DE102023110485A1 - DETECTING AND RESPOND TO ENVIRONMENTAL SECURITY ATTACKS ON SEMICONDUCTOR PACKAGING - Google Patents

Abstract

A process includes generating an output value by a canary circuit of a semiconductor package. The semiconductor package includes a hardware root of trust engine for an electronic system. The process includes comparing the output value to an expected value by the canary circuit. The process includes the semiconductor package regulating a response of the semiconductor package to a reset request in response to a result of the comparison.

Description

BACKGROUND

A computer platform can be the subject of a security attack, e.g. B. to access information stored on the computer platform or to damage components of the computer platform. To prevent or at least limit the extent of potential damage from security attacks, the computing platform may have various levels of security. For example, the computing platform may have various mechanisms for restricting access, such as firewalls, passwords and keys. As another example, the computer platform may have a security processor. The security processor can provide a number of security-related functions to protect the computing platform against security attacks. A security-relevant function can, for example, be the secure storage of platform secrets. Another example of a security-relevant function can be the validation of firmware. Another example of a security-related function can be securing firmware updates. Other examples of security-related functions include cryptographic key generation, cryptographic key sealing, and cryptographic key unsealing.

BRIEF DESCRIPTION OF DRAWINGS

• 1 is a schematic diagram of a computing platform having a digital canary circuit and a reset controller for protecting a security processor of the computing platform against environmental security attacks, according to an example implementation.
• 2 is a schematic representation of a secure enclave of the security processor according to one embodiment.
• 3 is a block diagram of the reset controller according to an embodiment.
• 4 is a flowchart illustrating a process performed by the security processor to regulate a response of the security processor to a reset request, according to an example implementation.
• 5 shows a silicon root of trust engine (SRoT engine) of the security processor and illustrates the integration of a digital canary circuit into the SRoT engine according to an implementation example.
• 6 shows the spatial mixing of logic gates of the root-of-trust engine and logic gates of the canary circuit according to an implementation example.
• 7 shows a processing core of the security processor and illustrates the incorporation of a digital canary circuit into the processing core according to an implementation example.
• 8th shows the spatial mixing of logic gates of the processing core and logic gates of the canary circuit according to an implementation example.
• 9 is a block diagram of a digital canary circuit according to an implementation example.
• 10 is a flowchart of a process for detecting and responding to tampering activities according to an example implementation.
• 11 is a block diagram of a baseboard management controller (BMC) with a canary circuit for detecting tampering and a controller for taking a response action in response to a detected tampering, according to an example implementation.
• 12 is a block diagram of a computer platform having a canary circuit for detecting tampering and a reset controller for regulating a reset hold time in response to detected tampering, according to an example implementation.

DETAILED DESCRIPTION

A computing platform may include a security processor that may perform one or more security-related services for the computing platform. For example, a security processor may validate firmware instructions as part of the secure boot process of the computing platform. As a more specific example, a security processor may include a root of trust engine to validate firmware instructions associated with a cryptographic chain of trust in response to a reset or power-on of the computing platform. As further examples, a security processor may perform one or more of the following: storing measurement hashes, loading reference measurement hashes, storing cryptographic keys, retrieving cryptographic keys, generating cryptographic keys, retrieving a cryptographic platform identity, creating certificates, storing certificates, adding certificates, deleting certificates, sealing cryptographic keys, and unsealing cryptographic keys.

One possible method of attacking a computer platform is to manipulate an environmental condition of the platform's security processor such that the environmental condition is well outside the security processor's specifications for that condition. In this context, an "environmental condition" of a security processor refers to a parameter or characteristic of the operating state of the security processor that has an expected operating range and can be affected by a stimulus external to the security processor. For example, an environmental condition for a security processor may be the level of a supply voltage supplied to the security processor, the rate of a clock signal received by the security processor, the chip temperature of the security processor, the radiation level of the security processor, or the strength of an electromagnetic field to which the security processor is exposed. Deliberately manipulating an environmental condition of a security processor such that the environmental condition is outside the corresponding expected range is referred to herein as an "environmental condition-induced" security attack.

An example of an environmental security attack is that a security processor is supplied with a supply voltage that is greater than the maximum limit of the security processor's supply voltage. Another example is that the rate of a clock signal supplied to a security processor may be greater than the maximum clock frequency set for the security processor. Another example is that the ambient temperature for a security processor can be manipulated (e.g. a fan can be turned off, a heat sink can be removed, thermal energy can be added to the environment, or some other mechanism can be used to increase the ambient temperature increase) to cause the security processor chip temperature to exceed the maximum chip temperature specified for the security processor.

The goal of an environmental security attack on a security processor is to cause the security processor to malfunction or to cause one or more malfunctions, allowing an attacker to penetrate the otherwise closed system of the security processor. The malfunction can manifest itself in a number of ways. For example, a security processor malfunction can result in bit states being reversed, program instructions being corrupted, program execution behavior deviating from expected behavior, protected instructions being executed that should not be executed, execution of instructions that should not be bypassed being bypassed, firmware being validated that should not be validated, or the security processor generally exhibiting abnormal behavior. In other words, an environmental security attack can provide an attack path that bypasses the security processor's safeguards that would otherwise be in place if the security processor were functioning properly. Because an environmental security attack causes a security processor to operate outside of its design specifications, it is possible that the exact cause(s) of the malfunction are unknown and unpredictable.

According to embodiments, a security processor has one or more digital canary circuits to detect a security attack on the security processor caused by environmental conditions. As used herein, the term "canary circuit" refers to a circuit that malfunctions due to an environmental security attack and provides an observable indication when the malfunction occurs, such that the indication may also serve as an indicator of an environmental security attack. In accordance with some implementations, a canary circuit performs one or more cryptographic cipher transformations that produce an output based on a known input, and the output may be used as an indicator. In this way, a deviation of the canary circuit output from an expected output indicates a malfunction and indicates a security attack caused by the environmental conditions.

The canary circuit may have relatively complex logic (e.g., a chain of serially coupled AES cipher transformations) that is designed to fail at or near the time a protected component (e.g., a root-of-trust engine or a security processing core) of the security processor fails due to an attack caused by the environmental conditions. According to embodiments, the digital canary circuit provides a tamper indication in response to an output value generated by its complex logic that does not match an expected value. To ensure that the digital canary circuit is exposed to a similar environment as the component to be protected, the logic gates of the canary circuit ation is spatially mixed with the logic gates of the component to be protected, as described here. As further described here, the high sensitivity of the canary circuit to an environmental-related security attack enables a timely response to the manipulation.

Exposing a security processor to a security attack caused by environmental conditions, coupled with repeated resetting of the security processor, can increase the likelihood that the security attack will be successful. For example, the security processor may be part of a computer platform that has a secure boot process to ensure that authenticated firmware and software are running on the computer platform. During secure boot, the computing platform establishes a cryptographic chain of trust for the machine-readable instructions (e.g., firmware and software) executed by the computing platform. The chain of trust can begin with an initial link or a trust anchor, which represents the initial link or beginning of the chain of trust. In general, secure boot involves trusting each set of machine-readable instructions corresponding to each link in the trust chain and then loading and executing it to check whether the next set of machine-readable instructions corresponding to the next successor link is trusted before the next one Set can be loaded and executed.

Because a security processor can play a role in establishing a chain of trust for a computer platform, when components of the security processor are released from reset, each reset of the security processor is another opportunity for an induced malfunction of the security processor that provides an advantage to an attacker. For example, the security processor may include one or more components that form one or more links in a cryptographic chain of trust, and the malfunction of one or more such components may provide points of attack.

As a more specific example, a security processor may contain a root-of-trust engine that sets a trust anchor for a computing platform's chain of trust when the root-of-trust engine is released from reset. For example, a malfunction of the security processor at or near the time that the root of trust engine is released from the reset phase could result in a malicious set of initial firmware instructions being falsely authenticated ( i.e. classified as trustworthy). As another example, firmware executed by a processing core of a security processor may be trusted, but the processing core may, after being reset, falsely authenticate a malicious set of firmware instructions corresponding to the next link in the chain of trust. As another example, the initial firmware set may be trustworthy, but the processing core, after being released from the reset phase, may not correctly perform the initial error and/or security checks or generally exhibit unexpected execution behavior.

According to the examples described herein, a semiconductor package includes a reset controller that controls or regulates the reset behavior of the semiconductor package. According to the example implementations, controlling or regulating the “reset response” of the semiconductor package refers to the amount of time the semiconductor package is held in the reset state by the reset controller. In other words, according to example implementations, the reset controller controls or regulates a “reset hold time,” which is the continuous time between the start of the reset and the end of the reset (also referred to as the release of the reset). Control of the reset hold time by the reset controller can be used to effectively throttle or limit the rate at which the semiconductor package can be reset, and this throttling can be imposed and/or increased when tampering with the semiconductor package is detected.

