Method for providing a digital key

Abstract

The invention relates to a method (100) for providing a digital key to a processor unit (14) using a computer system (12), in which the digital key is provided within application code and an instruction sequence (20) is stored in the application code. In a method (100), a digital key is generated (110) using a computer system (12) and divided (120) into at least two key parts. The key portion is embedded (130) in at least two instructions (20) transmitted (140) from the computer system (12) to the application code of the processor unit (14).

Description

[0001] The present invention belongs to the field of cryptography. In particular, the present invention relates to a method for providing a digital key by a computer system to a processor unit and a corresponding method for reconstructing the digital key by the processor unit.

[0002] In some application scenarios, it is desirable to provide a digital key to a processor unit. The digital key contains confidential information for a specific processor unit. For example, the provided confidential information can be used for subsequent authentication of the processor unit.

[0003] Many methods for providing digital keys are known from cryptography, each having advantages and disadvantages. However, for all methods it is necessary to provide the digital keys in a secure manner so that unauthorized persons cannot access the provided keys. Even if no method can generally provide 100 percent security, it is at least desirable to make potential attacks by unauthorized persons as difficult as possible.

[0004] US2019 / 028273A1 describes a method for encrypting data. The method does not use a conventional key for encryption. Instead, future events are used as secret keys for encryption. Here, a transient key that is not permanently stored is used to encrypt data. In this way, the risk of key theft is reduced.

[0005] A method for encrypting data is proposed in US2020 / 159676A1. The method uses a cryptographically encoded pointer in a multi-party environment. For example, a first instruction is provided to generate a first address key for a private memory area in a memory unit, and to generate a first cryptographically encoded pointer to the private memory area of ​​the memory unit. Generating the first cryptographically encoded pointer includes storing context information assigned to the private memory area. In the method, a pointer generated by a first cryptographically generated pointer that allows one party in a multi-party environment to access a first address key and a private memory area can be provided.

[0006] In view of the above, it is an object of the present invention to provide a method for providing a processor unit with a digital key, wherein access to the digital key by unauthorized persons is made as difficult as possible.

[0007] In order to achieve the above object, the present invention proposes a method for a computer system to provide a digital key for a processor unit, wherein the digital key is provided in an application code, and wherein the instruction sequence is stored in the application code. In the method according to the present invention, the following method steps are provided:

[0008] - Generate a digital key to be provided by the computer system;

[0009] - splitting the digital key into at least two key parts;

[0010] - embedding the key portion in at least two instructions of the application code; and

[0011] - transferring the application code from the computer system to the processor unit.

[0012] In the method according to the invention, a digital key is embedded in the application code and "hidden" therein. Different key parts are stored in different instructions of the application code. The processor unit knows where the confidential information is stored in the application code, so that the processor unit can reconstruct the digital key and the confidential information it contains after receiving the application code. In this way, the key to be sent is hidden in the application code, making it difficult for a potential attacker to reconstruct the confidential information because he does not know where the various key parts are stored in the application code. In this regard, the application code has areas in which instructions are encoded and areas in which confidential information is encoded. The splitting of the digital key and the embedding of the key parts are performed by a computer system, which may also be referred to as a compiler system in the context of the present invention.

[0013] According to one embodiment of the invention, it can be arranged that embedding the key portion in at least two instructions of the application code comprises embedding the key portion in a specific field of the instruction that usually remains unused. In practice, it can be seen that some instruction sets of processor units contain instructions with unused specific fields. Therefore, it is advantageous to arrange the key portion in the unused fields of the instruction. In this way, the digital key can be provided particularly efficiently. Therefore, a preferred embodiment allows the digital key to be embedded in the application code without increasing the overall size of the application code.

