Quantum-based security for hardware devices

Abstract

The invention relates to quantum-based security of hardware devices. In quantum-based security of hardware devices, a computing device includes a processor for application processing in a trusted execution environment, and includes a quantum random number generator for generating quantum random numbers, the quantum random number generator provided with a source by a plurality of hardware devices in the computing device. The computing device further includes an embedded secure element that manages connection security of the plurality of hardware devices, and is a single root of trust that is a security controller of the quantum random number generator. The computing device further includes a security switch controlled by the embedded secure element, the security switch switchable to connect at least one of the plurality of hardware devices to obtain quantum random numbers from the quantum random number generator. The security switch can be a virtualized security switch implemented in the embedded secure element.

Description

Background Technology

[0001] Computing devices utilize random number generators to generate random keys for data encryption, enabling data to be securely transmitted, such as according to Internet encryption protocols. Many traditional devices use random number generation techniques with deterministic outputs, and the output can be determined if the input seed of the random number generator is known, or if a sufficient number of output sequences can be observed, which is detrimental when used for key generation. To improve data security in traditional devices using random number generators, quantum elements have been implemented as quantum random number generators to generate quantum random numbers for data encryption and security, such as for secure payments and other financial transactions. True random numbers are numbers generated by random processes, the results of which are unpredictable and cannot be reliably reproduced. By assuming that quantum physics is essentially random, using quantum processes as the source of randomness provides the unpredictable output of quantum random number generators.

[0002] Computing devices implement various hardware components, and current implementations of dedicated embedded secure elements and / or quantum random number generators fail to combine hardware-based security with the advantages of hardware serving as a root of trust for secure random number generation. Due to the current lack of integration in hardware manufacturing, conventional techniques can only provide one, not both. Given the physical nature of quantum random number generators as entropy sources, hardware-based security is unlikely to integrate these into a single package, such as within an application processor. The components of the quantum random number generator are not integrated with the application processor, and these components are not manufactured together. Implementation is difficult at lower levels of lithography, and assuming the expectation of generating random number seeds from the most trusted environment, embedded secure elements would be used at a higher level as dedicated authentication components, physically isolated from the application processor's subsystems. Attached Figure Description

[0003] The following figures illustrate how quantum-based security technologies are implemented in hardware devices. Throughout the text, the same numbers are used to refer to similar features and components shown in the figures:

[0004] Figure 1 An example of quantum-based security for hardware devices in a computing device according to one or more implementations described herein is shown.

[0005] Figure 2 Further examples of quantum-based security for hardware devices in computing devices according to one or more implementations described herein are shown.

[0006] Figure 3 This illustrates another example of quantum-based security of hardware devices in a computing device according to one or more implementations described herein.

[0007] Figure 4 Further examples of quantum-based security for hardware devices in computing devices according to one or more implementations described herein are shown.

[0008] Figure 5 An example method for quantum-based security of a hardware device is shown, based on one or more implementations of the techniques described herein.

[0009] Figure 6 Various components of an example device are shown, which can be used to implement quantum-based security techniques for hardware devices as described herein. Detailed Implementation

[0010] This paper describes a method for implementing quantum-based security in hardware devices and provides techniques that can be implemented by any type of computing device, such as smart devices, mobile devices (e.g., cellular phones, tablets, smartphones), consumer electronics, etc. Generally, these techniques are implemented to generate random numbers using a quantum random number generator (QRNG) in a quantum-secure hardware device within a mobile phone. Notably, a single quantum random number generator can be sourced from multiple hardware devices within a computing device (e.g., a mobile phone), where the hardware devices are tamper-proof components including an application processor and an embedded secure element, or including an integrated circuit incorporating an embedded secure element. A single quantum random number generator leverages the inherent randomness of quantum physics to generate truly random numbers for seed generation, for example, by utilizing hardware that uses light as an entropy source to create random number data, and the randomness of whether emitted photons are reflected or transmitted provides the quantum entropy.

[0011] The quantum-based security technology described for the hardware device provides a means of implementing hardware-based security, such as embedded secure elements for data encryption and security. A quantum random number generator can be shared and accessed as a single, shared quantum random number generator by multiple secure and non-secure hardware elements within the device. For example, an embedded secure element can be integrated with a Near Field Communication (NFC) controller in a mobile phone for payment transactions, or with an Ultra Wideband (UWB) controller for near-field vehicle and / or building access via wireless communication. In implementations, the embedded secure element can be implemented as a standalone Subscriber Identity Module (SIM), a standalone or discrete Electronic Subscriber Identity Module (eSIM), or integrated with SIM / eSIM capabilities, such as for cellular user identity, authentication, operator billing, roaming, and other mobile applications. Assuming that the tamper-proof and secure operating system requirements for secure payment transactions and user authentication are similar, secure elements (or secure computing hardware and / or software) can be used for secure payments and SIM / eSIM applications.

[0012] The described implementation enables all hardware devices in mobile devices that rely on secure cryptography to benefit from quantum-safe operation. Notably, mobile phones can achieve quantum-safe operation at the framework level (e.g., at the operating system level) and the application layer without having to add multiple quantum random number generators. Furthermore, the techniques described herein provide health monitoring of the quantum random number generator to ensure tamper-proof performance.

