A method and apparatus for generating keys from a randomly filled address array

Abstract

The application discloses a random redundancy filled address array key generation method and device, and the method comprises the steps of dividing each storage unit in an address addressed storage array into an effective entropy bit area and a random redundancy filled area; in response to a key generation starting signal, performing multiple loop iterations; generating a read address of a current iteration round according to a self-defined nonlinear rule, and reading data from a storage unit corresponding to the read address; extracting a bit from the effective entropy bit area according to a self-defined bit selection rule; and splicing the bits extracted in each round by bit to generate a device key. The application confuses the effective entropy source by random redundancy bits, blocks reverse positioning, adopts a self-defined nonlinear double extraction rule to eliminate linear correlation of the key and resist differential attacks, and has extremely low overall hardware overhead and is suitable for resource limited platforms.

Description

Technical Field

[0001] This invention relates to the field of chip security technology, and specifically to a method and apparatus for generating a key for an address array with random redundancy padding. Background Technology

[0002] In the field of chip hardware key generation, for storage array-based bit extraction schemes, all valid bits of the storage unit are currently used directly as the key entropy source, and extracted and concatenated into a key according to a preset linear rule. However, this method has the following shortcomings:

[0003] First, the effective entropy source is easy to locate. All bits in the storage unit are effective key entropy sources, containing no obfuscated or redundant data. After an attacker reads the storage array through chip disassembly, probe detection, or memory image capture, they can perform cryptanalysis and bit traversal on all stored bits, quickly locate the effective bits involved in key operations, and reverse-engineer the key generation rules, making the cracking threshold extremely low.

[0004] Second, the key has strong linear correlation. Existing schemes mostly use narrow address buses of 5 bits or less, resulting in insufficient entropy pool capacity and low key entropy values. The bit selection rules are fixed-position continuous truncation or simple arithmetic extraction, which are simple and linear. There is strong linear correlation between the bits of the key, making it vulnerable to differential attacks and linear cryptanalysis.

[0005] Third, TRNG solutions have high hardware overhead. Some solutions use true random number generators to generate keys in real time, relying on high-gain analog amplifiers and closed-loop correction circuits. This results in large chip area, high power consumption, and the key is not fixed each time it is powered on, making it impossible to achieve unique device identification binding and difficult to integrate into low-cost IoT chips.

[0006] Currently, engineers typically improve key security by increasing the depth of the storage array or introducing post-processing encryption modules. However, these methods significantly increase chip area and power consumption, and cannot fundamentally solve the problems of unobfuscated stored data and the ease with which valid bits can be reverse-engineered. As a result, the contradiction between key anti-reverse engineering capability and hardware overhead has not been effectively resolved for a long time.

[0007] To address the above problems, the present invention provides a method and apparatus for generating address array keys with random redundancy padding. Summary of the Invention

[0008] This invention discloses a method for generating a key for an address array with random redundancy padding, comprising:

[0009] S1: Divide each memory cell in the address-addressable memory array into an effective entropy bit area and a random redundancy padding area;

[0010] S2: In response to the key generation start signal, perform multiple loop iterations;

[0011] S3: Generate the read address for the current iteration based on the custom nonlinear rules, and read data from the storage unit corresponding to the read address;

[0012] S4: Extract one bit from the effective entropy bit region according to the custom bit selection rule;

[0013] S5: Concatenate the bits extracted in each round to generate the device key.

[0014] Furthermore, the storage array is a 256×32-bit storage array with 8-bit address addressing; the method performs 32 loop iterations and outputs a 32-bit device key; the bits in the effective entropy bit area are written with device-unique fixed data generated based on a physically non-cloning function, and the bits in the random redundancy fill area are written with random data generated by a true random number generator.

[0015] Preferably, the effective entropy bit region and the random redundancy fill region have no intersection, and their union constitutes all the bits of the storage unit; the number of bits in the effective entropy bit region is less than 32, and the number of bits in the random redundancy fill region is greater than the number of bits in the effective entropy bit region.

[0016] Preferably, the custom nonlinear rule is: Addr_i = (i × a + b) mod 256, where i is the current cycle number, a and b are preset integer coefficients, and a is coprime to 256.

[0017] Furthermore, the custom bit selection rule is as follows: within the preset effective entropy bit position set S, determine the target bit index BitSel_i = S[(i × c) mod L], where i is the current loop number, c is a positive integer, and L is the number of elements in the set S.