[0014] Preferably, it can be set that the application code is designed as a RISC-V (Reduced Instruction Set Computer V) application code, wherein the instructions are particularly designed as R-type instructions, and wherein the embedding of the key part is preferably performed in the Funct7 field. As described above, the key part can preferably be embedded in an unused field of the instruction. An example thereof is the R-type instruction of the RISC-V instruction set. Within the R-type instruction, for example, a Funct7 field that is usually unused is provided. This makes the Funct7 field particularly suitable for embedding the key part in these fields. In this way, the digital key can be embedded in the application code without increasing the amount of data required for the application code. This ensures that the digital key is provided particularly efficiently. For example, even though the Funct7 field of the R-type instruction is mentioned above, it is obvious to those skilled in the art that the present application is not limited to the mentioned fields. On the contrary, the key part can also be embedded in various other fields or other instructions.

[0015] In an advantageous embodiment of the method according to the invention, it can further be provided that the generation of the digital key provided by the computer system comprises the following method steps:

[0016] - generating a first key by the computer system, whereby the first key contains confidential information to be sent to the processor unit;

[0017] - reading a hardware identifier from the processor unit, the hardware identifier comprising a unique identifier of the processor unit; and

[0018] - calculating said digital key to be provided by said computer system, said calculation being performed as a function of said first key and said hardware identifier.

[0019] The first key can also be regarded as a software key, because it is generated based on software and does not contain any hardware-related information. In particular, the first key does not contain any hardware-related information for the specified processor unit. On the other hand, the hardware identifier contains specific information about the processor unit. In particular, the hardware identifier allows the unique assignment of the corresponding processor unit for which the digital key is provided. The hardware identifier can also be called a hardware fingerprint. In general, various hardware identifiers that allow the unique identification of the processor unit are known. Some specific examples of hardware identifiers are given below. The hardware identifier can be read out by a request from the computer system to the processor unit and a subsequent response from the processor unit to the computer system. Calculating the digital key to be provided based on the first key and the hardware identifier has the following advantage: the hardware identifier of the processor unit must be known for the subsequent reconstruction of the first key. In other words, the first key is encrypted with the hardware identifier. Therefore, an unauthorized person who has previously successfully learned the digital key may not easily reconstruct the first key. In this way, the security of the method according to the invention is further improved. There are various options for calculating the digital key to be provided based on the first key and the hardware identifier. For example, the digital key can be calculated as the sum of the first key and the hardware identifier. In this case, the processor unit with its specific hardware identifier can calculate the first key by subtracting the hardware identifier from the received digital key. In a similar manner, it is also possible to provide that the digital key to be provided is calculated by multiplying the first key with the hardware identifier or by subtracting the hardware identifier from the first key.

[0020] According to the method of the present invention, it can be provided that the hardware identifier includes a serial number of the processor unit or a serial number of a storage element of the processor unit.

[0021] Furthermore, the method according to the invention can be designed so that the hardware identifier includes specific information of the memory element, in particular the DRAM memory element of the processor unit. This makes use of the fact that the memory elements of a processor unit are in fact never completely identical, but have marginal differences, which make it possible to identify the memory element or the processor unit.

[0022] The method according to the invention may also be designed such that the calculation of the digital key to be provided based on the first key and the hardware identifier comprises applying an XOR operator to the first key and the hardware identifier.

[0023] According to a preferred embodiment of the method according to the invention, it can be provided that the hardware identifier is designed as a temperature-dependent hardware identifier. This can further increase the security of the method according to the invention. An attacker who has previously successfully obtained knowledge of the provided digital key and knowledge of the hardware identifier still cannot easily reconstruct the first key, because the key required for decryption (= hardware identifier) ​​can only be read at a specific temperature. For example, if the hardware identifier is read at a temperature of 20°C during the generation of the digital key to be provided by the computer system, but an attack by an unauthorized person is performed at a temperature of 25°C, the attacker will obtain a hardware identifier that is not suitable for reconstructing the first key. This makes a possible attack by an unauthorized person significantly more difficult.