[0013] In all aspects of the described technology, a single quantum random number generator implemented in a computing device can be used in conjunction with an embedded secure element and a trusted execution environment for the microprocessor, which is tamper-proof hardware with isolated processors (CPU), memory (RAM), and secure storage devices. In this implementation, the quantum random number generator is switched, allowing for different bus control sources and secure verification of health monitoring and status using the output of the quantum random number generator. While alternative implementations could utilize multiple dedicated quantum random number generators, such as one for the embedded secure element and one for the trusted execution environment for the microprocessor, along with other components, multiple quantum random number generators occupy additional space on the printed circuit board and increase manufacturing costs and require more security certification testing (per QRNG) when additional space is very precious and limited in smartphone designs.

[0014] The quantum-based security technologies described for hardware devices enhance the security of mobile phone users by increasing the effort required to determine encryption keys. This provides better security for end users by protecting the quantity and type of user information, particularly the data and information stored on their devices by typical smartphone users. The described quantum-based security technologies also enable enhanced enterprise security, digital key encryption, personal information security, credential protection use cases, and any other type of enhanced cryptographic security within the quantum infrastructure enabling end-to-end solutions.

[0015] In the described aspect of quantum-based security of the hardware device, a computing device such as a mobile phone, wireless device, smartphone, or other communication device includes a processor for performing application processing in a trusted execution environment and a quantum random number generator that generates quantum random numbers, the quantum random number generator being sourced from multiple hardware devices within the computing device. The computing device also includes an embedded secure element that manages the connection security of the multiple hardware devices and acts as a single root of trust, serving as a secure controller for the quantum random number generator. The computing device also includes a security switch controlled by the embedded secure element, which is switchable to connect at least one of the multiple hardware devices to obtain quantum random numbers from the quantum random number generator. Alternatively, the computing device includes a virtualized security switch implemented in the embedded secure element, wherein the virtualized security switch is switchable to connect at least one of the multiple hardware devices to obtain quantum random numbers from the quantum random number generator. The embedded secure element can also monitor the entropy source performance associated with the generation of quantum random numbers and determine the operational health of the quantum random number generator based on the monitored entropy source performance.

[0016] In other aspects of the quantum-based security of the described hardware device, the computing device includes a processor for application processing in a trusted execution environment and a quantum random number generator that generates quantum random numbers from sources provided by multiple hardware devices within the computing device. The computing device also includes a security switch controlled by an embedded security element that manages the connection security of the multiple hardware devices. The security switch is switchable to connect at least one of the multiple hardware devices to obtain quantum random numbers from the quantum random number generator. The embedded security element acts as a single root of trust, acting as a security controller for the security switch, to manage access to the quantum random number generator from the multiple hardware devices. Furthermore, the embedded security element can monitor the entropy source performance associated with the generation of quantum random numbers and determine the operational health of the quantum random number generator based on the monitored entropy source performance.

[0017] While the features and concepts of quantum-based security in hardware devices can be implemented in any number of different devices, systems, environments, and / or configurations, the ways in which quantum-based security in hardware devices is implemented are described in the context of the following example devices, systems, and methods.

[0018] Figure 1 Example 100 of a quantum-based security technique is illustrated, such as that implemented in a hardware device 102. In this example 100, the computing device 102 can be any type of mobile phone, wireless device, smartphone, computing device, tablet device, and / or any other type of device. Generally, the computing device 102 can be any type of electronic, computing, and / or communication device implemented with various components, such as application processors and memory, and reference... Figure 6 The example device shown may be further described with respect to any number of different components and combinations thereof.

[0019] In this example 100, computing device 102 includes a processor 104 for application processing in a trusted execution environment (TEE) 106, such as any type of microprocessor, controller, application processor, etc. Generally, the trusted execution environment 106 is a secure area of ​​the processor that provides an isolated execution environment for a higher level of security, isolated execution, and integrity for trusted applications running on the computing device.

[0020] The computing device 102 also includes an embedded secure element (eSE) 108, which is a tamper-proof hardware device, such as a smart card chip, including its own integrated processor (CPU), memory (e.g., ROM, EEPROM, RAM), and I / O ports for tamper-proof connection and data communication with other hardware devices implemented in the computing device 102. In implementation, the embedded secure element 108 can be a standalone component used in mobile phones, for example, for secure payments and financial transactions, for transportation applications, and in secure location access environments. As a standalone component, the embedded secure element 108 can include SIM / eSIM functionality. Notably, the tamper-proof hardware, memory, and secure operating system functionality can be used for secure payment transactions, such as in NFC devices, or for user authentication, such as in SIM cards. The same advanced security features can be used for secure payment transactions or SIM / eSIM applications.

[0021] In other implementations, the embedded secure element 108 may be incorporated as an integrated circuit of a computing device and / or a secure element of another device component 110. For example, the computing device 102 may implement other hardware devices, such as a Near Field Communication (NFC) controller to facilitate compatible mobile payment transactions and other short-range communications between devices, or an Ultra Wideband (UWB) controller to facilitate short-range vehicle and / or building access via wireless communication from a mobile phone. In other implementations, the embedded secure element 108 may be integrated with SIM / eSIM functionality, such as for cellular user identity, authentication, operator billing, roaming, and other mobile applications. Assuming that the tamper-proof and secure operating system requirements for secure payment transactions and user authentication are similar, the secure element (or secure computing hardware and / or software) can be used for secure payments and SIM / eSIM applications.