In general, the reset controller controls the response of the semiconductor package to a "reset request". In this context, a "reset request" refers to an indication provided or generated to reset one or more components of the semiconductor package. For example, a reset request may be triggered by an electrical reset signal. Many different components, both inside the semiconductor package and outside the semiconductor package, can cause the reset signal to be activated. For example, a power monitoring circuit outside the semiconductor package can trigger the reset signal. Another example is an internal watchdog timer of the semiconductor package that triggers the reset signal when the timer expires. Another example is that an internal circuit can activate the reset signal in response to a specific bit being written to a control register.

The reset signal may have a first state (e.g., an activated state, such as a logic zero state) to reset the semiconductor package (or request initiation of the reset), and a second state (e.g., deactivated state, such as a logical on state) to release the semiconductor package from reset. In accordance with example implementations, the reset controller receives an input reset signal (e.g., the reset signal activated to provide the reset request) and provides an output reset signal to the reset terminal(s) of one or more components of the semiconductor package. The reset control regulates the reset hold time, that is, the delay between the time when the reset control activates the output reset signal (to begin the reset) and the time when the output reset signal deactivates the output reset signal (to enable the reset).

According to embodiments, the reset controller may regulate the reset hold time independently of the reset hold time, which may be indicated by the input reset signal. In other words, although the reset controller initiates reset in response to activation of the input reset signal, the reset enable of the reset controller may be independent of the time that the input reset signal is no longer activated.

In accordance with example implementations, the reset controller regulates the reset hold time (i.e., it regulates the reset response time of the semiconductor package) based on whether or not one of the canary circuits of the semiconductor package has detected tamper activity. For example, in accordance with example implementations, the reset controller may first specify a first smaller reset hold time (e.g., specify a reset hold time that corresponds to the reset hold time of the input reset signal, or specify a predefined minimum reset hold time), and the reset controller can increase the reset hold time in response to a canary circuit indicating detection of tampering activity.

According to embodiments, the reset controller may regulate the reset hold time in response to detection of tamper activity that is not due to detection of an environmental security attack by a canary circuit. In this context, detection of "tamper activity" refers to detection or identification of a signature of one or more events, where this signature matches a signature (a temporal pattern of events, an attribute of an event, a particular sequence of events) of a security attack.

As examples of tampering activity that is not due to an environmental security attack, tampering activity can be detected when a switch sensor indicates that the computing platform (e.g., a blade server) is ejected from an enclosure (e.g., a rack ) has been removed, or if a switch sensor indicates that a computer platform cover has been opened. As further examples, tampering activities can be detected when the level of the supply voltage exceeds a certain maximum limit, when the input clock rate exceeds a certain maximum rate or when the chip temperature exceeds a certain maximum temperature.

The semiconductor package may initiate and/or perform one or more actions in response to detected tampering activity, which may go beyond changing the package's reset response, to counteract, report, and/or mitigate the detected tampering activity. For example, a shutdown of the semiconductor package may be initiated in response to detected tampering activity. As another example, the semiconductor package may log detection of tampering activity. As another example, the semiconductor package may send or initiate sending an alert (e.g., sending a message or other notification to a system administrator) in response to detected tampering activity. As another example, the semiconductor package may delete secrets stored in secure storage in response to detected tampering activity.

As in 1 As a more specific example, in accordance with some implementations, a computing platform 100 includes a semiconductor package 153 that includes one or more digital canary circuits 134 (referred to herein as “canary circuits 134”) and a reset controller 135. As described herein, in accordance with example implementations, the canary circuits 134 may be placed near or integrated with components of the security processor 130 to protect against environmental security attacks. These components may include, for example, a silicon root of trust SRoT engine 143, a security processing core 142, and/or other components. component of the security processor 130. The reset controller 135 controls or regulates a reset response of the security processor 130, and in accordance with example implementations, the reset controller 135 changes the reset response in response to detected tampering activity, such as tampering activity detected by a canary circuit 134. According to embodiments, the reset controller 135 regulates a reset hold time for the semiconductor package 153 depending on whether tampering of the semiconductor package 153 has been detected.

The semiconductor package 153 can be any number of different semiconductor packages, such as. B. a surface mount package, a through-hole package, a ball grid array package, a small outline package, a chip-scale package, or other container that contains one or more semiconductor chips 157.

In addition to detecting tampering activity by a canary circuit 134, a dedicated semiconductor package tampering detecting circuit may detect tampering activity in some embodiments. Additionally, in some embodiments, tampering activity may be detected by the reset controller 135. For example, in some embodiments, the reset controller 135 monitors a timing pattern of reset requests for the semiconductor package 153 to determine whether the timing rate of reset requests exceeds a predefined threshold (indicating the detection of tampering activity). The semiconductor package 153 may, in response to a detected tampering activity, initiate and/or perform one or more response actions to counteract the tampering activity, report the tampering activity, and/or mitigate the effects resulting from the tampering activity, according to example implementations.

The reset regulator 135 and the canary circuit(s) 134 may be part of a number of different semiconductor packages depending on the particular implementation. As in 1 For example, as shown, the semiconductor package 153 may contain a security processor 130, and a reset controller 135 and one or more canary circuits 134 may be part of the security processor 130. For example, the security processor 130 can be manufactured on one or more semiconductor chips 157 of the semiconductor package 153. As used herein, a “security processor” refers to a hardware component of an electronic device, such as computing platform 100, that performs one or more security-related services for the electronic device.

In further embodiments, a semiconductor package may include a reset governor 135 and one or more canary circuits 134; however, the semiconductor package may not include a security processor. For example, according to some implementations, a central processing unit (CPU) semiconductor package (or "socket") may include a reset governor 135, one or more canary circuits 134, and one or more processing cores (e.g., CPU cores), and the CPU semiconductor package may not include a security processor. As another example, according to further implementations, a semiconductor package may include a reset governor 135 and one or more canary circuits 134, but the semiconductor package may not include any processing cores or a security processor.

The security processor 130 may take various forms depending on the particular implementation. For example, according to some implementations, the security processor 130 may correspond to a standalone security-specific semiconductor package that includes a hardware root of trust, validates a firmware image for a computing platform, and controls the boot of the computing platform based on a result of that validation. As another example, according to some implementations, the security processor 130 may be a trusted platform module (TPM). As another example, according to some implementations, the security processor 130 may be a co-processor of a CPU semiconductor package having multiple CPU cores (or "sockets").

At the in 1 In the example implementation shown, the security processor 130 is part of a management controller, e.g. B. a BMC 129.

As used herein, a "BMC" or "Baseboard Management Controller" is a specialized service processor that monitors the physical state of a server or other hardware using sensors and communicates with a management system over a management network. The baseboard management controller can also communicate with applications running at the operating system level through an Input/Output Controller (IOCTL) interface driver, a REST application program interface (API), or another system software proxy that facilitates communication between the baseboard management controller and applications. The baseboard management controller can be at the hardware level Access hardware devices located in a server chassis, including system memory. The baseboard management controller may be able to modify the hardware devices directly. The baseboard management controller can operate independently of the operating system of the system in which the baseboard management controller is located. A baseboard management controller can be located on the motherboard or motherboard of the server or other device being monitored.

The fact that a baseboard management controller is mounted on a motherboard of the managed server/hardware or is otherwise connected or attached to the managed server/hardware does not prevent the baseboard management controller from being considered "separate" from the server/hardware. As used herein, a baseboard management controller has management functions for subsystems of a computing device and is separate from a processing resource that executes an operating system of a computing device. The baseboard management controller is separate from a processor, such as a central processing unit, that executes a high-level operating system or hypervisor on a system.

The computing platform 100 is, according to embodiments, a modular unit that includes a frame or chassis. Furthermore, this modular unit may include hardware mounted on the chassis that is capable of executing machine-readable instructions. A blade server is an example of a computing platform 100 as used in some implementations. The computing platform 100 may take a number of different other forms, such as a rack-mounted server, a standalone server, a client, a desktop, a smartphone, a portable computer, a network component, a gateway, a network switch, a storage array, a portable electronic device, a wearable computer, a tablet computer, a thin client, a laptop computer, a television, a modular switch, a consumer electronics device, an appliance, an edge processing system, a sensor system, a watch, a removable peripheral card, or generally any other processor-based platform, in accordance with further implementations.

