Generating cryptographic keys based on hardware component fingerprints

Abstract

This invention relates to a method for generating a first cryptographic key (K1) for a system (3), wherein the system (3) includes hardware components (1, 2), the method comprising the steps of: - obtaining a first set of tags for a first group, wherein the first set of tags assigns a first hardware component (1) to the first group, wherein the hardware components (1, 2) of the system (3) include the first hardware component (1); - obtaining a first fingerprint of the first hardware component (1); - generating the first cryptographic key (K1), wherein the generation is performed by deriving the first cryptographic key (K1) from the first fingerprint. Furthermore, this invention relates to an associated computer program and a higher-level system (3).

Description

[0001] Regardless of the grammatical gender of a particular term, it includes individuals of all genders. Technical Field

[0002] This invention relates to a method for generating a first cryptographic key for a system, wherein the system has hardware components. Furthermore, this invention relates to associated computer programs and higher-level systems. Background Technology

[0003] A key requirement for cryptographic security methods in devices (especially in Internet of Things (IoT) environments) is the secure storage of cryptographic keys, which can only be accessed or used by authorized entities of the IoT devices.

[0004] Cryptographic keys are typically securely stored in hardware-based (HW) secure elements and / or trust anchors, particularly in Trusted Platform Modules (TPMs) or Hardware Security Modules (HSMs). Alternatively, physically unclonable functions (PUFs) can be used to store cryptographic keys in a secure manner and method (i.e., using methods to enhance or ensure security). This storage method eliminates the need for permanently and explicitly storing the cryptographic key; instead, the key is repeatedly generated using the PUF and stored auxiliary data only when needed.

[0005] Typically, the initial ("master") key is stored securely "only," and additional keys are generated at runtime as needed via the Key Derivation Function (KDF).

[0006] Secure elements (SEs) capable of storing cryptographic keys in secure ways and methods are known. Additional authentication methods that allow access to these keys within the SE are also known. Secure elements can have tamper-proof protection. However, this only protects the SE itself, not the IoT device as a whole.

[0007] Tamper protection against intrusion into devices is known in hardware security modules. This can be achieved through features such as housing switches, drill-proof foil, or radiation sensors. However, tamper monitoring is very costly and requires batteries for continuous monitoring.

[0008] Furthermore, it is known that drill-proof foils similar to semiconductor PUFs can be used for key generation or key storage (Siemens, "TAMPER PROTECTION DEVICE FOR PROTECTING A FIELD DEVICE AGAINST TAMPERING", EP2673733B1; US9858446B2).

[0009] Furthermore, physically unclonable functions (PUFs) capable of generating hardware-specific fingerprints in CMOS circuits are also known. This fingerprint (typically generated after error correction by a fuzzy key extractor with auxiliary data) or its derivatives can be used as a device-specific key or as an "identity / fingerprint" for identification or authentication.

[0010] One type of "weak PUF" is the optical PUF, also known as the "Optical Physical One-Way Function (OPOWF)". Its mechanism is based on an optical system / sensor that must establish the exact same relative positioning of the light-scattering marker, laser beam, and CCD camera on each readout. This implementation is costly and potentially error-prone.

[0011] Furthermore, the different safety states that the equipment can be in are also known.

[0012] Furthermore, key derivation functions are also known. Here, another cryptographic key is derived from a cryptographic key (or other data) and derivation parameters. For example, identifiers of software components, hardware components, or strings characterizing the purpose of the derived key can be used as derivation parameters. Multiple keys can be derived from a single key using key derivation functions.

[0013] Furthermore, secure booting with cryptographic verification using software components (secure booting, verification booting, measurement booting, trusted booting, etc.) is also known. It is also known that the identity of hardware components can be verified during secure booting.

[0014] Furthermore, the "sealed object" in the TPM is also known. Depending on the contents of the so-called Platform Configuration Register (PCR), which depends on the system's HW or SW components, the TPM object (e.g., a password key) may or may not be output. The contents of the PCR are, for example, filled during the system's boot process and provide information about the system's integrity status.

