GENERATION OF A CRYPTOGRAPHIC KEY FROM SRAM MEMORY

Abstract

Method for generating a cryptographic key from an SRAM memory and device implementing such a method, the method comprising the steps of: biased initialization of a first set of cells located in a first region (12) of the SRAM memory so as to favor the establishment of the cells of the first set in a first logical state, storing, in a second set of cells in a second region (14) of the memory, the respective states of the cells of the first set and resulting from the first biased initialization, then, performing a second biased initialization of the first set of cells so as to favor the establishment of the cells of the first set in a second logical state, complementary to the first logical state, the method further comprising, after the first biased initialization and the second biased initialization (Figure 2)

Description

Title of the invention: CRYPTOGRAPHIC KEY GENERATION FROM AN SRAM MEMORY Technical field

[0001] The present application relates to the field of generating cryptographic keys from a memory.

[0002] It relates more specifically to an improved method for generating a cryptographic key from a digital fingerprint resulting from the initialization of an SRAM memory (Static Random Access Memory), as well as a device using such a method. STATE OF THE PRIOR ART

[0003] It is known to use an SRAM memory as a physical unclonable function or PUF (for "Physical Unclonable Function") in order to provide a digital fingerprint that is not directly accessible and which serves as a unique identifier. A cryptographic key can then be created from this digital fingerprint.

[0004] A known technique for generating such a digital fingerprint capable of serving as a cryptographic key from an SRAM notably comprises a phase called enrollment ("enrollment" according to English terminology) consisting of carrying out a repeated succession of initializations of the SRAM memory in order to be able to select memory cells, in other words bits, called "highly biased".

[0005] There are a small number of techniques for initializing an SRAM memory. The best-known initialization technique is a so-called "free" initialization, which consists of the unconstrained ignition of a plane of memory cells. With a free initialization, the state in which each cell is initialized is established freely. In particular, during an unconstrained ignition of a kth chip among a very large number Np ~ 10,000 of chips produced, the cell of the ith column and the jth row has a probability pijk of initializing to a logic level '1' and a probability l-pijk of initializing to a logic level '0'. Over a large number ~ 100 unconstrained initializations, the average of the initialization values ​​of the cell of the ith column and the jth row in a memory plane of the kth chip will tend towards this probability value pijk.It turns out that this probability value changes from one cell to another and between one chip and another, in a way that on a set of cells of different chips we will have a statistic of p which depends in particular on the local variability of its manufacturing process and more generally on PVT conditions ("Process", "Voltage", "Temperature", i.e. process, voltage, temperature) in other words on va- . local and global nations of the manufacturing process, the slew rate (VSR) of the supply voltage level used, and the operating temperature.

[0006] For a fixed k, highly biased bits correspond to cells with a high probability of switching and initializing at a given logic level (pijk equal to or very close to 1 for cells with a high tendency to initialize at '1'; and pijk equal to or very close to 0 for cells with a high tendency to initialize at '0').

[0007] The initialization of a memory can take several cycles (100-100000 depending on the frequency of the system) and an enrollment phase can contain several memory ignitions, typically several dozen to ensure sufficient invariability of the initialization potential value corresponding to a logic level '1' or '0' and thus allow the identification of a cell, in other words a highly biased bit (HBB for "Highly Biased Bit").

[0008] The enrollment phase can thus prove to be very long to implement and one may wish to carry it out only a limited number of times and advantageously only once.

[0009] Furthermore, the result of the enrollment phase is typically stored in a non-volatile memory (NVM) whose security may prove insufficient.

[0010] Furthermore, known enrollment techniques sometimes require the use of an error correction code (ECC) to retrieve the result of the enrollment phase stored in the NVM memory and to extract the HBB bits each time a cryptographic key based on the SRAM PUF is generated. This way of doing things reduces the number of cycles necessary to create a key, but the absolute number of cycles can still remain significant given that the decoding of the ECC code must typically be performed at each key generation request.

[0011] The use of non-volatile NVM memory and ECC code also has the disadvantage of requiring a large amount of memory space.

[0012] The problem arises of finding a new method for generating a cryptographic key from an SRAM type memory, which is improved and in particular with regard to at least one of the drawbacks stated above. Statement of the invention

[0013] It is therefore an aim of the present invention to provide a method for generating a cryptographic key from an SRAM memory, comprising steps consisting of: - performing a first biased initialization of a first set of cells located in at least a first region of the SRAM memory, so as to promote the establishment in a first logical state of the cells of said first set, - storing, in a second set of cells of a second region of the memory, the respective states of the cells of said first set and resulting from the first biased initialization, then, - carrying out a second biased initialization of said first set of cells so as to promote a placing in a second logical state, complementary to said first logical state, of the cells of said first set,

[0014] the method further comprising, after the first biased initialization and the second biased initialization: - establishing, from one or more given positions identified in the second region respectively of one or more cells “highly biased in the second state” which belong to said second set and are in the second logical state following the first biased initialization, and from one or more other positions identified in the first region respectively of one or more cells “highly biased in the first state” which belong to said first set and which are in said first logical state following the second biased initialization: a digital key of N-bits, the digital key being intended to form the cryptographic key or forming a digital word from which the encryption key is intended to be formed.

[0015] The first region is typically a so-called “PUF” region, in other words dedicated in particular to the implementation of a non-clonable physical function. The second region can be a so-called “post-processing” region.

[0016] With such a method, it is possible, with a limited number of initialization steps, here particular and "biased" initializations, to quickly highlight cells (in other words bits) strongly biased to '1' and cells or bits strongly biased to '0' and to use the respective positions of these cells or bits to form a digital key capable of forming a cryptographic key or encryption key.

[0017] With such a method, a limited memory space is also used since it is not necessary to duplicate the respective states of memory cells a significant number of times.

[0018] Such a method thus makes it possible to replace the conventional enrollment phase with a faster and less resource-intensive phase.

[0019] Such a method also has the particularity of not necessarily requiring non-volatile memory and the use of error correction codes.

[0020] It also allows for improvements in security, as the amount of sensitive data used during the development of the digital key is reduced.

