Storage Devices
By integrating physically non-replicable function units and shielding engines in the storage device, providing random bit pools and key derivation functions, the problem of insufficient security in storage devices is solved, and efficient data protection and resource conservation are achieved.
Patent Information
- Application Number
- CN202010663518.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Priority Date
- 2020-06-09
- Filing Date
- 2020-07-10
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2041-01-03
AI Technical Summary
Existing storage devices have insufficient security in terms of unauthorized data access, use, modification and recording, and it is difficult to effectively protect data.
Using a storage device containing a physically non-replicable function (PUF) unit, a controller and a storage array, a random bit pool is provided through the PUF unit. The controller extracts the random bit sequence and performs the key derivation function by the masking engine to expand the random bit sequence to mask. The input signal is stored according to the masked signal, providing secure data storage, unique identity generation, true random number generation and secure key storage functions.
Enhanced data security, protect data from unauthorized access, saves the microprocessor's data processing resources, realizes execution (XIP) operations in -place, and improves data security and storage efficiency.
Smart Images
Figure CN112395654B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a storage device, and in particular to a storage device providing information security function. Background Art
[0002] With the development of information security and communication technology, the importance of information security in electronic circuits has gradually gained attention. Information security is about preventing unauthorized data access, use, modification, inspection and recording. For storage devices, information security maintenance is very important. Summary of the invention
[0003] An embodiment of the present invention provides a storage device, comprising a physically uncopyable function (PUF) unit, a controller, and a storage array. The PUF unit is used to provide a random bit pool. The controller is coupled to the PUF unit and is used to extract a random bit sequence from the random bit pool. The controller includes a masking engine, and the masking engine is used to perform a key derivation function to expand the extracted random bit sequence and mask an input signal. The storage array is coupled to the masking engine and is used to store according to the masked input signal. BRIEF DESCRIPTION OF THE DRAWINGS
[0004] Figure 1 It is a block diagram of a cryptographic system in an embodiment of the present invention.
[0005] Figure 2 It is a block diagram of another cryptographic system in an embodiment of the present invention.
[0006] Figure 3 It is a block diagram of another cryptographic system in an embodiment of the present invention.
[0007] The reference numerals are described as follows:
[0008] 1 to 3: Storage device
[0009] 10: Storage device
[0010] 100: Controller
[0011] 101: Shield Engine
[0012] 102: Random Number Generator
[0013] 103: Unique identifier unit
[0014] 105: Physically non-copyable function unit
[0015] 106: Storage Array
[0016] 12,22,32: Microprocessor
[0017] 120: Cryptographic Engine
[0018] 200: Cryptographic Engine
[0019] 220: Certification Procedure
[0020] 300: Password Processor
[0021] Addr: access address
[0022] Addrm: shielded access address
[0023] Cs: Security Commands
[0024] Data: data sequence
[0025] Datam: masked data sequence
[0026] K: Key
[0027] S: Entropy value
[0028] TRN: True Random Number
[0029] UID: Unique Identifier DETAILED DESCRIPTION
[0030] The term “true random” or “true random number” used in the specification refers to a bit stream or data sequence whose Hamming weight and inter-device (ID) Hamming distance are substantially 50% and whose minimum entropy is substantially 1.
[0031] Figure 1 The block diagram is a cryptographic system 1 in an embodiment of the present invention. The cryptographic system 1 may include a storage device 10 and a microprocessor (MCU) 12 coupled to the storage device 10. The cryptographic system 1 may be applicable to an Internet of Things (IoT) network. The MCU 12 may obtain data from an external device or access data from the storage device 10. The external device may be a sensor or a network. The storage device 10 may provide security functions, including a secure data storage function, a unique identity generation function, a true random number generation function, and a secure key storage function, thereby saving data processing resources of the MCU 12, protecting data, preventing data from unauthorized access, and enhancing data security.
[0032] The MCU 12 may include a cryptographic engine 120, which may be implemented by software code executable by the MCU 12. The storage device 10 may include a controller 100, a physically unclonable function (PUF) unit 105, and a storage array 106. The controller 100 may be coupled to the MCU 12, the PUF unit 105, and the storage array 106. The controller 100 may include a shielding engine 101, a random number generator (RNG) 102, and a unique identifier (UID) unit 103. The shielding engine 101, the random number generator 102, and the UID unit 103 may be coupled to the PUF unit 105. The shielding engine 101 may be coupled to the storage array 106. The PUF unit 105, the storage array 106, and the controller 100 may form an integrated circuit.