[0024] According to an advantageous embodiment of the method according to the invention, it can be provided that the hardware identifier includes information about a specific charging time of a capacitor of a DRAM memory element or information about a delay time of the DRAM memory element. The specific charging time of the capacitor of the DRAM memory element and the information about the delay time of the DRAM memory element are specific variables that allow a reliable identification of the corresponding DRAM memory element. During a subsequent reconstruction of the first key, the processor unit that knows the information about the DRAM memory element can use this information to decrypt the digital key. For a potential attacker who does not have this hardware information, it is impossible (or at least significantly more difficult) to obtain possession of the first key without the necessary hardware information.

[0025] Furthermore, according to a preferred embodiment of the method according to the present invention, it can be designed that the hardware identifier is determined by a method based on machine learning. The method based on machine learning may have been previously trained with training data. The training data may, for example, have a temperature value (or temperature range) and a readout measurement value (for example, specifically, readout information of a DRAM memory element, specifically, specific information about a specific charging time of a capacitor or about a delay time of a memory element) as input variables, and a hardware identifier corresponding to the input variable as an output variable. The readout measurement value can be a temperature-related value in particular. In this way, the method based on machine learning can learn which hardware identifier to generate for one or more processor units at certain temperatures during the training process. If the hardware identifier or the measurement value assigned to the hardware identifier is then read out at a specific temperature, the method based on machine learning can, for example, calculate a unified hardware identifier that allows the processor unit to be uniquely identified. In this way, temperature-related effects can be compensated so that the same hardware identifier is always output for the processor unit regardless of the current ambient temperature.

[0026] In addition, in order to achieve the above object, a method for reconstructing a digital key by a processor unit is proposed, the method comprising the following steps:

[0027] - receiving an application code from a computer system, wherein a sequence of instructions and a digital key are stored in said application code; and wherein said digital key comprises at least two key parts stored discontinuously in said application code;

[0028] - assembling said digital key from at least two key parts.

[0029] The processor unit has information in advance about where the various key parts are stored in the application code. For example, the processor unit may know that a specific field of a specific instruction is provided for storing the key parts. In this way, the processor unit can search for specific fields in the application code, extract the various key parts from these fields, and then combine the various key parts into a digital key. In addition, the processor unit can be modified in such a way that it interprets additional instructions about the total number of key parts stored in the application code. This is advantageous because the length of the entire key can be determined as early as possible for later use. This also enables the entire key to be effectively partially used for various applications at a later date. It is well known from the prior art in cryptography that the same key should preferably be used only for a specific purpose, such as encryption or the creation of a digital signature, rather than for both at the same time.

[0030] Preferably, it can be designed that the application code is designed as RISC-V application code, wherein the instructions are particularly designed as R-type instructions, and wherein the embedding of the key part is preferably performed in the Funct7 field.

[0031] It may also be provided that the method comprises the following steps:

[0032] - calculating a first key containing confidential information based on the digital key received from the computer system and a hardware identifier of the processor unit.

[0033] The calculation of the first key depends on how the digital key was previously calculated.The first digital key may be calculated, for example, by addition, subtraction or by applying an XOR operator to the received digital key and the hardware identifier.

[0034] Preferably, the hardware identifier comprises specific information of a DRAM memory element of the processor unit.

[0035] Advantageously, it can be provided that the hardware identifier is designed as a temperature-dependent hardware identifier.

[0036] It can also be provided that the hardware identifier comprises information about a specific charging time of a capacitor of the DRAM memory element or information about a delay time of the DRAM memory element.

[0037] Furthermore, a computer system comprising a computing unit, a memory unit and a communication unit is proposed for achieving the above-mentioned object, wherein the computer system is provided for providing a digital key within an application code, and wherein the computing unit of the computer system is configured to:

[0038] - Provide digital key;

[0039] - splitting the digital key into at least two key parts;

[0040] - embedding the key portion in at least two instructions of the application code; and

[0041] - transferring said application code to a processor unit.

[0042] Furthermore, a processor unit for reconstructing a digital key is proposed for solving the above-mentioned task, the processor unit being configured to:

[0043] - receiving an application code from a computer system, wherein a sequence of instructions and a digital key are stored in said application code; and wherein said digital key comprises at least two key parts stored discontinuously in said application code;

[0044] - assembling said digital key from said at least two key parts.