[0021] In the event of a possible attack, these two regions of the memory can advantageously be erased in a single clock stroke, for example by a so-called “fast erase” method.

[0022] Advantageously, the first region is accessible only in read mode. This can make it possible to avoid a drift in behavior in terms of initialization of the first region during its useful life.

[0023] Advantageously, the second region is accessible in reading and writing.

[0024] The first region may be formed of m rows of memory cells, while the second region is formed of m or m+k (with m and k non-zero integers) rows of memory cells.

[0025] When the first region is formed of m lines, it can be associated with k complementary lines formed of distinct system registers of the memory.

[0026] According to a particular embodiment, the establishment of the digital key comprises steps of: - searching in an ith row of the second region for at least one highly biased cell in the second state and when a highly biased cell in the second state called "first cell" is detected, identifying the position, "first position", of the first detected cell, - searching in an ith line of the first region for at least one highly biased cell in the first state and when a highly biased cell in the second state called "second cell" is detected, identifying the position, "second position", of the second detected cell,

[0027] the method further comprising, - after identification of the first position of the first cell: modification of a given bit located at a first location of the digital key, in particular by putting said given bit in the second state, said first location of the digital key being selected as a function of the first position (pl_HBB) identified,

[0028] and / or, - after identification of the second position: modification of another bit located at a second location of the digital key, in particular by putting said other bit in the first state, said second location of the digital key being selected as a function of the second identified position.

[0029] Line-by-line processing is thus preferably carried out on a reduced number of regions of the SRAM memory to result in the formation of the key.

[0030] Advantageously, the first identified position corresponds to the kth rank of the ith line and the digital key can be formed in at least one “auxiliary post-processing” line of the SRAM memory or in a register of the system mentioned above. The first location can then be determined in the post-processing auxiliary line as a function of k, and in particular can correspond to the kth rank of the post-processing auxiliary line or register.

[0031] According to an advantageous embodiment, the method may further comprise: - after searching and identifying the first position and before modifying said given bit: a step of verifying with respect to a first determined threshold a proportion of bits in the first state in the digital key,

[0032] and / or, - after searching and identifying the second position and before modifying said other bit: a verification step with respect to a second determined threshold of a proportion of bits in the second state in the digital key.

[0033] Such checks can control the number of '0's and '1's in the digital key and thus adjust it according to the application.

[0034] The digital key can advantageously be formed from an auxiliary post-processing line of the SRAM memory or from a memory register of a system to which said memory belongs, with the erasure property described above. This memory can also be provided with one or more additional auxiliary post-processing lines, and in particular one or more lines for listing, at each modification of a bit of the digital key, a corresponding location of this modified bit in the digital key. If the memory does not include these k auxiliary lines, it is possible to carry out these operations in registers of the system to which the memory belongs.

[0035] According to one embodiment, the digital key being developed is recorded at a first memory address or a first register of the system. The digital key being developed is duplicated in the form of a second digital key at a second memory address or a second register of the system.

[0036] A key can be stored at a memory address and duplicated in a register or conversely a key is stored in a register and duplicated at a memory address.

[0037] A modification of a bit of the digital key can then be carried out in this case simultaneously in the second digital key and the method can further comprise steps consisting of: - verify the identity of the digital key and the second digital key and, when the digital key and the second digital key are different, - erase the contents of the first region and the second region.

[0038] A so-called "fast" erasure mechanism can be used in particular. This provides an additional level of security in the event of a possible intrusion.

[0039] According to another particular embodiment, when establishing the key N-bit digital key is performed by line-by-line processing and when all the lines of the first region have already been processed without all the N-bits of the digital key having been updated or constituted, the method may further comprise, during said establishment of the N-bit digital key, additional steps consisting of: - carry out a third biased initialization of a third set of cells of a third region, in particular dedicated to the PUF, of the SRAM memory or belonging to another SRAM memory so as to promote the establishment in a first logical state of the cells of said third set, - store the respective states of the cells of said third set and resulting from the third biased initialization, then, - carrying out a biased initialization of said third set of the third region so as to promote placing the cells of said third set in a second logical state, complementary to said first logical state.

[0040] It is then possible to complete the digital key from the positions of one or more cells “highly biased in the second state” which belong to said third set and are in the second logical state following the third biased initialization, and from the positions of one or more cells “highly biased in the first state” which belong to said third set and are in said first logical state following the fourth biased initialization.

[0041] Alternatively, the digital key may consist of N-bits whose respective values ​​each depend on an identified position among the given positions and the other identified positions of highly biased cells in the first state following the second biased initialization and of highly biased cells in the first state following the second biased initialization.

[0042] According to one possible implementation of the method, the digital key is established in an “auxiliary” sub-region of the SRAM memory or in a system register and the method may further comprise, prior to the first biased initialization and the second biased initialization, a step of initializing the “auxiliary” sub-region or the register, so as to establish the memory cells of the “auxiliary” sub-region or the bits of the register all in the same given logic state, in particular a logic state '0'.

[0043] According to a particular implementation of the method, the latter may further comprise, prior to the first biased initialization, a step of parameterizing means for controlling the initialization of the SRAM memory, so as to adjust the given probability of the cells of the first region establishing themselves in a first logic state following the first biased initialization.

[0044] This given probability can be advantageously modulated as a function of a pulse duration on at least one word line coupled to access transistors of the cells of said first set of cells and applied during the first biased initialization.

[0045] According to another aspect, the present invention provides a method of controlling an SRAM memory comprising steps of: - powering up the SRAM memory; - implementation of a method for generating a cryptographic key as defined above,

[0046] and, between the power-up and the implementation of the method for generating a cryptographic key or, after the implementation of said method for generating a cryptographic key: - placing the cells of the first region and the second region in an indeterminate state called “metastable” for which their respective first storage node and their respective second storage node are placed at equal or substantially equal potentials.

[0047] It is thus possible to provide for applying an anti-aging process or one against the NBTI effect to the regions of the memory used to develop the key.

[0048] According to another aspect, the present invention relates to a device comprising: - an SRAM memory, - SRAM memory control means provided with at least one processor, or a digital circuit or at least one computer processing unit, configured to implement a method as defined above.