[0022] The computing device 102 also includes a quantum random number generator (QRNG) 112 for generating quantum random numbers, the source of which is provided by any of a plurality of hardware devices within the computing device. For example, the plurality of hardware devices may be tamper-proof components of the computing device, including processor 104 and embedded secure element 108, or integrated circuits or other device components 110 incorporated into the embedded secure element. In this example 100, the quantum random number generator 112 is designed for implementation in a small, low-power mobile device such as a smartphone.

[0023] The quantum random number generator 112 can be shared and accessed as a single, shared quantum random number generator by multiple secure and non-secure hardware devices within computing device 102. In an example implementation, the quantum random number generator 112 may include one or more light-emitting diodes (LEDs), a CMOS image sensor, and an analog-to-digital converter (ADC). The LEDs emit a light field, and the CMOS image sensor converts the emitted photons into electrons. The electrons are converted into a random distribution of voltage values, which are then digitized by the ADC. Based on the quantum fluctuations in the number of photons emitted by the LEDs, an entropy bit is generated as the entropy source of the quantum random number generator.

[0024] In terms of the described quantum security technology, computing device 102 includes a security switch 114, which is controlled by an embedded secure element 108 via a secure I / O control bus 116. Security switch 114 can be switched to connect to any of a plurality of hardware devices to obtain quantum random numbers from quantum random number generator 112. Embedded secure element 108 acts as a single root of trust, serving as the secure controller for security switch 114, to manage access to quantum random number generator 112 from multiple hardware devices of computing device 102. Notably, embedded secure element 108, as the ultimate root of trust, is the most trusted entity in the system and securely controls security switch 114.

[0025] The embedded secure element 108 manages and controls when the processor 104 or any other device component 110 can access the quantum random number generator 112 by controlling and owning the security switch 114. If the embedded secure element 108 needs to utilize the quantum random number generator 112, the embedded secure element can ensure that it has access rights and that those access rights are not compromised.

[0026] The trusted execution environment 106 and the embedded secure element 108 of the processor 104 can transmit requests and acknowledgments via the data message transfer bus 118. For example, the trusted execution environment 106 can request a stream of quantum random numbers, and the embedded secure element 108 can initiate the connection of a secure switch 114 to the trusted execution environment via the secure I / O control bus 116. The trusted execution environment 106 then receives quantum random numbers generated by the quantum random number generator 112 via the secure data bus 120 that connects the trusted execution environment 106 to the secure switch. Similarly, the embedded secure element 108 can initiate the connection of the secure switch 114 to the device component 110 via the secure I / O control bus 116. The device component 110 then receives quantum random numbers generated by the quantum random number generator 112 via the secure data bus 122 that connects the device component 110 to the secure switch.

[0027] Figure 2 Examples 200 of quantum-based security features of hardware devices are also shown, such as in reference Figure 1 Implemented in the computing device 102 shown and described. As shown in this example 200, the computing device 102 includes a processor 104 for application processing using a trusted execution environment 106, a quantum random number generator 112, and a security switch 114. An embedded secure element 108 is implemented as an integrated element of the communication component 202, such as a near-field communication (NFC) controller, which incorporates a secure architecture for contactless card access. The secure architecture of the NFC controller includes a secure data bus 204 between the trusted execution environment 106 on the device processor 104 and the embedded secure element 108 on the NFC controller.

[0028] In this example 200, the computing device 102 also includes another communication component 206, such as an ultra-wideband (UWB) controller, an independent subscriber identity module (SIM), or an independent electronic subscriber identity module (eSIM). The secure data bus 122 can be implemented as I... 2The interface can be a C-type addressable SIM I / O bus of any type that can be used to connect multiple devices. Notably, the secure data bus 122 facilitates the connection of multiple hardware devices, such as communication components 202, 206, to the secure switch 114, through which quantum random numbers generated by the quantum random number generator 112 can be received. The computing device 102 can also be implemented using additional communication interfaces between device components, such as any type of I / O bus used for data communication between the UWB controller, processor 104, and / or SIM / eSIM within the device. 2 A C-interface, a Serial Peripheral Interface (SPI) bus, an ISO interface, or any type of SIM I / O bus can be used. For example, a data communication bus 208 can be implemented between the communication component 206 and the processor 104 for data message transmission and communication.

[0029] It is worth noting that the embedded secure element 108 controls the secure switch 114 via the secure I / O control bus 116, and as the single root of trust for the secure switch, the embedded secure element 108 manages access to the quantum random number generator 112 by the communication components 202, 206 and the trusted execution environment 106 of the device processor 104. In terms of the described quantum security technology, the embedded secure element 108 also monitors the entropy source performance associated with the generation of quantum random numbers, and can determine the operational health status of the quantum random number generator 112 based on the monitored entropy source performance.

