Password storage authentication

Abstract

According to an exemplary aspect of the present invention, a device is provided, comprising: a random access memory device; at least one processing core coupled to the random access memory device via a first interface; and a security hardware element comprising a hash function circuit and directly coupled to the random access memory device via a second interface, the security hardware element being configured to: obtain data as input from a memory space of the random access memory device; generate a hash value of the input as output; and cryptographically sign the hash value using a physically unclonable function value of the device.

Description

Technical Field

[0001] The present disclosure relates to the field of secure memory management in integrated devices. Background Art

[0002] A Trusted Platform Module (TPM) is a secure cryptographic processor designed to improve the reliability of various aspects of processing and processing hardware. In detail, a TPM may include a microcontroller designed to make hardware elements more difficult to tamper with without detection by using cryptographic processing.

[0003] The TPM can be configured with circuits to, for example, support platform integrity, disk encryption, and system password protection. Platform integrity refers to the confidence that the platform is in an untampered state, for example, that the platform's read-only memory has not been compromised by the introduction of an unauthorized firmware version. An example of disk encryption is the BitLocker mechanism. Summary of the invention

[0004] According to some aspects, the subject matter of independent claims is provided. Some embodiments are defined in the dependent claims. The scope of protection sought by various embodiments of the present invention is set forth by the independent claims. The embodiments, examples and features described in this specification that do not fall within the scope of the independent claims (if any) will be interpreted as examples useful for understanding the various embodiments of the present invention.

[0005] According to a first aspect of the present disclosure, a device is provided, comprising: a random access memory device; at least one processing core coupled to the random access memory device via a first interface; and a security hardware element comprising a hash function circuit and directly coupled to the random access memory device via a second interface, the security hardware element being configured to: obtain data from a memory space of the random access memory device as input; generate a hash value of the input as output; and cryptographically sign the hash value using a physically unclonable function value of the device.

[0006] According to a second aspect of the present disclosure, a method in a device is provided, the method comprising: obtaining data as input from a memory space of a random access memory device through a secure hardware element; generating a hash value of the input as output; and cryptographically signing the hash value using a physical unclonable function value of the device, wherein the device comprises: the random access memory device; at least one processing core coupled to the random access memory device through a first interface; and the secure hardware element, which is directly coupled to the random access memory device through a second interface.

[0007] According to a third aspect of the present disclosure, a device is provided, comprising: a device for obtaining data as input from a memory space of a random access memory device through a secure hardware element; a device for generating a hash value of the input as output; and a device for cryptographically signing the hash value using a physically unclonable function value of the device, wherein the device comprises: the random access memory device; at least one processing core coupled to the random access memory device through a first interface; and the secure hardware element, which is directly coupled to the random access memory device through a second interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 An example system is shown in accordance with at least some embodiments of the present invention;

[0009] Figure 2 illustrates a process according to at least some embodiments of the present invention;

[0010] Figure 3 is a flow chart of a method according to at least some embodiments of the present invention;

[0011] Figure 4 illustrates signaling in accordance with at least some embodiments of the present invention; and

[0012] Figure 5 A platform configuration register to memory map is shown in accordance with at least some embodiments of the present invention. DETAILED DESCRIPTION

[0013] A trusted boot mechanism for a small, simple device is disclosed herein such that providing the trusted boot mechanism does not increase the complexity of the device to an unacceptable degree, such as a microcontroller configured to control a brake mechanism, a sensor node, or a valve actuator of a vehicle, for example.

[0014] Figure 1 An example system according to at least some embodiments of the present invention is shown. Device 100 may include a device controller, such as a brake or pump controller. Device 100 is connected to an external system 170, such as a brake, an actuator mechanism, or a fuel pump of a vehicle, via connection 1G. Connection 1G may include a control interface, for example, wherein a specific potential is selected for connection 1G to control a fuel pump to pump at a specific rate, or for a brake to be applied at a specific pressure, which is selected depending on the specific potential. Another external connection of device 100 is to a communication bus 180 via connection 1A, for example for controlling and programming device 100. Connection 1A may, for example, be a serial or parallel connection, and bus 180 may, for example, be based on an Internet Protocol (IP).