[0018] Furthermore, it also includes a factory-fixing step: generating effective entropy bits based on a physically non-clonable function and writing them into the effective entropy bit area of ​​each storage unit; generating random bits using a true random number generator and filling the random redundancy padding area of ​​each storage unit.

[0019] On the other hand, the present invention also discloses a hardware device for generating a random redundancy-filled address array key, comprising:

[0020] The loop counting control module is used to generate loop count values;

[0021] A custom address substitution generation module is used to map the loop counter value to a read address;

[0022] A hierarchical storage array, each storage cell containing fixed effective entropy bits and random redundant padding bits, is used to output the data of the corresponding storage cell in response to the read address;

[0023] The effective bit set storage register is used to pre-store the set of effective entropy bit positions;

[0024] A custom bit selection module is used to generate a target bit index within the set of effective entropy bit positions.

[0025] A single-bit extraction module is used to extract a single bit from the read storage unit data according to the target bit index;

[0026] The key buffer register is used to store the single bits extracted in each round bit by bit, and outputs the complete device key after the iteration is completed.

[0027] Furthermore, it also includes a PUF entropy generation unit and a TRNG random filling unit, which are used to generate the effective entropy bits and the random redundant filling bits during the manufacturing stage, respectively, and write them into the hierarchical storage array.

[0028] Preferably, the custom address replacement generation module has a built-in configurable modular multiplication coefficient register, which can generate multiple sets of different device keys under the same hardware architecture by changing the modular multiplication coefficient.

[0029] Preferably, it also includes a key post-processing module, whose input is connected to the output of the key buffer register, for performing S-box permutation and shift XOR nonlinear operation on the generated device key and then outputting the final key.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. This invention divides each storage unit into an effective entropy bit area and a random redundancy area. The effective entropy bits are fixed by PUF, and the redundant bits are independently and randomly filled by TRNG. The two are indistinguishable in terms of storage form, so attackers cannot identify the source of effective entropy, which increases the difficulty of locating it exponentially, thus blocking reverse engineering from the physical layer.

[0032] 2. This invention employs a dual rule of custom nonlinear address mapping and bit selection to eliminate the linear correlation between the key and the storage address, thus resisting linear cryptanalysis and differential attacks; the entropy sources of each bit of the key are independent and discrete, and the information entropy approaches the theoretical maximum value, significantly improving the resistance to brute-force enumeration.

[0033] 3. This invention requires only basic logic operations, without the need for real-time TRNG computation or hash encryption. It has a small area increment, extremely low power consumption, and is compatible with resource-constrained platforms. It completes one round of operations in a single cycle and outputs the key in 32 cycles. It is ready to use upon power-on and meets the requirement of zero latency.

[0034] 4. The effective bit set register in this invention is configurable, and switching the set can generate multiple independent keys, adapting to scenarios such as identity authentication and data encryption; the address mapping coefficient is configurable, and changing the coefficient can derive different keys, resulting in high hardware reuse rate.

[0035] 5. The number of effective entropy bits in this invention can be flexibly configured. The more redundancy, the higher the confusion strength, and the complexity of reverse location increases exponentially. It provides quantifiable security margins and meets the requirements of cross-level protection. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating a method for generating a randomly redundant address array key provided in this embodiment;

[0037] Figure 2 This is a schematic diagram of the structure of an address array key generation device with random redundancy padding provided in this embodiment;

[0038] Figure 3 This is a schematic diagram of the custom address replacement generation module provided in this embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0040] Example 1

[0041] Please see Figure 1 , Figure 1 This is a flowchart illustrating a method for generating a randomly redundant address array key according to an embodiment of this application, including:

[0042] S1: Divide each memory cell in the address-addressable memory array into an effective entropy bit area and a random redundancy padding area;

[0043] S2: In response to the key generation start signal, perform multiple loop iterations;

[0044] S3: Generate the read address for the current iteration based on the custom nonlinear rules, and read data from the storage unit corresponding to the read address;

[0045] S4; Extract one bit from the effective entropy bit region according to the custom bit selection rule;

[0046] S5: Concatenate the bits extracted in each round to generate the device key.

[0047] This embodiment constructs a 256×32-bit hierarchical memory array with 8-bit address bus addressing, where each memory cell has a bit width of 32 bits. A preset fixed set of effective entropy bit positions S={2,5,9,16,21,27} is established, consisting of 6 effective entropy bits. Each bit in set S is defined as an effective entropy bit region. The remaining 26 bits in each memory cell, excluding those in set S, are all allocated to a random redundancy padding region. The number of effective entropy bits is less than the number of redundant bits to ensure confusion strength.