[0033] The cryptographic engine 120 may perform an authentication procedure to ensure the authenticity of data access, and thus control data access of the storage device 10. After verifying the authorized access, the cryptographic engine 120 may send a security command Cs to the storage device 10 to permit data access to the storage array 106. The storage device 10 may receive the security command Cs, and control data access to the storage array 106 according to the security command Cs. The storage array 106 may be a NAND flash memory, and the data access may be a read access and / or a write access.
[0034] The PUF unit 105 may store a random bit pool and generate a PUF response from the random bit pool in response to a PUF challenge. The PUF unit 105 may include a one time programmable memory (OTP) memory, which may be an antifuse-based circuit. The random bit pool may be programmed into the OTP memory during manufacturing setup. The random bit pool may include a plurality of truly random PUF bits. The PUF unit 105 may output a PUF response according to a predetermined selection algorithm. In some embodiments, the PUF unit 105 may select a first group of 1K PUF bits as a PUF response. In other embodiments, the PUF unit 105 may select PUF bits from multiple rows of storage cells in a predetermined row order, for example, selecting PUF bits from odd rows in ascending order for use as a PUF response. In some embodiments, the one time programmable memory may be replaced by a non-volatile memory including a plurality of truly random bits. For example, the non-volatile memory may be a 64-bit by 64-bit flash memory cell, and each row, column, or diagonal of memory cells may contain true random bits. In some embodiments, these true random bits may be updated periodically.
[0035] The controller 100 can operate the PUF unit 105 and the masking engine 101 to provide a secure data storage function. After receiving the security command Cs that allows data access, the controller 100 can extract a random bit sequence from the random bit pool in the PUF unit 105, the masking engine 101 can perform a key derivation function to expand the extracted random bit sequence, and use the expanded random bit sequence to mask the input signal, and the storage array 106 can store according to the masked input signal. The input signal may include an access address Addr or a data sequence Data. The masking of the expanded random bit sequence and the input signal can be a data mask or an address mask, and an XOR operation can be performed on the expanded random bit sequence and the data sequence Data or the access address Addr in a bitwise manner. In the data masking, the masking engine 101 can use the expanded random bit sequence to mask the access address Addr to generate a derived key, and use the derived key to mask the data sequence Data to generate a masked data sequence Datam, and the storage array 106 can store the masked data sequence Datam at the access address Addr. In some embodiments, the masking engine 101 may store the derived key in the local memory to restore the masked data sequence Datam using the derived key in a read operation. For example, in a read operation, the masking engine 101 may read the masked data sequence Datam at the access address Addr, mask the masked data sequence Datam using the derived key to restore the data sequence Data, and send the data sequence Data to the MCU 12. In address masking, the masking engine 101 may mask the data sequence Data using an extended random bit sequence to generate a derived key, and mask the access address Addr using the derived key to generate a masked access address Addrm, and the storage array 106 may store the data sequence Data in the masked access address Addrm. In some embodiments, the masking engine 101 may store the derived key in the local memory, and regenerate the masked access address Addrm in a read operation. For example, in a read operation, the masking engine 101 may receive an access address Addr from the MCU 12, regenerate a masked access address Addrm by masking the access address Addr and a derived key, read a data sequence Data from the masked access address Addrm, and send the data sequence Data to the MCU 12. The data masking operation and the address masking operation enhance data security and protect data from unauthorized access.
[0036] The random number generator 102 can generate true random numbers. In some embodiments, the cryptographic engine 120 can send a security command Cs to the controller 100, including a request for a true random number, and the controller 100 can extract a random bit sequence from the random bit pool of the PUF unit 105 in response to the request. The random number generator 102 can use the extracted random bit sequence to generate a true random number TRN, and send the true random number TRN to the cryptographic engine 120.
[0037] The UID unit 103 may generate a unique identifier. In some embodiments, the cryptographic engine 120 may send a security command Cs to the controller 100, including a request for a unique identifier, and the controller 100 may extract a random bit sequence from the random bit pool of the PUF unit 105 in response to the request. The UID unit 103 may generate a unique identifier UID based on the extracted random bit sequence, and send the unique identifier UID to the cryptographic engine 120.