[0015] The interface device 140 is configured to output information to the interface 1A as indicated by the processor 120 through the interface 1C. The processor 120 may include, for example, a single-core or multi-core processor, wherein the single-core processor includes one processing core, and the multi-core processor includes more than one processing core. The processor 120 may generally include a control device. In detail, the processor 120 may be a microcontroller, which includes one or two microcontroller processing cores. The processor 120 may include at least one application-specific integrated circuit (ASIC). The processor 120 may include at least one field programmable gate array (FPGA). The processor 120 may be a device for executing the method steps (such as obtaining and generating information) in the device 100. The processor 120 may, for example, be configured at least in part by computer instructions to perform actions. In the case where the processor 120 is an ASIC, it may be configured by its inherent structure.

[0016] A processor such as processor 120 may include circuitry, or be configured as one or more circuits, configured to perform the various stages of a method according to an embodiment described herein. As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) a hardware-only circuit implementation, such as an implementation using only analog and / or digital circuitry; and (b) a combination of hardware circuitry and software, such as the following (if applicable): (i) a combination of analog and / or digital hardware circuitry with software / firmware, and (ii) any portion of a hardware processor (including a digital signal processor) with software, software, and memory that work together to enable a device such as a controller device to perform various functions; and (c) a hardware circuit and / or processor (such as a microprocessor or a portion of a microprocessor) that requires software (e.g., firmware) for operation, but the software may not be present when it is not required for operation.

[0017] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers implementations of only a hardware circuit or processor (or multiple processors), or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers (for example and where applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, or other computing or network device.

[0018] The processor 120 may be provided with a transmitter arranged to output information from the processor 120 to other devices included in the device 100 via electrical leads inside the device 100. An example of such leads is the interface 1C. Such a transmitter may include a serial bus transmitter arranged to output information to the random access memory device 130 for storage therein, for example, via at least one electrical lead. As an alternative to a serial bus, the transmitter may include a parallel bus transmitter. Similarly, the processor 120 may include a receiver arranged to receive information in the processor 120 from other devices included in the device 100 via electrical leads inside the device 100. Such a receiver may include a serial bus receiver arranged to receive information from the interface device 140, for example, via at least one electrical lead for processing in the processor 120. As an alternative to a serial bus, the receiver may include a parallel bus receiver.

[0019] Processor 120 may communicate to external system 170 via interface device 150. Interface device 150 may be configured to convert instructions it receives from processor 120 via connection 1F into instructions expressed in a format understandable to external system 170. These instructions may be provided to external system 170 via interface 1G.

[0020] The device 100 includes a random access memory device 130 coupled to the processor 120 via an interface 1E, which may therefore include a memory interface. For simplicity, the random access memory device 130 is referred to as memory 130 below. The random access memory device may include, for example, a static random access memory (SRAM) chip or more than one such chip. The memory 130 may be at least partially included in the processor 120. The memory 130 may be a device for storing information. The memory 130 may include computer instructions that the processor 120 is configured to execute. When computer instructions configured to cause the processor 120 to perform certain actions are stored in the memory 130 and the device 100 as a whole is configured to run under the guidance of the processor 120 using computer instructions from the memory 130, the processor 120 and / or at least one of its processing cores may be considered to be configured to perform the certain actions. The memory 130 may be at least partially outside the device 100, but may be accessed by the device 100.

[0021] The device 100 may also include a read only memory (ROM) 160. Figure 1In the example of , ROM 160 is connected to processor 120 via connection 1D, which is therefore a memory interface. ROM 160 may be configured to store computer instructions, for example, which are executed in conjunction with powering up device 100. In some embodiments, in conjunction with booting up device 100, a computer program for controlling the functionality of device 100 is copied from ROM 160 to memory 130. For example, processor 120 may be configured to perform the copying via connections 1D and 1E.

