Secure Pseudo-Random Number Generator (PRNG) Resediction

Abstract

This document discloses techniques, devices, and systems for secure pseudorandom number generator (PRNG) reseeding. Integrated circuits (ICs) may use PRNGs to enable cryptographic processes that can protect the IC or electronic device from malicious attacks. In general, an IC (e.g., a security circuit) may seed or reseed a PRNG with entropy useful for generating pseudorandom numbers or bits. However, in generating entropy, the behavior of the IC may change, resulting in circuit characteristics that allow an attacker to determine when the IC operates on entropy-related secret information. In this way, an attacker may identify moments when an attack is more likely to reveal secret information. In aspects of secure PRNG reseeding, a security circuit may manipulate circuit elements to limit the association between circuit operations related to entropy generation and observable circuit characteristics. In doing so, the IC may implement cryptographic operations without allowing detection of circuit operations related to secret information.

Description

[Background technology]

[0001] Electronic devices often contain at least one integrated circuit (IC) that enables various functions on the electronic device. To perform some of these functions securely, the electronic device may store or operate using secret information restricted to certain access levels within the IC. However, an attacker may attempt to unauthorizedly access this secret information of the device in order to impair or modify the operation of the device. However, existing approaches to prevent unauthorized access of ICs are often insufficient to counter evolving software, hardware, and wireless attacks employed by malicious actors attempting to access the secret information of electronic devices. Summary of the Invention

[0002] This document discloses techniques, apparatus, and systems for secure pseudorandom number generator (PRNG) reseeding. Integrated circuits (ICs) may use PRNGs to enable cryptographic processes that can protect the IC or electronic device from malicious attacks. In general, an IC (e.g., a security circuit) may seed or reseed a PRNG with entropy useful for generating pseudorandom numbers or bits. However, in generating entropy, the behavior of the IC may change, resulting in circuit characteristics that allow an attacker to determine when the IC operates on secret information. In this way, an attacker may identify moments when an attack is more likely to reveal the secret. In aspects of secure PRNG reseeding, a security circuit may manipulate circuit elements to limit the association between circuit behavior related to entropy generation and observable circuit characteristics. In doing so, the IC may implement cryptographic operations without enabling detection of malicious, or other, circuit behavior. The term "entropy" here refers to data that is fundamentally unpredictable according to the laws of physics (e.g., when the next particle is detected by a Geiger counter), or that is unpredictable from a practical standpoint (e.g., depends on physical phenomena that are difficult for an adversary to measure, e.g., timing of actions by a human operator). An entropy source may be a noise source. The term "reseding" refers to resetting the value of the seed used by a PRNG to generate random numbers.

[0003] In some aspects, a method for secure PRNG reseeding includes receiving a request for entropy for reseeding a PRNG-dependent cryptographic module (such as a cryptographic module including a pseudorandom number generator (PRNG) configured to generate random numbers using a seed based on received entropy). In response to the request, entropy for reseeding the PRNG-dependent cryptographic module is generated. While each entropy generation operation is performed by an entropy complex (entropy source), the PRNG-dependent cryptographic module is operated to overlap at least a portion of the power consumption associated with generating entropy for reseeding the PRNG-dependent cryptographic module.

[0004] In some aspects, the PRNG-dependent encryption module operates by performing an encryption operation using a current (i.e., previously received) entropy based on a current (i.e., previously received) seed provided to the PRNG-dependent encryption module. In other aspects, the PRNG-dependent encryption module operates by performing an operation of generating a power signature that at least partially overlaps with a power signature generated by an entropy generation process without performing an encryption operation by the PRNG-dependent encryption module. For example, the PRNG-dependent encryption module can generate a power signature that masks the power signature generated by the entropy generation process to obscure the operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the entropy generation process masks the power signature of the PRNG-dependent encryption module to obscure the operation of the PRNG-dependent encryption module. In yet another aspect, the PRNG-dependent encryption module is configured to perform an encryption operation using less entropy than the entropy requested by the encryption module.

[0005] Generating entropy for reseeding a PRNG-dependent cryptographic module may include generating one or more bits of entropy with an entropy source and processing one or more bits of entropy with a cryptographically secure random number generator to generate more than the one or more bits of entropy. The more bits of entropy may then be distributed by an entropy distribution network to reseed the PRNG. In some implementations, the entropy generation may include operating one or more of the entropy source, the cryptographically secure random number generator, or the entropy distribution network at the same time intervals as another one of the entropy source, the cryptographically secure random number generator, or the entropy distribution network.

[0006] In various aspects, a system for secure PRNG reseeding may perform a method for secure PRNG reseeding as described herein. In some implementations, the system includes an integrated circuit including an entropy generation circuit configured to generate entropy for reseeding a PRNG-dependent cryptographic module. The PRNG-dependent cryptographic module may include a PRNG and may be configured to perform cryptographic operations using entropy provided by the PRNG, to request entropy for reseeding the PRNG-dependent cryptographic module, and to operate the PRNG-dependent cryptographic module to overlap at least a portion of power consumption associated with generating entropy for reseeding the PRNG-dependent cryptographic module during generation of entropy for reseeding the PRNG-dependent cryptographic module.

[0007] This Summary is provided to introduce simplified concepts for implementing secure PRNG reseeding, which are further described in the Detailed Description below. This Summary is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter.

