Forced execution of authenticated code
Described herein are systems and methods for providing hardware based security to software applications in a television receiver. The system can include a television receiver having a trusted hardware environment that includes a security processor and a standard environment that includes an application processor. The security processor can ensure that at least a portion of the software application executed by the application processor is secure. A portion of the software application code can be placed in an interrupt service routine memory space. During execution of the software application, the security processor can security check the portion of the software application in the interrupt service routine memory space, making it trusted code. The security processor can force the application processor to execute the trusted code by triggering an interrupt. Such forced execution can allow the security processor to not only ensure that code is trusted, but that it is executed.
1. A method, comprising:
executing, by an application processor in a television receiver, a software application comprising software application code, wherein a first portion of the software application code resides in an interrupt service routine memory space and execution of the first portion of the software application code generates a result, and wherein executing the software application comprises executing a second portion of the software application code;
security checking, by a security processor in the television receiver, the first portion of the software application code in the interrupt service routine memory space, wherein the security processor is not the application processor;
after security checking the first portion of the software application code, triggering, by the security processor, an interrupt to the application processor;
in response to the interrupt:
halting execution, by the application processor, of the second portion of the software application code,
executing, by the application processor, the first portion of the software application code in the interrupt service routine memory space,
after executing the first portion of the software application code in the interrupt service routine memory space, transmitting, by the application processor, the result to the security processor, and
after transmitting the result to the security processor, continuing execution, by the application processor, of the second portion of the software application code; and
performing, by the security processor, a security action if the security checking fails.
2. The method of claim 1 , wherein the security checking comprises:
generating, by the security processor, a hash of the first portion of the software application code in the interrupt service routine memory space;
obtaining, by the security processor, a reference hash;
decrypting, by the security processor, the reference hash with a public key;
comparing, by the security processor, the generated hash with the decrypted reference hash; and
determining, by the security processor, that the security check passed only if the generated hash matches the decrypted reference hash.
3. The method of claim 1 , wherein the security action is rebooting the television receiver.
4. The method of claim 1 , wherein the security action is terminating execution of the software application.
5. The method of claim 1 , further comprising:
comparing, by the security processor, the result with an expected result; and
performing, by the security processor, the security action if the result does not match the expected result.
6. The method of claim 1 , further comprising:
performing, by the security processor, the security action a threshold period of time after triggering the interrupt if the security processor does not receive the result from the application processor.
7. The method of claim 1 , wherein the interrupt is triggered by the security processor periodically.
8. The method of claim 1 , wherein the interrupt is triggered by the security processor randomly.
9. The method of claim 1 , wherein the security checking is performed continuously.
10. The method of claim 1 , further comprising:
in response to receiving the result, security checking, by the security processor, the first portion of the software application code in the interrupt service routine memory space again.
11. A television receiver, comprising:
a security processor;
an application processor;
a first memory storing instructions that, when executed by the application processor cause the application processor to:
execute a software application comprising software application code, wherein a first portion of the software application code resides in an interrupt service routine memory space and execution of the first portion of the software application code generates a result, and wherein executing the software application comprises executing a second portion of the software application code;
in response to an interrupt triggered by the security processor:
halt execution of the second portion of the software application code,
execute the first portion of the software application code in the interrupt service routine memory space;
after executing the first portion of the software application code in the interrupt service routine memory space, transmit the result to the security processor, and
after transmitting the result to the security processor, continue executing the second portion of the software application code; and
a second memory storing instructions that, when executed by the security processor, cause the security processor to:
security check the first portion of the software application code in the interrupt service routine memory space;
after security checking the first portion of the software application code, trigger the interrupt to the application processor; and
perform a security action if the security check fails.
12. The television receiver of claim 11 , wherein the instructions to security check the first portion of the software application code in the interrupt service routine memory space include instructions that, when executed by the security processor, cause the security processor to:
generate a hash of the first portion of the software application code in the interrupt service routine memory space;
obtaining a reference hash;
decrypting the reference hash with a public key;
compare the generated hash with the decrypted reference hash; and
determine that the security check passed only if the generated hash matches the decrypted reference hash.
13. The television receiver of claim 11 , wherein the security action is rebooting the television receiver.
14. The television receiver of claim 11 , wherein the security action is terminating execution of the software application.
15. The television receiver of claim 11 , wherein the second memory includes further instructions that, when executed by the security processor, cause the security processor to:
compare the result with an expected result; and
perform the security action if the result does not match the expected result.
16. The television receiver of claim 11 , wherein the second memory includes further instructions that, when executed by the security processor, cause the security processor to:
perform the security action a threshold period of time after triggering the interrupt if the security processor does not receive the result from the application processor.
17. The television receiver of claim 11 , wherein the interrupt is triggered periodically.
18. The television receiver of claim 11 , wherein the interrupt is triggered randomly.
19. The television receiver of claim 11 , wherein the security check is performed continuously.
20. The television receiver of claim 11 , wherein the second memory includes further instructions that, when executed by the security processor, cause the security processor to:
security check the first portion of the software application code in the interrupt service routine memory space in response to receiving the result from the application processor.