[0022] Figure 1 The device 100 also includes a trusted element 110, which is a hardware circuit device configured to provide trusted functions related to the device 100. The trusted element 110 can be a secure hardware element, such as a trusted platform module. The secure hardware element is an execution environment separate from the processor 120. At least in some embodiments, the trusted element 110 is not programmable, and therefore its functions cannot be cracked. Figure 1 In the example structure of , the trusted element 110 includes an identification processing circuit 112, a key providing circuit 114, and a hash function circuit 116. In general, the trusted element 110 and the circuits included therein, such as the hash function circuit 116, can be devices for performing actions such as obtaining, providing, and cryptographic signing.

[0023] The identification processing circuit 112 is configured to generate an identifier characteristic of the device 110. The identifier may be generated based on a physical unclonable function (PUF) derived from a physical characteristic of at least one element of the device 100. For example, the identification processing circuit 112 may be configured with an identifier at the time of manufacture. The physical characteristic may alternatively reflect unique physical changes that inevitably occur during semiconductor manufacturing. For example, the PUF may be based on manufacturing variability of the random access memory device 130. Since the PUF is physically a manifestation of hardware manufacturing variability, it is a physical entity embodied in the physical structure of the device 100 and will be stable during a restart of the device 100. The identification processing circuit 112 may obtain the PUF from the memory 130 via the connection 1M. As an alternative to the memory 130, the PUF may be based on manufacturing variability of, for example, the processor 120 or the trusted element 110 itself.

[0024] The key providing circuit 114 is configured to generate an encryption key based on the identifier that the identification processing circuit 112 is configured to generate. Figure 1As shown, the identifier may be provided from the identification processing circuit 112 to the key providing circuit 114 via connection 1H. In some embodiments, to save silicon space, only a single cryptographic function is configured in the trusted element 110. To save more silicon space, in some embodiments, cryptographic signatures are the only cryptographic process supported by the trusted element 110. In an embodiment according to the Trusted Platform Module (TPM) 2.0 standard, two cryptographic keys are generated, an endorsement key (EK) from the identifier generated by the identification processing circuit 112, and a certificate key then derived from the EK, for example, by the key providing circuit 114.

[0025] exist Figure 1 In the example of , the trusted element 110 also includes a hash function circuit 116. The hash function circuit 116 is configured to generate a hash value on a set of input data, the data coming from the memory space of the random access memory 130. In some embodiments, the input further includes an identifier generated by the identification processing circuit 112 from the physical unclonable function value. In some embodiments, instead of the identifier or in addition to the identifier, the input also includes an indication of the number of times the device 100 has been restarted or reset. The trusted element 110 can access data from the memory 13 through the interface 1L and access the PUF-derived identifier through the connection 1K. The hash function circuit 116 can provide a hash value for signing the key providing circuit system 114 through the connection 1J. In practice, the interface 1L can be directly wired to the memory interface 1E of the memory 130. Typically, the interface of the trusted element 110 can be directly wired to the memory interface 1E of the memory 130. Typically, the direct interface between the trusted element 110 and the memory 130 may include, for example, a connection that does not pass through a processor, a microcontroller, or a basic input / output system (BIOS).

[0026] The trusted element 110 may have an interface 1B to an interface device 140 for providing an authenticated memory hash to, for example, a communication bus 180 to check the integrity of the contents of the memory 130. In embodiments deemed useful, the trusted element 110 may have an optional connection 1N to a processor 120 to enable the processor 120 to trigger a trusted action by the trusted element 110.