[0015] Furthermore, "node-locked licenses" are also known. Here, software licenses are bound to HW identities (IDs). Software application licenses are only valid if the corresponding HW-ID is correct.

[0016] Microsoft Windows license checks verify multiple hardware components. Minor changes to hardware components are allowed, but if significant changes occur, the Windows license must be reactivated ("If a major hardware change occurs to the device, such as replacing the motherboard, Windows will no longer find a license that matches your device, and you will need to reactivate Windows to get it up and running."). Summary of the Invention

[0017] The objective of this invention is to provide a solution for generating cryptographic keys with improved security.

[0018] This invention is derived from the features of the independent claims. Advantageous improvements and designs are derived from the subject matter of the claims. The designs, applications, and advantages of the invention are illustrated in the following description and drawings.

[0019] This invention relates to a method for generating a first cryptographic key for a system, wherein the system has hardware components and includes the following steps: - Obtain (especially including receiving, retrieving, and / or defining) the first set of tags for the first group. The first set of tags assigns the first hardware component to the first group. The system's hardware components include a first hardware component. (The first hardware component is therefore at least part of the overall hardware components of the system.) - Acquiring (especially including receiving and / or retrieving) the first fingerprint of the first hardware component, (In particular, the first fingerprint is obtained from the first hardware component,) Specifically, a first fingerprint is obtained from each of the first hardware components. and / or In particular, multiple first fingerprints are obtained from each of the first hardware components. - Generate the first cryptographic key. The first cryptographic key is generated by deriving the first fingerprint.

[0020] One aspect of the invention involves generating cryptographic keys (a first cryptographic key and other cryptographic keys) based on the hardware state (HW state) of a defined (specific) hardware component of the system. This achieves indirect protection of the hardware device integrity, because the cryptographic key is only correctly generated when the hardware fingerprint (HW fingerprint) of the hardware component group (the first group of the first hardware components and / or other groups) is correct. This prevents access to the cryptographic key when the hardware integrity of the subsystem to which the corresponding hardware component group belongs is not present. Therefore, with the proposed method, the integrity of the group of hardware components can be implicitly verified by successfully deriving a specific cryptographic key.

[0021] In particular, the present invention also includes deriving a plurality of first cryptographic keys. Thus, a plurality of first cryptographic keys are derived from a first set or a first hardware component. Furthermore, the output of the first derivation can be re-inputted into further derivations, from which cryptographic keys are generated separately, and the cryptographic keys from the further derivations are specifically intended for further uses. In particular, it is also intended to change the fingerprint order used for derivation for different keys, and / or to use additional input values ​​(different for each key) for derivation.

[0022] If any components of the system are replaced after delivery, different derived cryptographic keys are automatically generated. This ensures that data encrypted using cryptographic keys derived from the original hardware configuration (hardware component configuration) is no longer decryptable after hardware configuration changes and / or tampering, thus providing protection.

[0023] In other words, a specific cryptographic key in the system can only be derived and / or generated if the specific hardware components belonging to the predefined group are intact, that is, if these hardware components have not been replaced by counterfeit components and / or the same original components from other original systems and / or tampered hardware components, and / or the hardware components are defect-free.

[0024] The integrity of each hardware component is therefore indirectly determined by its HW fingerprint. The correct cryptographic key (i.e., the usable key) assigned to the group can only be calculated if the fingerprints of each hardware component within the group are correct (i.e., the hardware components have not changed), and the input values ​​for generating the key, especially the input values ​​for the key derivation function (KDF), are correct.

[0025] Therefore, this invention provides advantages in improving the security of preventing unauthorized access to cryptographic keys in IoT devices. In particular, access is no longer possible once the IoT device hardware has been tampered with.

[0026] According to the present invention, hardware components are assigned to various groups. In particular, the allocation of hardware components is based on importance, relevance, and the security they provide.