[0030] In this implementation, data bus control and health checks are performed by the most trusted environment, which is the embedded secure element 108, which receives health data from the quantum random number generator 112 via the secure health I / O data bus 210. The embedded secure element 108 determines the operational health status of the quantum random number generator 112 to ensure the integrity of the quantum-secure system is maintained, the distribution of generated quantum random numbers is within health limits, and the entropy is correct so that if the system is tampered with, the key can be flagged as incorrect and invalidated. If the operational health status of the quantum random number generator 112 falls outside the expected limits, the embedded secure element 108 can control a security switch 114 via the secure I / O control bus 116, for example, to interrupt the flow of quantum random numbers being generated and transmitted to the trusted execution environment 106 of the processor 104 via the secure data bus 120.

[0031] Figure 3Another example 300 of a quantum-based security technique, such as that implemented in a hardware device 302, is illustrated. In this example 300, the computing device 302 can be any type of mobile phone, wireless device, smartphone, computing device, tablet device, and / or any other type of device. Generally, the computing device 302 can be any type of electronic, computing, and / or communication device implemented with various components, such as application processors and memory, and reference... Figure 6 The example device shown may be further described with respect to any number of different components and combinations thereof.

[0032] In this example 300, the computing device 302 includes a processor 304 for application processing in a trusted execution environment (TEE) 306, such as any type of microprocessor, controller, application processor, etc. Generally, the trusted execution environment 306 is a secure area of ​​the processor that provides an isolated execution environment for a higher level of security, isolated execution, and integrity for trusted applications running on the computing device.

[0033] The computing device 302 also includes an embedded secure element (eSE) 308, which is a tamper-proof hardware device, such as a smart card chip, including its own integrated processor (CPU), memory (e.g., ROM, EEPROM, RAM), and I / O ports for tamper-proof connection and data communication with other hardware devices implemented in the computing device 302. In implementation, the embedded secure element 308 can be a standalone component used in mobile phones, for example, for secure payments and financial transactions, for transportation applications, and in secure location access environments. As a standalone component, the embedded secure element 308 can include SIM / eSIM functionality. Notably, the tamper-proof hardware, memory, and secure operating system functionality can be used for secure payment transactions, such as in NFC devices, or for user authentication, such as in SIM cards. The same advanced security features can be used for secure payment transactions or SIM / eSIM applications.

[0034] In other implementations, the embedded secure element 308 can be incorporated as an integrated circuit of a computing device and / or a secure element of another device component 310. For example, the computing device 302 can implement other hardware devices, such as a Near Field Communication (NFC) controller to facilitate mobile payment transactions and other short-range communications between devices, or an Ultra Wideband (UWB) controller to facilitate short-range vehicle and / or building access via wireless communication from a mobile phone. In other implementations, the embedded secure element 108 can be integrated with SIM / eSIM functionality, such as for cellular user identity, authentication, operator billing, roaming, and other mobile applications. Assuming that the tamper-proof and secure operating system requirements for secure payment transactions and user authentication are similar, the secure element (or secure computing hardware and / or software) can be used for secure payments and SIM / eSIM applications.

[0035] Computing device 302 also includes a quantum random number generator (QRNG) 312 for generating quantum random numbers, the quantum random number generator being sourced from any of a plurality of hardware devices within the computing device. For example, the plurality of hardware devices may be tamper-proof components of the computing device, including processor 304 and embedded secure element 308, or integrated circuits or other device components 310 incorporated into the embedded secure element. The quantum random number generator 312 can be shared and accessed as a single, shared quantum random number generator by a plurality of secure and non-secure hardware devices within computing device 302, and can be implemented as described with reference to quantum random number generator 112, as described in reference [reference missing]. Figure 1 and 2 As shown and described.

[0036] In the described quantum security aspect, an embedded secure element 308 implements a virtualized secure switch 314, which is controlled by the embedded secure element and can be switched to provide quantum random numbers from a quantum random number generator 312 to any of a plurality of hardware devices. As described above, the embedded secure element 308 acts as a single root of trust, serving as a security controller for the virtualized secure switch 314, to manage access to the quantum random number generator 312 by a plurality of hardware devices of the computing device 302. In this implementation, the quantum random number generator 312 is switched, and the output is delivered through the embedded secure element 308, which manages and controls when the processor 304 or any other device component 310 can access the quantum random number generator 312 by controlling and owning the virtualized secure switch 314.

[0037] The trusted execution environment 306 of processor 304 and the embedded secure element 308 can transmit requests and acknowledgments via data message transfer bus 316. For example, the trusted execution environment 306 can request a quantum random number, and the embedded secure element 308 can then obtain the requested quantum random number from the quantum random number generator 312 via the secure data bus 318. The embedded secure element 308 receives the quantum random number from the quantum random number generator 312 and routes the requested quantum random number to the trusted execution environment 306 of processor 304 via the virtualized secure switch 314 through the secure data bus 320. Similarly, the embedded secure element 308 can initiate the routing of a quantum random number received from the quantum random number generator 312 via the secure data bus 318 to device component 310 via the virtualized secure switch 314.