[0008] One or more aspects of the described systems and methods for secure PRNG reseeding are described in detail below. Where the same reference numbers are used in different instances in the description and figures, similar elements are indicated. [Brief description of the drawings]

[0009] [Figure 1] 1 illustrates an exemplary operating environment including an electronic device in which secure PRNG reseeding may be implemented. [Diagram 2] 1 illustrates an example security circuit that includes multiple circuit components that can be implemented to support aspects of secure PRNG reseeding. [Diagram 3] 1 illustrates an example Advanced Encryption Standard (AES) unit capable of implementing secure PRNG reseeding, according to one or more aspects. [Figure 4] 1 illustrates an example of entropy generation according to one or more aspects of secure PRNG reseeding. [Figure 5-1] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 5-2] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 5-3] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 6] 1 illustrates an example method for secure PRNG reseeding, according to one or more embodiments. [Figure 7]1 illustrates an exemplary method for continuing to operate a cryptographic module while entropy is being generated for reseeding the cryptographic module. [Figure 8] 1 illustrates an exemplary electronic device in which secure PRNG reseeding can be implemented. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] In general, there are a wide variety of methods that an attacker may use to obtain sensitive information about the cryptographic process of an integrated circuit. For example, side channel analysis (SCA) can be used to extract secret assets (e.g., keys) by measuring the power consumption, electromagnetic emissions, padding operations, operation timing, etc. of an integrated circuit during operation. In some cases, SCA can be effective because these channels (e.g., the power consumption, electromagnetic emissions, padding operations, or operation timing of an integrated circuit) depend on intermediate values ​​created and / or processed by the integrated circuit.

[0011] To mitigate SCA, many ICs include encryption modules that utilize randomness to perform encryption operations that provide enhanced security. For example, encryption modules may utilize a PRNG to provide randomness, which can be used as a mask for Boolean masking, making these channels independent of the true values ​​generated and / or processed by the integrated circuit. However, these PRNGs may require reseeding to consistently generate entropy of the desired quality. Because generating entropy can be an expensive process that requires a significant amount of time, encryption modules that utilize entropy may cease operation if high-quality entropy is not available.

[0012] Terminating the execution of these cryptographic modules may reduce the power consumption of the circuit, but this process may result in information leakage to a potential attacker of the integrated circuit. For example, an attacker monitoring any channel of the circuit (e.g., the integrated circuit's power consumption, electromagnetic emissions, padding operation, or timing behavior) may observe changes in the circuit characteristics when the cryptographic modules are deactivated. By observing these changes, an attacker may be able to determine when cryptographic processes are running within the IC. Because private keys are often used to enable these cryptographic processes, the disclosed information about the operation of the cryptographic modules may enable an attacker to determine the optimal times to launch and terminate an attack to reveal the chip's secrets.

[0013] Enhanced security may be possible through controlled operation of the encryption module or entropy generation process to limit information leakage to an attacker. For example, the encryption module may continue to execute operations that create a power signature that does not indicate deactivation. In certain aspects, because masking does not require high quality randomness with guaranteed uniformity, it may not be mandatory to terminate execution of the encryption module when reseeding is requested. Thus, the encryption module may continue encryption operations using randomness based on the current seed while entropy generation is occurring. In this way, an attacker may not be able to determine when the encryption module is activated or deactivated, thereby hiding the handling of the encryption key. Additionally, executing more operations from multiple sources increases the overall noise floor of the circuit characteristics, making it more difficult for an attacker to recognize meaningful differences between the circuit characteristics at different times.

[0014] Example Environment 1 illustrates an example environment 100 including devices 102 in which aspects of secure PRNG reseeding can be implemented. Devices 102 may be implemented as any suitable devices, some of which are shown as a smartphone 102-1, a tablet computer 102-2, a laptop computer 102-3, a game console 102-4, a desktop computer 102-5, a server computer 102-6, a wearable computing device 102-7 (e.g., a smart watch), and a broadband router 102-8 (e.g., a mobile hotspot). Although not shown, devices 102 may be implemented as any of a mobile station (e.g., fixed or mobile STA), a mobile communications device, a client device, a user equipment, a mobile phone, an entertainment device, a mobile game console, a personal media device, a media playback device, a health monitoring device, a drone, a camera, an Internet home appliance capable of wireless Internet access and browsing, an IoT device, and / or other types of electronic devices. Device 102 may provide other functionality or may include components or interfaces that have been omitted from FIG. 1 for clarity or visual simplicity.

[0015] The device 102 includes an integrated circuit 104 that utilizes one or more processors 106 and a computer-readable medium (CRM 108), which may include a memory medium or a storage medium. The processor 106 may be implemented as a general-purpose processor (e.g., a multi-core central processing unit (CPU) or an application processor (AP)), an application specific integrated circuit (ASIC), a graphics processing unit (GPU), or a system-on-chip (SoC) integrated with other components of the device 102. The CRM 108 may include any suitable type of memory or storage medium, examples of which include read-only memory (ROM), programmable ROM (PROM), random access memory (RAM), dynamic RAM (DRAM), static RAM (SRAM), or flash memory. In the context of this description, the computer-readable medium 108 of the device 102 is implemented as at least one hardware-based or physical storage device that does not include a transitory signal or carrier wave. Applications, firmware, and / or an operating system (not shown) of the device 102 may be implemented on the computer-readable medium 108 as processor-executable instructions and executed by the processor 106 to provide various functions described herein. The computer-readable medium 108 may also store device data 110, such as user data or user media, accessible via the applications, firmware, or operating system of the device 102.

[0016] In this example, the integrated circuit 104 includes a security circuit 112. The device 102, the integrated circuit 104, or the security circuit 112 may implement a secure cryptographic processor. The security circuit 112 may be implemented using one or more circuit components 114, such as circuit components 114-1 through 114-n. The circuit components 114 may be configured to perform any number of operations to enable functionality of the device 102. Examples of circuit components include a processor and multiple functional components, as illustrated in FIG. 2. The security circuit 112 may be realized, for example, as a protected enclave, a trusted chip platform, a hardware-based Root of Trust (RoT) chip (e.g., a silicon RoT), and the like. Regardless of how or where the security circuit 112 is incorporated into the electronic device, the security circuit 112 may resist many types of attacks.