[0038] The PUF unit 105 may provide security key storage. Specifically, a portion of the OTP memory in the PUF unit 105 may be reserved for storing security keys. In some embodiments, the cryptographic engine 120 may send a security command Cs to the controller 100, including a request for storing a security key and the security key, and the PUF unit 105 may store the security key in the reserved portion of the OTP memory.
[0039] Since the mask engine 101 can perform data masking and / or address masking on a data sequence and / or an access address, the storage device 10 can be used in an execute in place (XIP) method. In the method of the embodiment, the program is executed directly from the storage array 106 without copying the program to a volatile memory, thereby reducing the required storage space.
[0040] The cryptographic system 1 uses the storage device 10 to provide security functions, including secure data storage, unique identity generation, true random number generation, and secure key storage, saving data processing resources of the MCU 12, thereby protecting data from unauthorized access and enhancing data security while implementing XIP operations.
[0041] Figure 2 2 is a block diagram of another cryptographic system 2 in an embodiment of the present invention. The difference between the cryptographic system 2 and the cryptographic system 1 is that the MCU 22 may include a non-volatile memory for storing the authentication program 220, and the storage device 20 may also include a cryptographic engine 200. The cryptographic engine 200 may be implemented by a hardware circuit that can load the authentication program 220 from the MCU 22 and execute the authentication program 220 when the computer is turned on. The following discussion will focus on the configuration and operation of the authentication program 220 and the cryptographic engine 200. The cryptographic engine 200 may be coupled to the controller 100.
[0042] The cryptographic engine 200 may execute the authentication program 220 to perform the authentication program. The authentication program may include an authentication operation sequence. The authentication program 220 may be a firmware code for instructing the cryptographic engine 200 to perform the authentication operation sequence. In some embodiments, the controller 100 may receive a sequence of security commands Cs from the MCU 22, and the sequence of security commands Cs is used to perform the authentication operation sequence. The controller 100 may instruct the cryptographic engine 200 to perform the authentication operation sequence in response to the sequence of security commands Cs, and control data access to the storage array 106 based on the result of the authentication operation sequence. When the authentication program is successful, the controller 100 may authorize data access to the storage array 106; when the authentication program fails, the controller 100 may deny data access to the storage array 106.
[0043] The cryptographic engine 200 may generate an entropy value S by using an extracted random bit sequence and / or a true random number TRN. The MCU 22 may send a security command Cs to the controller 100, the security command Cs including an entropy value request. In one embodiment, in response to the entropy value request, the controller 100 may extract a random bit sequence from a random bit pool in the PUF unit 105, instruct the random number generator 102 to generate a true random number TRN, and the cryptographic engine 200 may use the extracted random bit sequence to mask the true random number TRN to generate an entropy value S, and send the entropy value S to the MCU 22. The lengths of the true random number TRN, the extracted random bit sequence, and the entropy value S may be equal. In another embodiment, the cryptographic engine 200 may combine a plurality of bits in the true random number TRN within a predetermined time period, such as within 3 frequency cycles, into an entropy value bit to generate an entropy value S, and send the entropy value S to the MCU 22. The length of the entropy value S may be less than the length of the entropy value of the true random number TRN. In another embodiment, the cryptographic engine 200 may combine multiple bits in the extracted random bit sequence within a predetermined time period into an entropy value bit to generate an entropy value S, and send the entropy value S to the MCU 22. The length of the entropy value S may be shorter than the length of the extracted random bit sequence.
[0044] Since the cryptographic engine 200 is implemented by hardware, the authentication procedure can be executed in a faster and more efficient manner. In addition, since the cryptographic engine 200 is located in the storage device 20, all authentication data used for authentication processing can be kept inside the storage device 20 without being exposed to external circuits, thereby improving security. The cryptographic system 2 uses the cryptographic engine 200 and the authentication program 220 to improve the operating speed and efficiency of the authentication program, reduce the risk of exposing the authentication key to the external circuit, protect the data from unauthorized access, and save the data processing resources of the MCU 22.