[0038] Figure 4 Example 400 of features for quantum-based security in hardware devices is also shown, such as in reference Figure 3 Implemented in the computing device 302 shown and described. As shown in this example 400, the computing device 302 includes a processor 304 for application processing using a trusted execution environment 306, and a quantum random number generator 312. The embedded secure element 308 includes a virtualized secure switch 314 and is implemented as an integrated element of the communication component 402, such as a near field communication (NFC) controller, which incorporates a secure architecture including a secure data bus 320 between the trusted execution environment 306 on the device processor 304 and the embedded secure element 308 on the NFC controller.

[0039] In this example 400, the computing device 302 also includes another communication component 404, such as an ultra-wideband (UWB) controller, an independent subscriber identity module (SIM), or an independent electronic subscriber identity module (eSIM). The secure data bus 318 can be implemented as I... 2 The interface can be either a C-type or addressable SIM I / O bus of any type that can be used to connect multiple devices. Notably, the secure data bus 318 facilitates the connection of multiple hardware devices, such as communication components 402 and 404, via an embedded secure element 308. The embedded secure element 308 controls a virtualized secure switch 314 to route received quantum random numbers generated from the quantum random number generator 312. The computing device 302 can also be implemented using additional communication interfaces between device components, such as any type of I / O bus. 2A C-interface, a Serial Peripheral Interface (SPI) bus, an ISO interface, or any type of SIM I / O bus used for data communication between the UWB controller, processor 304, and / or SIM / eSIM in the device. For example, a data communication bus 406 is implemented between the communication component 404 and the processor 304 for data message transmission and communication.

[0040] It is worth noting that the embedded secure element 308 controls the virtualized secure switch 314, and as a single root of trust for the virtualized secure switch, the embedded secure element 308 manages access to the quantum random number generator 312 by the trusted execution environment 306 of the communication components 402, 404 and the device processor 304. In the described aspects of quantum security, the embedded secure element 308 also monitors the entropy source performance associated with the generation of quantum random numbers, and can determine the operational health status of the quantum random number generator 312 based on the monitored entropy source performance.

[0041] In this implementation, data bus control and health checks are performed by the most trusted environment, which is the embedded secure element 308, which receives health data from the quantum random number generator 312 via the secure health I / O data bus 408. The embedded secure element 308 determines the operational health status of the quantum random number generator 312 to ensure the integrity of the quantum-secure system is maintained, the distribution of the generated quantum random numbers is within health limits, and the entropy is correct so that if the system is tampered with, the key can be flagged as incorrect and invalidated. If the operational health status of the quantum random number generator 312 falls outside the expected limits, the embedded secure element 308 can control the virtualization security switch 314, for example, to interrupt the flow of quantum random numbers being generated and transmitted to the trusted execution environment 306 of the processor 304 via the secure data buses 318 and 320.

[0042] Based on the implementation of quantum-based security in hardware devices, refer to Figure 5 Example method 500 is described. Generally, any services, components, modules, methods, and / or operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Some operations of the example methods can be described in the general context of executable instructions stored on computer-readable storage memory local and / or remote on a computer processing system, and implementations can include software applications, programs, functions, etc. Alternatively or additionally, any functionality described herein can be performed at least in part by one or more hardware logic components, such as, but not limited to, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), etc.

[0043] Figure 5 An example method 500 for quantum-based security of a hardware device is illustrated, generally described with reference to a computing device. The order in which the methods are described is not intended to be construed as limiting, and any number or combination of the described method operations can be performed in any order to perform one method or an alternative method.

[0044] At 502, the device application is processed by a processor in a trusted execution environment. For example, computing device 102 includes a device processor 104 for application processing in a trusted execution environment 106, such as any type of microprocessor, controller, application processor, etc. Similarly, computing device 302 includes a device processor 304 for application processing in a trusted execution environment 306.

[0045] At 504, quantum random numbers are generated by a quantum random number generator whose sources are provided by multiple hardware devices in the computing device. For example, quantum random number generator 112 generates quantum random numbers for any number of hardware devices in computing device 102. The hardware devices are tamper-proof components in computing device 102 that obtain quantum random numbers from quantum random number generator 112, and these hardware devices include processor 104, embedded secure element 108, and / or any other hardware device, such as communication component 202 integrating embedded secure element 108. For example, computing device 102 may include other hardware devices such as near field communication (NFC) controller, ultra-wideband (UWB) controller, independent subscriber identity module (SIM), independent electronic subscriber identity module (eSIM), and / or secure element integrating SIM / eSIM functionality. Similarly, quantum random number generator 312 generates quantum random numbers for any number of hardware devices in computing device 302.

[0046] At 506, an embedded secure element manages the connection security of multiple hardware devices, operating as a security controller for the quantum random number generator. For example, embedded secure element 108 manages the connection security of hardware devices that function as tamper-proof components within computing device 102. Notably, embedded secure element 108 acts as a single root of trust, serving as a security controller for security switch 114, to manage access to the quantum random number generator 112 from multiple hardware devices within the computing device. Similarly, embedded secure element 308 acts as a single root of trust, serving as a security controller for virtualization security switch 314, to manage access to the quantum random number generator 312 from multiple hardware devices within computing device 302.