[0049] According to a particular implementation, the device can also be provided with a register bank for auxiliary calculations. Brief description of the drawings

[0050] The present invention will be better understood on reading the description of exemplary embodiments given, for purely indicative and non-limiting purposes, with reference to the appended drawings in which:

[0051] [Fig-1] serves to illustrate an example of arrangement of an SRAM memory area from which a method for generating a cryptographic key and as implemented according to the invention can be carried out;

[0052] [Fig.2] serves to illustrate an example of a sequence of process steps for generating a cryptographic key from strongly '1' biased cells and strongly '0' biased cells of an SRAM memory area;

[0053] [Fig.3] serves to illustrate an example of a method for modulating a probability initializing memory cells of a SRAM memory region to '1' or '0' and being able to perform biased initialization of the memory cells favoring a given initialization logic state;

[0054] [Fig.4] serves to illustrate a search for bits strongly biased to '0' and bits strongly biased to '1' respectively in a first region, in particular dedicated to the PUF, of an SRAM memory having been the subject of a prior initialization biased to '1' and in a second region, in particular post-processing region, of an SRAM memory containing cells whose state results from an initialization biased to '0';

[0055] [Fig.5] serves to illustrate a modification of a particular memory line or system register, intended to form a digital key based on the positioning of highly biased bits identified in the first region or in the second region;

[0056] [Fig.6] serves to illustrate a process variant in which a digital key is duplicated during development in order to verify its integrity during this development;

[0057] [Fig.7] serves to illustrate a method variant in which the proportion of '1' or '0' in a digital key produced from a region of said PUF of an SRAM memory is adjusted;

[0058] [Fig.8] serves to illustrate a method variant in which, when the PUF region used to constitute a digital key does not contain enough highly biased bits, another memory region is selected in which a succession of biased initializations to '0' and biased initializations to '1' are carried out.

[0059] [Fig.9] serves to illustrate an additional memory region intended to form a PUF region and used in the event of a possible shortage of highly biased bits in the main PUF region;

[0060] [Fig. 10] is used to illustrate putting the bits of a memory into a particular state called “metastable”;

[0061] Identical, similar or equivalent parts of the different figures bear the same numerical references so as to facilitate the transition from one figure to another.

[0062] The different parts represented in the figures are not necessarily on a uniform scale, in order to make the figures more readable.

[0063] DETAILED DESCRIPTION OF PARTICULAR EMBODIMENTS

[0064] An exemplary method according to the present invention for generating a cryptographic key uses an SRAM memory typically having a memory area 10 divided into at least two regions as schematically illustrated in [Fig.l].

[0065] A first region 12 of the zone 10 is provided here with m lines (in other words m horizontal rows, with m a non-zero integer), of memory cells. This first region 12 called “PUF” is preferably made accessible only in read mode and contains a non-clonable physical function.

[0066] A second region 14 of the area 10 called post-processing (“Post Processing” in English, PP), made accessible both in reading and writing, is here provided with a size and a number of lines m+k (with k a non-zero integer) greater than those of the first region 12 insofar as, during the method implemented to enable the cryptographic key to be generated, the second region 14 is intended to store a copy of the respective states of memory cells of the first region 12. The second region 14 is not exclusively dedicated to the generation of a cryptographic key and can, outside of the processing described here to generate such a key, be used for the implementation of other secure calculations.

[0067] Typically, the second region 14 is provided to be slightly larger than the first region 12, with a number of k additional lines comprised for example between 4 and 6. The k additional lines of the second region 14 can form a sub-region 141 called “auxiliary” dedicated to the implementation of calculations during the establishment of the cryptographic key.

[0068] The flowchart in [Fig.2] schematically gives a possible succession of phases and steps implemented to be able to obtain (final step EF1N) a digital key, for example in the form of an N-bit word intended to form the cryptographic key or from which the cryptographic key is likely to be formed.

[0069] The generation of the cryptographic key here has the particularity of including a phase i called "highly biased bit highlighting HBB" (HBB for "Highly Biased Bits"). This phase O, here includes a reduced number of processing steps and in particular a reduced number of initializations.

[0070] During this phase Oi, a first particular initialization step E 1C0 is first carried out, called “biased” initialization of the cells belonging to the first region 12 of the SRAM memory zone 10. This first biased initialization is carried out here so as to favor the placing in a first given logic state of the cells of the first region 12.

[0071] By "favoring" is meant here that one acts, by means of control means of the SRAM memory, on the probability of each cell, of establishing itself in a given logic state rather than in a complementary logic state following an initialization and this, without however imposing this given logic state and thus putting all the cells in this given logic state during this initialization. Such control means make it possible to adjust the probability of establishment of the cells in a given state of the cells so that their probability of initialization in this given state, for example '0', is greater than a complementary logical state, for example '1', of this given state.

[0072] When biased initialization is implemented, a large majority of the initialized cells are established in a given logic state. However, some cells are established in the logic state complementary to the given logic state despite the initialization bias introduced. These cells are here called "highly biased".

[0073] Examples of control means for implementing biased initialization of SRAM memory cells are given in the application FR 3128570 Al issued by the applicant. A circuit for carrying out biased initialization is described in this application FR 3128570 Al in particular in connection with [Fig.6] of this application FR 3128570 Al. To control the initialization statistics and modulate the probability of establishing the cells in a given logic state, action is taken here in particular on their polarization during initialization and in particular on the voltage values ​​applied to the bit lines.

[0074] To enable the initialization state of a given memory cell to be biased, another example of control means is based on the adjustment of a write time, in particular by modulating the duration Tpuise of a pulse applied to activate a word line WL associated with a row of cells to which this given memory cell belongs.

[0075] As illustrated schematically in [Fig.3], if one wishes to perform a write to a given logic state in a cell, for example to '0' and impose a logic state '0' on it in this case, one then leaves a pulse duration Tpuke sufficient and greater than a first threshold so that the bit lines BLTi, BLFi can establish themselves at respective predetermined levels, for example 0.9 VDD for a first bit line and 0.1 VDD for the complementary bit line BLFi.