In accordance with example implementations, computing platform 100 may be connected to a network fabric 161. Network fabric 161 may be connected to one or more types of communications networks, such as (as examples) Fibre Channel networks, Compute Express Link (CXL) fabrics, dedicated management networks, local area networks (LANs), wide area networks (WANs), global networks (e.g., the Internet), wireless networks, or any combination thereof.

In accordance with example implementations, the BMC 129 may execute a set of firmware instructions referred to as a "firmware management stack" to perform a variety of management-related functions for a host 101 of the computing platform 100. For example, the BMC 129 may provide management-related functions such as operating system runtime services, resource discovery and initialization, and pre-operating system services. The management-related functions may also include remote management functions. For example, the remote management functions may include keyboard video mouse (KVM) functions, virtual power functions (e.g., remotely activated functions for remotely setting a power state, such as a sleep state, a power-on state, a reset state, or a power-off state), virtual media management functions, and one or more other management-related functions for the host 101.

A “host” (or “host instance”) is associated with an instance of the operating system 113 (e.g., a Linux or Windows operating system instance) and is provided by a corresponding set of resources of the computing platform 100. At the in 1 In the example implementation shown, the resources for a host 101 may include one or more main CPU cores 102 (e.g., CPU processing cores, semiconductors with CPU processor cores) and memory devices connected to the CPU core(s) 102 are to form a system memory 104. The CPU core(s) 102 may be coupled to one or more input/output bridges 106 that facilitate communication between the CPU core(s) 102 and the BMC 129, as well as communication with various I/Os. A devices enable, e.g. B. with storage drives 122, one or more network interface controllers (NICs) 124, one or more USB (Universal Serial Bus) devices 126, I/O devices, a video controller, and so on. In addition, the computer platform 100, as also shown in 1 shown include one or more Peripheral Component Interconnect Express (PCIe) devices 110 (e.g., PCIe expansion cards), which may be connected to the CPU core(s) 102 via corresponding individual PCIe buses 108. According to another example implementation, the PCIe devices 110 may be coupled to the I/O bridge(s) 106 the, rather than being coupled to the CPU core(s) 102. In still other implementations, the I/O bridge(s) 106 and the PCIe interfaces may be part of the CPU core(s) 102.

In accordance with some implementations, the computing platform 100 may include multiple hosts 101 (e.g., each host 101 may correspond to an associated CPU multicore package (or "socket")). The BMC 129 may provide management-related services and security-related services for each host 101.

In general, the memory devices that make up the system memory 104, as well as other memories and storage media described herein, may be formed from non-transitory memory devices such as semiconductor memory devices, flash memory devices, memristors, phase change memory devices, a combination of one or more of the aforementioned memory technologies, etc. In addition, the memory devices may be volatile memory devices (e.g., dynamic random access memory (DRAM), static random access memory (SRAM), etc.) or non-volatile memory devices (e.g., flash memory, read-only memory (ROM), etc.), except herein stated otherwise.

In accordance with some implementations, one or more NICs 124 may be intelligent input/output peripherals or “intelligent I/O peripherals” that provide backend I/O services to one or more applications 115 (or application instances) that be executed on the computer platform 100. In accordance with some implementations, one or more of the PCIe devices 110 may be intelligent I/O peripherals.

In accordance with example implementations, the BMC 129 includes one or more main management processor cores 154 (referred to herein as “main processing cores 154”) that execute machine-readable instructions to perform management functions for a host 101 as part of the management plane of the BMC. These instructions may correspond to a BMC 129 firmware management stack. The main processing core(s) 154 executes the firmware management stack to enable the BMC 129 to perform a variety of management functions for the host 101, such as: Such as monitoring sensors, monitoring operating system status, monitoring power status, logging computer system events, providing a remote console, providing remote functions and other virtual presence technologies, and other management activities. In accordance with example implementations, the BMC 129 may communicate with a remote management server 190 via a NIC 158 of the BMC 129. In accordance with other implementations, the BMC 129 may communicate with the remote management server 190 via a NIC 124.

In addition to providing management functions for the host(s) 101, the BMC 129 may provide security-related features that protect the host(s) 101 from security attacks. In particular, in accordance with example implementations, the security layer of the BMC includes a secure enclave 140. In this context, a “secure enclave” refers to a subsystem of the BMC 129 for which access into and out of the subsystem is tightly controlled. As further described herein, in accordance with example implementations, the secure enclave 140 may include, among its other features, the reset controller 135, one or more canary circuits 134, a secure memory 144, and the security processing core 142.

According to example implementations, the secure enclave 140 performs cryptographic functions for the host(s) 101 and is located entirely within a cryptographic boundary. A "cryptographic boundary" in this context refers to a continuous boundary or perimeter that contains the logical and physical components of a cryptographic subsystem, such as BMC components, that make up the secure enclave 140.

The secure enclave 140 of the BMC 129 is isolated from the management plane of the BMC (and other non-secure components of the BMC 129 that are external to the secure enclave 140) in accordance with example implementations. According to example implementations, the secure enclave 140 includes a hardware or silicon RoT (referred to herein as "SRoT") that may be provided via the SRoT engine 143.

In particular, in accordance with example implementations, the secure enclave 140 stores an immutable fingerprint that is used by the SRoT engine 143 to validate an initial portion of the firmware 170 (ie, verify the trustworthiness of the initial portion) before that initial portion of the firmware 170 is executed. In accordance with example implementations, in response to powering up or resetting the BMC 129, the BMC 129 maintains its main processing core(s) 154 in reset, and the BMC 129 maintains the security processing core 142 of the secure enclave 140 in reset. As reaction upon power-on/reset, the SRoT engine 143 validates an initial portion of the firmware 170 and then loads it into a memory 151 of the secure enclave 140 so that that portion of firmware is now trusted. The BMC 129 then releases the security processing core 142 from reset to allow the security processing core 142 to boot and execute the loaded firmware instructions.

By executing the firmware instructions, the security processing core 142 may then validate another portion of the firmware 170 corresponding to a portion of the BMC's management firmware stack, and after validation, load that portion of the firmware stack into a memory 155 of the BMC 129. The portion of the management firmware stack may then be executed by the BMC's main processing core(s) 154 (when released from reset), causing the main processing core(s) 154 to load additional portions of the firmware 170 and place the loaded portions in a memory 164. Accessing the memory 164 may include additional training and initialization steps (e.g., training and initialization steps specified in the DDR4 specification). These instructions may be executed by the validated portion of the BMC's firmware management stack in the memory 155. In accordance with example implementations, secure enclave 140 may lock memory 155 to prevent changes or tampering with the validated firmware sections stored in memory 155.

Therefore, according to example implementations, a cryptographic chain of trust anchored in the SRoT of the BMC may be extended from the SRoT to the firmware management stack executed by the main processing cores 154 of the BMC. Furthermore, according to example implementations, the firmware management stack executed by the main processing core(s) 154 may validate host system firmware, such as Unified Extensible Firmware Interface (UEFI) 111 firmware, thereby extending the chain of trust to the host system firmware.

In accordance with example implementations, the BMC 129 is designed to prevent a particular domain or entity of the BMC 129 from powering on or coming out of reset until the secure enclave 140 validates the domain/entity. Additionally, in accordance with example implementations, the BMC 129 may prevent components of the BMC 129 from accessing resources of the BMC 129 and resources of the computing platform 100 until the secure enclave 140 has approved/validated the resources. The BMC 129 may perform bus filtering and monitoring (e.g., bus filtering and monitoring for a Serial Peripheral Interface (SPI) bus, a System Management Bus (SMB) bus, an Inter-Integrated Component (I ² C) bus, an Improved I ³ C (I ² C) bus, etc.) to prevent unwanted access to bus devices. For example, the BMC 129 may perform bus filtering and monitoring for a bus 167 (e.g., an SPI bus) that is connected to a non-volatile memory 168 in which the firmware 170 is stored.

In accordance with example implementations, the reset regulator 135 may be fabricated on the same semiconductor chip 157 as the secure enclave 140. As described herein, according to example implementations, although the security processor 130 has a staggered reset in which the security processing core 142 and the SRoT engine 143 are brought into reset at the same time, the security processing core 142 and the SRoT engine 143 come out of the reset at different times Approved. In this way, according to example implementations, the SRoT engine 143 is first released from reset (while the security processing core 142 is kept in reset) to validate the initial portion of the firmware 170. In accordance with example implementations, the SRoT engine 143 releases the security processing core 142 from default after the SRoT engine validates and then loads the initial portion of the firmware 170 into memory 151 for execution of the processing core. Consistent with example implementations, the reset hold time (which is controlled by the reset controller 135) controls the time that the SRoT engine 143 is held in reset. By setting a controllable reset hold time for the reset state, the reset controller 135 can throttle or limit reset requests to limit the rate at which the security processor 130 can be reset.