[0047] At 508, an embedded secure element toggles a secure switch to connect at least one of a plurality of hardware devices requesting quantum random numbers from the quantum random number generator. For example, embedded secure element 108 controls secure switch 114 in computing device 102 via secure I / O control bus 116 to connect any of the hardware devices requesting quantum random numbers from quantum random number generator 112. Similarly, embedded secure element 308 in computing device 302 implements a virtualized secure switch 314, which is controlled by embedded secure element 308 and can be switched to provide quantum random numbers from quantum random number generator 312 to any of the plurality of hardware devices.

[0048] At 510, the entropy source performance associated with generating quantum random numbers is monitored. For example, an embedded security element 108 implemented in computing device 102 receives health data from quantum random number generator 112 via security health I / O data bus 210 and monitors the entropy source performance associated with generating quantum random numbers for hardware devices in the computing device. Similarly, an embedded security element 308 implemented in computing device 302 receives health data from quantum random number generator 312 via security health I / O data bus 408 and monitors the entropy source performance associated with generating quantum random numbers for hardware devices in the computing device.

[0049] In 512, the embedded secure element determines the operational health status of the quantum random number generator based on the monitored entropy source performance. For example, the embedded secure element 108 implemented in computing device 102 determines the operational health status of quantum random number generator 112 based on the monitored entropy source performance of the quantum random number generator. Embedded secure element 108 determines the operational health status of quantum random number generator 112 to ensure that the integrity of the quantum-secure system is maintained, the distribution of generated quantum random numbers is within health limits, and that the entropy is correct for cryptographic applications. Similarly, the embedded secure element 308 implemented in computing device 302 determines the operational health status of quantum random number generator 312 based on the monitored entropy source performance of the quantum random number generator.

[0050] Figure 6 Various components of example device 600 are illustrated, which can implement aspects of the quantum-based security techniques and features for hardware devices as described herein. Example device 600 can be implemented with reference to the preceding... Figures 1 to 5 Any device described, such as any type of wireless device, mobile device, mobile phone, flip phone, client device, companion device, pairing device, display device, tablet computer, computing, communication, entertainment, gaming, media playback and / or any other type of computing and / or electronic device. For example, see references. Figures 1 to 5The computing devices 102 and 302 described can be implemented as example device 600.

[0051] Example device 600 may include various communication devices 602 that enable wired and / or wireless communication of device data 604 with other devices. As described herein, communication device 602 may be implemented as any communication component implemented in a computing device, such as a Near Field Communication (NFC) controller, an Ultra Wideband (UWB) controller, a standalone Subscriber Identity Module (SIM), a standalone Electronic Subscriber Identity Module (eSIM), and / or a secure element integrated with SIM / eSIM functionality, such as those implemented in computing devices 102, 302. Device data 604 may include any of various device data and content that is generated, processed, determined, received, stored, and / or transferred from one computing device to another and / or synchronized between multiple computing devices. Typically, device data 604 may include any form of audio, video, image, graphic, and / or electronic data generated by applications executing on the device. Communication device 602 may also include a transceiver for cellular telephone communication and / or any type of network data communication.

[0052] Example device 600 may also include various types of data input / output (I / O) interfaces 606, such as data network interfaces that provide connectivity and / or communication links between devices, data networks, and other devices. I / O interface 606 can be used to couple the device to any type of component, peripheral device, and / or accessory device, such as a computer input device that can be integrated with example device 600. I / O interface 606 may also include a data input port through which any type of data, information, media content, communication, message, and / or input can be received, such as user input to the device, and any type of audio, video, image, graphic, and / or electronic data received from any content and / or data source.

[0053] Example device 600 includes a processor system 608 of one or more processors (e.g., any one of a microprocessor, controller, etc.) and / or a processor and memory system implemented as a system-on-a-chip (SoC) to process computer-executable instructions. The processor system may be implemented at least partially in computer hardware, which may include components of integrated circuits or SoCs, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations in silicon and / or other hardware. Processor system 608 may also incorporate and utilize a trusted execution environment, such as trusted execution environment 106 of processor 104 in computing device 102, or trusted execution environment 306 of processor 304 in computing device 302. Alternatively or additionally, example device 600 may be implemented using any one or a combination of software, hardware, firmware, or fixed logic circuitry, which may be incorporated into the processing and control circuitry generally identified at 610.

[0054] Example device 600 may also include any type of system bus or other data and command transmission system coupling various components within the device. The system bus may include different bus structures and architectures, as well as any one or a combination of control lines and data lines. For example, the described computing devices 102, 302 include any one or more secure data buses for transmitting generated quantum random numbers from secure switch 114 and / or from embedded secure element 308 via virtualized secure switch 314 to a hardware device that is a tamper-proof component implemented within the computing device.

[0055] Example device 600 also includes memory and / or memory device 612 (e.g., computer-readable storage memory) that implements data storage, such as a data storage device implemented in hardware accessible by a computing device, and provides persistent storage for data and executable instructions (e.g., software applications, programs, functions, etc.). Examples of memory device 612 include volatile and non-volatile memory, fixed and removable media devices, and any suitable memory device or electronic data storage device that maintains data for access by a computing device. Memory device 612 can include various implementations of random access memory (RAM), read-only memory (ROM), flash memory, and other types of storage media in various memory device configurations. Example device 600 may also include mass storage media devices.

