A key derivation and hierarchical security fusing method and system based on tamper posture binding

Abstract

The application relates to the field of smart meter security protection, and particularly relates to a key derivation and hierarchical security fusing method and system based on tampering posture binding, which comprises four steps of security initialization, tampering posture word (TSW) construction, key derivation and security operation execution: a TSW is constructed by monitoring passive tampering pins, clock precision, voltage abnormalities and illegal access of a debugging interface; a chip root key HUK, a device unique identifier UID, the TSW and a key version counter CTR are used as materials to dynamically derive a working key WK, and the derivation is refused when the TSW is not zero; a plaintext key P is obtained by using the WK to unseal a key storage block WKB, and all password operation APIs are forced to check the TSW value. The application eliminates the risk of static key storage by dynamically binding the tampering posture word and the key derivation, closely couples tampering detection and key protection, and realizes hierarchical fusing responses through L0 to L3 four-level security state machines, so that normal business operation is ensured, precise protection is provided for attacks of different levels, and a high-security-level key protection scheme is provided for smart meters.

Description

Technical Field

[0001] This invention belongs to the field of smart grid information security technology, specifically smart meter security protection technology. Background Technology

[0002] As the core terminal equipment for power system metering and management, smart meters undertake important functions such as user electricity data collection, remote reading, and fee control management. Their security and reliability are directly related to the stable operation of the power system and the vital interests of users. With the rapid development of Internet of Things (IoT) technology, remote communication between smart meters and the master station is becoming increasingly frequent. Cryptographic operations such as identity authentication and data encryption have become basic means to ensure communication security. However, existing smart meters have fundamental flaws in their key protection mechanisms. Keys are usually stored statically in non-volatile memory, making them vulnerable to physical attacks.

[0003] Specifically, traditional smart meter key management schemes suffer from the following prominent problems: Working keys are pre-stored in non-volatile storage media such as Flash or EEPROM. Attackers can extract the key content through methods such as probe reading, chip disassembly, and cold start attacks, thereby forging identities to establish communication connections with the master station and achieving the purpose of electricity theft or data tampering. Although some schemes use external security chips to store keys, this increases hardware costs and complexity and cannot fundamentally eliminate the risk of leakage caused by static key storage. Furthermore, existing tamper detection and key protection often employ two independent mechanisms. Upon detecting an anomaly, an additional "key destruction" operation is required. However, one-time programmable memories cannot be physically "burned," allowing attackers to bypass or reset these protection measures through technical means.

[0004] The Renesas RA6 series microcontrollers integrate a wealth of hardware security features, including the SCE9 hardware encryption engine, chip root key, TrustZone security isolation, tamper detection pin, clock monitoring, and voltage monitoring, providing a technical foundation for solving the aforementioned problems. How to fully utilize these native hardware capabilities to design a security solution that eliminates the risks of static key storage while tightly coupling tamper detection with key protection has become a pressing technical challenge in the field of smart meter security. Summary of the Invention

[0005] To address the aforementioned shortcomings of existing technologies, this invention proposes a smart meter security protection method based on key derivation bound to tamper status. The core idea is to use the real-time tamper status at the hardware level as a necessary input to the key derivation function, making the existence of the working key mathematically dependent on the physical integrity of the device, thereby fundamentally eliminating the security risks caused by static key storage.

[0006] The technical solution of this invention is:

[0007] In a first aspect, the present invention provides a key derivation and hierarchical security circuit breaker method based on tamper-proof situation binding, comprising the following steps:

[0008] Step S1, Security Initialization: After the system is powered on, the TrustZone security architecture is initialized, and the memory boundaries between the secure world and the normal world are defined; the encryption engine is started to enter the protected mode; the chip root key HUK and the device unique identifier UID are obtained from the verified secure world firmware;

[0009] Step S2, construct the tamper status word TSW: maintain an N-bit tamper status word register, each bit corresponding to the detection status of a type of hardware tamper detection source, the hardware tamper detection source including passive tampering pin, clock precision monitoring circuit, voltage monitoring circuit and illegal access detection of debugging interface;

[0010] Step S3, Key Derivation: Secure World uses the key derivation function KDF to combine four materials to calculate and output the working key WK. The four materials include the chip root key HUK, the device unique identifier UID, the tamper status word TSW, and the key version counter CTR. If the tamper status word TSW is non-zero, the derivation of WK is rejected and a tampering error is returned.

[0011] Step S4, Secure Operation Execution: Under the condition that the tampered state word TSW is zero, the secure world uses the derived working key WK to unseal the storage block WKB to obtain the plaintext key P, and performs operations based on the plaintext key P in the secure isolation environment; all cryptographic operation APIs check the TSW value at the entry point, and if the tampered state word TSW is not zero, they refuse to execute and return a tampering error.