[0076] In the case that interests us, we wish to carry out a biased initialization (favoring a logic state '0' with a given probability rather than imposing it). However, when the pulse duration Tpuke is sufficient and greater than a second threshold but less than the first threshold, this cell can be initialized either to a logic state '0' or to a state '1', with all the same a probability of establishing itself in the state '0' greater than that of establishing itself in the state '1' and typically between 95 and 99% and advantageously between 98 and 99%.

[0077] In such a case, if following a biased initialization to 0, the logic state imposed on the cell is indeed '0', this means that the cell does not correspond to a strongly biased cell. It thus follows the inertia of the input pulses (curves Cn and Ci2) imposed on the first bit line BLTi and second bit line BLFi.

[0078] On the other hand, if following an initialization biased to 0, the logic state of the cell still switches to a logic state '1' (curves C2i and C22) despite the higher probability of switching to 0, the cell (and its corresponding bit) is then identifiable as strongly biased to 1.

[0079] According to one possible embodiment, as illustrated in [Fig.2], the first step of biased initialization of the cells of the first region 12 may for example be a biased initialization to '0' (step E1Co), in other words carried out in such a way as to favor a setting in a logic state '0' of the cells of the first region 12.

[0080] The respective state of the cells of the first region 12 resulting from the first biased initialization is then stored (step ESTo) in the second region 14 of the SRAM memory area 10. The respective states of the cells of the first region 12 are thus duplicated in the second region 14.

[0081] Then (step E1Ci), a second biased initialization is carried out, this time to the second state of the (same) cells of the first region 12 of the memory. This then favors the establishment in a second state complementary to the first state of the cells of the first region 12.

[0082] Thus, if we follow the example illustrated in [Fig.2], where we have previously carried out a first biased initialization to '0' of the cells of the first region 12, the second biased initialization is this time a biased initialization to '1' (step E1Ci). In other words, we carry out an initialization of these cells of the first region 12 so as to favor a setting to a logic state '1' of the cells of the first region 12.

[0083] At the end of these steps E1Co and E1Ci, there is available in the memory zone 10 in the first region 12, a set of cells whose state results from the second biased initialization (step E1Ci), here an initialization biased to '1', and in the second region 14, a set of cells whose state results from the first biased initialization (step E1Co), here a biased initialization to '0'.

[0084] In the first region 12, cells (in other words bits) strongly biased in the first state have thus been highlighted, and in the second region 14, cells (in other words bits) strongly biased in the second state.

[0085] If we follow the particular embodiment of the method illustrated in [Fig.2], we have highlighted, in the second region 14, certain cells noted “HBB1” and which, despite the first initialization biased to '0' (step E1Co) and a higher probability of initializing to '0', have established themselves at a logic state '1'.

[0086] In the first region 12, certain cells noted “HBB0” have also been highlighted and which, despite the second initialization biased to '1' (step E1Ci) and a higher probability of initializing to '1', have established themselves in a logic state '0'.

[0087] The O| phase of highlighting cells (in other words bits) strongly biased replaces a conventional enrollment phase and as implemented in methods according to the prior art for generating a cryptographic key from an SRAM memory and in particular from a PUF region of this memory.

[0088] It has the advantage in particular of comprising a reduced number of steps (E1C o, Esto and E1Ci) much lower than a conventional enrollment phase and according to a sequence which does not necessarily need to be repeated. This makes it possible to achieve a considerable gain in terms of consumption, necessary resources (whether from the point of view of processing time and the sizes of allocated memory areas) and data security.

[0089] Once the biased initialization sequence and phase O, of highlighting the highly biased bits, have been completed, a phase O2 called “post-processing” is carried out, where a digital key intended to form the encryption key or from which the encryption key is capable of being formed is iteratively constructed.

[0090] The establishment of such a digital key comprises steps of searching, in the second region 14, for the bits strongly biased in the first state and identifying their respective positions, and of searching in the first region 12, for the bits strongly biased in the second state and identifying their respective positions.

[0091] Thus, if we refer to the example of initialization sequence given previously with an initialization biased to '0' followed by an initialization biased to '1', during the post-processing phase O2, the digital key is established from the positions of bits "HBB1" (in other words cells) strongly biased to '1' in the second region 14 and from positions of bits "HBB0" (in other words cells) strongly biased to '0' in the first region 12.

[0092] Such a search in regions 12 and 14 of memory area 10 is shown schematically in [Fig.4].

[0093] For example, it can be provided that the detection of the presence of a highly biased cell in an ith line (in other words “horizontal row”) of the first region 12 or of the second region 14 and located at a kth position in this ith line (i.e. the kth column or vertical row) can lead to a modification of a bit located at a location, in particular located at a kth position of at least one auxiliary “post-processing” memory line Lkey from which the digital key is formed. This memory line Lkey is in particular a memory line of the auxiliary sub-region 141, dedicated to post-processing calculations.

[0094] Thus, in a particular embodiment illustrated in [Fig.2], when we detect, in an ith line Li, strongly biased bits HBB in region 12 or region 14, and we identify their positions P1_HBB, P2_HBB (i.e. a horizontal row), we can then carry out a modification of bits in the digital key at corresponding locations Eml, Em2, in terms of positioning or rank in this digital key. In the particular embodiment illustrated when we detect bits strongly biased to '1' respectively in the 3rd column (or rank) and in the 7th column (or rank), we modify (here we write a '1') the bits of the 3rd rank (or column) and of the 7th (rank or column) of the line Lkey forming the digital key.

[0095] Typically, the post-processing phase dL comprises repeated processing, line by line, comprising steps consisting of:

[0096] a) searching for at least one cell strongly biased to state '1' in an ith row of the second region 14 and, if necessary, identifying the position called "first position" of this cell in the ith row of the second region 14,

[0097] b) searching for at least one cell strongly biased to state '0' in an ith row of the first region 12 and, if necessary, identifying the position called "second position" of this cell strongly biased to state '0' in this ith row of the first region 12.