In accordance with some implementations, the reset controller 135 regulates the duration of the reset hold time depending on whether or not tampering activity has been detected. For example, in accordance with example implementations, the reset controller 135 may set a first, smaller reset hold time when a tamper detection history (e.g., a history represented by non-volatile memory bits) does not indicate a previous tamper detection, and the reset controller 135 may increase the reset hold time in response to detected tamper activity. In accordance with some implementations, an indication of tamper activity may be the result of a sensor of a tamper detection circuit. of the security processor 130 that detects an environmental condition (e.g., the rate exceeding a threshold defining a supply voltage, a clock rate, or a chip temperature) that exceeds a certain range for the environmental condition. In accordance with implementation examples, a canary circuit 134 of the security processor 130 may detect an environmental condition-related security attack and provide a corresponding tamper detection indication.

In accordance with some implementations, the reset controller 135 may detect tampering activities based on the timing pattern of reset requests provided to the security processor 130. For example, in some implementations, the reset controller 135 may detect tampering activity when the rate of reset requests exceeds a predefined threshold (e.g., when the rate exceeds a threshold that defines a maximum number N of reset requests within a time period T).

As in 2 As shown, the secure enclave 140 may be a complete system-on-chip (SOC) and located within a tightly controlled cryptographic boundary 204. In general, the components of the secure enclave 140 may communicate via a bus infrastructure 205. In accordance with example implementations, the bus infrastructure 205 may include features such as a data bus, a control bus, an address bus, a system bus, one or more buses, one or more bridges, etc.

The security processing core 142 may include an instruction cache 209 and a data cache 211. The volatile memory 151 may be, for example, a static random access memory (SRAM) and may store data representing measurements of the trusted computing base (TCB), such as one or more PCR banks. The secure memory 144 may be, for example, a non-volatile RAM (NVRAM). The secure enclave 140 may include registers 240. The registers 240 may be software registers, hardware registers, or a combination of hardware and software registers, depending on the particular implementation. For example, in some implementations, the registers 240 include cryptographically secure registers, such as software PCRs. In addition, according to example implementations, the registers 240 may include operational registers, such as hardware registers that provide control, status, and configuration functions for the secure enclave 140.

The secure enclave 140, in accordance with example implementations, includes a secure bridge 214 that controls access to the secure enclave 140 (ie, establishes a firewall for the secure enclave 140) over a secure connection 218. The connection 218 may be, for example, a bus 218 (e.g. an SPI bus) or an internal connection structure, such as. B. an Advanced Microcontroller Bus Architecture (AMBA) structure or an Advanced eXtensible Interface (AXI) structure. The secure bridge 214 may provide an additional upstream interface to allow the secure enclave 140 to “reach” the connection 218. The secure enclave 140 may use the upstream interface to obtain its firmware and generally validate the firmware 170 ( 1 ). The secure bridge 214 may employ filtering and monitoring on the connection line 218 to prevent unauthorized access to the memory 151. In accordance with example implementations, the management plane of the BMC 129 may communicate with the secure enclave 140 through the execution of one or more security service programming interfaces (APIs).

As also in 2 , in accordance with example implementations, secure enclave 140 may include tamper detection circuitry 234. Tamper detection circuitry 234 receives one or more environmental signals 236 (e.g., sensor signals representing a chip temperature, clock rate, supply voltage magnitude, package open status, removal status, etc.) that tamper detection circuitry 234 may use to detect tampering, in accordance with example implementations. For example, tamper detection circuitry 234 may compare a value (e.g., a supply voltage) represented by a particular environmental signal 236 to a threshold (e.g., a maximum threshold for the supply voltage) to determine whether tampering activity is detected. As another example, the tamper detection circuit 234 may determine whether a particular environmental signal 236 (e.g., a switch status indicating whether a chassis cover has been opened) has a condition indicating that a cover of the computer platform 100 has been opened.

The tamper detection circuit 234 may, in accordance with example implementations, monitor tamper indication signals 237 provided by canary circuits 134 of the secure enclave 140 to determine whether environmental tamper activity has been detected by one of the canary circuits 134. Additionally, in accordance with some implementations, the tamper detection circuit 234 may receive an indication of detected tamper activity from the reset controller 135 via one or more communication lines 274 (e.g., an indication that the reset controller 135 has detected that the time rate of reset requests exceeds a predefined threshold).

In accordance with some implementations, the tamper detection circuit 234 may monitor a reset indicator 283 (e.g., a bit stored in non-volatile memory) connected to a real time clock (RTC) 280 to detect tamper activity associated with the RTC 280. In this manner, as further described herein, the RTC device 280 may be used by the reset controller 135 to measure the reset hold time, in accordance with example implementations. The RTC device 280 may be connected to a backup battery 285 (e.g., a "coin" battery), and when the backup battery 285 is removed, volatile memories of the RTC device 280 may be erased, thereby causing the RTC device 280 is reset.

For example, according to some implementations, the reset governor 135 may use an alarm timer of the RTC device 280 such that the RTC device 280 generates an indication (e.g., asserts an interrupt signal) when the timer reaches a time that the reset governor 135 writes to a register of the RTC device 280. The reset governor 135 may use the indication provided by the RTC device 280 to trigger the release of a reset (i.e., set the duration of the reset hold time). However, when the RTC device 280 is reset, the reset hold time may also be effectively reset, thus thwarting the imposition of a longer reset hold time, which may be advantageous to an attacker.

In accordance with example implementations, removal of the backup battery 281 may be detected, and in response to this detection, the state of the reset indicator 283 may be set to a value indicating that the RTC device 280 has been reset. For example, a circuit may detect removal of the backup battery 285 by storing data in non-volatile memory representing one or more register values (e.g., data representing a current date or other value) of the RTC device 280 and periodically comparing the corresponding current register value(s) to the stored value(s) to see if the current register value(s) has regressed in time. In accordance with some implementations, the RTC device 280 may detect its reset and set the reset indicator 283 to indicate the reset. In accordance with further implementations, the tamper detection circuit 234 may control the setting of the reset indicator 283. It is noted that, although in 2 the RTC device 280 is shown outside of the secure enclave 140, in accordance with further implementations, the RTC device 280 may be part of the secure enclave 140. In accordance with some implementations, the RTC device 280 may be one of a plurality of timers 254 of the secure enclave 140.

In accordance with example implementations, when tampering is detected by tamper detection circuit 234, tamper detection circuit 234 may initiate and/or perform one or more actions to respond to the detected tamper activity. For example, tamper detection circuit 234 may communicate with bus infrastructure 205 via communication lines 290 to initiate one or more response actions to counteract the tamper activity, report the tamper activity, and/or mitigate the effects of the tamper activity. As another example, tamper detection circuit 234 may communicate with reset controller 135 via one or more communication lines 274 to cause reset controller 135 to increase the reset hold time. As another example, tamper detection circuit 234 may cause secure enclave 140 to remove sensitive information (e.g., delete certain secrets stored in secure storage 144); transmit a signal or message to alert an external component (e.g., a main processing core 154, the operating system 113 ( 1 ), the remote management server 190 ( 1 ) or another entity) of the tampering activity; reset the main processing core(s) 154; or perform one or more other response actions to counteract the tampering activity, report the tampering activity, and/or mitigate the effects of the tampering activity.

In accordance with some implementations, the reset controller 135 may have an output 282 that provides an output reset signal. The output 282 can be connected to a reset connection 203 of the SRoT motor 143 be coupled so that the reset controller 135 can activate an output reset signal to put the SRoT motor 143 into the reset state and can deactivate the output reset signal to release the SRoT motor 143 from the reset state. As in 2 As shown, in accordance with example implementations, reset controller 135 includes an input 207 that receives an input reset signal that may indicate a reset request 201. A specific reset request 201 can e.g. B. can be generated by activating the input reset signal (e.g. bringing it to a logic zero level). According to embodiments, in response to activation of the input reset signal, the reset controller 135 asserts its output reset signal to place the SRoT motor 143 into the reset state. Without the presence of the reset controller 135 (ie, when the input and output reset signals are equal), the SRoT motor 143 is powered down by resetting the input reset signal (e.g., by allowing the input reset signal to return to a logic one level ) released from the reset state.

