Secure processing unit systems and methods
A hardware Secure Processing Unit (SPU) is described that can perform both security functions and other information appliance functions using the same set of hardware resources. Because the additional hardware required to support security functions is a relatively small fraction of the overall device hardware, this type of SPU can be competitive with ordinary non-secure CPUs or microcontrollers that perform the same functions. A set of minimal initialization and management hardware and software is added to, e.g., a standard CPU/microcontroller. The additional hardware and/or software creates an SPU environment and performs the functions needed to virtualize the SPU's hardware resources so that they can be shared between security functions and other functions performed by the same CPU.
1. A secure processing unit, comprising:
a processor,
said processor capable of operating in a plurality of modes, at least one of said modes being a secure mode and at least one of said modes being a normal mode,
said processor comprising one or more processor security registers,
a first of said one or more processor security registers arranged to indicate whether or not the processor is operating in a secure mode;
secure internal memory,
said secure internal memory being secured by hardware such that it is accessible only by the processor when said first processor security register indicates that the processor is operating in secure mode,
said secure internal memory being divided into a plurality of regions, at least one of said plurality of regions containing logic for performing a process, and at least one of said plurality of regions being further restricted to accesses by the processor based on the values in a secure memory configuration register;
a secure memory configuration register;
logic to ensure that access to a restricted region of secure memory is only permitted when both:
(i) the first processor security register indicates that the processor is operating in a secure mode, and
(ii) the secure memory configuration register contains values indicating that the access is permitted; and
logic to ensure that the processor initializes in a secure state by default.
2. The secure processing unit of claim 1 , wherein the region containing logic for performing a process comprises instructions for performing a validation process.
3. The secure processing unit of claim 2 , wherein said instructions for performing a validation process includes an embedded validation key.
4. The secure processing unit of claim 1 , wherein the restricted region of secure memory comprises instructions for performing a field initialization process.
5. The secure processing unit of claim 1 , wherein the region containing logic for performing a process comprises instructions for execution by the processor, and the secure processing unit further includes logic that only permits the processor to begin executing said instructions at a securely configured entry point within the secure memory.