[0045] Furthermore, in order to advantageously perform the present task and increase security, a cryptographic calculation unit can be provided, which cooperates with the following units of the overall system to apply any error correction on the one hand, but on the other hand isolates the entire key from the processor unit, so that cryptographic operations such as encryption or digital signatures are directly performed by this unit and only the results of these operations are sent to the processor unit. This results in a strong separation and confidentiality of the entire key from the higher-level program logic.

[0046] In the following, the present invention is described in more detail with reference to the accompanying drawings. In the drawings:

[0047] Figure 1 A first embodiment of the method according to the invention is shown,

[0048] Figure 2 The method steps for generating a digital key to be provided according to an example of an embodiment of the present invention are shown.

[0049] Figure 3 shows instructions with various fields that are partially occupied and partially unused, and

[0050] Figure 4 A system including a computer system and a processor unit is shown.

[0051] Figure 1 A first embodiment of a method 100 according to the present invention is shown. In this embodiment, the method 100 according to the present invention has method steps 110-140. In the first method step 110, a computer system generates a digital key to be provided. The digital key may be a randomly generated number. The digital key contains information that should be provided to a processor unit in a secure manner so that a potential attacker cannot easily reconstruct the key. In the second method step 120, the digital key is divided into at least two key parts. In fact, the digital key can be divided into tens, hundreds or even thousands of key parts. Regardless of the exact number of key parts, the principle of the present invention remains the same. Subsequently, in the third method step 130, each key part is embedded in at least two instructions 20 of the application code. According to a particularly effective embodiment of the present invention, the key part can be embedded in a specific field of an instruction that is usually kept unused. This allows the digital key to be embedded in the application code without affecting the overall size of the application code. On the one hand, this is particularly effective because the digital key can be integrated without increasing the amount of data required for the application code. On the other hand, this prevents a potential attacker from being able to infer whether the application code contains a key based on the size of the application code. For example, the application code may be a RISC-V application code, and the key portion is embedded in the Funct7 field of the R-type instruction. Subsequently, in a fourth method step 140, the application code is transferred from the computer system to the processor unit. The processor unit may then reconstruct the digital key from the received application code.

[0052] Figure 2 A method for generating ( Figure 1The method step of providing a digital key to be provided by a computer system in step 110 of the embodiment of the present invention. In a first sub-step 112, a first key containing confidential information to be sent to a processor unit is generated. The first key is encrypted using a hardware-based key before being transmitted to the processor unit, so that a potential attacker cannot easily reconstruct the first key. In a second sub-step 114, a hardware identifier of the processor unit is read out. The hardware identifier (also referred to as hardware ID) has a unique identifier of the processor unit, thus enabling the processor unit to be uniquely identified. In particular, the hardware identifier may contain specific information of a DRAM memory element of the processor unit. In a third sub-step 116, a digital key to be provided is calculated based on the first key and the hardware identifier, which is sent to the processor unit. As described above, the calculation may be performed, for example, by addition, subtraction or by applying an XOR operator to the first digital key and the hardware identifier. Here, the first digital key and the hardware identifier may, for example, be binary numbers each having 128 bits or 256 bits.

[0053] Figure 3 An instruction 20 with various fields 22 is shown, wherein the fields 22 are partially occupied and partially unused. For example, it can be designed that each field 22 has a length of 10 bits. Therefore, Figure 3 The illustrated instruction 20 may include 80 bits. Of the total eight fields 22, five fields 22 contain information related to the instruction 20. These are Figure 3 is shown as shaded field 22. In addition, Figure 3 The instruction 20 shown includes three unused fields 22. The unused fields 22 are particularly suitable as containers for holding key components. If the key parts are stored in these containers, digital keys can be provided in a particularly efficient manner without changing the amount of data required for the application code.