[0017] The security circuit 112 may include one or more Advanced Encryption Security (AES) units 116 capable of performing cryptographic operations for the integrated circuit 104. In an aspect, the AES units 116 may implement one or more PRNG-dependent encryption modules 118 that utilize a PRNG 120 to perform cryptographic operations, e.g., data encryption or data decryption operations, where the data may be, for example, image data (e.g., captured by a camera or video camera) or audio data (e.g., captured by a microphone). In one example, a PRNG value may be used to generate a private / public key pair. The public key is transmitted from the device 102 via the transceiver 126 and / or the I / O port 128. Data (e.g., image / audio data) encrypted using the public key and received by the device 102 via the transceiver 126 and / or the I / O port 128 may be decrypted using the private key. Alternatively or additionally, data such as image data or audio data (e.g., data acquired using sensor 130) may be hashed using a private key to generate a hash digest, and the data and hash digest may be transmitted from device 102 via transceiver 126 and / or I / O port 128 such that the hash digest serves as a signature of the data and can be verified by a third party using the public key. In another embodiment, encryption module 118 may perform Boolean masking and remasking operations on data manipulated by integrated circuit 104 based on the pseudorandomness provided by PRNG 120. In some aspects, encryption module 118 and / or PRNG 120 may be implemented as or in conjunction with a secure PRNG reseeding module (not shown, e.g., FIG. 4), which may implement the methods described herein. However, PRNG 120 may require reseeding to consistently generate entropy of a desired quality. Over time, the pseudorandomness provided by the PRNG 120 may become deterministic, and therefore cryptographic operations performed based on the pseudorandomness may not be effective in protecting against various attacks.To ensure the quality of the pseudorandomness utilized by the encryption module 118 , fresh entropy may be generated and consumed to reseed the PRNG 120 .

[0018] The AES unit 116 may handle device secrets, such as encryption keys or other sensitive information, used to ensure proper use and performance of the integrated circuit 104. To protect the sensitive information handled by the AES unit 116, cryptographically secure operations may be performed to protect against various attacks that may expose the device secrets or information about the integrated circuit 104.

[0019] As shown, the security circuitry 112 is coupled to an interconnect 122. The interconnect 122 may be implemented using, for example, a bus, a switching fabric, or a bus network that allows the various circuit components to communicate. Each circuit element may be directly or indirectly coupled to the interconnect 122.

[0020] The device 102 may also include a display 124, a transceiver 126, input / output ports (I / O ports 128), and / or sensors 130. The display 124 may be operatively coupled to one of the processors 106 (e.g., a graphics processing unit (GPU)) and configured to graphically display the operating system or applications of the device 102. The transceiver 126 may be configured to enable wired or wireless communication of data (e.g., device data 110) across a wired or wireless network according to any suitable communication protocol. The I / O ports 128 of the device 102 may include universal serial bus (USB) ports, coaxial cable ports, and other serial or parallel connectors (including internal connectors) useful for coupling an electronic device to various components, peripherals, or accessories (such as a keyboard, microphone, or camera).

[0021] The device 102 also includes sensors 130 that enable the device 102 to sense various properties, changes, stimuli, or characteristics of the environment in which the device 102 operates. For example, the sensors 130 may include various motion sensors, ambient light sensors, acoustic sensors, capacitance sensors, infrared sensors, temperature sensors, radar sensors, or magnetic sensors. In an aspect, the sensors 130 may be used to generate entropy for reseeding the PRNG 120. Alternatively or additionally, the sensors 130 may enable the device 102 to interact with or accept input from a user, such as by touch sensing or proximity sensing.

[0022] Exemplary Circuit Components 2 illustrates, at 200, an example security circuit 112 including an example processor 106 and a number of circuit components, including a number of example circuit components 114 that can be implemented to support aspects of secure PRNG reseeding. As shown, the security circuit 112 includes a processor 106 coupled to an interconnect 122. Each processor 106, a number of memories, and a number of other circuit components 114 may be directly or indirectly coupled to the interconnect 122. In an aspect, the components of FIG. 2 may be embodied as a secure computing platform or a secure system-on-chip that implements a root of trust and / or other secure cryptographic functions.

[0023] In an exemplary embodiment, the memories may include a read only memory (ROM 202), a static random access memory (SRAM 204), and a flash memory 206. In an embodiment, the ROM 202, the SRAM 204, or the flash memory 206 may be implemented in the security circuit 112 or in a CRM (e.g., CRM 108). The circuit components 114 may include an alert handler 208, an advanced encryption standard (AES) unit (AES unit 116), a hash-based message authentication code (HMAC) engine (HMAC engine 210), and a serial peripheral interface (SPI) device (SPI device 212). The components 114 may also include a universal asynchronous receiver / transmitter (UART) unit (UART unit 214), a general purpose input / output (GPIO) interface (GPIO interface 216), a pin multiplexer (pin MUX 218), and a pad controller 220. The plurality of components 114 may further include a random number generator (RNG 222) and a timer 224. Additionally, the components 114 may include any memory, as shown in Figure 2. Although particular examples of memory and other components 114 are shown in Figure 2 or described herein, a given implementation of the security circuit 112 may include more, fewer, and / or different instances of processors, controllers, memories, modules, or peripheral devices (including duplicates thereof).

[0024] The illustrated circuit components may operate synchronously based on one or more clock signals. Although not shown in FIG. 2, the security circuit 112 may include at least one clock generator for generating a clock signal or may include a reset circuit for resetting one or more individual components independently of one another, resetting multiple components jointly, or resetting the entire IC chip. Alternatively, the security circuit 112 may receive at least one clock or reset signal from a source external to the security circuit 112, which may or may not be on a separate chip. One or more separate components 114 may each operate in an individual clock domain. For example, the circuit components may be synchronized to a clock local to the respective component. Components in different clock domains may operate or communicate asynchronously with respect to one another.