[0012] Furthermore, the KDF operation described in step S3 is performed in a secure world and uses cryptographic primitive functions that execute in constant time, with an output length of not less than 256 bits.

[0013] Furthermore, the working key WK derived in step S3 is written only to the secure world volatile RAM, which has the characteristics of being lost upon power failure, isolation between the DMA controller and the normal world CPU bus, and prohibition of writing to non-volatile storage media.

[0014] Furthermore, in S4, the storage block WKB is configured before leaving the factory, including key derivation, subkey derivation, and key encapsulation steps, specifically:

[0015] Key derivation step: Using the same key derivation step as step S3, the working key WK is calculated and output by combining the four materials using the key derivation function KDF;

[0016] Subkey derivation steps: The working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac through the key derivation function;

[0017] Kenc = KDF_sub(WK, label="ENC", UID, ver);

[0018] Kmac = KDF_sub(WK, label="MAC", UID, ver);

[0019] Wherein, KDF_sub is a deterministic key derivation function based on standard hash / standard MAC, label="ENC" indicates that the subkey is used for encryption; label="MAC" indicates that the subkey is used for message authentication; ver represents the version number, which uses the current version counter CTR value;

[0020] Key encapsulation steps: The structure of encryption before authentication is adopted. The plaintext key P is encrypted with the encryption subkey Ken to obtain the ciphertext C, C = Enc(Kenc, P, IV);

[0021] The message authentication code label T is calculated using the authentication subkey Kmac on the associated data AAD, the random number IV, and the ciphertext C, where T = MAC(Kmac, AAD ‖ IV ‖ C); where the associated data AAD is AAD = UID ‖ key_type ‖ ver, which includes UID, key type key_type, and version number ver;

[0022] Assemble storage block WKB and write it to the secure world's non-volatile Flash memory, which is inaccessible in the normal world; where WKB = IV ‖ C ‖ T,

[0023] Furthermore, in S4, the secure world uses the derived working key WK to unpack the storage block WKB to obtain the plaintext key P, including:

[0024] The key decryption steps include: parsing the storage block WKB to extract IV, C, and T, and checking whether the current tamper status word TSW is zero;

[0025] If the tampered state word TSW is non-zero, decryption stops and a tampering error is returned directly. If the tampered state word TSW is zero, the current working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac again according to the subkey derivation steps. The message authentication code label T' is recalculated according to the key encapsulation steps and compared with the message authentication code label T for a constant time.

[0026] If the comparison is consistent, the plaintext key P is decrypted and restored; if the comparison is inconsistent, an L2-level circuit breaker response is triggered to confirm the tampering.

[0027] Furthermore, it also includes a tiered circuit breaker response step:

[0028] In the secure world, maintain an N-bit state detection source. Based on the TSW state word detection results, execute a differentiated response strategy according to a four-level security state machine. The four-level security states include normal operation state L0, soft anomaly state L1, confirmed tampering state L2, and severe attack state L3.

[0029] The L0 state is defined as the normal operating state, with all functions operating normally, WK valid and available, and TSW=0;

[0030] The L1 state is defined as a software abnormal state. Under normal circumstances, the detection bit will not change. The L1 state is defined as the detection of occasional abnormalities in the status bit, but all within a reasonable threshold control range. TSW=0, reducing the frequency of use.

[0031] The L2 state is defined as confirming that an attack has been detected and that the confirmation state has been tampered with. At this time, if any state exceeds the threshold, the state will be changed. TSW != 0, decryption will no longer be supported, and remote recovery is possible.

[0032] The L3 state is defined as a critical attack or self-destruct key state. It is entered when multiple L2 states are detected simultaneously and exceed a threshold. At this time, the protected key will be set to unreadable or destroyed. TSW != 0, decryption is no longer supported, and remote recovery is impossible.

[0033] Furthermore, the transition rules for the four-level security state machine described in step S5 are as follows:

[0034] When a single detection source is detected in the L0 state and the duration does not reach the confirmation threshold, it is defined as a transient anomaly and will transition to the L1 state.

[0035] If any detection source is detected in the L1 state for a duration exceeding the threshold (confirmed by de-jittering and multi-sampling), it is defined as confirmation that tampering has occurred, and the process transitions to the L2 state.

[0036] When multiple detection sources are detected to trigger concurrently in the L2 state, or when multiple sources of probe-type deep intrusion are detected to trigger concurrently, the system transitions to the L3 state.

[0037] If no new triggering event occurs in the L1 state within a preset time, the system will automatically revert to the L0 state.