[0048] First, the on-chip PUF unit is invoked to generate a 6-bit unique device fingerprint based on the physical differences introduced during chip manufacturing. This fingerprint is then written bit by bit to the corresponding position in set S of each memory cell. Due to the uniqueness of the PUF's physical characteristics, even if the storage address is the same, the written effective entropy bit values ​​will be different for each chip, ensuring the global uniqueness of the key for each chip. Simultaneously, the data generated by the PUF is non-clonable and tamper-proof, preventing attackers from replicating the same effective entropy bit values ​​on other chips through physical measurement or modeling methods.

[0049] Secondly, the on-chip TRNG cell is invoked to generate an independent 26-bit true random number sequence for the remaining 26-bit redundant padding area of ​​each memory cell and write it. There is no correlation between redundant bits between different memory cells, or between different redundant bits within the same memory cell; they are random, independent, and without any discernible pattern.

[0050] After solidification, the data in each cell of the storage array presents a mixed form of "6 bits of unique solidified data + 26 bits of random data". The effective entropy bits and redundant bits are completely consistent in electrical characteristics, storage cell structure and data form, and external detection methods cannot distinguish the boundary between the two.

[0051] After the chip powers on and completes its reset, the loop counter control module enters the working state in response to the key generation start signal. The loop counter variable `i` is set, and iterates from 0 to 31, performing 32 loop iterations to generate a 32-bit device key. Simultaneously, the entire 32-bit key buffer register is cleared to prepare for bit-by-bit writing.

[0052] For each iteration i (i=0,1,2,...,31), the custom 8-bit address permutation generation module receives the current loop count value i and generates an 8-bit read address according to the preset nonlinear permutation formula: Addr_i = (i × 41 + 13) mod256.

[0053] The read address sequences generated in each round are as follows:

[0054] i=0: Addr_0=(0×41+13) mod 256=13, read the memory unit located at address 13;

[0055] i=1: Addr_1=(1×41+13) mod 256=54, read the memory unit where address 54 is located;

[0056] i=2: Addr_2=(2×41+13) mod 256=95, read the memory unit located at address 95;

[0057] i=3: Addr_3=(3×41+13) mod 256=136, read the memory unit located at address 136;

[0058] i=4: Addr_4=(4×41+13) mod 256=177, read the memory unit located at address 177;

[0059] i=5: Addr_5=(5×41+13) mod 256=218, read the memory unit where address 218 is located;

[0060] i=6: Addr_6=(6×41+13) mod 256=259 mod 256=3, read the memory unit where address 3 is located.

[0061] Subsequent rounds follow the same pattern until i=31 completes the out-of-order traversal of all 256 address spaces. Observing the above address sequence, it can be seen that the memory addresses read in adjacent rounds are distributed in a jump pattern in physical space, without any sequential traversal or a gradual arithmetic progression, thus disrupting the entropy source collection order at the addressing level.

[0062] After receiving the aforementioned 8-bit read address, the hierarchical memory array outputs the complete 32-bit data of the memory cell corresponding to that address to the data bus within a single clock cycle for use in subsequent steps. The read 32-bit data includes both effective entropy bits and random redundancy bits.

[0063] The effective bit set storage register pre-stores S={2,5,9,16,21,27}, limiting key generation to select only from these 6 effective entropy bit positions, and the 26 bits of the random redundancy padding area are completely inaccessible.

[0064] Each round, the single-bit extraction module outputs 1 bit of data and writes it to the i-th bit of the 32-bit key buffer register. As i increments from 0 to 31, the key buffer register is filled sequentially from the least significant bit to the most significant bit, and all 32 bits are filled after the 31st round.

[0065] When the loop counter control module detects that i=31 has been completed and the 31st bit has been written, it generates a key ready flag signal. The 32-bit data concatenated in the 32-bit key buffer register is then output as the final device key to the upper-layer security module. This key can be directly used in the AES encryption engine, HMAC authentication module, or as a seed for key derivation functions.

[0066] Example 2

[0067] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of an address array key generation device with random redundancy padding provided in this embodiment.

[0068] like Figure 2 As shown, the device 100 in this embodiment includes: a cycle counting control module 101, a custom address permutation generation module 102, a hierarchical storage array 103, an effective bit set storage register 104, a custom bit selection module 105, a single bit extraction module 106, and a key cache register 107.