[0025] Exemplary implementations of the illustrated components are described below. The processor 106 may be realized as the "main," "central," or "core" processor of the security circuit 112. The processor 106 may be implemented, by way of example only, with a 32-bit in-order reduced instruction set computing (RISC) core with a multi-stage pipeline. For example, using RISC-V capabilities, the processor may implement M (machine) and U (user) modes. Activating a reset pin (not shown) (e.g., by deassertion of an active-low reset pin) causes the processor 106 to exit reset and begin executing code at its reset vector. The reset vector may begin in ROM 202, thereby enabling that code before jumping to the emulated embedded flash (eFlash). In other words, it is expected that the code will be instantiated in the eFlash before the reset is released. In some cases, the reset of the entire security circuit 112 may be asynchronous active low according to a compatibility specification to support interoperability between various circuit components. The reset may be generated by the alert handler 208 as a security measure, may be generated by a watchdog timer, etc. A reset signal may also be sent to other circuit components (such as one of the memories or one of the other components 114).

[0026] A debug module 226 (DM) and an interrupt controller 228 (ItC) are coupled to the processor 106 and may be compatible with either of them. The debug module 226 provides debug access to the processor 106. The logic of the debug module 226 interfaces with specific pins of the IC to allow the processor 106 to enter a debug mode and provides the ability to inject code into the device (e.g., by emulating instructions) or memory. The interrupt controller 228 may be located close to the processor 106. The interrupt controller 228 may accept a vector of interrupt sources from within the security circuit 112. The interrupt controller 228 may also assign a level and priority to the interrupt before forwarding it to the processor 106 for processing.

[0027] The processor 106 may provide any desired level of performance or include any internal circuit components. For example, the processor 106 may include at least one arithmetic logic unit (ALU) (e.g., an "extra" ALU to calculate branch targets and remove latency cycles for conditional branches) and multiple pipeline stages. With multiple pipeline stages, the pipeline may perform register write-back to reduce latency cycles from loads and stores and prevent pipeline stalls where the response to a load or store is available the cycle after the request. The processor 106 may implement a single-cycle multiplier or generate an imprecise exception in error response to a store, which allows the processor to continue execution beyond the store without waiting for a response. Although not shown, the processor 106 specifically, or the security circuitry 112 generally, may include an instruction cache that provides single-cycle access times for instructions.

[0028] In the illustrated example 200, the components of the security circuit 112 include or have access to three memory address spaces for instructions and data. The ROM 202 is the target of the processor 106 after it is released from reset. The ROM 202 includes hard-coded instructions to perform a subset of platform checks before checking the next stage code. The next stage code (e.g., a boot loader stored in e-flash memory) may be the first piece of code that is not hard-coded into the silicon of the device. This next stage code is therefore signature checked for integrity to improve security. The ROM 202 can perform this signature check by implementing a Rivest-Shamir-Adleman check (RSA check) algorithm on all of the boot loader contents.

[0029] The flash memory 206 can be implemented as an e-flash memory for storing code. The e-flash can contain the boot loader mentioned herein as well as overlaying operating systems and applications. The SPI device 212 can be used to bulk load the e-flash memory. The debug module 226 can also be used for code loading. The SRAM 204 can act as a scratchpad SRAM available for data storage by the processor 106 (e.g., for stack and heap information). The SRAM 204 can also store code.

[0030] The security circuitry 112 may include circuit components 114, which may be subordinate execution units, coupled to the processor 106 via an interconnect 122. Each of these components 114 may adhere to an interface framework that ensures compatibility with each other and with the processor 106. The compatibility scheme may specify how the processor 106 communicates with a given circuit component (e.g., using the interconnect 122), how the circuit component communicates with the processor 106 (e.g., using interrupts), how the circuit component communicates security events (e.g., using alert indications) to other circuit components such as the alert handler 208, how the circuit component communicates with peripheral devices (e.g., by chip I / O), or a combination thereof. The illustrated components 114 may include circuit components associated with alert-related functions provided by the alert handler 208, associated with the processor 106, associated with one or more memories, associated with the chip I / O, etc. Thus, memories may also include components 114 associated with each other, or other illustrated circuit components.

[0031] The circuit or chip I / O includes a pin MUX 218 and a pad controller 220. The pin MUX 218 provides signaling routes between at least some of the components 114 and available multiplexable I / O nodes of the security circuit 112 (e.g., pins of the chip on which the various components are integrated, or interfaces to other parts of the SoC). The pad controller 220 manages the control or pad attributes, such as drive strength, technology, pull-up vs. pull-down, etc., of each circuit component. The pin MUX 218 and the pad controller 220 may themselves be peripheral devices on the interconnect 122. As such, each may have or be associated with at least one register collection that provides software configurability.

[0032] The UART unit 214 can implement UART characteristics such as single lane duplex UART functionality. Its outputs and inputs can be configured to connect to any circuit I / O via pin MUX 218. The GPIO interface 216 creates G-bit bidirectional communication to external circuitry via pin MUX 218, where G is a positive integer such as 16, 32, or 64. With respect to memory I / O, the SPI device 212 can implement a firmware mode, where the firmware mode can enable a feature that provides an external driver the ability to send firmware update code to a bank of the flash memory 206 for in-field firmware updates. The firmware mode can include addressing of memory using SPI transactions. Although not shown, the security circuit 112 can include an Inter-Integrated Circuit (I2C) host to enable commands for I2C devices. The commands for I2C devices can include standard mode, full mode, and high-speed mode.