[0038] In the L2 state, if both TSW zeroing and remote authorization verification are satisfied (the remote authorization verification refers to: the master station using its private key to digitally sign the recovery command; the meter's public key is embedded in the secure world (the public key does not need to be kept secret and does not rely on WK protection), and the device can re-derive WK only after the signature verification is passed), then it will recover to the L0 state;

[0039] The L3 state is an irreversible final state, and any input will remain in the L3 state.

[0040] Furthermore, in response to the confirmed tampering state L2, the execution includes: clearing the WK in the secure world volatile RAM within a time of less than n milliseconds, stopping the response to key decryption requests, locking the debug interface through the device lifecycle management module, and reporting a tampering event report with a digital signature to the master station.

[0041] Furthermore, for the severe attack state L3, the response includes: executing all L2 level response actions and setting the non-volatile Flash in the security world where the firmware resides to irreversible write protection, causing the device to enter a physical lock-up state.

[0042] Secondly, the present invention provides a key derivation and hierarchical security circuit breaker system based on tamper-proof situation binding, including a processor, a memory and an encryption engine;

[0043] The processor runs secure world code and normal world code, and secure isolation is achieved through the TrustZone architecture.

[0044] The encryption engine is configured to provide constant-time cryptographic computation capabilities in protected mode;

[0045] The memory includes secure-world volatile RAM and secure-world non-volatile Flash;

[0046] The system is configured to perform the method described.

[0047] The beneficial effects of this invention are:

[0048] 1. Keys are "not stored on the ground," fundamentally eliminating the risk of static leakage: WK (Key Detection) is derived in real-time within the secure world via KDF (Key Detection Function). After derivation, it is only written to the volatile RAM of the secure world. This area has the characteristics of being lost upon power failure, isolation between the DMA controller and the CPU bus in the ordinary world, and prohibition of writing to non-volatile storage media. It is discarded after use and calculated only when needed. Even if a physical attacker completely controls the chip's Flash bus, no form of WK residue can be found. This is a direct solution to the defect of "statically storing keys on non-volatile media."

[0049] 2. "Derivation equals invalidation," tightly coupling tamper detection and key protection: Each bit of the TSW participates in the mathematical calculation of WK as one of the four input materials of KDF. An attack causing a change in TSW will instantly invalidate the KDF output WK, and all cryptographic APIs check the TSW value at the entry point; if it is non-zero, execution is directly rejected without additional "destruction" action. This directly solves the defect of "tamper detection and key protection being independent," while cleverly circumventing the physical weakness of "OTPs cannot be truly destroyed."

[0050] 3. Tiered Response, Balancing Security and Availability: The four-level security state machine (L0 normal operation state, L1 soft anomaly state, L2 confirmed tampering state, L3 severe attack state) differentiates between different scenarios such as transient interference, confirmed tampering, and severe attacks, avoiding the high false alarm rate caused by a "one-size-fits-all" approach. The design of automatically reverting to L0 from L1 state when no new triggering events occur within a preset time, and reverting to L2 state after TSW is zeroed and remote authorization verification is successful, ensures the continuous availability of the device in non-malicious scenarios. This directly addresses the deficiency of "undifferentiated tiered handling of anomalies."

[0051] 4. Zero Additional Hardware Costs: All security capabilities are built on the native hardware modules of the RA6 chip (SCE9 / HUK / Tamper / CAC / LVD / DLM / TRNG / TrustZone), eliminating the need for external security chips, custom ASICs, and additional tamper-proof sensor chips. The BOM cost per meter increases to zero. This directly addresses the drawback of "external security chips increasing hardware costs."

[0052] 5. Enhanced Side-Channel Protection: The SCE9 hardware engine provides native constant-time and DPA resistance; Secure World KDF operations use cryptographic primitive functions executed in constant time, combined with mask calculations, constant-time comparisons (such as comparison of message authentication code tag T), and TRNG-driven refresh mechanisms to increase interference and improve side-channel eavesdropping security; TSW gating ensures that all cryptographic operations stop under abnormal conditions. This three-layered protection significantly increases the threshold and cost of implementing side-channel attacks.

[0053] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0054] The above and other objects, features and advantages of the present invention will become more apparent from the more detailed description of exemplary embodiments of the invention in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the invention.

[0055] Figure 1 A flowchart of a key derivation and hierarchical security circuit breaker method based on tamper-proofing status binding according to an embodiment of the present invention is shown. Detailed Implementation

[0056] Preferred embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0057] Example 1:

[0058] This embodiment provides a key derivation and hierarchical security circuit breaker method based on tamper-proofing status binding.

