , wherein the binding is carried out by operating on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system to generate a context specific cryptography unit secret key.
32. The method of claim 31 , wherein the binding is carried out by operating on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system according to a predefined logic function.
33. The method of claim 31 , wherein the binding is carried out by operating on the cryptography unit secret key and the user sub-system identifier of the currently running user sub-system according to an Exclusive OR function.