[0027] The device 100 may include Figure 1100 includes other devices not shown. On the other hand, in some embodiments, the device 100 lacks at least one of the above-mentioned devices. For example, some devices 300 may lack ROM 160. The internal structure of the trusted element 110 is schematic, because the circuits 112, 114 and 116 can form a single unified circuit of the trusted element 110 with the above-mentioned functions in practice. For example, such a single unified circuit can be called a hash function circuit 116. In this view, connections 1J, 1H and 1K will be included in the unified circuit, and interfaces 1M and 1L will be included in the interface with the memory 130 that the trusted element 110 has. As described above, such an interface can be directly applied to the memory interface 1E.

[0028] The processor 120, the memory 130, the interface device 140, the interface device 140 and other elements of the device 100 may be interconnected in a variety of different ways via electrical leads inside the device 100. For example, each of the aforementioned devices may be connected to a main bus inside the device 100, respectively, to allow the devices to exchange information. However, as will be appreciated by those skilled in the art, this is only an example, and depending on the embodiment, various ways of interconnecting at least two of the aforementioned devices may be selected without departing from the scope of the present disclosure.

[0029] In use, to authenticate the memory space of the memory 130, the trusted element 110 may obtain data from the memory space of the memory 130 and derive a hash value of the data using the hash function circuit 116. The trusted element 110 may obtain data from the memory 130 using an interface that the trusted element 110 has with the memory 130, so the trusted element 110 does not rely on the processor 120 to obtain the data. In some embodiments, when deriving the hash value, the identifier provided by the identification processing circuit 112 may be included in the input to the hash function. For example, for overlapping memory spaces, multiple authentications may be generated.

[0030] The hash value thus obtained can be cryptographically signed using an encryption key to obtain an authentication of the memory space, the encryption key being generated using an identifier provided by the identification processing circuit 112. The authentication can be stored in a platform configuration register (PCR) circuit. The PCR circuit may be included in, for example, the trusted element 110. In various embodiments, the trusted element 110 may have one, two, or more than two platform configuration registers to store memory authentication. In the simplest case, a single authentication is derived over the entire contents of the memory 130, i.e., the memory space used to provide data for the hash function is the entire memory space of the memory 130. In some embodiments, an authentication is made for the contents of ROM 160, and the resulting authentication is stored in a platform configuration register of the platform configuration register circuit of the trusted element 110.

[0031] The signature of the hash value can be performed according to a public key cryptography system such as Rivest-Shamir-Adleman (RSA) or ElGamal public key cryptography system. In this case, a public key-private key pair is generated based on an identifier from the identification processing circuit 112. In detail, the private key of this pair can be used to sign digital information, thereby proving that the owner of the private key has signed the information. In principle, a public key can be assigned to enable verification that the signature is authentic, while the private key will be held closely and not disclosed. For example, the private key can be stored in the circuit of the trusted element 110 to keep it safe.

[0032] Figure 2 Block 210 represents a process according to at least some embodiments of the present invention. Figure 1 Memory 130 of , used as a source of data from the memory space to be proven. Box 220 represents the physical characteristics of a device such as a PUF, which provides an identifier as described above to a hash function circuit 240 via an identification processing circuit 230.

[0033] The hash function circuit 240 uses data from the memory space and, optionally, in some embodiments, also uses an identifier as input to calculate a hash value. The platform configuration register (PCR) 250 stores the hash value thus generated for the integrity measurement of the memory space. The reference generator 260 is configured to retrieve the authentication from the PCR register and provide it as an integrity value related to a specific memory space. As described herein, the authentication may include a hash value encrypted with a key derived directly or indirectly from the identifier of the device, wherein the identifier may be based on a PUF as described above. Typically, authentication may be automatically generated for a fixes PCR list so that an authentication request does not need to specify a memory space to be authenticated. This will reduce the demand for silicon in the circuit and will also save processing cycles. Each PCR may be mapped to a memory space and is therefore configured to prove the contents of the memory space.