[0059] Step S0, Pre-shipment configuration:

[0060] The storage block WKB is configured before leaving the factory, including key derivation, subkey derivation, and key encapsulation steps, specifically:

[0061] Key derivation step: Using the same key derivation step as step S3, the working key WK is calculated and output by combining the four materials using the key derivation function KDF; the four materials include the chip root key HUK, the device unique identifier UID, the tamper status word TSW, and the key version counter CTR;

[0062] Subkey derivation steps: The working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac through the key derivation function;

[0063] Kenc = KDF_sub(WK, label="ENC", UID, ver);

[0064] Kmac = KDF_sub(WK, label="MAC", UID, ver);

[0065] Wherein, KDF_sub is a deterministic key derivation function based on standard hash / standard MAC, label="ENC" indicates that the subkey is used for encryption; label="MAC" indicates that the subkey is used for message authentication; ver represents the version number, which uses the current version counter CTR value;

[0066] Key encapsulation steps: The structure of encryption before authentication is adopted. The plaintext key P is encrypted with the encryption subkey Kenc to obtain the ciphertext C, C = Enc(Kenc, P, IV);

[0067] The message authentication code label T is calculated using the authentication subkey Kmac on the associated data AAD, the random number IV, and the ciphertext C, where T = MAC(Kmac, AAD ‖ IV ‖ C); where the associated data AAD is AAD = UID ‖ key_type ‖ ver, which includes UID, key type key_type, and version number ver;

[0068] Assemble the storage block WKB and write it to the secure world non-volatile Flash, which is inaccessible in the normal world; where WKB = IV ‖ C ‖ T.

[0069] Step S1, Security Initialization:

[0070] After the system is powered on, the TrustZone security architecture is initialized, and the memory boundaries between the secure world and the normal world are defined; the encryption engine is started to enter the protected mode; the chip root key HUK and the device unique identifier UID are obtained from the verified secure world firmware;

[0071] Specifically, the first stage after the system is powered on is the establishment of a safe environment:

[0072] (a) After the chip is reset, the CPU fetches instructions from the on-chip immutable ROM (Read-Only Memory). The boot code in the ROM first initializes the TrustZone address partition controller (SAU / IDAU), defining the memory boundaries between the secure world and the normal world.

[0073] (b) The startup code calls the SCE9 encryption engine, putting it into Protected Mode. In this mode, SCE9 provides constant-time execution and the ability to resist SPA / DPA power analysis.

[0074] (c) Load the digitally signed secure world firmware image from ROM into a secure memory region (protected by SAU and inaccessible from the normal world). Signature verification is performed by SCE9 hardware to ensure that the firmware has not been tampered with.

[0075] (d) After the Secure World firmware boots up, it obtains two key identifiers: (i) HUK handle - a pointer to the HUK region inside the SCE9; (ii) UID - the chip's unique device identifier (usually 128 bits, which can be published but not duplicated).

[0076] Step S2: Construct the Tampered Status Word (TSW):

[0077] Maintain an N-bit tamper status register, where each bit corresponds to the detection status of a type of hardware tamper detection source, including passive tampering pins, clock precision monitoring circuits, voltage monitoring circuits, and illegal access detection of debugging interfaces.

[0078] Specifically, this is one of the key inputs of this invention. The secure world maintains an N-bit register variable TSW (Tamper Status Word), with each bit corresponding to a type of hardware tampering detection source:

[0079] TSW Status Word Bit Field Description

[0080] Position number Corresponding hardware detection source Set 1 condition Bit 0 ~ Bit 2 Passive tampering pin (RTCICn) The meter casing was detected to have been opened or physically touched. Bit 3 CAC clock accuracy monitoring circuit The external clock frequency deviation exceeds a preset threshold (e.g., ±5%). Bit 4 LVD voltage monitoring circuit The supply voltage is lower than the safe operating threshold. Bit 5 Debugging interface illegal access detection An unauthorized JTAG / SWD connection attempt was detected.

[0081] Each detection source undergoes two layers of processing before reaching the TSW bit:

[0082] Debounce: Hardware signals may experience momentary glitches due to electromagnetic interference. Each signal must persist for more than a time threshold T_debounce (e.g., 10 microseconds to 1 millisecond, depending on the specific signal type) to be considered a valid event. This avoids false triggering.

[0083] Threshold confirmation: For analog signals (such as CAC frequency deviation, LVD voltage amplitude), they must exceed the normal range for multiple consecutive samplings (such as more than 3 times) before they are judged as abnormal.

[0084] The TSW is stored in the secure world's memory. Code in the normal world can only read the TSW's "digest hash" or "status flags" and cannot directly modify any bit of the TSW. This ensures that even if an attacker breaches the normal world, they cannot forge a "perfect" TSW value.

