Managing a fault condition by a security module
View Patent ↗A microcontroller is awakened from a lower power state in response to a trigger indication indicative of a fault condition. After the awakening, the microcontroller performs a security action with respect to secret information in the security module in response to the fault condition.
1. A method for managing a fault condition, comprising:
in response to detecting the fault condition, activating, by a monitoring circuit of a security module, a trigger indication;
awakening a microcontroller of the security module from a lower power state in response to the trigger indication, wherein the microcontroller has a storage to store secret information; and
performing, by the microcontroller after awakening from the lower power state, a security action with respect to the secret information in response to the fault condition, wherein performing the security action comprises:
determining whether the fault condition is a first type of fault condition or a second type of fault condition; and
in response to determining that the fault condition is the second type of fault condition, locking access to the secret information to prevent access to the secret information that remains stored in the storage of the microcontroller.
2. The method of claim 1 , further comprising:
transitioning the microcontroller to the lower power state in response to detecting that the security module is being powered by a battery but not an external power source.
3. The method of claim 1 , further comprising:
after performing the security action, transitioning the microcontroller to the lower power state.
4. The method of claim 1 , wherein performing the security action further comprises, in response to determining that the fault condition is the first type of fault condition, erasing the secret information from the storage of the microcontroller.
5. The method of claim 4 , wherein the first type of fault condition is a fatal fault condition.
6. The method of claim 5 , wherein the second type of fault condition is a non-fatal fault condition.
7. A method for managing a fault condition, comprising:
in response to detecting the fault condition, activating, by a monitoring circuit of a security module, a trigger indication;
awakening a microcontroller of the security module from a lower power state in response to the trigger indication, wherein the microcontroller has a storage to store secret information;
performing, by the microcontroller after awakening from the lower power state, a security action with respect to the secret information in response to the fault condition;
transitioning the microcontroller to the lower power state in response to detecting that the security module is being powered by a battery but not an external power source;
preventing input/output access of information in the microcontroller by a processor of the security module in response to detecting that the security module is powered by the battery but not the external power source; and
allowing input/output access of information in the microcontroller by the processor in response to detecting that the security module is powered by the external power source.
8. The method of claim 1 , further comprising:
repeatedly moving data values of the secret information to different locations in the storage to avoid imprinting of data in the storage.
9. The method of claim 8 , further comprising:
issuing, by a timer, timer trigger indications on a periodic basis,
wherein repeatedly moving the data values of the secret information is in response to the timer trigger indications.
10. A security module for managing a fault condition, comprising:
a monitoring circuit to monitor for the fault condition; and
a microcontroller having an active state and a lower power state, and a storage to store secret information, the microcontroller to:
awaken from the lower power state to the active state in response to a trigger indication from the monitoring circuit that indicates presence of the fault condition; and
perform a security action with respect to the secret information to handle the fault condition, wherein to perform the security action, the microcontroller is to:
determine whether the fault condition is a first type of fault condition or a second type of fault condition;
in response to determining that the fault condition is the first type of fault condition, erase the secret information from the storage of the microcontroller; and
in response to determining that the fault condition is the second type of fault condition, lock access to the secret information to prevent access to the secret information that remains stored in the storage of the microcontroller.
11. The security module of claim 10 , wherein the fault condition is at least one selected from among a condition indicative of tampering with the security module, a condition indicative of physical penetration through a cover of the security module, a temperature out-of-range condition, and a battery out-of-range condition.
12. The security module of claim 10 , further comprising a processor to request access of the secret information and to perform a security function using the secret information.
13. The security module of claim 12 , wherein the secret information is a cryptographic key, and the security function includes a cryptographic computation.
14. The security module of claim 10 , wherein the microcontroller is to perform a non-imprinting action to avoid data imprinting at the storage.
15. The security module of claim 14 , wherein the microcontroller is to repeatedly perform the non-imprinting action in response to trigger indications activated by corresponding expirations of a timer.
16. The security module of claim 10 , further comprising a battery, wherein the security module is powered by the battery when the security module is not powered by an external power source, and wherein the microcontroller is to:
transition from the active state to the lower power state in response to the microcontroller being idle and the security module being powered by the battery but not the external power source.
17. The security module of claim 10 , further comprising:
a battery; and
a processor separate from the microcontroller, wherein the microcontroller is to further:
prevent input/output access of information in the microcontroller by the processor in response to detecting that the security module is powered by the battery but not by an external power source that is external of the security module; and
allow input/output access of information in the microcontroller by the processor in response to detecting that the security module is powered by the external power source.
18. An article comprising at least one non-transitory machine-readable storage medium storing instructions for managing a fault condition, the instructions upon execution causing a microcontroller to:
awaken the microcontroller from a lower power state based on a trigger indication indicative of the fault condition of a security module; and
after the awakening, perform a security action with respect to secret information stored in a storage in the security module in response to the fault condition, wherein to perform the security action the instructions upon execution cause the microcontroller to:
determine whether the fault condition is a first type of fault condition or a second type of fault condition;
in response to determining that the fault condition is a first type of fault condition, erase the secret information from the storage; and
in response to determining that the fault condition is the second type of fault condition, block access to the secret information to prevent access to the secret information that remains stored in the storage.
19. The article of claim 18 , wherein the security module includes a battery and a processor separate from the microcontroller, wherein the instructions upon execution cause the microcontroller to further:
prevent input/output access of information in the microcontroller by the processor in response to detecting that the security module is powered by the battery but not an external power source that is external of the security module; and
allow input/output access of information in the microcontroller by the processor in response to detecting that the security module is powered by the external power source.