Devices and methods utilizing sensor information for increased trust level
Various embodiments may include methods and systems for providing security on a system-on-a-chip (SoC). A method may include receiving, from a service requesting environment by a secure subsystem, a request to perform a cryptographic function, in which the secure subsystem stores a condition for performing the requested cryptographic function. The method may further include receiving, by the secure subsystem, an input from a sensing circuit that includes at least one indication relevant to the condition for performing the requested cryptographic function, determining, by the secure subsystem, whether the input indicates that the condition for performing the requested cryptographic function is satisfied, and performing the requested cryptographic function using a cryptographic key stored in the secure subsystem in response to determining that the condition is satisfied.
1. A system-on-a-chip (SoC), comprising:
a secure subsystem storing a cryptographic key and configured to:
receive an input from a sensing circuit relevant to a condition for performing a cryptographic function using the cryptographic key, wherein the condition is associated with performance metrics of the sensing circuit;
receive a request to perform the cryptographic function from a service requesting environment, wherein the received request is distinct from the received input from the sensing circuit; and
perform the cryptographic function in response to receipt of the request to perform the cryptographic function and the received input indicating that the condition for performing the cryptographic function is satisfied.
2. The SoC of claim 1 , further comprising a sensing circuit configured to sense a condition relevant to one or more conditions for performing the cryptographic function, wherein the secure subsystem receives the input from the sensing circuit.
3. The SoC of claim 1 , wherein the secure subsystem is configured to receive the input from a sensing circuit that is separate from the SoC.
4. The SoC of claim 1 , wherein the secure subsystem is further configured to:
receive a request for the cryptographic function from a service requesting environment; and
perform the requested cryptographic function in response to the received input indicating that the condition for performing the requested cryptographic function is satisfied.
5. The SoC of claim 4 , wherein the secure subsystem is further configured to authorize usage of the cryptographic key corresponding to the cryptographic function to perform the requested cryptographic function in response to the received input indicating that the condition for performing the requested cryptographic function is satisfied.
6. The SoC of claim 1 , wherein the secure subsystem is configured to receive the input from the sensing circuit along a communication path that is independent from a service requesting environment.
7. The SoC of claim 1 , wherein the input includes a Boolean value indicating whether the condition for performing the cryptographic function is satisfied.
8. The SoC of claim 1 , wherein the input includes operating sensor information, and wherein the secure subsystem is configured to continuously receive the input from the sensing circuit.
9. The SoC of claim 1 , wherein the secure subsystem comprises one or both of:
a secure processing unit (SPU) configured to store the cryptographic key, and configured to receive the request to perform the cryptographic function from a service requesting environment; or
an SoC root-of-trust (RoT) configured to:
receive the input from the sensing circuit; and
receive the request to perform the cryptographic function from the service requesting environment.
10. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether a person is within a proximate range to physically operate a device, and the input includes an indication of a physical presence of the person within the proximate range to the device containing the SoC.
11. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether user physical characteristics match authorized user physical characteristics, and the input includes an indication of present user physical characteristics of a user of a device containing the SoC.
12. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether a device orientation is within acceptable thresholds, and the input includes an indication of the device orientation of a device including the SoC.
13. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether a device location is in an authorized location, and the input includes an indication of the device location of a device including the SoC.
14. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether a proximate device is an authorizing device, and the input includes an indication of the proximate device capable of connecting to a device including the SoC.
15. The SoC of claim 1 , wherein the condition for performing the cryptographic function is whether a communication network matches an authorized communication network, and the input includes an indication of the communication network detected by a device including the SoC.
16. A method for providing security in a system-on-a-chip (SoC), comprising:
receiving, from a service requesting environment by a secure subsystem, a request to perform a cryptographic function, wherein the secure subsystem stores a condition for performing the requested cryptographic function, wherein the condition is associated with performance metrics of a sensing circuit;
receiving, by the secure subsystem, an input from a sensing circuit that is distinct from the received request and includes at least one indication relevant to the condition for performing the requested cryptographic function;
determining, by the secure subsystem, whether the input indicates that the condition for performing the requested cryptographic function is satisfied; and
performing the requested cryptographic function using a cryptographic key stored in the secure subsystem in response to receipt of the request to perform the cryptographic function and determining that the received input indicates that the condition for performing the requested cryptographic function is satisfied.
17. The method of claim 16 , wherein receiving the input from the sensing circuit comprises the secure subsystem receiving the input from the sensing circuit along a communication path that is independent from the service requesting environment.
18. The method of claim 16 , wherein receiving the input from the sensing circuit comprises receiving a Boolean value indicating whether that the condition for performing the requested cryptographic function is satisfied.
19. The method of claim 16 , wherein the received input is operating sensor information, and wherein receiving the input from the sensing circuit comprises the secure subsystem continuously receiving the input from the sensing circuit.
20. The method of claim 16 , wherein performing the requested cryptographic function in response to determining that the received input indicates that the condition is satisfied comprises performing the cryptographic function by one of a secure processing unit (SPU) or an SoC root-of-trust (RoT) in response to determining that the condition is satisfied.
21. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether a person is within a proximate range to physically operate a device; and
determining whether the received input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the input includes an indication of a physical presence of the person within the proximate range to the device containing the SoC.
22. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether user physical characteristics match authorized user physical characteristics; and
determining whether the received input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the input includes an indication of present user physical characteristics of a user of a device containing the SoC.
23. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether a device orientation is within acceptable thresholds; and
determining whether the received input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the input includes an indication of the device orientation of a device including the SoC.
24. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether a device location is in an authorized location; and
determining whether the input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the received input includes an indication of the device location of a device including the SoC.
25. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether a proximate device is an authorizing device; and
determining whether the input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the received input includes an indication of the proximate device capable of connecting to a device including the SoC.
26. The method of claim 16 , wherein:
the condition for performing the cryptographic function is whether a communication network matches an authorized communication network; and
determining whether the input indicates that the condition for performing the requested cryptographic function is satisfied comprises determining whether the received input includes an indication of the communication network detected by a device including the SoC.
27. A system-on-a-chip (SoC), comprising:
a secure subsystem storing a cryptographic key and a condition for performing a cryptographic function, wherein the secure subsystem comprises:
means for receiving a request to perform the cryptographic function;
means for receiving an input from a sensing circuit that is distinct from the received request and includes at least one indication relevant to at least one condition for performing the cryptographic function, wherein the condition is associated with performance metrics of the sensing circuit;
means for determining whether the input indicates that the condition for performing the cryptographic function is satisfied; and
means for performing the cryptographic function in response to receipt of the request to perform the cryptographic function and determining that the received input indicates that the condition for performing the requested cryptographic function is satisfied.
28. The SoC of claim 27 , wherein means for receiving the input from the sensing circuit further comprises:
means for receiving the input from the sensing circuit along a communication path that is independent from a service requesting environment.
29. The SoC of claim 27 , wherein means for receiving the input from the sensing circuit comprises means for continuously receiving the input from an operating sensing circuit.
30. A non-transitory processor-readable medium having stored thereon processor-executable instructions configured to cause a processor within a secure subsystem of an integrated circuit to perform operations comprising:
receiving a request to perform a cryptographic function from a service requesting environment;
receiving an input from a sensing circuit that is distinct from the received request and includes at least one indication relevant to a condition for performing the cryptographic function, wherein the condition is associated with performance metrics of the sensing circuit;
determining whether the input indicates that the condition for performing the cryptographic function is satisfied; and
performing the cryptographic function in response to receipt of the request to perform the cryptographic function and determining that the received input indicates that the condition for performing the requested cryptographic function is satisfied.