[0085] Step S3, Key Derivation:

[0086] The secure world uses the key derivation function KDF to combine four materials to calculate and output the working key WK. The four materials include the chip root key HUK, the device unique identifier UID, the tamper status word TSW, and the key version counter CTR. If the tamper status word TSW is non-zero, the derivation of WK is rejected and a tampering error is returned. The KDF operation is performed within the secure world and uses a cryptographic primitive function that executes in constant time, with an output length of not less than 256 bits.

[0087] Specifically, the secure world uses the key derivation function KDF to calculate the combination of the four materials and outputs the working key WK. After successful derivation, WK is written into a dedicated volatile RAM area of ​​the secure world. This area has the following properties:

[0088] Loss upon power failure: Once power is lost or the device is reset, the contents are immediately lost and cannot be recovered.

[0089] Bus isolation: This area is not addressable by the DMA controller and the normal world CPU.

[0090] Never written to disk: WK will never be written to Flash, EEPROM, or any non-volatile storage medium. This means that even after the chip has been cut open, a physical probe cannot extract WK from the silicon wafer because it is simply not there.

[0091] Step S4, Safe computation execution:

[0092] Under the condition that the tamper status word TSW is zero, the secure world uses the derived working key WK to unpack the storage block WKB to obtain the plaintext key P, and performs operations based on the plaintext key P in a secure isolation environment; all cryptographic operation APIs check the TSW value at the entry point, and if the tamper status word TSW is not zero, they refuse to execute and return a tampering error.

[0093] In this process, the secure world uses the derived working key WK to unpack the storage block WKB and obtain the plaintext key P, including:

[0094] The key decryption steps include: parsing the storage block WKB to extract IV, C, and T, and checking whether the current tamper status word TSW is zero;

[0095] If the tampered state word TSW is non-zero, decryption stops and a tampering error is returned directly. If the tampered state word TSW is zero, the current working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac again according to the subkey derivation steps. The message authentication code label T' is recalculated according to the key encapsulation steps and compared with the message authentication code label T for a constant time.

[0096] If the comparison is consistent, the plaintext key P is decrypted and restored; if the comparison is inconsistent, an L2-level circuit breaker response is triggered to confirm the tampering.

[0097] Specifically, with WK, the secure world can use it to decrypt other long-term stored keys P (such as device identity private key pairs, pre-shared master station communication keys, etc.) and perform various cryptographic operations in a secure, isolated environment:

[0098] AES / RSA / ECC computation: The SCE9 hardware engine is used first. SCE9 inherently possesses resistance to SPA / DPA side-channel attacks in Protected Mode, requiring no additional protection measures.

[0099] Other standard cryptographic algorithms (such as standard elliptic curve cryptography, standard RSA, etc.): are implemented in software within the secure world, with the following side-channel protection measures: (a) all table lookup operations are masked; (b) branch conditions are eliminated by constant-time select; and (c) mask refresh values ​​are provided by TRNG.

[0100] Access control gating: All cryptographic operation APIs check the current TSW (Tamper Status Word) value at the entry point. If TSW ≠ 0 (i.e., an active tampering flag exists), any operation involving the WK or long-term key is refused, and an error code is returned directly.

[0101] In this step, TSW not only affects the derivation of WK, but also runs through the entire process of each subsequent key use, forming a full-link linkage of "detection-derivation-use".

[0102] Furthermore, it also includes a graded circuit breaker response (state machine): when the TSW (Tamper Status Word) detects an anomaly, the system does not simply self-destruct, but enters four different security levels from L0 to L3 according to the severity.

[0103] In the secure world, maintain an N-bit state detection source. Based on the TSW state word detection results, execute a differentiated response strategy according to a four-level security state machine. The four-level security states include normal operation state L0, soft anomaly state L1, confirmed tampering state L2, and severe attack state L3.

[0104] The L0 state is defined as the normal operating state, with all functions operating normally, WK valid and available, and TSW=0;

[0105] The L1 state is defined as a software abnormal state. Under normal circumstances, the detection bit will not change. The L1 state is defined as the detection of occasional abnormalities in the status bit, but all within a reasonable threshold control range. TSW=0, reducing the frequency of use.

[0106] The L2 state is defined as confirming that an attack has been detected and that the confirmation state has been tampered with. At this time, if any state exceeds the threshold, it will enter this state, TSW != 0, decryption is no longer supported, and remote recovery is possible.

[0107] The L3 state is defined as a critical attack or self-destruct key state. It is entered when multiple L2 states are detected simultaneously and exceed a threshold. At this time, the protected key will be set to unreadable or destroyed. TSW != 0, decryption is no longer supported, and remote recovery is impossible.

