Secure subsystem
An apparatus for performing secure operations with a dedicated secure processor is described in one embodiment. The apparatus includes security firmware defining secure operations, a processor configured to execute the security firmware and perform a set of operations limited to the secure operations, and a plurality of secure hardware registers, accessible by the processor and configured to receive instructions to perform the secure operations. An apparatus for performing secure operations with a plurality of security assist hardware circuits is described in another embodiment. The apparatus comprises one or more secure hardware registers configured to receive a command to perform secure operations and one or more security assist hardware circuits configured to perform discrete secure operations using one or more secret data objects.
1. An apparatus comprising:
a plurality of secure hardware registers configured to receive instructions to perform a plurality of secure operations for manipulating one or more secret data objects; and
one or more security assist hardware circuits configured to perform discrete operations using the one or more secret data objects, wherein each of the plurality of secure hardware registers corresponds to a different security assist hardware circuit, the discrete operations comprising at least one of data encryption, data decryption, signature calculation and checking, and random number generation.
2. The apparatus of claim 1 , further comprising:
a memory configured to store the one or more secret data objects; and
a processor to execute security firmware and perform a set of operations comprising the plurality of secure operations to manipulate the one or more secret data objects.
3. The apparatus of claim 1 , wherein the one or more secret data objects comprise at least one encryption key.
4. The apparatus of claim 1 , wherein the one or more secret data objects are inaccessible to devices outside the apparatus.
5. The apparatus of claim 1 , further comprising:
an encryption circuit configured to encrypt data using the one or more secret data objects; and
a decryption circuit configured to decrypt data using the one or more secret data objects.
6. The apparatus of claim 2 , wherein the processor is configured to execute the security firmware stored on the memory external to the apparatus.
7. The apparatus of claim 2 , wherein the processor, the plurality of secure hardware registers, and the one or more secret data objects are disposed within a secure boundary.
8. The apparatus of claim 7 , wherein the processor is configured to execute the security firmware stored on the memory within the secure boundary.
9. The apparatus of claim 2 , wherein the processor is configured to manipulate the one or more secret data objects based on a limited number of secure operations.
10. A method comprising:
receiving a request to execute a secure operation at one or more of a plurality of secure hardware registers; and
executing, with one of a plurality of security assist hardware circuits, the secure operation, the secure operation comprising at least one of random number generation, encryption key generation, signature calculation, signature verification, symmetric encryption, symmetric decryption, asymmetric encryption, and asymmetric decryption, wherein respective ones of the plurality of secure hardware registers corresponds to a different one of the plurality of security assist hardware circuits.
11. The method of claim 10 , wherein the request to execute the secure operation includes manipulating one or more secret data objects.
12. The method of claim 11 , wherein manipulating the one or more secret data objects occurs based on a defined number of secure operations.
13. The method of claim 10 , further comprising transmitting to an unsecure hardware register a value responsive to executing the secure operation, wherein the plurality of secure hardware registers, the one or more secret data objects, and a dedicated secure processor are located within a secure boundary.
14. The method of claim 13 , further comprising notifying the dedicated secure processor of the request to execute the secure operation.
15. The method of claim 13 , further comprising executing the secure operation based on dedicated security firmware stored on a memory within the secure boundary.
16. The method of claim 15 , wherein executing the secure operation comprises encrypting data using the one or more secret data objects.
17. The method of claim 16 , wherein executing the secure operation comprises storing the encrypted data in a storage device external to the secure boundary.
18. The method of claim 15 , wherein executing the secure operation comprises retrieving encrypted data from a storage device external to the secure boundary.
19. The method of claim 18 , wherein executing the secure operation comprises decrypting the encrypted data using the one or more secret data objects.
20. The method of claim 18 , wherein executing the secure operation comprises identifying one or more of the plurality of security assist hardware circuits configured to execute the secure operation.