[0034] As an example with respect to PCR registers, each PCR register may include a cryptographic hash value calculated by reading the contents of a particular memory space of memory 130. PCRs may be grouped into banks corresponding to hash functions. For example, banks of secure hash algorithm 1 (SHA1) and 256-bit secure hash algorithm 2 (SHA256) may be provided. Cryptographic signing of the hash value may be performed prior to storing the hash value in the PCR register or as a response to an authentication request. In either case, the authentication provided from the trusted element 110 has a cryptographically signed hash value that is performed using a key derived from the physical properties of the device 100.

[0035] For example, SHA256-PCR0 may be mapped to memory addresses 0x0000-0xFFFF and utilize the SHA256 function to compute the cryptographic hash of the values ​​at those locations. Similarly, SHA256-PCR1 may be mapped to memory addresses 0x0000-0xFFFF and utilize the SHA256 function to compute the cryptographic hash of the values ​​at those locations, using the identifier value in the calculation to combine the identifier with the measured hash in a known order. Other libraries and PCR values ​​may return default values, such as: 0x0...0 or 0xF...F as desired.

[0036] The ordering of the inputs from the identifier and memory for the cryptographic hash calculation is defined on a per-system basis and may occur in any order, which may be specified so that any possible external validation may be performed. For example, a request for authentication may be received in the trusted element 110 from the communication bus 180, the connection 1A, the interface device 140, and the connection 1B. Authentication may be provided to the communication bus 180 via the same route.

[0037] Figure 3 is a flow chart of a method according to at least some embodiments of the present invention. The stages of the method shown may be Figure 1 The method is executed in the device 100 or in a secure hardware element therein.

[0038] Stage 310 includes obtaining data as input from a memory space of a random access memory device through a secure hardware element. The input can be obtained using an interface that the secure hardware element has with the random access memory device, which interface is independent of the processor of the device. The interface between the secure hardware element and the random access memory device can be direct, because it does not pass through another device included in the device, in particular it does not pass through the processor of the device. Stage 320 includes generating a hash value of the input as output. Stage 330 includes cryptographically signing the hash value using a physical unclonable function value of the device. The device includes: the random access memory device; at least one processing core, which is coupled to the random access memory device through a first interface; and a secure hardware element, which is directly coupled to the random access memory device through a second interface.

[0039] Figure 4 1 shows signaling according to at least some embodiments of the present invention. On the vertical axis, starting from the left, the identification processing circuit 112, the memory 130, and the key providing circuit 114 are arranged. Time progresses from top to bottom. The identification processing circuit 112 and the key providing circuit 114 can be included in the trusted element 110 as described above.

[0040] In stage 410, identification processing circuitry 112 requests a characteristic of physical memory 130, such as through a direct interface between trusted element 110 and memory 130. In stage 420, memory 130 responsively provides the requested characteristic, thereby enabling identification processing circuitry 112 to generate a seed based on the physical characteristic of memory 130 in stage 430. The characteristic may define, for example, a PUF as described above.

[0041] In stage 440, the key provisioning circuit 114 requests the seed generated in stage 430 and responsively receives it in stage 450. The seed is used to generate a key, such as an encryption key. An example of a generated encryption key is an endorsement key (EK).

[0042] Figure 5 A platform configuration register (PCR) to memory mapping is shown in accordance with at least some embodiments of the present invention. Memory 130 is shown having ten exemplary memory locations, 0x000 to 0x009, with only the last bit shown for clarity. A first PCR, PCR0, is obtained as a cryptographic hash of memory region 0x000-0x002. A second PCR, PCR1, is obtained as a cryptographic hash of memory region 0x003-0x005. A third PCR, PCR2, is obtained as a cryptographic hash of memory region 0x006–0x008.

[0043] For example, a request for a reference to a microcontroller device for PCR0 and PCR1 may be signed with a key such as an authentication key. A process for implementing this may include, for example, receiving a request for a reference. In response, an authentication key may be generated. To generate the authentication key, the following may be used in conjunction with Figure 4 The endorsement key is generated as discussed above. The authentication key can then be derived from the endorsement key, for example by using the normal cryptographic methods used to create a certificate chain from the endorsement key.