[0098] Step a) may be followed, when a cell strongly biased to state '1' has been detected, by a step consisting of updating or modifying, in particular setting to state '1', a bit of the digital key located at a first location. This first location in the digital key depends on that of the first position identified in the ith row. Thus, if the cell strongly biased to state '1' is in the kth position or located at a kth rank of the ith row, the bit likely to be modified is determined as a function of this kth position and may in particular be placed at the kth rank of the digital key or of the auxiliary post-processing line Lkey in which this digital key is formed.

[0099] The possible modification of the first location may be conditioned by the fact that this first location has not already been modified during the processing of a previous line L, , or i-th line.

[0100] Thus, prior to a possible step of modifying the first location, the method may comprise a step of verifying whether the first location of the digital key has already been modified previously. When no prior modification has been implemented, the modification or updating of the bit at the first location may then be carried out. To carry out such a verification, the auxiliary sub-region 141 may for example be provided with one or more specific auxiliary post-processing lines for listing each location of bits already modified in the digital key.

[0101] Similarly, step b) may be followed, when the second highly biased cell has been detected, by a step consisting of modifying, in particular putting into the first state, at least a second bit of the digital key at a second location in the memory line L; or ith line.

[0102] The possible modification of the second location may be conditioned by the fact that this second location has not already been modified during the processing of a previous line L, i or i-th line.

[0103] Thus, prior to a possible step of modifying the second location, the method may comprise a verification step to determine whether the second location in the digital key has been previously modified. When no prior changes have been implemented, the second location change can then be made.

[0104] Referring to the particular example of the process illustrated in the [Fig.2], the so-called “post-processing” phase itself contains a sequence of two sub-phases 0ppl, 0ppO to process an ith line, this sequence being repeated for as many lines as are necessary to constitute the key.

[0105] During a first sub-phase 4>PP1, called post-processing of bits biased to 1, we first detect (step EDi) the possible presence of bits HBB1 strongly biased to '1' on the line i-th line L; of the first region 12 and if necessary we identify their respective positions.

[0106] It is then checked (step Evi) whether locations corresponding to these respective positions in the digital key have already been modified. If this is not the case, a modification (step Emodi) of the digital key is carried out at said corresponding locations by writing the value of the heavily biased bits, here typically a logical value of '1' for HBB1 bits heavily biased to '1'.

[0107] Otherwise, if the corresponding locations of the digital key have already been modified, no modification of the digital key is made and we move on to the second sub-phase 4>PP0.

[0108] In a case where, during the first sub-phase 0PPi, no HBB1 bit strongly biased to '1' is detected on the ith line L;, we also move on to the second sub-phase 4>PP0.

[0109] During the second sub-phase 4>PP0, called post-processing of bits biased to '0', the possible presence of bits HBB0 strongly biased to '0' on the line i-th line L; of the second region 14 is first detected (step ED0).

[0110] If there are one or more HBB0 bits, in other words, strongly biased to '0', their respective positions are identified and then it is checked (step EVo) whether the corresponding locations in the digital key have already been modified.

[0111] If this is not the case, a modification (step Emod0) of the digital key is carried out at said corresponding locations by writing the value of the heavily biased bits, here typically a logical value of '0' for heavily biased HBB0 bits at 0.

[0112] We then move on to the next line Li+i (step Li++)

[0113] In a case where, during the second sub-phase 0PPo, no HBB0 bit, in other words, strongly biased to '0' is detected on the ith line L;, we also move to the line next Li+i(step L;++).

[0114] We repeat the same procedure line by line.

[0115] The digital key that is iteratively constituted can be formed of N-bits. The repetition of the sequence of the two sub-phases 4>PP1, 4>PP0 can be stopped as soon as one has completed and written at least once, in each of the N bits constituting the cryptographic key.

[0116] The digital key that has been iteratively constituted may be intended to be used directly as a cryptographic key or serve as a basis for the generation of a cryptographic key, possibly with a different number of bits, after having undergone one or more treatments, in particular one or more logical operations.

[0117] The number m of lines of the first region 12 is here preferably dimensioned by design to allow, even in extreme cases of memory aging and high temperatures, that at least N heavily biased bits are available at the end of the cpi phase of highlighting the heavily biased bits.

[0118] However, the method of implementing the cryptographic key can be completed and the cryptographic key can be determined at the end of a number of repetitions of the sequence of the two sub-phases 0PPi, 0PPo less than m, the calculations in the m / 2nd line or before if the operating conditions are more optimal than expected.

[0119] In the embodiment described previously in connection with [Fig.2], bits (or cells) strongly biased to '0' are highlighted in the first region 12 and bits (or cells) strongly biased to '1' in the second region 14.

[0120] As an alternative to the first phase “Ih” of highlighting the highly biased bits, it is however possible to first carry out the biased initialization to '1' of the first region 12 (step E1Ci), then duplicate the initialization values ​​in the second region 14 (step ESToX) then carry out the biased initialization to '0' (step E1Co) in the first region 12.

[0121] In this case, we then detect, during the post-processing phase cp2, bits (or cells) strongly biased to '1' in the first region 12 and bits (or cells) strongly biased to '0' in the second region 14.

[0122] Similarly, the order of the steps or sub-phases 0ppl, 0PPo during the post-processing phase çp2 can also be reversed compared to that described previously in connection with [Fig.2].

[0123] Thus, one can first perform the sub-phase 0PPo to process an ith line of the region 12 or 14 containing the bits strongly biased to '0' in order to identify the positioning of the bits strongly biased to '0' and modify accordingly a dedicated location of the digital key according to this positioning, then perform the sub-phase 0PPi to process an ith line of the other region 14 or 12 containing the heavily biased bits to '1' in order to identify the positioning of the heavily biased bits to '1' in this ith row and modify accordingly, typically by writing a '1' to another location dedicated to the digital key according to this positioning.

[0124] Even if, as described previously, a reverse order of certain steps of the phases cpi, çp2 can be provided, the same order of steps is however preferably kept throughout the lifetime or use of the SRAM memory, in order to be able to generate the same cryptographic key each time.

