System and method for securing executable code
View Patent ↗A system and method for the secure storage of executable code and the secure movement of such code from memory to a processor. The method includes the storage of an encrypted version of the code. The code is then decrypted and decompressed as necessary, before re-encryption in storage. The re-encrypted executable code is then written to external memory. As a cache line of executable code is required, a fetch is performed but intercepted. In the interception, the cache line is decrypted. The plain text cache line is then stored in an instruction cache associated with a processor.
1. A system for secure execution of processor instructions, the system comprising:
a first memory configured to store an encrypted instruction; and
a secure processor system coupled to said first memory and configured to receive the encrypted instruction, said secure processor system comprising:
a processor, and
a security controller configured to decrypt said encrypted instruction according to a decryption algorithm, wherein the decryption algorithm uses a first key as a key input to the decryption algorithm and an address corresponding to a location in said first memory of said encrypted instruction as an initialization vector input to the decryption algorithm.
2. The system of claim 1 , wherein the secure processor system further comprises:
an instruction cache coupled to said processor; and
a memory controller coupled to said instruction cache configured to fetch said encrypted instruction from said first memory.
3. The system of claim 2 , wherein the security controller is further configured to:
load said decrypted instruction into said instruction cache to be executed by said processor.
4. The system of claim 3 , wherein the secure processor system further comprises:
a cryptographic engine configured to use an advanced encryption standard (AES) algorithm.
5. The system of claim 4 , wherein said cryptographic engine is further configured to use an encryption cipher block chaining (CBC) mode of said AES algorithm to decrypt said encrypted instruction.
6. The system of claim 1 , wherein the secure processor system is further configured to receive an image having a block of encrypted executable code and an encrypted block of data.
7. The system of claim 6 , wherein the security controller is further configured to:
decrypt, using a second key, said block of encrypted executable code to obtain executable code,
decrypt said encrypted block of data by executing said executable code, wherein said encrypted block of data includes a plurality of instructions,
encrypt an instruction in said plurality of instructions using the first key, and
store said encrypted instruction in said first memory.
8. The system of claim 7 , wherein the security controller is further configured to encrypt said instruction using an advanced encryption standard (AES) algorithm in decryption mode.
9. The system of claim 6 , further comprising a second memory configured to store the image having the block of encrypted executable code and the encrypted block of data.
10. The system of claim 9 , wherein the second memory is flash memory.
11. The system of claim 10 , wherein said flash memory stores said image in a compressed form; and
said image is decompressed when transferred to the first memory during a boot process.
12. The system of claim 1 , wherein a time constraint can be associated with the first key.
13. A method, in a secure processor system, for secure execution of processor instructions, comprising:
intercepting, by a memory controller in the secure processor system, a request for an instruction to be executed by a processor;
retrieving an encrypted instruction, corresponding to the instruction, from a first memory;
decrypting, in a security controller in the secure processor system, the encrypted instruction using an encryption mode of an advanced encryption standard (AES) algorithm to obtain a resulting instruction, wherein a first key is used as a key for the AES algorithm and an address, corresponding to a location in the first memory of the encrypted instruction is used as an initialization vector input for the AES algorithm; and
loading the resulting instruction into an instruction cache in the secure processor system, wherein the resulting instruction is to be executed by the processor.
14. The method of claim 13 , further comprising:
prior to retrieving the encrypted instruction,
receiving, in the secure processor system, an image having a block of encrypted executable code and an encrypted block of data;
decrypting, in the security controller, the block of encrypted executable code to obtain first executable code using a second key;
decrypting the encrypted block of data, in the security controller, by executing the first executable code, wherein the block of data includes second executable code having a plurality of instructions; and
encrypting an instruction in the plurality of instructions using the first key.
15. The method of claim 14 , further comprising:
storing the encrypted instruction in the first memory.
16. The method of claim 15 , further comprising:
individually encrypting remaining instructions in the plurality of instructions using the first key; and
storing the remaining encrypted instructions in the first memory.
17. The method of claim 14 , wherein encrypting the instruction further comprising:
encrypting the instruction using the AES algorithm.
18. The method of claim 14 , wherein the image further comprises a segment of boot code, the method further comprising:
receiving, in the secure processor system, the segment of boot code; and
booting the processor using the segment of boot code.
19. The method of claim 13 , wherein retrieving the encrypted instruction comprises:
retrieving the encrypted instruction from an allowable address space with the first memory.