[0044] PCR0 may include a hash of a memory location to which PCR0 is wired or configured to be read through an intermediate circuit. Similarly, PCR1 will contain a hash of a memory location to which PCR1 is wired or configured to be read through some intermediate circuit. If the Trusted Computing Group (TCG) standard is used, a TPMS_ATTEST structure may be generated by hashing PCR0 and PCR1 together in some provided or predetermined order. TPMS_ATTEST or a similar structure based on PCR0 and PCR1 may be signed by a generated authentication key and returned as a response to a referenced request.

[0045] It is to be understood that the disclosed embodiments of the invention are not limited to the specific structures, process steps or materials disclosed herein, but extend to their equivalents, as will be recognized by those of ordinary skill in the relevant art. It is also to be understood that the terminology employed herein is only used for the purpose of describing specific embodiments and is not intended to be limiting.

[0046] Throughout the specification, reference to an embodiment or embodiments means that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present invention. Thus, the phrases "in one embodiment" or "in an embodiment" appearing in various places throughout this specification do not necessarily all refer to the same embodiment. Where terms such as approximately or substantially are used to refer to a value, the exact value is also disclosed.

[0047] As used herein, for convenience, multiple items, structural elements, constituent elements and / or materials may be presented in a common list. However, these lists should be interpreted as if each member of the list were individually identified as a separate and unique member. Therefore, based solely on their presentation in a common group without an indication to the contrary, any single member of the list should not be interpreted as a de facto equivalent of any other member of the same list. In addition, various embodiments and examples of the present invention and alternatives for its various components may be referenced herein. It should be understood that such embodiments, examples and alternatives should not be understood as de facto equivalents of each other, but should be considered as separate and autonomous representations of the present invention.

[0048] In addition, in one or more embodiments, the described features, structures or characteristics may be combined in any suitable manner. In the foregoing description, many specific details, such as examples of length, width, shape, etc., are provided to provide a thorough understanding of embodiments of the present invention. However, those skilled in the relevant art will recognize that the present invention may be practiced without one or more specific details, or using other methods, components, materials, etc. In other cases, in order to avoid confusing various aspects of the present invention, known structures, materials or operations are not shown or described in detail.

[0049] Although the foregoing examples illustrate the principles of the present invention in one or more specific applications, it is obvious to those skilled in the art that numerous modifications in the form, use and details of the embodiments can be made without inventive work and without departing from the principles and concepts of the present invention. Therefore, it is not intended to limit the present invention except as set forth in the claims below.

[0050] The verb "to comprise" is used in this document as an open limitation, which neither excludes nor requires the presence of unrecited features. The features recited in the dependent claims may be freely combined with each other unless expressly stated otherwise. Furthermore, it should be understood that the use of "a" or "an" throughout this document, i.e. in the singular, does not exclude a plurality.

[0051] Industrial Applicability

[0052] At least some embodiments of the present invention find industrial application in reviewing memory contents.

[0053] Reference Mark List

[0054]

[0055]

Claims

1. A device comprising: - Random access memory devices; - at least one processing core coupled to the random access memory device via a first interface; as well as - a secure hardware element, which includes a hash function circuit and is directly coupled to the random access memory device, wherein the direct coupling is a direct wired connection without passing through any device in the device, and the secure hardware element is configured to: obtain data from the memory space of the random access memory device as input; and generate a hash value of the input as output; cryptographically signing the hash value using a physical unclonable function value of the device; and providing the signed hash value as authentication of the inputted data from the secure hardware element to the communications bus via an interface connecting the secure hardware element to the communications bus.

2. The device according to claim 1, wherein: The physical unclonable function value of the device includes a value characteristic of manufacturing variations of the random access memory device.

3. The device according to claim 1 or 2, wherein: The secure hardware element is configured to provide the hash value to a platform configuration register circuit included in the secure hardware element, the platform configuration register circuit being configured to store a plurality of hash values ​​derived from a plurality of memory spaces of the random access memory device.