[0069] The loop counting control module 101 is a finite state machine or binary counter. Its clock input is connected to the on-chip system clock signal, and its reset input is connected to the reset management unit. This module responds to the key generation start signal, starting from an initial value of 0 and incrementing clock cycles to generate loop count values ​​i from 0 to 31, for a total of 32 count values. The output of the loop counting control module 101 is connected to the input of the custom address substitution generation module 102 and the first input of the custom bit selection module 105, respectively, to synchronously output the loop count value i of the current round to both. When the count reaches 31 and the current round is completed, the loop counting control module 101 outputs a loop end flag signal to the key buffer register 107.

[0070] The custom address substitution generation module 102 is a combinational logic circuit, and its input is connected to the output of the loop counting control module 101. This module has a built-in modular multiplication coefficient register (pre-stored coefficient a=41 in this embodiment) and an offset register (pre-stored b=13 in this embodiment). It receives the current loop count value i and performs multiplication, addition, and modulo operations according to the preset nonlinear substitution formula Addr_i=(i×41+13) mod 256, mapping the 8-bit loop count value to an 8-bit read address Addr_i. The value range of this 8-bit read address covers 0 to 255, corresponding to the 256 memory cells of the hierarchical storage array 103. The output of the custom address substitution generation module 102 is connected to the address input of the hierarchical storage array 103, and is used to output the generated 8-bit read address to the hierarchical storage array 103.

[0071] The hierarchical storage array 103 is a 256×32-bit static random access memory array. Its address input is connected to the output of the custom address replacement generation module 102, and its data output is connected to the data input of the single-bit extraction module 106. The hierarchical storage array 103 uses an 8-bit address bus for addressing and contains a total of 2... 8 = 256 storage units, each storage unit has a bit width of 32 bits.

[0072] The core structural difference between the tiered storage array 103 and conventional storage arrays lies in the fact that each storage cell is divided into two functional regions: a fixed effective entropy bit region and a random redundancy fill region. The fixed effective entropy bit region consists of 6 bits, located at bits S={2,5,9,16,21,27} in each storage cell, storing unique, fixed data written by the PUF unit during the device's manufacturing process. The random redundancy fill region consists of 26 bits, comprising the remaining bits in each storage cell excluding set S, storing a sequence of truly random numbers independently generated and written by the TRNG unit during the manufacturing process. The effective entropy bits and redundant bits are interleaved within the storage cell, maintaining identical electrical characteristics and read timing.

[0073] In response to the received 8-bit read address Addr_i, the hierarchical storage array 103 outputs all 32 bits of data Data[Addr_i] of the corresponding storage cell to the single-bit extraction module 106 via the data bus within a single clock cycle. This 32-bit data includes both fixed effective entropy bits and random redundant padding bits.

[0074] The effective bit set storage register 104 is a configurable register, and its output is connected to the second input of the custom bit selection module 105. This register is used to pre-store a fixed effective entropy bit position set S, that is, the position index of the effective entropy bit in the 32-bit data of each storage unit. In this embodiment, the pre-stored set S = {2, 5, 9, 16, 21, 27}, with a total of L = 6 effective entropy bit positions. Each value in this set is an integer between 0 and 31, pointing to the effective bit position in the corresponding storage unit that participates in the key operation. All bit positions that do not belong to set S are random redundancy padding areas and are permanently masked during the key generation process.

[0075] The effective bit set storage register 104 is a software-configurable register, which supports writing new sets S' through upper-level software without modifying the hardware circuit, thereby enabling the derivation of multiple independent keys under the same hardware architecture.

[0076] The custom bit selection module 105 is a combinational logic circuit. Its first input is connected to the output of the loop counting control module 101, its second input is connected to the output of the effective bit set storage register 104, and its output is connected to the selection input of the single bit extraction module 106. This module is used to receive the current loop count value i and the effective entropy bit position set S, and calculate the target bit index BitSel_i of the current round within the effective entropy bit position set S according to a preset bit selection rule.

[0077] In this embodiment, the custom bit selection module 105 integrates a step size register (pre-stored c=5) and calculates the target bit index according to the following formula: BitSel_i=S[(i×5) mod L], where L=6 is the number of elements in set S. This rule ensures that the bit index selected in each round falls within the range defined by the effective entropy bit position set S, and the bit positions in the random redundant filling area are permanently excluded. At the same time, since the step size 5 is coprime to L, the frequency of selection of each effective entropy bit position remains basically balanced within 32 iterations, and there is no situation where a certain bit is never selected.