[0125] During the post-processing phase O2 described above, the steps of identifying the highly biased bits can be carried out for example using a sequence of logical operations such as elementary logical operations OR, AND and XOR.

[0126] According to a particular embodiment, the steps of biased initialization in the first state and biased initialization in the second state can be parameterized so that the probability of initialization, in the second state, of cells having been initialized by biased initialization in the first state, is different from the probability of initialization, in the first state, of the same cells having been initialized by biased initialization in the second state.

[0127] Thus, we can respectively configure the biased initialization at '1' (step ECoi) and the biased initialization at '0' (step ECoo) so that, following the biased initialization at '1', the probability of finding bits strongly biased at '0' HBB0 is different from the probability, following the biased initialization at '0', of finding bits strongly biased at '1' HBB1. By doing this, we can thus modulate the percentage of '0' and '1' that we will find in the cryptographic key. This makes it possible to diversify the response that the same PUF zone can give.

[0128] During the post-processing phase O2, one can use, and perform operations on other lines (or bits or locations) than Le lé (intended to form the cryptographic key itself).

[0129] Thus, for example, a second line of the auxiliary sub-region 141 may be provided, for example, to allow tracking of already modified bits of the first auxiliary post-processing line during the post-processing phase O2 following detection of a bit strongly biased to '0'. A third line of the auxiliary sub-region 141 may be provided, for example, to allow tracking of already modified bits of the first auxiliary post-processing line during the post-processing phase O2 following detection of a bit strongly biased to '1'. An additional line may be used to perform masked writing in the auxiliary post-processing line(s) Lkey forming the digital key.

[0130] A method as described above may comprise, prior to the phase O, highlighting the HBBs, a phase Oq of additional steps in particular of definition of certain parameters prior to those of biased initializations of the memory zone 10.

[0131] Thus, in the exemplary embodiment illustrated in [Fig.2], prior to the first phase O ।, the method comprises a phase O0 during which a step ECal of designing the first region 12 containing a non-clonable physical function.

[0132] Such a step may comprise in particular the parameterization of the initialization conditions of this first region 12 and in particular of the initialization control means associated with this first region 12 in order to define the probability of setting to '0' or to '1' the cells of the first region 12 and / or a specific percentage of bits strongly biased to '0' or to '1'.

[0133] The parameters regulating the biased initialization conditions of the first region 12 can be adapted according to the technological node used to manufacture the SRAM memory and an estimation of its lifetime, and by using an abacus linked to the physical characteristics of the circuit, in particular aging and operating temperature.

[0134] Such a design may also include a step of dimensioning the first region 12 aimed in particular at determining the number m of useful lines for this first region 12.

[0135] Phase Oo of the method may also comprise a step E^r of initializing intermediate addresses, and in particular of initializing the second region 14 or at least its auxiliary post-processing sub-region 141. The memory cells of this “auxiliary” sub-region 141 are then established by imposing on them all the same given logic state, in particular a logic state '0'.

[0136] According to an improved alternative embodiment in terms of security, it is possible to provide for duplicating the digital key intended to form the cryptographic key or from which the cryptographic key is intended to be formed at another address and thus provide for establishing a second digital key in parallel. This second key is intended, just like the first key, to be formed incrementally, for example in a manner as described previously. The digital key and the second key are preferably modified simultaneously following the detection of a highly biased bit.

[0137] In this case, it is also possible to provide, before a possible step of modifying the digital key and the second key following the detection of a highly biased bit, a step of verifying the identity of the digital key and the second key. In the case where, following this verification step, a difference between these two keys is detected, it is then possible to proceed with erasing the memory area 10 in order to erase the contents of the cells of the first region 12 and of the second region 14.

[0138] Such erasure can in particular be implemented by a fast erasure technique such as described for example in document EP 3°496°101 and in which, in particular, their access transistors are turned on and the BLT and BLF bit lines with which they are associated are connected together.

[0139] Thus, in the particular embodiment illustrated in [Fig. 6], in addition to steps similar to those of the embodiment illustrated in [Fig. 2], additional steps EVEri and EVEr2 for verifying the identity between the two keys are provided. A first verification step EVERi of the identity of the digital keys keyl and key2 is implemented in particular after detection of a bit strongly biased to '1' and its position and before any modification of the first and second keys following this detection. A second verification step EVER2 of the identity of the digital keys keyl and key2 may also be implemented in particular after detection of a bit strongly biased to '0' and its position and before any modification of the first and second keys resulting from this detection.

[0140] In a case where a difference is detected between the two keys key1 and key2, a step Eeff is triggered to erase the memory area. In the opposite case, where the digital keys key1 and key2 are indeed identical, the sequence continues in a manner as described previously.

[0141] In either of the previously described embodiments, when the percentage of bits HBB0 strongly biased to '0' and when the percentage of bits HBB1 strongly biased to '1' is similar, the result is most of the time the generation of a key in which there is 50% of '0' and 50% of '1'.

[0142] However, one may wish to move away from this parity. For certain applications, one may also want to have several different keys extracted from the same SRAM memory area 10 and in particular from PUF region 12.

[0143] For this, a variant embodiment of the method integrates at least one step of comparing a proportion of '1' or '0' in the digital key being developed with a predetermined threshold.

[0144] Thus, in the embodiment illustrated in [Fig.7], after the step EDi of searching for cell(s) strongly biased to '1' on the ith line L; and of identifying the position of this or these cell(s) and prior to a possible modification of at least one bit of the digital key, a verification step EPROPi of the proportion of '1' in the digital key being developed is provided. This verification step EPROPi typically comprises the comparison of this proportion to a maximum threshold l. When this maximum threshold l is exceeded, we move on to the second sub-phase 0PPo. On the other hand, as long as this maximum threshold l is not exceeded, the digital key is likely to be modified by setting bits to the logic value '1' here.

[0145] Similarly, after the step ED[ of searching for cell(s) strongly biased to '0' on the th ngne l. and identification of the position of this or these cell(s) and prior to a possible modification of another bit of the digital key, a verification step EPROPo is provided for the proportion of '0' in the digital key being developed. This verification step EPROPoTypically includes the comparison of this proportion to a maxO threshold. When this maxO threshold is exceeded, we move on to the next line. On the other hand, as long as this maxO threshold is not exceeded, the digital key is likely to be modified by setting bits to the logical value '0' here.