According to some implementations, the reset controller 135 releases the SRoT motor 143 from reset (e.g., clears the output reset signal) when the input reset signal is cleared, or in a relatively short time thereafter if no tamper activity is detected. However, if tampering activity is detected, the reset controller 135 releases the SRoT motor 143 from reset with a relatively longer delay (e.g., the reset controller 135 specifies a longer reset hold time), as shown in examples.

Among other features, the secure enclave 140 may, in accordance with some implementations, as in 2 shown, may include a cryptographic processing engine 270 that encrypts data written to the secure storage 144 and decrypts data read from the secure storage 144. Depending on the particular implementation, the encryption and decryption may use an Advanced Encryption Standard-XOR-Encrypt-XOR-Based Tweaked-Codebook Mode with Ciphertext Stealing (or "AES-XTS") block cipher or another block cipher.

The secure enclave 140 may include cryptographic accelerators 244, such as symmetric and asymmetric cryptographic accelerators, in accordance with example implementations that assist the security processing core 142 in operations such as key generation, signature validation, encryption, decryption, etc. In addition, the cryptographic accelerators 244 may include a true random number generator to provide a trusted source of entropy for cryptographic operations.

In accordance with example implementations, the secure enclave 140 may include one-time programmable (OTP) fuses 258 that store data representing truly immutable attributes, such as a Secure Hash Algorithm 2 (SHA-2) silicon root of trust signature (e.g., the immutable fingerprint used by the SRoT engine 143), a unique identifier (e.g., an identifier used to place a platform identity certificate), a security clearance fingerprint, and so on. The secure enclave 140 may also include other components that, as one of skill in the art may appreciate, may be present in a processor-based architecture, such as timers 254, an interrupt controller 250 (which receives interrupt trigger pulses from the timers 254 and other sources), and so on.

In addition, the secure enclave 140 may include interfaces to support the initial development and troubleshooting of the secure enclave 140 (in the pre-production mode of the secure enclave 140), but which may be completely disabled or may have modified functions (for the production mode of the secure enclave 140). if certain fuses (e.g. certain OTP fuses 258) are blown. These interfaces may include, for example, a Universal Asynchronous Receiver/Transmitter (UART) 262, which may be used for troubleshooting and development of the secure enclave 140 and then secured to a transmit-only configuration for the production mode of the secure enclave 140. For example, according to some implementations, the UART 262 may be configured by the OTP fuses 258 to unilaterally provide status information from the secure enclave 140 in production mode to the secure enclave 140. As another example, in accordance with other implementations, the OTP fuses 258 may disable the UART 262 for production mode so that all communication with the UART 262 is disabled to prevent any communication across the cryptographic boundary 204. As another example of an interface that may assist in initial development and troubleshooting of the secure enclave 140, but may be modified/disabled for production mode, the secure enclave 140 may include a Joint Test Action Group (JTAG) interface (not shown ) for the security processor included; and this JTAG interface can be disabled for secure enclave 140 production mode.

In 3 A subsystem 300 of the secure enclave 140 is shown that controls the response of the secure enclave 140 to reset requests 201 in accordance with example implementations. As in 3 As shown, according to example implementations, the subsystem 300 includes the reset controller 135 and the RTC device 280. According to example implementations, the reset controller 135 receives reset requests 201 from one or more reset request sources 350. A particular reset request source 350 may be external or internal to the security processor 130 ( 1 ).

A source for the reset request 350 may be, for example, a power monitoring circuit. As another example, according to some implementations, a reset request source 350 may be circuitry that generates a reset request 201 in response to the security processing core 142 ( 2 ) writes into a reset bit of a control register. As another example, a reset request source 350 may be a watchdog timer in accordance with some implementations. A reset request source 350 may potentially be associated with a malicious entity to generate reset requests 201 as part of a security attack. A reset request source 350 may include circuitry of the security processor 130 ( 1 ), of BMC 129 ( 1 ) or the computer platform 100 ( 1 ), but can be manipulated by a malicious organization to generate reset requests 201 as part of a security attack.

As in 3 As shown, in accordance with some implementations, the reset regulator 135 includes a reset delay circuit 310 and a controller 304. The reset enable delay circuit 310 passes the assertion of the input reset signal (received at input 207) to the output reset signal (provided at output 282), in accordance with example implementations. In other words, in accordance with example implementations, the reset enable delay circuit 310 enforces little to no delay in the assertion of the output reset signal after the input reset signal is asserted. According to embodiments, the edge of the input reset signal associated with the activation (e.g., the negative going edge) triggers the reset controller 135 to measure a reset hold time, ie, to measure the time that elapses before the reset controller 135 releases the output reset signal again to enable the reset.

More specifically, in accordance with some implementations, in response to the activation of the input reset signal, the controller 304 writes data representing a time value to an alarm timer register 360 of the RTC device 280. The time value represents a future RTC time offset from the current RTC time by the reset hold time. The RTC device 280 thus measures the reset hold time and generates an indication (e.g., an interrupt signal) to indicate that the reset hold time has expired. The reset enable delay circuit 310 waits for the RTC device 280 to generate the indication representing the measurement of the reset hold time, in accordance with example implementations. In response to the RTC device 280 producing the indication, the reset enable delay circuit 310 asserts the output reset signal at output 282 to enable the reset.

The controller 304 may, in accordance with example implementations, regulate the reset hold time (and therefore write the corresponding value to the alarm time register) depending on whether tampering activity has been detected. For example, if no tampering activity has been detected, the controller 304 may write data to the alarm register of the RTC device 280 representing a time offset corresponding to a minimum reset hold time. If tampering activity has been detected, the controller 304 may write data to the alarm register of the RTC device 280 representing a predefined longer reset hold time offset from the current time.

In accordance with some implementations, the controller 304 may regulate the reset hold time based on the type of tampering detected. For example, in response to an environmental security attack, the controller 304 may prescribe a longer reset hold time than a reset hold time prescribed for other types of tampering activities. Moreover, in accordance with some implementations, the controller 304 may adjust the reset hold time upward for certain types of tampering (e.g., an environmental security attack) but not for other types of tampering (e.g., a detected cover opening).

In accordance with some implementations, the controller 304 may set more than two reset hold times. In addition, the controller 304 may set the reset hold time based on a history of detection of tampering activities. For example, the controller 304 may set a first reset hold time in response to an initial detection of tampering activity, and the controller may set a second reset hold time, greater than the first reset hold time, in response to a subsequent detection of tampering activity.

The controller 304 may reset the tamper history from the perspective of the reset controller 135 in accordance with some implementations. For example, the controller 304 may store a history of tamper activity detection for the reset controller 135 in non-volatile memory, regulate the reset hold time based on this history, and clear the history of tamper activity detection after a predetermined time in which no tamper activity (relevant to the reset controller 135) has been detected. In accordance with further implementations, the controller 304 clears the history of tamper activity detection regardless of the time that has passed since the last tamper detection.

According to example implementations, controller 304 may consist of one or more hardware processing cores that execute machine-executable instructions to perform the functions of reset controller 135 described herein. In accordance with further implementations, all or a portion of reset controller 135 may be executed by dedicated hardware (e.g., logic gates) that performs one or more functions for reset controller 135 without executing machine-executable instructions. As such, this hardware may be an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), etc., depending on the particular implementation.

According to some implementations, the reset delay circuit 310 may consist of logic, e.g. B. from combinational logic gates and flip-flops. According to further implementations, the operation of the reset delay circuit 310 may not depend on an RTC device. For example, according to some implementations, the reset enable delay circuit 310 may measure the reset hold time using a chain of serially coupled delay elements, and the controller 304 may control the number of delay elements in the chain to regulate the reset hold time. As another example, the reset enable delay element may include a timer circuit or other delay element for measuring the reset hold time, in accordance with other implementations.

In 4 An example process 400 is shown which is executed by the security processor 130 ( 1 ) to control the reset response of the safety processor according to example implementations. The process 400 may involve a number of components of the safety processor 130, such as the reset controller 135 ( 2 and 3 ), the tamper detection circuit 234 ( 2 ), the canary circuit(s) 134 ( 2 ) and the RTC device 280 ( 2 ), as described here.

According to 4 In accordance with example implementations, the process 400 begins at power-on and includes determining (as per decision block 408) whether the tamper detection circuitry has detected new tampering activity and, if so, taking one or more response actions (as depicted at 412) in response to the tampering activity Manipulation activity. In particular, performing the response actions 412 in accordance with example implementations may include increasing the reset hold time in accordance with block 416 and logging detection of tamper activity in accordance with block 420. In addition, as also in 4 shown, in accordance with some implementations, performing the response actions 412 may include initiating (block 424) an alarm notification (e.g., notifying a management processing core 154 of the BMC 129 or notifying the remote management server 190 ( 1 ) about the detection of manipulation activity).