[0078] The single-bit extraction module 106 is a data selector or bit extraction logic circuit. Its data input is connected to the data output of the hierarchical storage array 103, its selection input is connected to the output of the custom bit selection module 105, and its output is connected to the bit writing terminal of the key buffer register 107. This module is used to receive the complete 32-bit data Data[Addr_i] output by the hierarchical storage array 103 and the target bit index BitSel_i output by the custom bit selection module 105. Within a single clock cycle, it extracts the single-bit value of the BitSel_i-th bit from Data[Addr_i], and discards the remaining 31 bits of data, which do not participate in any calculations.

[0079] The effective extraction range of the single-bit extraction module 106 is limited by the BitSel_i output by the custom bit selection module 105. Since BitSel_i always comes from the effective entropy bit position set S, the single-bit extraction module 106 actually only extracts data from the fixed effective entropy bit area. The bits in the random redundant padding area do not participate in the key generation process, thus achieving physical isolation between the key generation logic and the storage of obfuscated data.

[0080] The key buffer register 107 is a 32-bit shift register. Its bit write end is connected to the output of the single-bit extraction module 106, and its control end is connected to the loop end flag output of the loop counting control module 101. The output end serves as the key output port for the entire hardware device. This register is used to store the single bits extracted in each round bit by bit.

[0081] Specifically: In each iteration, the 1-bit data output by the single-bit extraction module 106 is written to the i-th bit of the key buffer register 107. As the loop count value i increments from 0 to 31, the key buffer register 107 is filled sequentially from the least significant bit to the most significant bit. When the loop count control module 101 outputs a loop end flag signal, the 32-bit data concatenated in the key buffer register 107 is output as the complete device key.

[0082] The output of the loop counting control module 101 is connected to the custom address substitution generation module 102 and the custom bit selection module 105 respectively, and provides the current loop count value i to both synchronously.

[0083] The output of the custom address replacement generation module 102 is connected to the address input of the hierarchical storage array 103, providing it with the read address Addr_i for the current round.

[0084] The data output terminal of the hierarchical storage array 103 is connected to the data input terminal of the single-bit extraction module 106, providing it with the complete 32-bit data Data[Addr_i].

[0085] The output of the effective bit set storage register 104 is connected to the second input of the custom bit selection module 105, providing it with the effective entropy bit position set S.

[0086] The output of the custom bit selection module 105 is connected to the selection input of the single bit extraction module 106, providing it with the target bit index BitSel_i for the current round.

[0087] The output of the single-bit extraction module 106 is connected to the bit writing end of the key buffer register 107 to provide it with the extracted single-bit value.

[0088] The control terminal of the key buffer register 107 is connected to the loop end flag output terminal of the loop counting control module 101, and the final output of the key is triggered by the flag signal.

[0089] The key post-processing module 108 has its input connected to the output of the key buffer register 107, and is used to perform nonlinear confusion operation on the generated 32-bit basic key and output the final key.

[0090] The key post-processing module 108 includes an S-box permutation submodule and a shift-XOR submodule. The S-box permutation submodule has a built-in 8×8 fixed permutation table. It splits the basic key into four 8-bit data blocks by byte, looks up and permutes them in the table, and then reassembles the output into 32-bit data. The shift-XOR submodule performs left shift by 3 bits and right shift by 5 bits on the S-box output data, and performs bitwise XOR operations on the original data and the three shifted data to output the final 32-bit key.

[0091] After the key buffer register 107 completes 32 rounds of iteration, the basic key is sent to the key post-processing module 108. After undergoing S-box permutation and shift XOR operations, the final encryption key is output from the output port of the key post-processing module 108.

[0092] Example 3

[0093] Please see Figure 3 , Figure 3 This is a schematic diagram of the custom address replacement generation module provided in this embodiment.

[0094] like Figure 3 As shown, the custom address permutation generation module 102 includes a PUF entropy generation unit 1021, a TRNG random filling unit 1022, and a configurable modular multiplication coefficient register 1023.

[0095] The PUF entropy generation unit 1021 generates 6-bit unique device fingerprint data based on manufacturing process parameter deviations. Its output is connected to the write data port of the hierarchical storage array 103, and writes the effective entropy bits to the corresponding positions of the S set in each storage unit.

[0096] TRNG random padding unit 1022 generates a truly random bit sequence, and its output is connected to the write data port of hierarchical storage array 103 to write 26 bits of random data into the redundant padding area of ​​each storage cell. PUF entropy generation unit 1021 and TRNG random padding unit 1022 are only enabled during the factory stage and turned off after hardening, and do not participate in the key generation stage.

