Collated multi-image check in system-on-chips

1. A method of authenticating executable images in a system-on-chip (SoC), the method comprising:

storing a plurality of executable images;

storing, as separate from the plurality of executable images, a signed image of hashes comprising: i) an image of hashes comprising a plurality of hashes corresponding to the plurality of executable images; and ii) a first signature of the image of hashes;

authenticating the signed image of hashes based on the first signature;

using a first hash of the plurality of hashes to authenticate a first executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature; and

using a second hash appended to the first executable image to authenticate the first executable image when the signed image of hashes does not pass the authentication based on the first signature.

2. The method of claim 1 , further comprising caching the plurality of hashes in secure memory when the signed image of hashes passes the authentication based on the first signature.

3. The method of claim 1 , further comprising using a third hash of the plurality of hashes to authenticate a second executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature.

4. The method of claim 1 , further comprising:

updating a second executable image of the plurality of executable images, while not updating the signed image of hashes;

determining the signed image of hashes does not pass the authentication based on the first signature; and

using hashes appended to each of the plurality of executable images to authenticate the plurality of executable images.

5. The method of claim 1 , further comprising:

updating the signed image of hashes based on an updated second executable image of the plurality of executable images, while not updating the second executable image;

computing a hash of the second executable image;

determining a third hash of the plurality of hashes corresponding to the second executable image does not match the computed hash; and

using a hash appended to the second executable image to authenticate the second executable image.

6. The method of claim 1 , further comprising storing a second signed image of hashes comprising: i) a second image of hashes comprising a second plurality of hashes corresponding to a second plurality of executable images; and ii) a second signature of the second image of hashes, wherein the second signature is generated with a different root certificate than the first signature; and authenticating the second signed image of hashes based on the second signature.

7. A system-on-chip (SoC) comprising:

an interface to a memory, the memory being configured to store:

a plurality of executable images; and

separate from the plurality of executable images, a signed image of hashes comprising: i) an image of hashes comprising a plurality of hashes corresponding to the plurality of executable images; and ii) a first signature of the image of hashes; and

at least one hardware processor configured to:

authenticate the signed image of hashes based on the first signature;

use a first hash of the plurality of hashes to authenticate a first executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature; and

use a second hash appended to the first executable image to authenticate the first executable image when the signed image of hashes does not pass the authentication based on the first signature.

8. The SoC of claim 7 , further comprising a secure memory, and wherein the at least one processor is further configured to cache the plurality of hashes in the secure memory when the signed image of hashes passes the authentication based on the first signature.

9. The SoC of claim 7 , wherein the at least one processor is further configured to use a third hash of the plurality of hashes to authenticate a second executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature.

10. The SoC of claim 7 , wherein the at least one processor is further configured to:

update a second executable image of the plurality of executable images, while not updating the signed image of hashes;

determine the signed image of hashes does not pass the authentication based on the first signature; and

use hashes appended to each of the plurality of executable images to authenticate the plurality of executable images.

11. The SoC of claim 7 , wherein the at least one processor is further configured to:

update the signed image of hashes based on an updated second executable image of the plurality of executable images, while not updating the second executable image;

compute a hash of the second executable image;

determine a third hash of the plurality of hashes corresponding to the second executable image does not match the computed hash; and

use a hash appended to the second executable image to authenticate the second executable image.

12. The SoC of claim 7 , wherein the memory is further configured to store a second signed image of hashes comprising: i) a second image of hashes comprising a second plurality of hashes corresponding to a second plurality of executable images; and ii) a second signature of the second image of hashes, wherein the second signature is generated with a different root certificate than the first signature, wherein the at least one processor is further configured to authenticate the second signed image of hashes based on the second signature.

13. A system-on-chip (SoC) comprising:

means for storing a plurality of executable images;

means for storing, as separate from the plurality of executable images, a signed image of hashes comprising: i) an image of hashes comprising a plurality of hashes corresponding to the plurality of executable images; and ii) a first signature of the image of hashes;

means for authenticating the signed image of hashes based on the first signature;

means for using a first hash of the plurality of hashes to authenticate a first executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature; and

means for using a second hash appended to the first executable image to authenticate the first executable image when the signed image of hashes does not pass the authentication based on the first signature.

14. The SoC of claim 13 , further comprising means for caching the plurality of hashes in secure memory when the signed image of hashes passes the authentication based on the first signature.

15. The SoC of claim 13 , further comprising means for using a third hash of the plurality of hashes to authenticate a second executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature.

16. The SoC of claim 13 , further comprising:

means for updating a second executable image of the plurality of executable images, while not updating the signed image of hashes;

means for determining the signed image of hashes does not pass the authentication based on the first signature; and

means for using hashes appended to each of the plurality of executable images to authenticate the plurality of executable images.

17. The SoC of claim 13 , further comprising:

means for updating the signed image of hashes based on an updated second executable image of the plurality of executable images, while not updating the second executable image;

means for computing a hash of the second executable image;

means for determining a third hash of the plurality of hashes corresponding to the second executable image does not match the computed hash; and

means for using a hash appended to the second executable image to authenticate the second executable image.

18. The SoC of claim 13 , further comprising means for storing a second signed image of hashes comprising: i) a second image of hashes comprising a second plurality of hashes corresponding to a second plurality of executable images; and ii) a second signature of the second image of hashes, wherein the second signature is generated with a different root certificate than the first signature; and means for authenticating the second signed image of hashes based on the second signature.

19. A non-transitory computer readable medium having instructions stored thereon that when executed by a system-on-chip (SoC) cause the SoC to perform a method of authenticating executable images in the SoC, the method comprising:

storing a plurality of executable images;

storing, as separate from the plurality of executable images, a signed image of hashes comprising: i) an image of hashes comprising a plurality of hashes corresponding to the plurality of executable images; and ii) a first signature of the image of hashes;

authenticating the signed image of hashes based on the first signature;

using a first hash of the plurality of hashes to authenticate a first executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature; and

using a second hash appended to the first executable image to authenticate the first executable image when the signed image of hashes does not pass the authentication based on the first signature.

20. The non-transitory computer readable medium of claim 19 , wherein the method further comprises caching the plurality of hashes in secure memory when the signed image of hashes passes the authentication based on the first signature.

21. The non-transitory computer readable medium of claim 19 , wherein the method further comprises using a third hash of the plurality of hashes to authenticate a second executable image of the plurality of executable images when the signed image of hashes passes the authentication based on the first signature.

22. The non-transitory computer readable medium of claim 19 , wherein the method further comprises:

updating a second executable image of the plurality of executable images, while not updating the signed image of hashes;

determining the signed image of hashes does not pass the authentication based on the first signature; and

using hashes appended to each of the plurality of executable images to authenticate the plurality of executable images.

23. The non-transitory computer readable medium of claim 19 , wherein the method further comprises:

updating the signed image of hashes based on an updated second executable image of the plurality of executable images, while not updating the second executable image;

computing a hash of the second executable image;

determining a third hash of the plurality of hashes corresponding to the second executable image does not match the computed hash; and

using a hash appended to the second executable image to authenticate the second executable image.

24. The non-transitory computer readable medium of claim 19 , wherein the method further comprises storing a second signed image of hashes comprising: i) a second image of hashes comprising a second plurality of hashes corresponding to a second plurality of executable images; and ii) a second signature of the second image of hashes, wherein the second signature is generated with a different root certificate than the first signature; and authenticating the second signed image of hashes based on the second signature.