[0027] The fingerprint of the hardware component provides a personalized value. The acquisition (especially reception and / or retrieval) of the first fingerprint of the first hardware component is performed, in particular, from a trusted unit (trusted measurement application), which provides, i.e., determines, and / or reads, the first fingerprint and, in particular, transmits it to the unit performing the method according to the invention. In another variation, the trusted unit indirectly provides the fingerprint, in particular by triggering the hardware component to generate the fingerprint, wherein the hardware component is directly connected to the unit performing the method according to the invention and directly transmits the fingerprint to the unit performing the method according to the invention.

[0028] The system's hardware components are specifically configured as processors, CPUs, storage units, RAM, flash memory, ASICs, FPGAs, sensors, and / or external interfaces (I / O interfaces).

[0029] In an improved version of the present invention, the first cryptographic key is set for the already defined decryption.

[0030] The defined decryption can also be understood as a specific and / or defined purpose. This implementation emphasizes the idea of ​​generating cryptographic keys respectively assigned to specific purposes according to the present invention.

[0031] The derived key (i.e., the first cryptographic key) can be used for specific purposes, particularly for cryptographic protocols used to prove the status of a device and / or for decrypting sensitive data. Furthermore, the asymmetric key can be wrapped and / or encrypted with the first cryptographic key (especially if configured as a symmetric key).

[0032] In another improvement of the invention, the defined decryption is set by the first group (and therefore by the first hardware component, i.e., the hardware component assigned to the first group).

[0033] According to this implementation, decryption is defined by group affiliation of the first hardware component, meaning the first cryptographic key can be used for this purpose. The advantage of this is that the first group can be defined according to the intended use of the key, i.e., a first group of tags can be defined accordingly.

[0034] In another improved embodiment of the present invention, for the first fingerprint, the following applies: - The first fingerprint is based on static values ​​(specifically, the serial number of one of the first hardware components); and / or - The first fingerprint is generated by a challenge-response method; and / or - The first fingerprint is generated by a hardware component physically unclonable function (HW-PUF).

[0035] Therefore, fingerprints can be generated based on static values ​​(such as the serial number of a component) and / or through a challenge-response method, especially through trusted units (trusted measurement applications).

[0036] If the first fingerprint is generated by a hardware component physically unclonable function (HW-PUF), then the fingerprint modules of the hardware components each have their own physically unclonable functions (PUFs). The hardware components within the group are connected in series. The output of a hardware component's PUF is used as a challenge to the next hardware component's PUF.

[0037] If the fingerprint is implemented using a PUF, generating a stable fingerprint requires additional error correction methods. However, the error correction capability should be carefully selected so that fingerprints from incorrect, cloned, or defective hardware components cannot be identified as correct.

[0038] Specifically, this could be a combination of static values, values ​​generated by a challenge-response method, and values ​​generated by a hardware component physically unclonable function (HW-PUF). The PUF can output different responses based on different challenges. In this implementation, if the trusted unit has securely stored all previously valid challenge-response pairs, the component always sends a different response based on the challenge sent by the trusted unit. The response is checked by the trusted unit, and if correct, it forwards its securely stored fixed static value to the key derivation function.

[0039] In another improved embodiment of the present invention, the first cryptographic key is generated as follows: - Key Derivation Function (KDF); and / or - Key Derivation Physical Unclonable Function (KD-PUF).

[0040] The first cryptographic key is generated by deriving it from the first fingerprint using a key derivation function. The fingerprint of the hardware component is used as the input value to the KDF and is particularly concatenated (i.e., appended, permuted, linked, combined, and / or logically associated). To derive the first cryptographic key from the first fingerprint, a key derivation function (KDF) is obtained.

[0041] In another improved approach, the first cryptographic key can be generated using a physically unclonable function (PUF), also referred to in the context of this invention as a key-derived physically unclonable function (KD-PUF). This particularly enables the direct derivation of the first cryptographic key. The generation of the first cryptographic key via the key-derived physically unclonable function (KD-PUF) is performed as follows: a first fingerprint is used as the challenge of the KD-PUF, the key-derived physically unclonable function (KD-PUF) provides the result, and then the first cryptographic key is derived from the result provided by the key-derived physically unclonable function (KD-PUF) using a deterministic function. The reason for using the key-derived physically unclonable function (KD-PUF) can be summarized as generating a higher correlation with random physical fingerprints (such as PUF functions).