[0054] Figure 4 System 10 is shown including computer system 12 and processor unit 14. Figure 4 In the illustrated embodiment, there is bidirectional communication between the computer system 12 and the processor unit 14. For example, the computer system 12 can read the hardware identifier of the processor unit 14 and then calculate the digital key to be provided based on the first key containing the confidential information and the hardware identifier. In this way, the computer system 12 can generate the key to be provided, which is encrypted with the hardware information of the processor unit 14. After the computer system 12 generates the digital key to be provided, the digital key to be provided can be divided into at least two key parts, where each key part is embedded in at least two instructions of the application code before the application code is sent to the processing unit 14.

[0055] Reference numerals list 10 System 12 Computer Systems 14 Processor Units 20 Instructions 22 Fields 100 Methods 110 First Method Step 112 First Substep 114 Second Substep 116 The third sub-step 120 Second method step 130 Third Method Step 140 Fourth Method Step

Claims

1. A method (100) for providing a digital key to a processor unit (14) using a computer system (12), the digital key being provided within an application code and an instruction sequence (20) being stored in the application code, characterized in that The method (100) comprises the following steps: - generating (110) a digital key to be provided by the computer system (12); - splitting (120) the digital key into at least two key parts; - embedding (130) the key portion in at least two instructions (20) of the application code; and - sending (140) the application code from the computer system (12) to the processor unit (14).

2. The method (100) according to claim 1, characterized in that Embedding (130) the key portion in at least two instructions (20) of the application code comprises embedding the key portion in a specific field of the instruction (20) that normally remains unused.

3. The method (100) according to claim 1 or 2, characterized in that: The application code is designed as a RISC-V application code, the instruction (20) is particularly designed as an R-type instruction, and the embedding of the key part is preferably performed in a Funct7 field.

4. The method (100) according to any one of claims 1 to 3, characterized in that: Generating (110) the digital key to be provided by the computer system (12) comprises the following steps: - generating (112) a first key containing confidential information to be sent to said processor unit (14); - reading (114) a hardware identifier, said hardware identifier comprising a unique identifier of said processor unit (14); and - calculating (116) the digital key to be provided based on the first key and the hardware identifier.

5. The method (100) according to claim 4, characterized in that The hardware identifier includes specific information of a DRAM memory element of the processor unit (14).

6. The method (100) according to claim 4 or 5, characterized in that Calculating the digital key to be provided based on the first key and the hardware identifier includes applying an XOR operation to the first key and the hardware identifier.

7. The method (100) according to any one of claims 4 to 6, characterized in that The hardware identifier is designed as a temperature-dependent hardware identifier.

8. The method (100) according to claim 7, characterized in that The hardware identifier includes information about a specific charging time of a capacitor of the DRAM memory element or information about a delay time of the DRAM memory element.

9. The method (100) according to any one of claims 4 to 8, characterized in that The hardware identifier is determined by a machine learning based method (100).

10. A method for reconstructing a digital key by means of a processor unit (14), characterized in that The method comprises the following steps: - receiving an application code from a computer system (12), wherein an instruction sequence (20) and a digital key are stored in the application code; and the digital key comprises at least two key parts stored discontinuously in the application code; - assembling said digital key from said at least two key parts.

11. The method according to claim 10, characterized in that The application code is designed as a RISC-V application code, the instruction (20) is particularly designed as an R-type instruction, and the embedding (130) of the key part is preferably performed in a Funct7 field.

12. The method according to claim 10 or 11, characterized in that: The method further comprises the following steps: - calculating a first key containing confidential information based on the digital key received from the computer system (12) and the hardware identifier of the processor unit.

13. The method according to any one of claims 10 to 12, characterized in that The hardware identifier includes specific information of a DRAM memory element of the processor unit (14).

14. The method according to any one of claims 10 to 13, characterized in that: The hardware identifier is designed as a temperature-dependent hardware identifier.

15. The method according to any one of claims 10 to 14, characterized in that The hardware identifier includes information about a specific charging time of a capacitor of the DRAM memory element or information about a delay time of the DRAM memory element.

Images