Device and method for securing software
View Patent ↗A device includes a first memory unit adapted to store encrypted instructions, a processor adapted to execute decrypted instructions, a second memory unit accessible by the processor, and a decryption unit. The device includes a key database and a key selection circuit, wherein the key selection circuit is adapted to select a selected decryption key from the key database for decrypting encrypted instructions. The selection is responsive to a fixed selection information stored within the integrated circuit and to received key selection information. A method includes a stage of receiving encrypted instructions; and executing decrypted instructions by a processor. The method includes receiving key selection information, selecting a selected decryption key out of a key database in response to fixed selection information and to the received key selection information, and decrypting encrypted instructions using the selected decryption key.
1. A device comprising:
a first memory unit adapted to store encrypted instructions;
a processor adapted to execute decrypted instructions;
a decryption unit;
a key database comprising a plurality of storage locations, each storage location storing a decryption key;
a selection register to store a selection value, a first portion of the selection value being fixed and user un-modifiable, and a second portion of the selection value to be provided by the user and stored at a volatile storage location, wherein the first portion includes at least one fixed and user un-modifiable bit of the selection value and the second portion includes at least one user provided bit of the selection value; and
a key selection circuit to select a first decryption key from the key database for decrypting encrypted instructions based upon the selection value stored at the selection register.
2. The device according to claim 1 further adapted to perform de-hashing of the encrypted instructions and in response to a result of the de-hashing determine whether to decrypt the encrypted instructions.
3. The device according to claim 1 , wherein the key selection circuit is adapted to limit an amount of receptions of the user provided portion of the selection value.
4. The device according to claim 1 , wherein the key selection circuit is adapted to allow one reception of the user provided portion of the selection value after being reset.
5. The device according to claim 1 , wherein the device is adapted to erase multiple entries of a second memory unit after reset.
6. The device according to claim 1 , wherein the processor retrieves information from an instruction cache and wherein the device is adapted to invalidate instruction cache entries after reset.
7. The device according to claim 1 , wherein the key selection circuit is adapted to select a default key until receiving the user provided portion of the selection value.
8. The device according to claim 1 , wherein during test mode a test circuit reads an entry of a second memory unit only after previously writing to the entry.
9. The device according to claim 1 , wherein the processor is adapted to execute only predefined instructions.
10. The device according to claim 1 , further comprising a test circuit adapted to selectively facilitate testing or debugging of the processor in response to a comparison between the selected decryption key and the received user provided portion of the selection value.
11. The device according to claim 1 , the processor is further adapted to prevent access to the key database and to the fixed and user un-modifiable portion of the selection value.
12. A method implemented at a processor device, the method comprising:
receiving encrypted instructions;
storing a user provided value at a second portion of a selection register, the selection register comprising a first portion that is fixed and user un-modifiable, and the second portion that is volatile memory location where the user provided value is stored, wherein a selection value stored at the selection register comprises the first portion, having at least one fixed un-modifiable bit, and the second portion having at least one user provided bit;
selecting by the processor device based upon the selection value, a first decryption key from a key database, the key database comprising a plurality of storage locations, each storage location storing a decryption key; and
decrypting encrypted instructions using the selected decryption key.
13. The method according to claim 12 further comprising de-hashing the encrypted instructions and jumping to the stage of decrypting in response to determining the de-hashing is successful.
14. The method according to claim 12 , further comprising limiting an amount of receptions of the user provided portion of the selection value.
15. The method according to claim 14 wherein the limiting comprises allowing a single reception of the user provided portion of the selection value after reset.
16. The method according to claim 12 , further comprising preventing access to decrypted instructions stored in a device before a reset event.
17. The method according to claim 16 wherein the preventing comprises invalidating instruction cache entries after reset.
18. The method according to claim 16 wherein the preventing comprises erasing memory unit entries.
19. The method according to claim 16 wherein the preventing comprises allowing a testing unit to read an entry of a memory unit only after the testing unit wrote to that entry.
20. The method according to claim 12 , further comprising providing a default key before receiving the user provided portion of the selection value.
21. The method according to claim 12 , further comprising executing only instructions from predefined locations.
22. The method according to claim 12 , further comprising selectively allowing testing or debugging in response to a relationship between the selected decryption key and the received user provided portion of the selection value.
23. The method according to claim 12 , further comprising preventing access to the key database and to the fixed and user un-modifiable portion of the selection value.