[0042] As described in the preceding claims, the first fingerprint can also be generated by a PUF (referred to as a hardware component PUF). In conjunction with the embodiments described in these claims, the key is also generated by a PUF (also referred to herein as a key-derived physically non-cloning function (KD-PUF)). In this combination, a separate key derivation function is replaced by a key-derived physically non-cloning function (KD-PUF).

[0043] In another improved embodiment of the present invention, the generation of the first cryptographic key occurs during: - After the trusted system state is determined, it is specifically assumed that the trusted system state continues to exist. - During the initial system debugging - During system re-debugging, especially after an attack, - During the system manufacturing process - During the system boot process, and / or - During system runtime.

[0044] In another improvement of the invention, the generation of the first cryptographic key is performed by further deriving from at least one software fingerprint, wherein the at least one software fingerprint comes from at least one software component of the system.

[0045] Therefore, in addition to the fingerprints of the hardware components, the fingerprints of the system's software components are also included. This improves security.

[0046] In another improved embodiment of the present invention, the first cryptographic key is configured as a symmetric cryptographic key and / or an asymmetric cryptographic key.

[0047] If there are multiple first cryptographic keys, one part is particularly asymmetric and another part is particularly symmetric.

[0048] Therefore, according to the implementation method, the derived key is a symmetric key. The additional asymmetric key is wrapped and / or encrypted, in particular, with the symmetric key.

[0049] In another improved embodiment of the invention, the first set of tags assigns the first hardware component to the first group based on the component manufacturer's identifier.

[0050] In this variant, hardware components from component manufacturers are assigned to specific groups. Hardware components from other component manufacturers are assigned to other groups.

[0051] In another improved embodiment of the invention, the first set of tags assigns the first hardware component to the first group according to the group security level.

[0052] In this variant, hardware components within a group (Group 1) can be assigned to a specific group security level (also referred to as security level and / or security zone): For higher security requirements, the fingerprints of more security-critical hardware components are needed to generate the corresponding key due to the security level. These components are grouped accordingly, and their fingerprints are used for key generation based on group affiliation.

[0053] In another improved approach, for generating keys at a higher security level, the key previously calculated for a lower security level is used as input to derive that key.

[0054] In another improved embodiment of the present invention, the method according to the present invention includes the following further steps: - Obtain (especially receive, retrieve, and / or define) the second set of tags for the second group. The second set of labels assigns the second hardware component to the second group. The system's hardware components include a second hardware component. (The second hardware component is therefore at least part of the overall hardware components of the system.) - Acquiring (especially receiving and / or retrieving) a second fingerprint from a second hardware component, (In particular, the second fingerprint is obtained from the second hardware component.) Specifically, a second fingerprint is obtained from each of the second hardware components, and / or In particular, more than one second fingerprint is obtained from each of the second hardware components. - Generate a second cryptographic key. The second cryptographic key is generated by deriving the second cryptographic key from the second fingerprint.

[0055] In particular, the generation of the second cryptographic key is combined with the generation of the first cryptographic key.

[0056] Furthermore, it is proposed that another key be derived from (at least one) first cryptographic key and / or (at least one) second cryptographic key: a third cryptographic key (also referred to as K12). That is, another key is generated from (at least one) first cryptographic key and / or (at least one) second cryptographic key. The (at least one) first cryptographic key and / or (at least one) second cryptographic key are used here in particular as inputs to the key derivation function.

[0057] In another improvement of the invention, the first hardware component is also at least partially assigned to the second group, and / or the second hardware component is also at least partially assigned to the first group. In other words, it is therefore applicable that the first group label also additionally assigns the first hardware component to the second group, and / or the second group label also additionally assigns the second hardware component to the first group. In other words, the first hardware component is particularly also part of the second group, and / or the second hardware component is particularly also part of the first group. Therefore, each hardware component also belongs to multiple groups.