[0033] Also shown are several "core security" components, including an encryption engine and an alert handler 208. The AES unit 116, which may be implemented as described with reference to FIG. 1, may provide various symmetric encryption and decryption functions, such as by using one or more protocols and / or various key sizes, such as 128b, 192b, or 256b. In an aspect, the AES unit 116 may include an encryption module 118 and / or a PRNG 120, along with a secure PRNG reseeding module (not shown, e.g., FIG. 4), which may implement the methods described herein. The components may select to encrypt or decrypt data arriving in, e.g., 16-byte amounts, to be encrypted or decrypted using different block cipher modes of operation. The AES unit 116 may support an Electronic Code Book (ECB) mode, a Cipher Block Chaining (CBC) mode, a Cipher Feedback (CFB) mode, an Output Feedback (OFB) mode, a Counter (CTR) mode, etc. Data transfers may be made available to the processor. For example, keys and data material may be passed to the encryption engine via register writes. Alternatively, it may include a private channel for transferring keys and data material to reduce exposure from potentially untrusted processor activity.

[0034] The HMAC engine 210 can use the Secure Hash Algorithm (SHA) SHA-256 as a hash algorithm, for example. SHA-256 is part of the SHA-2 family of hash algorithms with a digest (or hash output) length of 256b, regardless of the input data size being hashed. After announcing the start of a hash request, data is sent to the HMAC engine 210, which zeroes out the internal state to an initial condition (e.g., 32b at a time). Once the data has been sent by the component client, the client can indicate completion of the hash request (optionally using a partial word last write). In accordance with an exemplary portability interface scheme, the HMAC engine 210 generates a hash result, which is available for read in a register by the requesting client. The data transfer can be made available to the processor or can be kept private to reduce exposure to potentially untrusted processor activity.

[0035] HMAC is a message authentication protocol layered on top of a hash function (e.g., SHA-256) and mixes it with a secret key for encryption. HMAC is the specific application of adding a secret key in a prescribed manner (e.g., twice) to the message hashing (via SHA-256). To provide this functionality, the 256b key can be programmed into the circuitry before the message hashing begins. The timing of authentication completion may vary and may result in longer latencies than when using native SHA-256. Again, the hash information or secret key may be made available to the processor for convenience or processing efficiency, or may be kept private in some fashion to improve security.

[0036] The alert handler 208 is responsible for handling and responding to alerts, including alerts provided by other components 114. Alerts can be considered security-critical interrupts that need to be processed in a timely manner to respond to a perceived security threat. Unlike "standard" interrupts, alerts are not handled solely by software running on the processor 106. An alert can trigger a first stage request that is handled by the software as a "normal" interrupt. However, if the software is unable to respond to the interrupt triggered by the alert and make appropriate corrections, the alert handler 208 triggers a second stage response. The second stage response can include taking security measures, examples of which include terminating processing, erasing or otherwise removing data, removing power from a circuit portion, or resetting an IC chip or part thereof. This ensures that the underlying problem (the perceived security threat) is addressed even if the processor 106 is busy, unresponsive, or under attack.

[0037] Thus, an alert can be implemented as an elevated interrupt-type signal or alert indication that the alert handler 208 receives from other circuit components and that indicates a potential security threat. In operation, the alert handler 208 can collect alerts from other circuit components 114 of the security circuit 112 and convert them into interrupts that the processor 106 can address. However, if the processor 106 does not clear the interrupt, the alert handler 208 provides a hardware response to address the potential security threat.

[0038] The security circuitry 112 may also include a RNG 222. In general, random numbers contribute to security functions by introducing variances at run time and making it impossible for an attacker to predict the right time to launch an attack. For example, random numbers can provide secret material used for IDs or encryption. The RNG 222 can be seeded into algorithmic calculations to obscure sensitive data values. In some aspects, the RNG 222 can be utilized in an entropy generation process to re-seed the PRNG. In general, the RNG 222 provides better performance as its number generation becomes more and more truly random, and can also be hardened against attacks. Some encryption processes may not require strong randomness assurances. The RNG 222 may be implemented as a "true" RNG (TRNG) or with a design having analog parts to exploit some non-deterministic physical events or processes. Exemplary TRNG designs rely on metastability, electronic noise, timing variations, thermal noise, quantum variations, and the like. The TRNG filters the resulting variable(s) and sends them to an entropy pool that the device can sample at a given time for the current randomization function. In some cases, the interface to the entropy pool includes a request to read available random bits. The TRNG interface indicates the number of bits available, and the requesting circuitry or software can read from this pool within the range of available bits. An interrupt or alert may be triggered if an attempt is made to read an entropy bit that is not available.

[0039] The other two components 114 include a timer 224 and a flash controller (not shown). The latter is described in the next paragraph. The timer 224 can support accurate performance by the processor 106, for example. The timer 224 consists of multiple bits (e.g., 64 bits) and operates as a free-running timer with a guaranteed frequency within a certain percentage. The timer 224 may enable the circuit component 114 to determine an appropriate time interval for performing an operation. For example, the PRNG in the AES unit 116 can request reseeding according to the timer 224. Another timer (not explicitly shown) can function as a watchdog timer to assist the processor 106 if the processor becomes unresponsive. The unresponsiveness may be due to wedged development code, security attacks, etc.

[0040] Although not shown, the flash controller may control the flash memory 206 available for code and data storage. The primary read path for this data may be located within a standard memory address space. However, flash memory is not written to in a standard way, so writes to that address space may be ignored. Instead, to write to the flash memory 206, software interacts with the flash controller. Flash functions may include three main commands: read, erase, and program. Read commands may be standardized and may use the address space of the chip memory. Erase commands are performed at the page level, with the page size being parameterizable by the flash controller. Upon receiving an erase request, the flash controller erases the contents of the targeted page, forcing the data to a "1" state (e.g., 0xFFFFFFFF per word). Software may then program individual words to any value. Because flash bits never return to a "1" state unless they are erased again, future contents are effectively changed by ANDing the current contents with the written value. Erase and program commands are relatively slow. Typical erase times are measured in milliseconds, while program times are in the microsecond range. Security is also a concern since sensitive data may be stored in the flash memory 206. Therefore, a degree of memory protection may be provided by the flash controller.