The process 400 further includes determining, at decision block 430, whether the timing pattern of recent reset indications indicates tampering activity. If so, control passes to block 412 to take appropriate action, in accordance with example implementations. Otherwise, if no new tampering activity has been detected, the process 400 includes determining (decision block 438) whether a predefined criterion or criteria for restoring an initial reset hold time (e.g., a predefined minimum reset hold time) has been met, in accordance with process 400. As an example, after a predetermined period of time has elapsed, in accordance with some implementations, the process 400 may include the reset controller restores an initial reset hold time (block 439).

According to example implementations, one or more canary circuits may be located near the respective components of a security processor to be protected. For example, in some implementations, one canary circuit may be located near an SRoT engine and another canary circuit may be located near a security processing core of the security processor.

According to further implementations, components of the component to be protected may be spatially mixed with components of the associated canary circuit. For example, in some implementations, components of a canary circuit may be spatially mixed with components of an SRoT engine. As in 5 , in some embodiments, the SRoT engine 143 may include SRoT logic elements 508. As used herein, a “logic element” refers to a circuit formed from a series of logic gates. As shown in 5 As shown, a logic element 508 may include one or more logic gates 520 (herein referred to as "SRoT logic gates 520"). For example, an SRoT logic gate 520 may be a combinational logic gate such as an AND gate, an OR gate, a NAND gate, a NOT gate, a NOR gate, an XOR gate, or generally a device that applies a Boolean algebra expression to one or more Boolean inputs to provide a Boolean output in accordance with the Boolean algebra expression. For example, an SRoT logic element 508 may be a flip-flop, a register, a counter, a timer, a delay circuit, a comparison circuit, a circuit for implementing a state of a state machine, or generally a set of logic gates that perform a function for the SRoT system 143.

The SRoT motor 143 may further include canary logic elements 512 of a canary circuit. Each canary logic element 512 may include one or more logic gates 516 (referred to herein as “canary logic gates 516”), which may be combinatorial logic gates. A canary logic element 512 may, for example, be a flip-flop, a register, a counter, a timer, a delay circuit, a comparison circuit, a circuit for implementing a state of a state machine, a circuit for performing an encryption cipher (e.g. an AES -cipher blocks) or generally a group of logic gates that perform a function for the canary circuit.

As with reference number 514 in 5 As shown, the canary logic gates 516 may be spatially intermingled with the SRoT logic gates 520 in accordance with example implementations. In this context, “spatial mixing” of logic gates 516 and 520 refers to the arrangement of logic gates 516 and 520 in an area of a semiconductor chip such that in the area, logic gates 516 and 520 are along a first path that is parallel to a first dimensional axis runs, are mixed and the logic gates 516 and 520 are also mixed along a second path that runs parallel to a second dimensional axis that is orthogonal to the first dimensional axis. Due to the spatial mixing of the canary logic gates 516 with the SRoT logic gates 520, the canary logic gates 516 experience all or more of the same environmental conditions as the SRoT gates 520. Therefore, a canary circuit formed from the canary logic gates 516 can Accurately detect environmental conditions of the SRoT engine 143 and quickly provide an indication of a security attack triggered by the environmental conditions that affects the SRoT engine 143.

In 6 An example of a semiconductor chip area 600 is shown according to an example implementation. In accordance with some implementations, the semiconductor chip region 600 corresponds to a region of a semiconductor chip 157 ( 1 ), in which the SRoT module 143 is partially or completely manufactured. It is noted that the SRoT module 143 can also be manufactured in one or more other areas of the semiconductor chip 157.

As in 6 As shown, the semiconductor chip region 600 extends laterally across a semiconductor chip along the X and Y dimensions, which correspond to an X-axis 602 and a Y-axis 601, respectively. The semiconductor chip has a Z thickness that corresponds to a Z axis 603. The Z axis 603 extends in a direction that is aligned with the surface normal of the wafer from which the chip comes.

At the in 6 In the example shown, the spatial mixing occurs along both the X and Y dimensions. More specifically, in the region 600, SRoT logic gates 520 (e.g. SRoT logic gates 520-1, 520-2, 520-3 and 520-4) and canary logic gates 516 (e.g. canary logic gates 516- 1, 516-3 and 516-3) along a first path 650 which runs parallel to the Y-axis 601. Also in area 604 are SRoT logic gates 520 (e.g. SRoT logic gates 520-3, 520-5 and 520-6) and canary logic gates 516 (e.g. canary logic gates 516-1, 516-2, 516-4 and 516-5) along a second path 654 together guided, which runs parallel to the X-axis 602 (which runs orthogonally to the Y-axis 601).

In this example implementation, the canary logic gates 516 and the SRoT logic gates 520 may be spatially mixed through the use of a layout design tool used to place the transistors, metal interconnects, and other features of the semiconductor chip. For example, user input to the layout design tool may set the boundaries of a first X-Y window for the canary logic gates 516 and further the boundaries of a second X-Y window for the SRoT logic gates 520 that at least partially overlaps with the first X-Y window. For example, the first X-Y window may be specified for a cell corresponding to a canary circuit and the second X-Y window may be specified for a cell corresponding to an SRoT engine. The layout design tool can place the transistors, interconnects and other features of the canary circuit and the SRoT engine on the semiconductor chip according to the first and second X-Y windows according to the placement rules and generate a file with data describing the layout.

As another example, in accordance with some implementations, user input may be provided to a layout design tool to specify specific positions for the canary logic gates 516 and the SRoT logic gates 520 in a manner that spatially converges the gates 516 and 520 along one or more dimensions of the semiconductor chip. As another example, in accordance with some implementations, user input may be provided to a layout design tool to specify specific positions for transistors of the canary logic gates 516 and SRoT logic gates 520 in a manner that spatially converges the transistors (and therefore the gates 516 and 520) along one or more dimensions of the semiconductor chip.

In accordance with other implementations, the spatial mixing of the canary logic gates 516 and SRoT gates 520 may extend along the Z axis 603.

Another example: In some embodiments, components of a canary circuit may be spatially intermingled with components of a security processing core. As in 7 As shown, security processing core 142 may include processing core logic elements 724, according to some implementations, and as shown in 7 As shown, a logic element 724 may include one or more logic gates 740 (herein referred to as “processing core gates 740”), which may be combinatorial logic gates. A logic element 724 of the processing core may be, for example, a flip-flop, a register, a counter, a timer, a delay circuit, a comparison circuit, a circuit for implementing a state of a state machine, or generally a group of logic gates that have a Execute function for security processing core 142. According to one embodiment, a particular logic element 724 of the processing core may form, in whole or in part, an arithmetic logic unit, a control unit, a cache, a register, an execution unit, an instruction fetch unit, a memory management unit, or another component of the security processing unit 142.

As in 7 , the security processing core 142 may further include canary logic elements 512, and each canary logic element 512 may include one or more canary logic gates 516. As indicated by reference number 714 in 7 As shown, the canary logic gates 516 may be spatially intermixed with the logic gates 724 of the processing core, in accordance with example implementations. Due to the spatial intermixing of the canary logic gates 516 with the logic gates of the processing core 724, the canary logic gates 516 experience all or more of the same environmental conditions as the logic gates of the processing core 724. Therefore, a canary circuit formed from the canary logic gates 516 may accurately sense the environmental conditions of the security processing core 142 and quickly provide an indication of a security attack triggered by the environmental conditions affecting the security processing core 142.

In 8th An example of a semiconductor chip area 800 is shown according to an example implementation. In accordance with some implementations, the semiconductor chip region 600 corresponds to a region of a semiconductor chip 157 ( 1 ), in which the security processing core 142 is partially or completely manufactured. It is noted that the security processing core 142 may also be fabricated in one or more other areas of the semiconductor chip 157.

As in 8th As shown, the semiconductor chip region 800 extends laterally across a semiconductor chip in an X dimension and a Y dimension, which correspond to an X axis 802 and a Y axis 801, respectively. The semiconductor chip has a Z thickness that extends along a Z axis 803. In accordance with example implementations, the spatial mixing of the canary logic gates 516 and the security processing logic gates tung core 724 along the X and Y dimensions. In accordance with some implementations, the spatial mixing may extend along the Z dimension. Spatial mixing can be accomplished using a layout design tool, as described here in the discussion of spatial mixing of canary logic gates and SRoT logic gates.