[0058] Group affiliation, number of groups, and the number of hardware components that are part of a group can be defined arbitrarily.

[0059] In another improved embodiment of the present invention, the method according to the present invention includes the following further steps: - Retrieve fingerprint security level, where the fingerprint security level is preset to the security standard of the hardware components. - Acquire (especially receive and / or retrieve) the third fingerprint of the first hardware component, The third fingerprint meets the security standards. (Therefore, the acquisition of a third fingerprint is specifically based on the fingerprint security level.) - Generate a third cryptographic key, which is generated by deriving the third cryptographic key from the third fingerprint.

[0060] In this embodiment, the hardware component (first hardware component) provides different fingerprints according to security standards: a first fingerprint or a third fingerprint. The first fingerprint, in particular, provides a lower security level than the third fingerprint.

[0061] In another variation, the idea of ​​this implementation can be achieved by having the same number and the same hardware components in at least two groups, where each group outputs a different fingerprint. Here, the first group specifically includes the "less secure" fingerprint of the hardware components (the first fingerprint) (especially the serial number), while the second group uses a more secure fingerprint (the third fingerprint) (especially a PUF-based fingerprint).

[0062] The invention further includes a computer program, wherein the computer program can be loaded into a storage device of a computing unit, and wherein when the computer program is executed on the computing unit, the steps of the method according to the invention are performed using the computer program.

[0063] The present invention further includes a system comprising: - According to the computer program of the present invention, - Constructed to provide, in particular, a trusted unit for reading and transmitting the first fingerprint (trusted measurement application), and / or - Hardware components, wherein the hardware components include a first group of first hardware components.

[0064] The system is specifically configured as an Internet of Things (IoT) system.

[0065] The computer program and the resulting key derivation function (KDF) can be implemented in the system's user space as a software application or operating system module. In another variation, the key derivation function and / or trusted element (trusted measurement application) can be implemented in a hardware implementation. Each set of hardware components may also have its own KDF instance. KDFs of secure elements (such as TPM or OpenTitan) can also be used to generate individual keys. Ideally, the "trusted measurement application" is also part of a secure element or protected by secure boot.

[0066] Hardware components are specifically configured as processors, CPUs, storage units, RAM, flash memory, ASICs, FPGAs, sensors, and / or external interfaces (I / O interfaces). Attached Figure Description

[0067] The features and advantages of the present invention will become clear from the following illustrations of several embodiments.

[0068] Figure 1 A first embodiment of the system according to the present invention is shown, and Figure 2 A second embodiment of the system according to the present invention is shown. Detailed Implementation

[0069] Figure 1 The first hardware component 1 (RAM 1, flash memory 1, and ASIC 1) of system 3 is assigned to a first group via a first set of tags. If the first fingerprint of the first hardware component 1 from the first group is correct, and the input value used to derive the first cryptographic key K1 (in particular via the key derivation function KDF) is correct, then the correct first key K1 can be calculated.

[0070] Figure 1 Furthermore, it is shown that the second hardware component 2 (sensor 2 and FPGA 2) is assigned to the second group via a second set of tags. Its correct fingerprint (second fingerprint) is required to calculate the second cryptographic key K2.

[0071] The first fingerprint and the second fingerprint are provided by at least one trusted unit TMA (Trusted Measurement Application TMA). It is particularly advantageous to equip the first fingerprint with a first trusted unit TMA and the second fingerprint with a second trusted unit TMA.

[0072] According to the method of the present invention, in order to successfully generate (correct) cryptographic keys K1 and K2, a predefined state of system 3 must exist (hardware components 1 and 2 must be correct). In this concept, the state of system 3 (especially device 3) is defined by the presence of correct hardware components 1 and 2 within the group.

[0073] System 3 also includes a processor 31 (CPU 31), a user space 32, an OS kernel 33, and an external interface 34 (I / O 34).