[0041] The security circuit 112 is shown in FIG. 2 with a particular set of circuit components. However, a given security circuit 112 may have more, fewer, or different circuit components. Also, the circuit components may be interconnected or operated differently from the exemplary manner described herein. Furthermore, some circuit components may be omitted while other circuit components are implemented in multiple instances. For example, the alert handler 208 may be duplicated or distributed, or there may be multiple AES units 116 in any security circuit. Furthermore, in cases where the security circuit 112 is an IC chip that forms only one core out of dozens of cores, the GPIO interface 216 may be omitted from the components 114 of the security circuit 112.

[0042] In an aspect, any of the circuit components 114 may include a cryptographic processor 230 to perform the cryptographic operations of the component. In some implementations, the cryptographic processor 230 is separate from the processor 106 of FIG. 1. In other implementations, the cryptographic processor 230 is implemented within the processor 106. Additionally, any of the circuit components 114 may include a cryptographic processor 230 (or processing core) for performing the particular function of that component.

[0043] 3 illustrates an example AES unit 116 that can implement secure PRNG reseeding, according to one or more aspects. The AES unit 116 can provide symmetric encryption and decryption using one or more protocols and various key sizes, such as 128b, 192b or 256b. Components can select to encrypt or decrypt data arriving in 16 byte amounts, for example, that is encrypted or decrypted using different block cipher modes of operation.

[0044] In one aspect, the AES unit 116 includes a PRNG 120 that generates pseudo-random numbers to determine the mask. The mask is mixed with the input data using a Boolean mask to create masked data. The masked data may be multiplexed and stored in a state register 302. The input data may then undergo non-linear operations within the masked sub-bytes 304. The masked sub-bytes 304 may include any number of permutation boxes or Galois Field (GF) multipliers. During the processing of the sub-bytes 304, bytes of the input data may be permuted and shifted to create a cryptographically secure method of weakening the correlation between the input and output bits. In one aspect, the data may be re-masked with the sub-bytes 304.

[0045] The masked data may then pass through a row shift 306 stage, where rows of the masked data are shifted during the forward process. In the row shift 306 stage, the rows of the masked data (e.g., state array) are circularly shifted and the byte order of the input data may be scrambled. The masked data may then pass through a column mix 308-1 stage, where each byte in a column is replaced with a function of all the bytes in the same column.

[0046] The AES unit 116 can provide symmetric encryption and decryption using keys, so that full key data can be encrypted using an initial key or encrypted using a decryption key 310. During encryption or decryption, each key can be masked and manipulated by multiple substitution boxes and GF multipliers in a masked key expansion 312 stage. Each key can be manipulated and mixed with the masked data in a column mix 308-2 stage to enable encryption or decryption. The output can be fed back to the state register 302 and the process can be performed iteratively until all stages of the encryption or decryption process are completed. In certain aspects, the AES unit 116 can include a secure PRNG reseeding module 314, which can manage or coordinate the operation of the components of the AES unit 116, the entropy complex, the encryption module, and / or other entities described herein to implement aspects of secure PRNG reseeding. Alternatively or additionally, the secure PRNG reseeding module 314 may be implemented (e.g., as hardware and / or software) in conjunction with or as part of the other components described, such as the entropy circuitry or encryption module.

[0047] Exemplary Entropy Generation for Secure PRNG Resediment 4 illustrates, at 400, an example of entropy generation according to one or more aspects of secure PRNG reseeding. The illustrated entropy generation may be implemented within the security circuitry 112 to provide entropy to one or more PRNGs 410 (e.g., PRNG 120 of FIG. 1) of an encryption module 402 (e.g., encryption module 118 of FIG. 1). As illustrated, the encryption module 402 is PRNG-reliant due to the PRNG 410 pseudo-random nature, with entropy provided via PRNG 410-1 through PRNG 410-N to perform the cryptographic operations of encryption modules 402-1 through 402-N, respectively. In an aspect, the entropy generation circuitry may include or be associated with a secure PRNG reseeding module 314, which may interact with various components and modules described herein to implement one or more aspects of secure PRNG reseeding.

[0048] In one aspect, the PRNG 410 provides pseudorandomness because the randomness is not generated with cryptographic guarantees that values ​​are uniformly distributed and untraceable. For purposes of masking and remasking, these guarantees may not be required, and thus the PRNG 410 can be used to efficiently provide randomness for these cryptographic operations. However, masking and remasking operations may require high-bandwidth entropy generation capable of supporting the masking operations on every clock cycle. Thus, the entropy generation circuitry may need to support multiple bits of entropy generation per clock cycle (e.g., hundreds of bits of randomness per clock cycle).

[0049] The entropy generation circuit may be limited by circuit area constraints, since multiple entropy generation circuits may be used on a single integrated circuit. It may be important to simplify the design of the entropy generation circuit to a smaller circuit area by relaxing the constraints ensuring backward secrecy and uniformity, which may not be required for masking and remasking operations. In this way, the circuit area may be reduced, thereby reducing circuit costs.

[0050] Any number of PRNG implementations may be used to meet these requirements. In one example, a PRNG utilizing a linear feedback shift register may be defined. For example, a value may be input from a feedback source (e.g., mouse movement, radiation, or any other available feedback) and mixed with the current value via logic gates to generate pseudorandomness. In another example, a multiplier may be used to multiply random data with a value to generate pseudorandomness. It should be understood that any number of PRNG implementations may be applied without going beyond the scope of this document.

[0051] In general, the PRNG 410 may be reseeded at various times to provide an initial value and generate randomness from an updated seed. By periodically reseeding the initial value, the operation of generating pseudorandomness may yield better statistical behavior over a period of time. Without reseeding the PRNG 410, the randomness generated by the PRNG 410 may become deterministic, and therefore an entropy generation framework may be required to provide fresh randomness for reseeding the PRNG 410.