As in 9 shown, the kanary circuit 134 may include a chain 908 of cryptographic processing stages 912 in accordance with some implementations. Consistent with example implementations, each stage 912 may correspond to an instance of a cryptographic cipher block or transformation. As in 9 As shown, in accordance with some implementations, stage 912 may correspond to, for example, an Advanced Encryption System (AES) encryption or a transformation and a particular AES iteration. According to example implementations, a particular stage 912 may be implemented by a set of combinatorial logic or a logic cone. In general, according to AES, a number of AES transformation iterations are performed, which depend on the size of the cryptographic key used.

In accordance with example implementations, the canary circuit 134 performs a number of AES transform iterations (via corresponding stages 912) in a single cycle of a clock signal 921. More specifically, in accordance with some implementations, the clock signal 921 may be the same clock signal that controls the operations of the security processing core 142 ( 2 ) and/or the SRoT engine 143 ( 2 ) clocks. The canary circuit 134, in accordance with example implementations, produces the output 916 for each cycle of the clock signal 921. In other words, in accordance with example implementations, the chain 908 receives an input or an input vector 904 in a single clock cycle and performs multiple AES transform iterations (via corresponding ones Steps 912) to produce an output 916.

According to example implementations, when the canary circuit 134 is functioning properly and is not malfunctioning (e.g., malfunctioning due to an environmental condition), chain 908 produces an output signal 916 that corresponds to an expected output signal 920. Otherwise, the output 916 does not match the expected output 920, and this mismatch causes the canary circuit 134 to provide an indication of detected tampering activity (e.g., indicating detection of an environmental security attack).

As in 9 As shown, in accordance with some implementations, the control logic 940 of the canary circuit 134 includes a comparator 924 that compares the output 916 of the chain 908 with an expected output 920. According to example implementations, if these outputs do not match, comparator 924 provides a tamper indication to an output 237 of canary circuit 134 (e.g., comparator 924 asserts a tamper indication signal to tamper detection circuit 234 ( 2 ) to inform about the detection of the manipulation activity).

Due to the nature of the AES transformation, a single logical value change corresponding to the transformation can cause multiple bits in the output of the transformation to change. Therefore, the use of the AES transform, and in particular the use of multiple cascaded AES transforms, amplifies the malfunction indicator (the difference between the output 916 and the expected output 920) and accordingly causes the canary circuit 134 to be very sensitive to environmental conditions responded to the security attack caused.

According to some implementations, due to the complexity of the logic (e.g. AES stages 912) of the canary circuit 134, the propagation of the input vector 904 through all transformations (e.g. AES transformations) takes a significant portion (e.g. 80 to 90 percent or a higher percentage) of the clock cycle. In accordance with implementation examples, the number of AES stages 912 of chain 908 may be adjusted such that chain 908 barely meets the timing specifications during a single clock cycle. For example, taking manufacturing variations into account, the number of AES stages 912 for the expected slowest silicon can be chosen so that the output 916 is provided at the end of the clock cycle. According to embodiments, canary circuit 134 is intentionally designed to be the first, if not one of the first, circuits of security processor 130 to malfunction in the event of a security attack caused by environmental conditions (e.g., output corresponds to 916 not the expected edition 920).

The control logic 940 is configured, in accordance with example implementations, to sample the output 916 for each cycle of the clock signal 921. For example, the control logic 940 may, in accordance with example implementations, apply the input vector 904 to the chain 908 in response to certain edges (e.g., positive going or rising edges) of the clock signal 921, and the comparator 924 may sample the output 916 on certain edges (e.g., rising edges) of the clock signal 921. Therefore, according to some implementations, the transformations begin at the beginning of the clock cycles, and the result of the transformations is sampled at the end of the clock cycles.

To refresh the logic gates of the canary circuit 134 for each clock cycle so that the logic gates transition during the clock cycle (rather than remain static), the control logic 940 provides different input vectors 904 to the chain 908 in alternating clock cycles. In this way, the control logic 940 can, as shown in 9 , in accordance with some implementations, control logic 940 may select a particular candidate input vector 946 as input vector 904 for clock cycle A. Candidate input vector 946 has a corresponding expected output 948 that control logic 940 compares to output 916 at the end of clock cycle A. For the next succeeding clock cycle B, control logic 940 may select a different candidate input vector 946 as input vector 904 for clock cycle B. This different candidate input vector 946 has a corresponding output 948 that control logic 940 compares to output 916 at the end of clock cycle B.

In accordance with some implementations, control logic 940 may alternately provide two different input vectors to chain 908 for alternate clock cycles. In accordance with other implementations, control logic 940 may alternate between more than two input vectors. In accordance with other implementations, chain 908 may be provided with the same input vector for each clock cycle.

According to 10 In accordance with example implementations, a process 1000 includes generating (block 1004) an output value by a canary circuit of a semiconductor package. The semiconductor package contains a hardware root-of-trust engine for an electronic system. In accordance with example implementations, the semiconductor package can be connected to a management controller, such as the BMC 129 ( 1 ), be connected. In accordance with some implementations, the semiconductor package may include a security processor 130 ( 1 and 2 ), and the electronic system may include a computer platform 100 ( 1 ) be. The canary circuit can contain logic, e.g. B. a chain of stages corresponding to AES cryptographic cipher transformations, and the number of stages can be tuned so that the canary circuit has high sensitivity to a security attack caused by environmental conditions. The process 1000 includes comparing (block 1008) the output value with an expected value by the canary circuit. Consistent with example implementations, the comparison can be performed every clock cycle. Additionally, according to example implementations, the canary circuit logic may be provided with different input values in alternating clock cycles to refresh the logic gates for each clock cycle. The process 1000 includes the semiconductor package regulating a response of the semiconductor package to a reset request in response to a result of the comparison (block 1012). The reset request may be a state (e.g., a state corresponding to a logic zero) of an electrical signal, according to example implementations. The reset request may be generated outside of the semiconductor package, may be generated within the semiconductor package, may be generated by circuitry, and may be generated in response to the execution of machine-readable instructions. In accordance with implementation examples, regulating the response of the semiconductor package to a reset request includes regulating a reset hold time.

According to 11 In accordance with example implementations, a baseboard management controller 1100 includes a management processor 1104 and a secure enclave 1108 that is separate from the management processor 1104. In accordance with some implementations, the baseboard management controller 1100 may provide management services and security services for a host. In accordance with example implementations, management processor 1104 may be a processing core 154 ( 1 ) that runs management stack firmware to provide management services for a host. The secure enclave 1108 has an associated cryptographic boundary and includes a security processing core 1112, a root of trust engine 1116, a canary circuit 1118, and a controller 1120. The canary circuit 1118 may include logic such as: B. a chain of stages corresponding to cryptographic cipher transformations (e.g. AES transforms), and the number of stages can be tuned so that the canary circuit 1118 has a high sensitivity to a security attack caused by environmental conditions. The root of trust engine 1116 validates machine-readable instructions to be executed by the security processing core 1112. The root of trust engine 1116 includes logic gates 1150, and the canary circuit 1118 includes logic gates 1154 that are spatially interconnected with the logic gates 1150 are mixed. The canary circuit 118 generates an output value and compares the output value with an expected value to provide a tamper indication. The controller 1120 takes an action in response to the tamper indication. In accordance with some implementations, performing the response action may include regulating a reset hold time.

As in 12 As shown, a computing platform 1200, according to example implementations, includes a main processing core 1204 and a security processor 1202. The main CPU processing core 102 ( 1 ) and the safe enclave 140 ( 1 ) are examples of the main processing core 1204 and the security processor 1202 according to some implementations. The security processor 1202 includes a security processing core 1208, a root of trust engine 1216, a canary circuit 1218 and a reset controller 1212. The first firmware command part is part of a trust chain, and the trust chain includes a second firmware command part, to be executed by the main processing core 1204. Consistent with example implementations, security processor 1202 may be a management controller, such as: B. a BMC 129 ( 1 ), which provides management services and security services for a host 101. The canary circuit 1218 may contain logic such as: B. a chain of stages corresponding to cryptographic cipher transformations (e.g. AES transforms), and the number of stages can be tuned so that the canary circuit 1218 has a high sensitivity to a security attack caused by environmental conditions. The root of trust engine 1216 includes a first plurality of logic gates 1250 for validating a first firmware instruction portion to be executed by the security processing core 1208. The canary circuit 1218 includes a second plurality of logic gates 1254 to generate an output value and compare the output value to an expected value to provide a tamper indication. The logic gates 1254 are spatially mixed with the logic gates 1250. The reset controller 1212 regulates a reset hold time of the security processor 1202 in response to the tamper indication.

In accordance with example implementations, generating the output value includes providing an input to a chain of serially coupled stages to cause the chain to provide the output value. Each stage of the chain is associated with a cryptographic transformation. A particular advantage is that the canary circuit accurately detects the environmental conditions of the component to be protected in order to quickly detect and respond to security attacks caused by the environmental conditions.