[0074] Figure 2 Showing the corresponding Figure 1 Components.

[0075] Furthermore, a hardware component physically unclonable function (HW-PUF) possessed by the first hardware component 1 and the second hardware component 2 is illustrated. In this embodiment, the hardware component physically unclonable function HW-PUF generates the first fingerprint and the second fingerprint.

[0076] Figure 2Furthermore, a key derivation function KDF is shown, which has a key derivation physically unclonable function KD-PUF for generating a first cryptographic key and a second cryptographic key, and a deterministic function DF.

[0077] Although the present invention has been described and illustrated in detail by way of embodiments, the present invention is not limited to the disclosed embodiments, and those skilled in the art can derive other variations therefrom without departing from the scope of protection of the present invention.

Claims

1. A method for generating a first cryptographic key (K1) for a system (3), wherein the system (3) includes hardware components (1, 2), the method comprising the steps of: - Get the first group of tags for the first group. The first set of tags assigns the first hardware component (1) to the first group. The hardware components (1, 2) of the system (3) include the first hardware component (1). - Obtain the first fingerprint of the first hardware component (1), - Generate the first cryptographic key (K1). The first password key (K1) is generated by deriving it from the first fingerprint. The first cryptographic key (K1) is set for the defined decryption, and The defined decryption is set by the first group.

2. The method according to claim 1, Wherein the first fingerprint: - Based on static values, and / or - Generated by a challenge-response method, and / or - Generated by Hardware Component Physically Unclonable Function (HW-PUF).

3. The method according to any one of the preceding claims, The first cryptographic key (K1) is generated as follows: - Key Derivation Function (KDF), and / or - Key-derived physically unclonable functions (KD-PUF).

4. The method according to any one of the preceding claims, The generation of the first cryptographic key (K1) is performed under the following conditions: - After determining the state of the trusted system, - In the case of the initial commissioning of the system (3), - In the case of re-debugging the system (3), - During the manufacturing process of the system (3), - During the boot process of the system (3), and / or - During the operation of the system (3).

5. The method according to any one of the preceding claims, The first cryptographic key (K1) is generated by further deriving it from at least one software fingerprint. The at least one software fingerprint is derived from at least one software component of the system (3).

6. The method according to any one of the preceding claims, The first cryptographic key (K1) is composed of: - Symmetric cryptographic key, and / or - Asymmetric cryptographic keys.

7. The method according to any one of the preceding claims, The first set of labels assigns the first hardware component (1) to the first set based on the component manufacturer's identifier.

8. The method according to any one of the preceding claims, The first group of tags assigns the first hardware component (1) to the first group according to the group security level.

9. The method according to any one of the preceding claims, comprising the following further steps: - Get the second set of tags for the second group. The second group of tags assigns the second hardware component (2) to the second group. The hardware components (1, 2) of the system (3) include the second hardware component (3). - Obtain the second fingerprint of the second hardware component (2), - Generate a second cryptographic key (K2). The second password key (K2) is generated by deriving the second password key (K2) from the second fingerprint.

10. The method according to claim 9, The first hardware component (1) is also at least partially allocated to the second group, and / or The second hardware component (2) is also at least partially allocated to the first group.

11. The method according to any one of the preceding claims, comprising the following further steps: - Retrieve the fingerprint security level, wherein the fingerprint security level presets the fingerprint security standard of the hardware components (1, 2). - Obtain the third fingerprint of the first hardware component (1), The third fingerprint meets the security standard. - Generate a third cryptographic key. The third cryptographic key is generated by deriving the third cryptographic key from the third fingerprint.

12. A computer program, wherein the computer program is loadable into a storage device of a computing unit, wherein when the computer program is executed on the computing unit, the steps of the method according to any one of claims 1 to 11 are performed using the computer program.

13. A system (3), comprising: - The computer program according to claim 12, - Constructed as a trusted unit (TMA) to provide the first fingerprint, and / or - Hardware components (1, 2), wherein the hardware components (1, 2) include a first group of the first hardware components (1).

Images