[0146] When the first SRAM region 12 available has, by its initial design, an insufficient size, it may happen that this region 12 does not allow the entirety of N-bits of the digital key to be established. Thus, a case may possibly be encountered in which there is a number less than N HBB cells necessary to form the N-bit digital key. It may also happen that certain identified HBB cells are in identical positions in terms of column or rank so that the number of HBB bits likely to be able to cause a modification of the key always remains insufficient. In this case, instead of a single SRAM memory partition or a single memory, it may be desired to have an additional partition. Thus, according to an alternative embodiment illustrated in [Fig.9] a third region 22 belonging here to an SRAM memory 20 can be used as a backup.This third region 22 is also typically dedicated to performing a physical unclonable function (PUF).

[0147] Thus, when the establishment of the N-bit digital key is carried out by line-by-line processing and all of the lines of the first region 12 have already been processed without all of the N-bits of the digital key having been updated or constituted, the method may further comprise, during said establishment of the N-bit digital key, additional steps consisting of: - carry out a new biased initialization of the set of cells of the third region 22 so as to favor the establishment in a first logical state of the cells of the third region 22, - store, in particular in the second region 14, the respective states of the cells of the third region 22 and resulting from the new biased initialization, then, - carry out another new biased initialization of the third region 22 and so as to promote a placing in a second logical state, complementary to said first logical state, of the cells of the third region 22.

[0148] The digital key is then completed from the positions of the cells highly biased in the second state and highly biased in the first state identified and which result from these new biased initializations.

[0149] Thus, in the particular example of the method illustrated in [Fig.8], a step consisting of comparing the number of lines already processed with the total number m of the first region 12 is provided. When this number is reached, we move on to the third region 22. We carry out a biased initialization to '0' and a biased initialization to '1' to highlight the highly biased cells or bits in this third region 22. We thus repeat a sequence as described previously.

[0150] In a particular case where it is desired to form an N-bit key, with N greater than the size of each memory line, in other words greater than the number of columns of the SRAM memory, it is possible, for example, to repeat the same procedure several times and in particular a procedure of the type described previously in order to be able to generate each time a sub-word constituting the key.

[0151] After powering up the SRAM memory and during operating phases of the SRAM memory other than the one(s) where a cryptographic key is generated, it is advantageous to provide for placing at least the memory cells of the first region 12 in a particular operating state called “metastable”, in order to prevent aging. Those of the second region 14 of the SRAM can optionally be placed in a metastable state to prevent attack by remanence of the states.

[0152] [Fig. 10] is used to schematically illustrate such an operating mode, triggered after powering up the memory, in particular to protect against harmful effects linked to NBTI (NBTI in English “Negative-Bias Temperature In-stability”). By putting the cells dedicated to the PUFs in a metastable state, a drift in their respective initialization states is thus avoided, thus avoiding distorting the value of the cryptographic key.

[0153] A method for placing the cells of the first region 12 and 14 in the metastable state as described in application FR No. 2214117 filed on 12 / 21 / 2022 with the INPI and can be used for example.

[0154] Placing the cells of the first region 12 and the second region 14 in a metastable state may thus consist of placing them in an indeterminate state for which their respective first storage node and second storage node are at equal or substantially equal potentials, for example by connecting the bit lines together or by connecting the complementary storage nodes of each cell together.

[0155] While regions 12 and 14 are put into the metastable state, other cells of the SRAM memory belonging to a separate part of area 10 and in particular the first and second regions 12 and 14 can be at the same time placed in a determined state for which their respective first node and second node are at different respective potentials between a low state, corresponding in particular to a given logical state '0', and a high state, corresponding to a complementary logical state '1'.

[0156] Steps of a method as described above can be implemented in several ways. A hardware-type implementation provides that the sequence of steps is carried out using a state machine (FSM in English for "Finite State Machine") coded in at least one electronic circuit and / or a processor possibly located on the same chip support as the SRAM memory. Such a type of implementation is more secure and optimized in terms of execution time and energy consumption.

[0157] It is also possible to carry out the method using a "software" type implementation in which an external program, housed in a remote device (computer, processor, etc.) sends instruction by instruction to the SRAM memory to carry out the different steps. Such an embodiment offers more flexibility for parameterizing the different steps and / or making modifications but typically has an execution time that may be longer.

[0158] Similarly, input parameters of the method such as, for example, the parameters which make it possible to adjust the initialization probabilities to '1' or to '0' by biased initialization, the division of these regions can be in the form of data stored in configuration registers.

[0159] It is also possible to integrate these parameters in the form of instructions. When a processor or a computer or computer or digital processing means send(s) the controlled initialization instructions, it(they) then adds one or more information fields containing for example a value which sets the biased initialization to '0' and the biased initialization to '1'. The hardware and software implementations are combinable. It is thus possible for example to implement a state machine triggered by an instruction which sends all the parameters characterizing the biased initialization or a program which is triggered by a configuration register and which would also contain the parameters of the biased initializations.

[0160] As a variant of one or other of the embodiments described above, it is possible to provide a second region of size m associated with one or more registers external to the memory and in which the calculations and / or operations for implementing the key are implemented. In this case, such registers are preferably also protected by a “fast erase” type mechanism.

[0161] A method according to one or other of the embodiments described above is particularly suitable for the rapid encryption of electronic systems and can make it possible to replace in such systems a TNRG (“true random number generator”) type module to create one or more encryption keys used by an AES (for “Advanced Encryption Standard”) type module or using another encryption algorithm.