4. The apparatus of claim 1 or 2, further configured to output an authentication of memory contents of the memory space of the random access memory device, the authentication comprising the hash value.

5. The device of claim 4, configured to cryptographically sign the hash value using a private key of a public key-private key pair of a public key cryptography system.

6. The device according to claim 5, wherein: The secure hardware element includes circuitry arranged to cryptographically sign information, but does not include circuitry arranged to perform a decryption operation using the private key.

7. The device according to claim 5 or 6, wherein: The public key cryptographic system includes the Rivest-Shamir-Adleman (RSA) or ElGamal cryptographic system.

8. The device according to claim 1 or 2, further comprising a read-only memory, and wherein: The secure hardware element is coupled to the read-only memory via a second interface, and wherein the secure hardware element is configured to obtain the physical unclonable function value of the device or a second physical unclonable function value of the device and data from the read-only memory as input to generate a second hash value.

9. The device according to claim 1 or 2, wherein: The at least one processing core includes a microcontroller processing core configured to execute computer code stored in the memory space of the random access memory device.

10. The device according to claim 9, wherein: The apparatus comprises a rail vehicle braking device.

11. A method in a device, comprising: - obtaining data as input from a memory space of a random access memory device through a secure hardware element; - Produces a hash value of the input as output; as well as - cryptographically signing the hash value using a physically unclonable function value of the device and providing the signed hash value from the secure hardware element to the communication bus via an interface connecting the secure hardware element to the communication bus as authentication of the input data, -Wherein, the device comprises: the random access memory device; at least one processing core coupled to the random access memory device via a first interface; and a security hardware element directly coupled to the random access memory device, wherein the direct coupling is a direct wired connection without passing through any device in the device.

12. The method according to claim 11, wherein: The physical unclonable function value of the device includes a value characteristic of manufacturing variations of the random access memory device.

13. The method of claim 11 or 12, comprising providing the hash value, by the secure hardware element, to a platform configuration register circuit included in the secure hardware element, the platform configuration register circuit being configured to store hash values ​​derived from a plurality of memory spaces of the random access memory device.

14. The method of claim 11 or 12, further comprising outputting an authentication of the memory contents of the memory space of the random access memory device, the authentication comprising the hash value.

15. The method of claim 14, further comprising cryptographically signing the hash value using a private key of a public key-private key pair of a public key cryptography system.

16. The method according to claim 15, wherein: The secure hardware element includes circuitry arranged to cryptographically sign information, but does not include circuitry arranged to perform a decryption operation using the private key.

17. The method according to claim 15 or 16, wherein: The public key cryptographic system includes the Rivest-Shamir-Adleman (RSA) or ElGamal cryptographic system.

18. The method according to claim 11 or 12, wherein: The device also includes a read-only memory, and wherein the secure hardware element is coupled to the read-only memory via a second interface, and wherein the method further includes: obtaining, by the secure hardware element, the physical unclonable function value of the device or the second physical unclonable function value of the device and data from the read-only memory as input; and generating a second hash value.

19. The method according to claim 11 or 12, wherein: The at least one processing core includes a microcontroller processing core configured to execute computer code stored in the memory space of the random access memory device.

20. The method according to claim 19, wherein: The device comprises a rail vehicle braking device.

21. A device comprising: - means for obtaining data as input from a memory space of a random access memory device by means of a secure hardware element; - means for generating as output a hash value of said input; as well as - means for cryptographically signing the hash value using a physically unclonable function value of the device and providing the signed hash value from the secure hardware element to the communication bus via an interface connecting the secure hardware element to the communication bus as authentication of the input data, -Wherein, the device comprises: the random access memory device; at least one processing core coupled to the random access memory device via a first interface; and a security hardware element directly coupled to the random access memory device, wherein the direct coupling is a direct wired connection without passing through any device in the device.

Images