[0052] In one embodiment, the PRNG 410 provides pseudorandomness to the encryption module 402 using a current seed provided to the PRNG 410. At any time, the encryption module 402 may determine that reseeding is necessary and request entropy from the entropy distribution network 404. The encryption module 402 or the PRNG 410 may determine that entropy is needed for reseeding and may assert a request 412 (e.g., request 412-1 or request 412-N) in any number of suitable ways. For example, the encryption module 402 may maintain a counter that allows the encryption module 402 to request 412 reseeding if the PRNG 410 has been operating using the current seed for a particular number of clock cycles. In other embodiments, the encryption module 402 may determine the quality of the entropy being consumed by the encryption module 402 and may request 412 reseeding if the quality falls below a desired quality.

[0053] The entropy distribution network 404 may interface to multiple encryption modules 402. When any of the PRNGs 410 request entropy 412 from the entropy distribution network 404, the entropy distribution network 404 may determine whether entropy 414 is available to provide to the PRNG 410. If entropy is available, the entropy distribution network 404 may provide entropy 414 (e.g., entropy 404-1 or entropy 404-N) to one or more PRNGs 410 requesting reseeding 412. In some implementations, entropy 414 may be provided to each of the PRNGs 410. However, if entropy 414 is not available, the entropy distribution network 404 may request (416) entropy 418 from the cryptographically secure random number generator 406.

[0054] The cryptographically secure random number generator 406 may include an AES engine that allows the entropy 422 provided by the entropy source 408 to be scaled in a cryptographically secure manner. When a request 416 for entropy 418 is made from the entropy distribution network 404 to the cryptographically secure random number generator 406, the cryptographically secure random number generator 406 may determine that the entropy 418 is available and provide the entropy 418 to the distribution network 404. If it is determined that the entropy 418 is not available to the cryptographically secure random number generator 406, a request 420 may be made to the entropy source 408.

[0055] The entropy source 408 may generate high quality entropy 422 at low bandwidth. As a non-limiting example, the entropy source 408 may generate on the order of 2 bits of entropy 422 per clock cycle, 2 bits of entropy 422 per 10 clock cycles, or 2 bits of entropy 422 per 100 clock cycles. In an embodiment, the entropy source 408 generates the entropy 422 by measuring and combining different measurement sources (e.g., spatial radiation or the movement of a mouse (e.g., by a human operator) within a time frame). The measurement sources may be independent and may make measurements of respective phenomena that are statistically uncorrelated with each other. The entropy source 408 may then pass the values ​​through a circuit that forms values ​​and performs quality checks (e.g., uniformity and reverse secrecy) to generate the entropy 422. Once the entropy 422 is generated, it may be provided by the entropy source 408 to a cryptographically secure random number generator 406.

[0056] In the cryptographically secure random number generator 406, the entropy 422 may be further whitened and the bandwidth may be increased to generate more bits of entropy 418 on each clock cycle. For example, 2 bits of entropy 422 may be generated by the entropy source 408 every 100 clock cycles, and the cryptographically secure random number generator 406 may generate 2 bits of entropy 418 on each clock cycle or every 10 clock cycles. The entropy 418 generated by the cryptographically secure random number generator 406 may then be provided to an entropy distribution network 404, which provides entropy 414 to the PRNG 410 as a seed enabling the PRNG 410 to provide high bandwidth entropy usable for masking and remasking operations in the encryption module 402.

[0057] It should be noted that the entropy generation process may be a relatively long and expensive operation. For example, it may take more than 100 clock cycles for the entropy to reach the PRNG 410 from the entropy source 408. Furthermore, each of the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 may create a strong power signature during operation. The entropy distribution network 404 may provide entropy to different circuit components across a large portion of the integrated circuit. Thus, the entropy distribution network 404 may include powerful drivers and transistors that generate a large power signature. Similarly, the cryptographically secure random number generator 406 may utilize AES encryption within a module that requires multiple transistors to perform an operation. The entropy source 408 may also include an encryption module that creates a large power signature during operation. In this manner, it may be possible to determine the isolated operation of these modules by observing the power signature of the integrated circuit.

[0058] In a typical operation of the encryption module 402, the encryption operations may terminate when a request 412 to reseed the PRNG 410 is made. However, the termination operation of the encryption module 402 may isolate a critical power signature of the IC that may characterize the secret key and other cryptographic information. In some implementations, the power signature of the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may indicate that an old cycle of the encryption process has ended and a new cycle of encryption operations is beginning. In this manner, an attacker may be able to observe a change in the power signature as a result of a number of transistors in the encryption module switching to an inactive state.

[0059] With regard to enhanced security, visual observation of the activation and deactivation of the encryption module 402 may provide an attacker with security-sensitive information that allows for better tailored attacks. Specifically, the encryption module 402 may maintain cryptographically secure keys that are used to perform specific encryption operations. By knowing when the encryption keys are used in an operation, an attacker may be able to observe characteristics related to the operation of the integrated circuit to extract the encryption keys or bypass security measures. If the cyclic operation of the encryption module 402 is known by an attacker, attacks may be directed to extract the encryption keys or bypass security measures at each operational cycle of the encryption module 402. Thus, typical entropy generation processes may exacerbate cryptographic attacks against integrated circuits.

[0060] To reduce the ability to determine details regarding the operation of the integrated circuit, the encryption module 402 and other modules (e.g., the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404) may be controlled during entropy generation. Various examples of controlling the encryption module 402, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 are described with respect to Figures 5-1 through 5-3.