[0108] The transition rules for the Level 4 security state machine are as follows: When a single detection source is detected to trigger momentarily in the L0 state and the duration does not reach the confirmation threshold, it is defined as a momentary anomaly and the system will transition to the L1 state. When any detection source is detected to exceed the threshold duration in the L1 state (confirmed by debouncing and multi-sampling), it is defined as confirmation of tampering and the system will transition to the L2 state. When multiple detection sources are detected to trigger concurrently in the L2 state, or when multiple sources of probe-type deep intrusion are detected to trigger concurrently, the system will transition to the L3 state. If no new triggering event occurs in the L1 state within the preset detection time, the system will automatically recover to the L0 state. In the L2 state, if both TSW zeroing and remote authorization verification are passed, the system will recover to the L0 state. The L3 state is an irreversible final state, and any input will remain in the L3 state.

[0109] Recovery in L2 state is not a simple matter of "rebooting". Since WK is derived from KDF in real time, the device will recalculate WK after a reset by going through the S1-S3 process again. There are two possibilities at this point:

[0110] Case A – TSW has returned to all 0 (e.g., the tamper switch that was accidentally triggered has been restored): After resetting, KDF will recalculate a WK that is the same as before (because the input material has not changed), and the business will automatically return to normal.

[0111] Case B – TSW is still not 0 (attack traces remain): In this case, KDF will refuse to derive (see lines 02-03 of the algorithm), WK cannot be generated, and the device remains in a locked state. To recover, the following must be met simultaneously: (i) physical attack is eliminated (TSW is zeroed); (ii) the master station initiates a remote challenge-response authentication, and the device is only allowed to derive WK again after a correct response.

[0112] This "two-factor recovery" mechanism ensures that even if an attacker can temporarily eliminate the physical trigger signal (such as by pressing the tamper switch back), the device cannot be restored without the remote authorization signature from the master station.

[0113] In this invention, the key is calculated on-site each time it is used, and whether the device has been tampered with is one of the necessary factors for the calculation. A tamper-proof binding key derivation mechanism is designed: the working key is not pre-stored somewhere, but is calculated in real time by a key derivation function (KDF) based on the following four factors each time it is needed:

[0114] HUK (Chip Root Key): A 256-bit secret that is permanently embedded at the factory and can never be read.

[0115] UID (Unique Device ID): Each meter is unique.

[0116] TSW (Tamper Status Signal): A string of 0 / 1 flags that reflects in real time whether this instrument has been tampered with. Under normal circumstances, all bits are 0; once any physical attack is detected, the corresponding bits are flipped to 1.

[0117] CTR (Key Version Counter): Note that CTR is not a serial number that increments with each derivation, but rather a key version number. During normal operation, CTR remains frozen to ensure that each derived key (WK) is identical (deterministic KDF). It only increments during explicit key change events (such as annual key rotation or forced key change after controlled recovery), and during incrementing, a re-encryption migration of the encapsulated data is performed simultaneously (decapsulating with the old WK and recapsulating with the new WK). Its purpose is to prevent attackers from replaying old versions of encapsulated data back onto the device.

[0118] The key point is that hash functions have a mathematical property: even a difference of just one bit in the input will completely change the output. Therefore, if any bit in the TSW is flipped due to an attack, the calculated working key will become a completely different, incorrect key. No destruction is needed; the old key is automatically rendered invalid, and an unrecoverable key is simply burned instead.

[0119] In this invention, the working key WK derived from KDF is positioned as a key encryption key (KEK), not a session key used for communication. It does not participate in communication, but it is positioned at the very top of the communication chain—WK locks the identity private key, which is used for handshake authentication with the master station. Therefore, when the meter is detached → TSW changes → WK miscalculates → private key cannot be retrieved → authentication fails → meter automatically loses connection, the entire process does not require notification to the master station.

[0120] For example: UID = 0x12345678 0x9ABCDEF0 (8 bytes); WK = 0xAA… (256 bits, derived from KDF(HUK‖UID‖TSW=0‖CTR=5)); plaintext to be encapsulated P = 32 bytes random key; key_type = 0x01 (identity private key); ver = 0x00000005.

[0121] Package end:

[0122] Kenc = KDF_sub(WK, "ENC", UID, 5)

[0123] Kmac = KDF_sub(WK, "MAC", UID, 5)

[0124] AAD = UID(8B) ‖ 0x01 ‖ 0x00000005

[0125] IV = TRNG() / / Get random number

[0126] C = Enc(Kenc, P, IV)

[0127] T= MAC(Kmac, AAD ‖ IV ‖ C)

[0128] WKB = "WKPB" ‖ 0x01 ‖ 32 ‖ 0x00000005 ‖ 0x0000 ‖ IV ‖ C ‖ T

[0129] / / Total length = 12 + 16 + 32 + 16 = 76 bytes, written to the Flash secure partition

[0130] Verification end (same device, same version, untampered):

[0131] Reading WKB → Parsing reveals key_type=0x01, ver=5, IV, C, T

[0132] TSW==0 via gating

[0133] AAD = UID || 0x01 || 5

[0134] Kenc = KDF_sub(WK, "ENC", UID, 5) / / The current WK is the same as the one used during encapsulation → the derived value is the same.