[0045] Figure 32 is a block diagram of another cryptographic system 3 in an embodiment of the present invention. The difference between the cryptographic system 3 and the cryptographic system 2 is that the MCU 32 may not have the authentication program 220, and the storage device 30 may further include a cryptographic processor 300. The following discussion will focus on the configuration and operation of the cryptographic processor 300, which may be coupled to the cryptographic engine 200.
[0046] The cryptographic processor 300 may include a circuit for indicating a sequence of authentication operations, thereby further improving the operation speed and efficiency of the authentication process. The controller 100 may receive a security command Cs to initiate an authentication procedure. The controller 100 may instruct the cryptographic processor 300 to initiate an authentication procedure in response to the security command Cs. Next, the cryptographic processor 300 may instruct the cryptographic engine to perform a sequence of authentication operations. Subsequently, the cryptographic engine 200 may perform a sequence of authentication operations to generate an authentication result. The controller 100 may control data access to the storage array 106 based on the authentication result. Specifically, the controller 100 may authorize data access to the storage array 106 after a successful authentication procedure, and may deny data access to the storage array 106 after a failed authentication procedure.
[0047] The cryptographic processor 300 may generate a key K by using the entropy value S and the extracted random bit sequence. The MCU 32 may send a security command Cs including a key request to the controller 100. In response to the key request, the controller 100 may extract a random bit sequence from the random bit pool in the PUF unit 105, and instruct the cryptographic engine 200 to generate an entropy value S, and the cryptographic processor 300 may use the extracted random bit sequence to mask the entropy value S to generate a key K, and send the key K to the MCU 32. The lengths of the entropy value S, the extracted random bit sequence, and the key K may be equal.
[0048] Since the cryptographic processor 300 and the cryptographic engine 200 can both be implemented by hardware, the authentication procedure can be performed in a faster and more efficient manner. Since the cryptographic processor 300 and the cryptographic engine 200 are both located in the storage device 30, all authentication data used for the authentication process can be kept inside the storage device 30 without being exposed to external circuits, thereby improving security. The cryptographic system 3 uses the cryptographic processor 300 to improve the operating speed and efficiency of the authentication procedure, reduce the risk of exposing the authentication key to the external circuit, protect the data from unauthorized access, and save the data processing resources of the MCU 32.
[0049] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A storage device, characterized in that: Include: a physically unclonable function (PUF) unit for providing a random bit pool; A controller, coupled to the PUF unit, for extracting a random bit sequence from the random bit pool, comprising: a masking engine for performing a key derivation function to expand the extracted random bit sequence, mask an access address using the expanded random bit sequence to generate a derived key, and then mask a data sequence using the derived key to generate a masked data sequence; and A storage array is coupled to the mask engine and is used for storing data according to the access address and the masked data sequence.
2. The storage device according to claim 1, characterized in that in, The storage array stores the masked data sequence at the access address.
3. The storage device according to claim 1, characterized in that: in, The controller further includes a unique identifier (UID) unit for generating a unique identifier according to the extracted random bit sequence.
4. The storage device according to claim 1, characterized in that: The controller further comprises: a random number generator coupled to the PUF unit and used to generate a true random number using the extracted random bit sequence.
5. The storage device according to claim 4, characterized in that: Also included is a cryptographic engine coupled to the controller and configured to generate an entropy value by using the extracted random bit sequence and / or the true random number.
6. The storage device according to claim 5, characterized in that: Also included is an encryption processor coupled to the cryptographic engine and configured to generate a key by using the entropy value and the extracted random bit sequence.
7. The storage device according to claim 1, characterized in that: The PUF unit, the storage array and the controller are formed in an integrated circuit.
8. The storage device according to claim 1, characterized in that: The PUF unit includes a one-time programmable memory.
9. The storage device according to claim 1, characterized in that: in, The controller is used for receiving a security command and controlling data access of the storage array according to the security command.
10. A storage device, characterized in that: Include: a physically unclonable function (PUF) unit for providing a random bit pool; A controller, coupled to the PUF unit, for extracting a random bit sequence from the random bit pool, comprising: a masking engine for performing a key derivation function to expand the extracted random bit sequence, mask a data sequence using the expanded random bit sequence to generate a derived key, and then mask an access address using the derived key to generate a masked access address; and A storage array is coupled to the mask engine and is used for storing data according to the data sequence and the masked access address.
11. The storage device according to claim 10, characterized in that: in, The storage array stores the data sequence at the masked access address.