Claims

Claims

1. A method for generating a cryptographic key from an SRAM memory, comprising steps of: - performing a first biased initialization of a first set of cells located in at least a first region (12) of said SRAM memory, in particular a region dedicated to performing a non-clonable physical function (PUF), so as to promote the establishment in a first logical state, of the cells of said first set, - storing in a second set of cells of a second region (14) of said memory, the respective states of the cells of said first set and resulting from said first biased initialization, then, - carrying out a second biased initialization of said first set of cells so as to promote placing said cells of said first set in a second logical state, complementary to said first logical state, the method further comprising, after the first biased initialization and the second biased initialization: -establishing an N-bit digital key, from one or more given positions identified in said second region (14) respectively of one or more so-called "highly biased in the second state" cells (HBB1; HBBO) which belong to said second set and are in the second logical state following said first biased initialization, and from one or more other positions identified in said first region (12) respectively of one or more so-called "highly biased in the first state" cells (HBBO; HBB1) which belong to said first set and are in said first logical state following said second biased initialization, said digital key being intended to form the cryptographic key or forming a digital word from which the encryption key is intended to be formed.

2. The method of claim 1, wherein establishing the digital key comprises steps of: - searching in an ith line of the second region (14) for at least one highly biased cell in the second state (HBB1; HBBO) and when a highly biased cell in the second state (HBB1; HBBO) called "first cell" is detected, identifying the position, called "first position", of said first detected cell, - searching in an ith line of the first region (12) for at least one highly biased cell in the first state (HBBO; HBB1) and when a highly biased cell in the second state called "second cell" is detected, identifying the position, called "second position", of said second detected cell, the method further comprising, - after identification of the first position of the first cell: modification of a given bit located at a first location (Eml) of the digital key, in particular by putting said given bit in the second state, said first location of the digital key being selected as a function of said first position (pl_HBB) identified, and / or, - after identification of the second position: modification of another bit located at a second location of the digital key, in particular by putting said other bit in the first state, said second location of the digital key being selected according to said second identified position.

3. Method according to claim 2, in which said first identified position corresponds to the kth rank of the ith line and in which the digital key is formed in a so-called "auxiliary post-processing" line of the SRAM memory, said first location being determined in the auxiliary post-processing line as a function of k, and in particular corresponds to the kth rank of said auxiliary post-processing line.

4. Method according to one of claims 2 to 3, further comprising, after searching and identifying said first position and before modifying said given bit, a step of verifying with respect to a first determined threshold a proportion of bits in the first state in the digital key and / or, after searching and identifying said second position and before modifying said other bit, a step of verifying with respect to a second determined threshold a proportion of bits in the second state in the digital key.

5. Method according to one of claims 1 to 4, in which the digital key is formed from an auxiliary post-processing line of the memory or in at least one register of a bank of auxiliary registers, the memory being provided with one or more additional auxiliary post-processing lines or one or more additional auxiliary registers for listing, at each modification of a bit of the digital key, a corresponding location of the modified bit in the digital key.

6. Method according to one of the preceding claims, in which said digital key is recorded at a first memory address or in a first register of the system, external to the memory, and is duplicated in the form of a second digital key at a second memory address or in a second register of the system, external to the memory, and in which a modification of a bit of the digital key is carried out simultaneously in the second digital key, the method further comprising steps consisting in: - verifying the identity of the digital key and the second digital key and, when the digital key and the second digital key are different, - erasing the contents of the first region (12) and of the second region (14).

7. Method according to one of claims 1 to 6, in which the establishment of the N-bit digital key is carried out by processing line by line and in which when all the lines of the first region (12) have already been processed without all the N-bits of the digital key having been updated or constituted, the method further comprises, during said establishment of the N-bit digital key, additional steps consisting of: - performing a third biased initialization of a third set of cells of a third region belonging to said SRAM memory or to another SRAM memory so as to promote the establishment in a first logical state, said cells of said third set of said third region, - storing the respective states of the cells of said third set and resulting from said third biased initialization, then, - performing a biased initialization of said third set of said third region (22) so as to promote a setting in a second logical state, complementary to said first logical state, said cells of said third set, - completing the digital key established from the positions of one or more cells called "highly biased in the second state" which belong to said third set and are in the second logical state following said third biased initialization,and from the positions of one or more cells called “highly biased in the first state” which belong to said third set and are in said first logical state following said fourth biased initialization.,

8. Method according to one of claims 2 to 6, in which the digital key consists of N-bits whose respective values ​​each depend on an identified position among said given positions and said other identified positions of highly biased cells in the first state following said second biased initialization and of highly biased cells in the first state following said second biased initialization.

9. Method according to one of the preceding claims, in which the digital key is established in a so-called “auxiliary” sub-region of the SRAM memory, the method further comprising, prior to the first biased initialization and the second biased initialization, at least one step of initializing the “auxiliary” sub-region, so as to establish the memory cells or bits of the registers of the “auxiliary” sub-region all in the same given logical state, in particular a state logic '0'.

10. Method according to one of the preceding claims, in which said first region (12) of the SRAM memory is accessible only in reading, said second region (14) is accessible in reading and writing.

11. Method according to one of the preceding claims, in which said first region (12) is formed of m lines of memory cells, said second region (14) being formed of m+k (with m and k non-zero integers) lines of memory cells or of m lines of memory cells and is associated with a bank of registers of size not less than k.

12. Method according to one of the preceding claims, in which the cells of the first region have a given probability of establishing themselves in a first logic state following the first biased initialization, the method further comprising, prior to said first biased initialization, a step of parameterizing means for controlling initialization of the SRAM memory, so as to adjust said given probability.

13. The method of claim 12, wherein said given probability is modulated as a function of a pulse duration on at least one word line coupled to access transistors of cells of said first set of cells and applied during said first biased initialization.

14. A method of controlling an SRAM memory in which each of the cells is provided with a first storage node and a second storage node comprising steps of: - powering up said SRAM memory; - implementing a method for generating a cryptographic key according to one of the preceding claims, the control method further comprising, between said powering up and said implementation of the method for generating a cryptographic key or, after the implementation of said method for generating a cryptographic key, steps consisting of: - putting the cells of the first region and of the second region in an indeterminate state called "metastable" for which their first storage node and their second storage node respective storage are set to equal or substantially equal potentials.

15. Device comprising: - an SRAM memory, - means for controlling the SRAM memory configured to implement a method according to one of claims 1 to 13.

Images