[0135] Kmac = KDF_sub(WK, "MAC", UID, 5)

[0136] T'= MAC(Kmac, AAD ‖ IV ‖ C)

[0137] A fixed-length comparison T' == T → holds true

[0138] P = Dec(Kenc, C, IV) / / Obtain the plaintext key that is exactly the same as the one used in the encapsulation.

[0139] Returns (P, 0x01, 5)

[0140] Tampering scenario (the device is opened and then powered on again, but the TSW is non-volatile latched, or the current TSW is not equal to 0):

[0141] Gating: TSW != 0 → Returns ERROR directly (no decryption, key unavailable)

[0142] Even if the gate control is bypassed and forced verification is enforced:

[0143] Current WK' = KDF(HUK‖UID‖TSW≠0‖CTR=5) ≠ Original WK

[0144] → Kmac' ≠ Original Kmac → T' ≠ T → ERROR_MAC_FAIL → Triggers L2 circuit breaker

[0145] Conclusion: The attacker could not obtain any usable plaintext keys, and the old encapsulated data automatically became invalid.

[0146] Example 2

[0147] This embodiment provides a key derivation and hierarchical security circuit breaker system based on tamper-proof situation binding. The system includes a processor, a memory, and an encryption engine.

[0148] The processor runs secure-world code and normal-world code, achieving secure isolation through a TrustZone architecture; the encryption engine is configured to provide constant-time cryptographic computation capabilities in protected mode; the memory includes secure-world volatile RAM and secure-world non-volatile Flash. The system is configured to execute the method described in Embodiment 1.

[0149] The overall security capability of the system is built on the native hardware modules of the RA6 chip (SCE9 / HUK / Tamper / CAC / LVD / DLM / TRNG / TrustZone), without the need for external security chips, custom ASICs, or additional anti-tamper sensor chips.

[0150] The normal world performs routine application operations, while the secure world is responsible for key derivation, maintenance of tamper-proof status codes, key decryption, and tiered circuit breaker responses. The secure world and the normal world are isolated from each other through the TrustZone architecture for memory and bus isolation.

[0151] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

Claims

1. A key derivation and hierarchical security circuit breaker method based on tamper-proof situation binding, characterized in that, Includes the following steps: Step S1, Security Initialization: After the system is powered on, initialize the TrustZone security architecture and define the memory boundaries between the secure world and the normal world; start the encryption engine to enter the protected mode; obtain the chip root key HUK and the device unique identifier UID from the verified secure world firmware; Step S2: Construct the Tamper Status Word (TSW): Maintain an N-bit Tamper Status Word register, where each bit corresponds to the detection status of a type of hardware tamper detection source. The hardware tamper detection sources include passive tampering pins, clock precision monitoring circuits, voltage monitoring circuits, and illegal access detection of debugging interfaces. Step S3, Key Derivation: Secure World uses the key derivation function KDF to combine four materials to calculate and output the working key WK. The four materials include the chip root key HUK, the device unique identifier UID, the tamper status word TSW, and the key version counter CTR. If the tamper status word TSW is non-zero, the derivation of WK is rejected and a tampering error is returned. Step S4, Secure Operation Execution: Under the condition that the tampered status word TSW is zero, the secure world uses the derived working key WK to unseal the storage block WKB to obtain the plaintext key P, and performs operations based on the plaintext key P in the secure isolation environment; All cryptographic operation APIs check the TSW value at the entry point. If the tamper status word TSW is not zero, execution is refused and a tampering error is returned.

2. The method according to claim 1, characterized in that, The KDF operation described in step S3 is performed in a secure world and uses cryptographic primitive functions that execute in constant time, with an output length of not less than 256 bits.

3. The method according to claim 1, characterized in that, The working key WK derived in step S3 is written only to the secure world volatile RAM, which is characterized by being lost upon power failure, isolation between the DMA controller and the normal world CPU bus, and prohibition of writing to non-volatile storage media.

