Using hardware to secure areas of long term storage in CE devices
A system includes long-term storage (e.g., flash memory) for storing sensitive data and critical components of a consumer electronic (CE) device such as an operating system (OS) kernel, private cryptographic key values, security applications, and firmware configurations, for example. Security hardware/software designates and restricts access to secured portions of long-term storage that contain the critical components. Requests for access to these secured portions are addressed by the security hardware/software, which authenticates a cryptographic authorization code received with the request. Read-write access to the secured portions is allowed for download and installation of, for example, a software or firmware upgrade if the cryptographic authorization code is authenticated.
1. A system for securing long-term storage in an electronic device, the system comprising:
a partitioned memory including one or more areas of long-term storage, including at least one area of secured long-term storage and at least one area of unsecured long-term storage;
a memory management unit for managing at least the secured long-term storage area of the memory;
a security component for regulating access to at least the secured long-term storage area, the security component including:
a controller including a memory security application for receiving and authenticating a cryptographic authorization code that controls access to at least the secured long-term storage area, the controller being configured to:
generate an encryption value for an authorized provider by performing a fast cryptographic algorithm using an identifier of the authorized provider and a secret key of the electronic device;
combine an encryption value for the electronic device and the cryptographic authorization code to generate a result;
authenticate the cryptographic authorization code by comparing the result with the encryption value for the authorized provider; and
send instructions from the memory security application to the memory management unit to disable writing into at least the secured long-term storage area of the memory if the security application does not authenticate the cryptographic authorization code;
wherein the security component is implemented by dedicated circuitry.
2. A system according to claim 1 , wherein the memory management system operates in an address space, the secured long-term storage is accessed using a portion of the address space and the memory security application controls access to the portion of the address space.
3. A system according to claim 1 wherein the memory security application includes an authenticating process selected from a group consisting of a Triple Data Encryption Standard (3DES) algorithm, an Advanced Encryption Standard (AES) algorithm, a Rivest Shamir Adleman (RSA) algorithm and a Symmetric Algorithm Based Public Key Standard (S-PKS) algorithm.
4. A system according to claim 1 , wherein the security component further comprises a data security application including predetermined decryption algorithms for receiving, validating and saving the data.
5. A system according to claim 1 , wherein the secured long-term memory includes data selected from a group consisting of:
an operating system kernel;
the data and memory security applications;
one or more firmware configurations for reconfigurable hardware elements;
one or more secret key values; and one or more checksum, CRC and hash values of the data.
6. A system according to claim 1 , wherein the memory includes a further secured long-term storage area for storing one or more of:
one or more secret key values;
one or more checksum, CRC and hash values of data stored in the secured long-term storage;
a communications log;
and an installation log.
7. A system according to claim 6 , wherein the further secured long-term storage area is configured to be accessed only by the security component.
8. A system according to claim 1 , further comprising a temporary storage for storing, at least, received data waiting to be validated and saved to the secured long-term storage by the data security application.
9. A system according to claim 1 , further comprising a receiver for receiving data through a medium selected from a group consisting of: a wired network, a wireless network, a secure digital card, a portable storage device, an infrared channel, a satellite link, a fiber optic link, a cable link, and a digital subscriber line.
10. The system according to claim 1 , wherein the fast cryptographic algorithm is selected from a group consisting of a block cipher algorithm and a keyed one-way hash function.