[0056] Memory device 612 (e.g., as a computer-readable storage device) provides data storage mechanisms, such as storing device data 604, other types of information and / or electronic data, and various device applications 614 (e.g., software applications and / or modules). For example, operating system 616 can be maintained on the storage device as software instructions and executed by processor system 608 as a software application. Device application 614 may also include device managers, such as any form of control application, software application, signal processing and control module, device-specific code, device-specific hardware abstraction layer, etc.

[0057] In this example, device 600 also includes device components that implement various aspects of the described features and techniques for quantum-based security of hardware devices, such as an embedded secure element 618, a secure switch 620, and a quantum random number generator 622. These components can be implemented using hardware components and / or software, as when example device 600 is implemented as a reference. Figures 1 to 5 When describing computing devices 102 and 302.

[0058] Example device 600 may also include a microphone 624 and / or a camera device 626, and a motion sensor 628, such as a component that can be implemented as an inertial measurement unit (IMU). The motion sensor 628 can be implemented using various sensors, such as gyroscopes, accelerometers, and / or other types of motion sensors, to sense the motion of the device. The motion sensor 628 can generate a sensor data vector with three-dimensional parameters (e.g., rotation vectors in x, y, and z-axis coordinates) indicating the device's location, position, acceleration, rotational speed, and / or orientation. Example device 600 may also include one or more power sources 630, for example, when the device is implemented as a wireless and / or mobile device. The power source may include a charging and / or power system and can be implemented as a flexible strip battery, a rechargeable battery, a rechargeable supercapacitor, and / or any other type of active or passive power source.

[0059] Example device 600 may also include an audio and / or video processing system 632 that generates audio data for audio system 634 and / or display data for display system 636. The audio system and / or display system may include any type of device or module that generates, processes, displays, and / or otherwise presents audio, video, display, and / or image data. Display data and audio signals can be transmitted to the audio component and / or display component via any type of audio and / or video connection or data link. In one implementation, the audio system and / or display system are integrated components of example device 600. Alternatively, the audio system and / or display system are external peripheral components of the example device.

[0060] Although implementations of quantum-based security for hardware devices have been described using language specific to features and / or methods, the appended claims are not necessarily limited to the specific features or methods described. Rather, specific features and methods are disclosed as exemplary implementations of quantum-based security for hardware devices, and other equivalent features and methods are intended to fall within the scope of the appended claims. Furthermore, various different examples are described, and it should be understood that each described example can be implemented independently or in combination with one or more other described examples. Other aspects of the techniques, features, and / or methods discussed herein relate to one or more of the following:

[0061] A computing device includes: a processor configured for application processing in a trusted execution environment; a quantum random number generator configured to generate quantum random numbers from sources provided by a plurality of hardware devices in the computing device; and an embedded security element configured to act as a security controller for the quantum random number generator to manage the connectivity security of the plurality of hardware devices.

[0062] As an alternative or supplement to the aforementioned computing device, any one or a combination of the following: An embedded secure element serves as a single root of trust for the secure controller of the quantum random number generator. The embedded secure element is configured to monitor the entropy source performance associated with the generation of quantum random numbers and determine the operational health status of the quantum random number generator based on the monitored entropy source performance. Multiple hardware devices are tamper-proof components including at least a processor and an embedded secure element. Multiple hardware devices are tamper-proof components including at least a processor and an integrated circuit incorporated into the embedded secure element. The computing device also includes a secure switch controlled by the embedded secure element, which is switchable to connect at least one of the multiple hardware devices to obtain quantum random numbers from the quantum random number generator. The at least one hardware device receives quantum random numbers generated by the quantum random number generator via a secure data bus connecting the at least one hardware device to the secure switch. The computing device also includes a virtualized secure switch implemented in the embedded secure element, which is switchable to connect at least one of the multiple hardware devices to obtain quantum random numbers from the quantum random number generator. The at least one hardware device receives a quantum random number, which is transmitted through an embedded secure element and via a secure data bus to which the at least one hardware device is connected.

[0063] A computing device includes: a processor configured for application processing in a trusted execution environment; a quantum random number generator configured to generate quantum random numbers from sources provided by a plurality of hardware devices in the computing device; and a security switch controlled by an embedded security element that manages the connection security of the plurality of hardware devices, the security switch being switchable to connect at least one of the plurality of hardware devices to obtain quantum random numbers from the quantum random number generator.

[0064] As an alternative or supplement to the aforementioned computing device, any one or a combination of the following: An embedded secure element is a single root of trust serving as a secure controller for a secure switch, managing access to the quantum random number generator by multiple hardware devices. The embedded secure element is configured to monitor the entropy source performance associated with the generation of quantum random numbers and determine the operational health status of the quantum random number generator based on the monitored entropy source performance. The multiple hardware devices are tamper-proof components including at least a processor and an embedded secure element. The multiple hardware devices are tamper-proof components including at least a processor and an integrated circuit incorporated into the embedded secure element. The at least one hardware device receives quantum random numbers generated by the quantum random number generator via a secure data bus connecting the at least one hardware device to the secure switch. The secure switch is a virtualized secure switch implemented in the embedded secure element, and the at least one hardware device receives quantum random numbers that are transmitted through the embedded secure element and via the secure data bus connecting the at least one hardware device to the embedded secure element.