4. The method according to claim 1, characterized in that, In S4, the storage block WKB is configured before leaving the factory, including key derivation, subkey derivation, and key encapsulation steps, specifically: Key derivation step: Using the same key derivation step as step S3, the working key WK is calculated and output by combining the four materials using the key derivation function KDF; Subkey derivation steps: The working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac through the key derivation function; Kenc = KDF_sub(WK, label="ENC", UID, ver); Kmac = KDF_sub(WK, label="MAC", UID, ver); Wherein, KDF_sub is a deterministic key derivation function based on standard hash / standard MAC, label="ENC" indicates that the subkey is used for encryption; label="MAC" indicates that the subkey is used for message authentication; ver represents the version number, which uses the current version counter CTR value; Key encapsulation steps: The structure of encryption before authentication is adopted. The plaintext key P is encrypted with the encryption subkey Kenc to obtain the ciphertext C, C = Enc(Kenc, P, IV); The message authentication code label T is calculated using the authentication subkey Kmac on the associated data AAD, the random number IV, and the ciphertext C, where T = MAC(Kmac, AAD ‖ IV ‖ C); where the associated data AAD is AAD = UID ‖ key_type ‖ ver, which includes UID, key_type, and version number ver; Assemble the storage block WKB and write it to the secure world non-volatile Flash, which is inaccessible in the normal world; where WKB = IV ‖C ‖ T.

5. The method according to claim 4, characterized in that, In S4, the secure world uses the derived working key WK to unpack the storage block WKB to obtain the plaintext key P, including: The key decryption steps include: parsing the storage block WKB to extract IV, C, and T, and checking whether the current tamper status word TSW is zero; If the tampered state word TSW is non-zero, decryption stops and a tampering error is returned directly. If the tampered state word TSW is zero, the current working key WK is used to derive the encryption subkey Kenc and the authentication subkey Kmac again according to the subkey derivation steps. The message authentication code label T' is recalculated according to the key encapsulation steps and compared with the message authentication code label T for a constant time. If the comparison is consistent, the plaintext key P is decrypted and restored; if the comparison is inconsistent, an L2-level circuit breaker response is triggered to confirm the tampering.

6. The method according to claim 1, characterized in that, It also includes a tiered circuit breaker response step: In the secure world, maintain an N-bit state detection source. Based on the TSW state word detection results, execute a differentiated response strategy according to a four-level security state machine. The four-level security states include normal operation state L0, soft anomaly state L1, confirmed tampering state L2, and severe attack state L3. The L0 state is defined as the normal operating state, with all functions operating normally, WK valid and available, and TSW=0; The L1 state is defined as a software abnormal state. Under normal circumstances, the detection bit will not change. The L1 state is defined as the detection of occasional abnormalities in the status bit, but all within a reasonable threshold control range. TSW=0, reducing the frequency of use. The L2 state is defined as confirming that an attack has been detected and that the confirmation state has been tampered with. At this time, if any state exceeds the threshold, it will enter this state, TSW != 0, decryption is no longer supported, and remote recovery is possible. The L3 state is defined as a critical attack or self-destruct key state. It is entered when multiple L2 states are detected simultaneously and exceed a threshold. At this time, the protected key will be set to be unreadable or destroyed. TSW != 0 means decryption is no longer supported, and remote recovery is not possible.

7. The method according to claim 6, characterized in that, The transition rules for the four-level security state machine described in step S5 are as follows: When a single detection source is detected in the L0 state and the duration does not reach the confirmation threshold, it is defined as a transient anomaly and will transition to the L1 state. If any detection source is detected in the L1 state for a duration exceeding the threshold (confirmed by de-jittering and multi-sampling), it is defined as confirmation that tampering has occurred, and the process transitions to the L2 state. When multiple detection sources are detected to trigger concurrently in the L2 state, or when multiple sources of probe-type deep intrusion are detected to trigger concurrently, the system transitions to the L3 state. If no new triggering event occurs in the L1 state within a preset time, the system will automatically revert to the L0 state. In L2 state, if both TSW zeroing and remote authorization verification are passed, then the system will revert to L0 state. The L3 state is an irreversible final state, and any input will remain in the L3 state.

8. The method according to claim 7, characterized in that, For confirmed tampering state L2, the response includes: clearing WK ​​in the secure world volatile RAM within less than n milliseconds, stopping the response to key decryption requests, locking the debug interface through the device lifecycle management module, and reporting a tampering event report with a digital signature to the master station.

9. The method according to claim 7, characterized in that, For severe attack state L3, the response includes: executing all L2 level response actions and setting the non-volatile Flash in the firmware's security world to irreversible write protection, causing the device to enter a physical lock-up state.

10. A key derivation and hierarchical security circuit breaker system based on tamper-proof situation binding, characterized in that: This includes the processor, memory, and encryption engine; The processor runs secure world code and normal world code, and secure isolation is achieved through the TrustZone architecture. The encryption engine is configured to provide constant-time cryptographic computation capabilities in protected mode; The memory includes secure-world volatile RAM and secure-world non-volatile Flash; The system is configured to perform the method of any one of claims 1 to 9.

Images