Storage device content authentication
Systems and methods that support storage device content authentication are provided. A system that verifies storage device content received from a storage device may comprise, for example, a security processor coupled to the storage device. The security processor may be adapted to receive a partitioned storage device region from the storage device. The partitioned storage device region may comprise, for example, regional content and first hashed regional content. The security processor may generate, for example, second hashed regional content by performing a hashing function on the regional content received by the security processor. The security processor may compare, for example, the first hashed regional content to the second hashed regional content. The security processor may verify the regional content received by the security processor if the first hashed regional content is the same as the second hashed regional content.
1. A method for verifying content, comprising:
partitioning storage device content into a plurality of storage device regions, each storage device region comprising a potential instruction region and a first region, the potential instruction region including executable instructions and data, the first region including a first hash of the potential instruction region;
receiving, by a security processor, a particular storage device region, the security processor comprising a memory;
generating a second hashed regional content by performing a single hashing function on the potential instruction region that includes the executable instructions of the particular storage device region received by the security processor;
comparing the first hash of the potential instruction region of the particular storage device region to the second hashed regional content;
executing, by a host processor that is part of a system on a chip, the executable instructions of the potential instruction region of the particular storage device region if the first hash of the potential instruction region of the particular storage device region is the same as the second hashed regional content; and
preventing access, by the host processor, to the potential instruction region of the particular storage device region received by the security processor if the first hash of the potential instruction region of the particular storage region is not the same as the second hashed regional content.
2. The method according to claim 1 , wherein the first hash of the potential instruction region of the particular storage device region comprises a first hash value, wherein the second hashed regional content comprises a second hash value, and wherein the first hash value is compared to the second hash value.
3. The method according to claim 1 , wherein the host processor, the security processor and a second memory that stores the storage device content are connected via one or more buses in a single device.
4. The method according to claim 1 , wherein the storage device content comprises at least one of the following: flash memory content, RAM content and SDRAM content.
5. The method according to claim 1 , further comprising cryptographically signing the particular storage device region.
6. The method according to claim 5 , wherein the cryptographically signing comprises applying at least one of a private key and a public key over the particular storage device region.
7. The method according to claim 5 , further comprising decrypting the cryptographically signed storage device region.
8. The method according to claim 7 , wherein the decrypting comprises applying at least one of a private key and a public key over the cryptographically signed storage device region.
9. The method according to claim 1 , wherein the generating comprises generating a second hashed regional content by performing a one-way hashing function on the potential instruction region of the particular storage device region received by the security processor.
10. The method according to claim 1 , wherein the generating comprises generating a second hashed regional content by performing a secure hash algorithm.
11. The method according to claim 1 , further comprising causing an exception if the first hash of the potential instruction region of the particular storage device region is not the same as the second hashed regional content.
12. The method according to claim 1 , further comprising setting a fail bit in a register if the first hash of the potential instruction region of the particular storage device region is not the same as the second hashed regional content.
13. The method according to claim 1 , further comprising repeatedly performing at least the generating, the comparing, the executing, and the preventing access.
14. The method according to claim 1 , further comprising performing the generating, the comparing, the executing, and the preventing access concurrently for at least two storage device regions.
15. The method according to claim 1 , further comprising repeatedly performing the generating, the comparing, the executing, and the preventing access concurrently for at least two storage device regions.
16. The method according to claim 1 , further comprising periodically performing the generating, the comparing, the executing, and the preventing access for respective storage device regions.
17. The method according to claim 1 , wherein the potential instruction region is defined inside a read only memory.
18. The method according to claim 1 , wherein the security processor comprises a public key engine or a random number generator.
19. The method according to claim 1 , wherein the security processor comprises a one-way hasher.
20. The method according to claim 1 , wherein an authentication algorithm executed by the security processor is stored in a read only memory.