[0065] A method comprising: generating quantum random numbers by means of a quantum random number generator whose sources are provided by a plurality of hardware devices in a computing device; managing the connection security of the plurality of hardware devices by means of an embedded security element that operates as a security controller for the quantum random number generator; and switching a security switch by the embedded security element to connect at least one of the plurality of hardware devices that request quantum random numbers from the quantum random number generator.

[0066] As an alternative or supplement to the above methods, any one or a combination of the following: An embedded security element is a single root of trust serving as a security controller for a security switch, managing access to the quantum random number generator from multiple hardware devices. The method also includes monitoring the entropy source performance associated with generating quantum random numbers, and determining the operational health status of the quantum random number generator by the embedded security element based on the monitored entropy source performance. The security switch is a virtualized security switch implemented within the embedded security element.

Claims

1. A computing device, comprising: A processor configured for application processing in a trusted execution environment; A quantum random number generator, configured to generate quantum random numbers from sources provided by multiple hardware devices in the computing device; as well as An embedded secure element is configured to act as a security controller for the quantum random number generator to manage the connection security of the plurality of hardware devices.

2. The computing device according to claim 1, wherein, The embedded security element is a single root of trust that serves as the security controller of the quantum random number generator.

3. The computing device according to claim 1, wherein, The embedded security element is configured to: Monitoring the entropy source performance associated with the generation of the quantum random numbers; and The operational health status of the quantum random number generator is determined based on the monitored entropy source performance.

4. The computing device according to claim 1, wherein, The plurality of hardware devices are tamper-proof components including at least the processor and the embedded security element.

5. The computing device according to claim 1, wherein, The plurality of hardware devices are tamper-proof components that include at least the processor and an integrated circuit incorporated into the embedded security element.

6. The computing device of claim 1 further includes a security switch controlled by the embedded security element, the security switch being switchable to connect at least one of the plurality of hardware devices to obtain quantum random numbers from the quantum random number generator.

7. The computing device according to claim 6, wherein, At least one hardware device receives a quantum random number generated by the quantum random number generator via a secure data bus that connects the at least one hardware device to the security switch.

8. The computing device of claim 1, further comprising a virtualized security switch implemented in the embedded security element, the virtualized security switch being switchable to connect at least one of the plurality of hardware devices to obtain quantum random numbers from the quantum random number generator.

9. The computing device according to claim 8, wherein, At least one hardware device receives the quantum random number, which is transmitted through the embedded secure element and via a secure data bus that connects the at least one hardware device to the embedded secure element.

10. A computing device, comprising: A processor configured for application processing in a trusted execution environment; A quantum random number generator, configured to generate quantum random numbers from sources provided by multiple hardware devices in the computing device; as well as A safety switch, controlled by an embedded security element that manages the connection security of the plurality of hardware devices, is switchable to connect at least one of the plurality of hardware devices to obtain quantum random numbers from the quantum random number generator.

11. The computing device according to claim 10, wherein, The embedded security element is a single root of trust that acts as a security controller for the security switch, managing access to the quantum random number generator from the plurality of hardware devices.

12. The computing device according to claim 10, wherein, The embedded security element is configured to: Monitoring the entropy source performance associated with the generation of the quantum random numbers; and The operational health status of the quantum random number generator is determined based on the monitored entropy source performance.

13. The computing device according to claim 10, wherein, The plurality of hardware devices are tamper-proof components including at least the processor and the embedded security element.

14. The computing device according to claim 10, wherein, The plurality of hardware devices are tamper-proof components that include at least the processor and an integrated circuit incorporated into the embedded security element.

15. The computing device according to claim 10, wherein, At least one hardware device receives a quantum random number generated by the quantum random number generator via a secure data bus that connects the at least one hardware device to the security switch.

16. The computing device according to claim 10, wherein: The safety switch is a virtualized safety switch implemented in the embedded safety element; and At least one hardware device receives the quantum random number, which is transmitted through the embedded secure element and via a secure data bus that connects the at least one hardware device to the embedded secure element.

17. A method in a computing device, comprising: Quantum random numbers are generated using a quantum random number generator that draws from multiple hardware devices within a computing device. The connection security of the plurality of hardware devices is managed by an embedded security element, which operates as a security controller for the quantum random number generator; as well as The embedded security element switches a security switch to connect at least one of a plurality of hardware devices that request quantum random numbers from the quantum random number generator.

18. The method according to claim 17, wherein, The embedded security element is a single root of trust that acts as a security controller for the security switch, managing access to the quantum random number generator from the plurality of hardware devices.

19. The method of claim 17, further comprising: Monitor the entropy source performance associated with the generation of the quantum random numbers; as well as Based on the monitored entropy source performance, the embedded security element determines the operational health status of the quantum random number generator.

20. The method of claim 17, wherein, The safety switch is a virtualized safety switch implemented in the embedded safety element.

Images