[0097] The configurable modular multiplication coefficient register 1023 is a read-write register, and its output is connected to the arithmetic unit of the custom address permutation generation module 102. The arithmetic unit generates the modular multiplication coefficient 'a' and the offset 'b' in the address mapping formula Addr_i=(i×a+b) mod 256. The register has default values ​​of a=41 and b=13, and new coefficients can be written via the bus.

[0098] The write data port of the hierarchical storage array 103 is divided into two paths: the first path connects to the PUF entropy generation unit 1021, writing 6 bits of effective entropy; the second path connects to the TRNG random filling unit 1022, writing 26 bits of random redundancy. Under the same write enable control, the two data paths are combined into a complete 32-bit data and written to the target cell at once.

[0099] When multiple independent keys need to be derived, new coefficients a' and b' are written to the configurable modular multiplication coefficient register 1023, and the read address sequence is generated using the update formula Addr_i=(i×a'+b') mod 256. Because the address selection order changes, the final output key is completely independent of the original key. The above is merely a preferred embodiment of the present invention and is not intended to limit the invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating a key for an address array with random redundancy padding, characterized in that, The hardware key generation device performs the following steps: S1: Divide each memory cell in the address-addressable memory array into an effective entropy bit area and a random redundancy padding area; S2: In response to the key generation start signal, perform multiple loop iterations; S3: Generate the read address for the current iteration based on the custom nonlinear rules, and read data from the storage unit corresponding to the read address; S4: Extract one bit from the effective entropy bit region according to the custom bit selection rule; S5: Concatenate the bits extracted in each round to generate the device key.

2. The method according to claim 1, characterized in that, The storage array is a 256×32-bit storage array with 8-bit address addressing; the method performs 32 loop iterations and outputs a 32-bit device key; the bits in the effective entropy bit area are written with device-unique fixed data generated based on a physically non-cloning function, and the bits in the random redundancy fill area are written with random data generated by a true random number generator.

3. The method according to claim 1, characterized in that, The effective entropy bit area and the random redundancy fill area have no intersection, and their union constitutes all the bits of the storage unit; the number of bits in the effective entropy bit area is less than 32, and the number of bits in the random redundancy fill area is greater than the number of bits in the effective entropy bit area.

4. The method according to claim 1, characterized in that, The custom nonlinear rule is: Addr_i = (i× a + b) mod 256, where i is the current cycle number, a and b are preset integer coefficients, and a is coprime to 256.

5. The method according to claim 1, characterized in that, The custom bit selection rule is as follows: determine the target bit index BitSel_i = S[(i × c) mod L] within the preset effective entropy bit position set S, where i is the current loop number, c is a positive integer, and L is the number of elements in the set S.

6. The method according to claim 1, characterized in that, It also includes a factory-fixing step: generating effective entropy bits based on a physically non-cloning function and writing them into the effective entropy bit area of ​​each of the storage units; generating random bits using a true random number generator and filling the random redundancy padding area of ​​each of the storage units.

7. An address array key generation apparatus for implementing the method of any one of claims 1 to 6 with random redundancy padding, characterized in that, include: The loop counting control module is used to generate loop count values; A custom address substitution generation module is used to map the loop counter value to a read address; A hierarchical storage array, each storage cell containing fixed effective entropy bits and random redundant padding bits, is used to output the data of the corresponding storage cell in response to the read address; The effective bit set storage register is used to pre-store the set of effective entropy bit positions; A custom bit selection module is used to generate a target bit index within the set of effective entropy bit positions. A single-bit extraction module is used to extract a single bit from the read storage unit data according to the target bit index; The key buffer register is used to store the single bits extracted in each round bit by bit, and outputs the complete device key after the iteration is completed.

8. The apparatus according to claim 7, characterized in that, The custom address replacement generation module also includes a PUF entropy generation unit and a TRNG random padding unit, which are used to generate the effective entropy bits and the random redundant padding bits during the factory stage, respectively, and write them into the hierarchical storage array.

9. The apparatus according to claim 7, characterized in that, The custom address replacement generation module has a built-in configurable modular multiplication coefficient register, which can derive multiple sets of different device keys under the same hardware architecture by changing the modular multiplication coefficient.

10. The apparatus according to claim 7, characterized in that, It also includes a key post-processing module, whose input is connected to the output of the key buffer register, and is used to perform S-box permutation and shift XOR nonlinear operation on the generated device key and then output the final key.

Images