According to implementations, generating the output includes providing an input to a chain of serially coupled AES block cipher transformation stages to cause the chain to provide the output value. A particular advantage is that the canary circuit accurately records the environmental conditions of the component to be protected in order to quickly detect and respond to environmental security attacks.

According to embodiments, the process includes providing a clock signal to a processing core of the semiconductor package. The clock signal has a clock, and generating the output value includes performing the generation within a time less than the clock. A particular advantage is that the canary circuit accurately records the environmental conditions of the component to be protected in order to quickly detect and respond to environmental security attacks.

In accordance with example implementations, generating the output includes providing an input to the logic of the canary circuit and using the logic to generate the output for each cycle of a plurality of cycles of a clock signal. Generating the output includes varying the input over the plurality of cycles and varying the expected value over the plurality of cycles according to the variation in the input. A particular advantage is that the canary circuit accurately senses the environmental conditions of the component being protected to quickly detect and respond to environmental security attacks.

Consistent with example implementations, the process further includes, in response to the reset request, placing the hardware root of trust engine into the reset state. Controlling the response of the semiconductor package to the reset signal includes controlling a delay between a first time at which the hardware root of trust engine is reset and a second time at which the hardware root of -Trust engine is released from the reset. A particular advantage is that the canary circuit accurately records the environmental conditions of the component to be protected in order to quickly detect and respond to environmental security attacks.

Consistent with example implementations, generating the output value involves providing an input to logic gates of the canary circuit. The logic gates of the canary circuit are spatially intermixed with the logic gates of the hardware root of trust engine. The logic gates of the canary circuit are used to generate the output. A particular advantage is that the canary circuit accurately senses the environmental conditions of the component being protected to quickly detect and respond to environmental security attacks.

According to embodiments, generating the output value includes providing an input to the logic gates of the canary circuit. The logic gates of the canary circuit are spatially mixed with the logic gates of a security processing core of the semiconductor package. The logic gates of the canary circuit are used to generate the output. A particular advantage is that the canary circuit accurately records the environmental conditions of the component to be protected in order to quickly detect and respond to security attacks caused by the environmental conditions.

According to embodiments, the process includes a processing core of a security processor of the semiconductor package executing machine-readable instructions to provide a security service for the electronic system. The canary circuit fails due to an environmental security attack on the semiconductor package. The malfunction includes that the comparison produces a result that means that the output value does not match the expected value. Controlling the response of the semiconductor package to the reset signal includes increasing a reset hold time for the semiconductor package depending on the result of the comparison. A particular advantage is that the canary circuit accurately senses the environmental conditions of the device to be protected in order to quickly detect and respond to environmental security attacks.

Although the present disclosure has been described with respect to a limited number of implementations, those skilled in the art having the benefit of this disclosure will appreciate numerous modifications and variations thereto. It is intended that the appended claims cover all such modifications and variations.

Claims (20)

A method comprising: generating an output value by a canary circuit of a semiconductor package, the semiconductor package comprising a hardware root of trust engine for an electronic system; comparing, by the canary circuit, the output value to an expected value; and in response to a result of the comparison, the semiconductor package regulates a response of the semiconductor package to a reset request. The procedure according to Claim 1 , wherein generating the output value comprises: providing an input to a chain of serially coupled stages to cause the chain to provide the output value, each stage of the chain being associated with a cryptographic transformation. The procedure according to Claim 1 , wherein generating the output comprises: providing an input to a chain of serially coupled Advanced Encryption Standard (AES) block cipher transformation stages to cause the chain to provide the output value. The procedure according to Claim 1 further comprising providing a clock signal to a processing core of the semiconductor package, wherein: the clock signal has a clock period; and generating the output value comprises performing the generation within a time period shorter than the clock period. The procedure according to Claim 1 , wherein generating the output includes: providing an input to the canary circuit logic; using the logic to generate the output for each cycle of a plurality of cycles of a clock signal; varying the input over the plurality of cycles; and varying the expected value over the plurality of cycles according to the variation of the input. The procedure according to Claim 1 , further comprising: in response to the reset request, placing the hardware root of trust engine in the reset state, wherein regulating the response of the semiconductor package to the reset signal comprises regulating a delay between a first time at which the hardware root of trust engine is placed in the reset and a second time point at which the hardware root of trust engine is released from the reset. The procedure according to Claim 1 , wherein generating the output value comprises: providing an input to logic gates of the canary circuit, wherein the logic gates of the canary circuit are spatially intermixed with logic gates of the hardware root of trust machine; and generating the output using the logic gates of the canary circuit. The procedure according to Claim 1 , wherein generating the output value comprises: providing an input to logic gates of the canary circuit, wherein the logic gates of the canary circuit are spatially intermixed with logic gates of a security processing core of the semiconductor package; and generating the output using the logic gates of the canary circuit. The procedure according to Claim 1 , further comprising: a processing core of a security processor of the semiconductor package that executes machine-readable instructions to provide a security service for the electronic system; and the canary circuit malfunctions due to an environmental-based security attack on the semiconductor package, the malfunction being that the comparison produces a result representing that the output value does not match the expected value, wherein regulating the response of the semiconductor package to the reset signal comprises increasing a reset hold time for the semiconductor package in response to the result. A baseboard management controller that includes: a management processor; and a secure enclave separate from the management processor, the secure enclave having an associated cryptographic boundary and comprising: a security processing core; a root of trust engine for validating machine readable instructions to be executed by the security processing core, the root of trust engine comprising a first plurality of logic gates; a canary circuit comprising a second plurality of logic gates spatially intermingled with the first plurality of logic gates, the canary circuit generating an output value and comparing the output value with an expected value to provide a tamper indication; and a controller that takes an appropriate action in response to a tampering indication. The base board management control after Claim 10 , wherein the controller includes a reset controller, and the reset controller regulates a reset hold time of the secure enclave in response to the tamper indication. The base board management control according to Claim 10 , wherein the security processing core comprises a third plurality of logic gates, the base board management further comprising: an additional canary circuit comprising a fourth plurality of logic gates, the fourth plurality of logic gates spatially intermixed with the third plurality of logic gates, and the fourth plurality of logic gates to generate an additional output value and compare the additional output value to another expected value to provide a tamper indication, the controller performing a corrective action in response to the tamper indication provided by the additional canary circuit. The base board management control according to Claim 10 wherein: the security processor comprises a semiconductor chip having a respective first dimension corresponding to a first axis and a respective second dimension corresponding to a second axis, the second axis being orthogonal to the first axis; the logic gates of the first plurality are merged along a first path parallel to the first axis; and the logic gates of the second plurality are merged along a second path parallel to the second axis. The base plate management control according to Claim 13 , wherein the semiconductor chip is associated with a third axis, the third axis is orthogonal to the first axis, the third axis is orthogonal to the second axis, and the third axis corresponds to a thickness dimension of the semiconductor chip. A computer platform comprising: a main processing core; and a security processor comprising: a security processing core; a root of trust engine, the root of trust engine comprising a first plurality of logic gates to validate a first firmware instruction portion executed by the security processor. processing core, wherein the first firmware instruction portion is part of a trust chain, the trust chain comprising a second firmware instruction portion to be executed by the main processing core; and a canary circuit comprising a second plurality of logic gates to generate an output value and compare the output value to an expected value to provide a tamper indication, wherein logic gates of the second plurality of logic gates are spatially intermixed with logic gates of the first plurality of logic gates; and a reset controller to regulate a reset hold time of the security processor in response to the tamper indication. The computer platform after Claim 15 , wherein the root of trust machine includes a reset input, and the reset controller further: receives a reset request; in response to the reset request, provide a signal to the reset input to place the root of trust machine into the reset state; and in response to the tamper indication, relativizes the reset hold time to regulate a time that the root of trust engine is held in reset before being released from reset. The computer platform according to Claim 15 , wherein the canary circuit comprises: a chain of serially coupled cryptographic processing stages, the chain receiving an input and providing the output value in response to the input vector. The computer platform according to Claim 17 , wherein the canary circuit generates the output for each cycle of a clock signal, and the canary circuit further comprises: a controller that changes the input in alternating cycles of the clock signal. The computer platform according to Claim 17 , where each stage includes logic to perform an Advanced Encryption Standard (AES) cipher block transformation. The computer platform according to Claim 16 , wherein the main processing core provides a host instance, and the computing platform further comprises a management controller to provide a management service for the host instance, the baseboard management controller comprising the security processor.

Images