[0061] 5-1 illustrates an example timing diagram 502 for secure PRNG reseeding in accordance with one or more aspects. In the timing diagram 502, a periodic clock 504 is shown. A cryptographic module request 506, which may be an example of a request 412, is asserted to indicate that a PRNG associated with the cryptographic module 402 has requested reseeding. The timing diagram 502 illustrates the operation of the cryptographic module 402, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404.

[0062] Initially, the encryption module 402 is shown as operating before the encryption module request 506 is asserted. If the encryption module request 506 is asserted and it is determined that entropy generation is required, the encryption module 402 may continue to operate during entropy generation. The encryption module 402 may be signaled to perform operations during entropy generation in any number of ways. In some implementations, the encryption module request 506 may signal the start or end of entropy generation. For example, entropy generation may begin when the encryption module request is asserted and entropy generation may end when the encryption module request 506 is deasserted. In an aspect, the encryption module may activate a timer that tracks the number of clock cycles since the encryption module request 506 is asserted. Operation of the cryptographic module to generate a power signature that does not indicate deactivation of the cryptographic module may continue until a predetermined time value is reached or until the cryptographic module request 506 is deasserted, indicating that the PRNG has been reseeded. Thus, the cryptographic module may not operate indefinitely or after the quality of the randomness provided by the PRNG has deteriorated beyond an acceptable level.

[0063] In other embodiments, signaling may be received by the encryption module 402 indicating that entropy generation is occurring. For example, the encryption module 402 may receive signaling indicating the generation of entropy from any of the modules utilized during the entropy generation process. The encryption module 402 may continue to operate to generate power signatures that do not indicate deactivation of the encryption module 402 as long as the signal is received.

[0064] In one aspect, the encryption module 402 can continue to perform cryptographic operations (e.g., masking and remasking) using entropy generated based on the current seed value provided to the PRNG. It may be possible to continue to perform these cryptographic operations because the entropy for the masking and remasking operations may not need to be subject to the same guarantees (e.g., uniformity and reverse secrecy) as other cryptographic operations. In this manner, the encryption module 402 can continue to perform operations while entropy is being generated.

[0065] In particular, the encryption module 402 may continue to operate during entropy generation by the entropy source 408, entropy processing by the cryptographically secure random number generator 406 to generate additional entropy bits, and / or entropy distribution for the entropy bits by the entropy distribution network 404. Entropy generation is described in more detail with respect to FIG. 3. In certain aspects, operation of the encryption module 402 during entropy generation may limit an attacker's ability to determine the operation of the encryption module 402 from a power signature or any other channel. For example, maintaining operation of the encryption module 402 may allow the noise floor of the power signature to increase, thereby making it more difficult to distinguish individual differences in the power signature that may provide information about the operation of the integrated circuit. By operating the encryption module 402 in a manner that produces a power signature that does not indicate deactivation of the encryption module 402, the power signature or other channel signature of the integrated circuit may not include significant changes that indicate the beginning and end of the encryption module 402. Additionally, the encryption module 402 can operate more efficiently without having to terminate operation during entropy generation.

[0066] In other embodiments, the encryption module 402 may be operated without performing cryptographic operations during entropy generation. For example, the encryption module request 506 may be asserted to indicate that entropy is required to reseed the PRNG. The encryption module 402 may begin performing operations that do not include cryptographic operations and may generate a power signature that does not indicate deactivation of the encryption module 402. In doing so, the power signature of the integrated circuit may not indicate the start or end of the encryption module 402. Additionally, by continuing operation of the encryption module 402 without performing cryptographic operations, it may be ensured that masking and remasking operations are never performed with entropy below a certain quality, providing enhanced security.

[0067] In either implementation, the encryption module 402 may operate to generate a power signature that does not indicate deactivation of the encryption module 402. Once entropy has been distributed by the entropy distribution network 404, the encryption module request 506 may be deasserted, the PRNG may be reseeded using fresh entropy, and the encryption module 402 may continue encryption operations using the new seed provided by the fresh entropy.

[0068] It should also be noted that the entropy generation process may not include all of the steps shown. For example, the encryption module request 506 may be asserted and it may be determined that entropy is available on the entropy distribution network 404. In this case, the entropy may be distributed by the entropy distribution network 404 and the request may not be sent to the cryptographically secure random number generator 406. Thus, the encryption module 402 may operate during any entropy generation process.

[0069] In some implementations, the encryption module 402 may be configured to consume an amount of entropy less than the amount of entropy requested. For example, the encryption module 402 may request 8 bits of entropy from the entropy distribution network 404. The entropy distribution network 404 may determine that only 4 bits of entries are available for consumption and provide the 4 bits of entropy to the encryption module 402 to reseed the PRNG. The encryption module 402 may use the lesser amount of entropy provided to the PRNG to perform encryption operations based on the entropy provided by the PRNG. In this manner, the encryption module 402 may be able to continue operating and perform encryption operations using any amount of fresh entropy available.

[0070] In addition to providing entropy to the PRNG for reseeding, the entropy distribution network 404 can request more entropy from the cryptographically secure random number generator 406. If entropy is available, it can be provided to the encryption module 402. If entropy is not available, the cryptographically secure random number generator can request entropy from the entropy source 408. In this manner, the encryption module 402 can be provided with all available entropy and entropy generation can be initiated to generate entropy for later use.

[0071] FIG. 5-2 illustrates an exemplary timing diagram 508 of secure PRNG reseeding, according to one or more aspects. Similar to FIG. 5-1, the timing diagram 508 illustrates a periodic clock 504, a cryptographic module request 506 being asserted to indicate that a PRNG associated with the cryptographic module 402 has requested reseeding, and the cryptographic module 402 operates during entropy generation. As described with respect to FIG. 4, the entropy generation process includes an entropy source 408 generating entropy 422, a cryptographically secure random number generator 406 processing the generated entropy to generate additional bits of entropy 418, and an entropy distribution network 404 distributing 410 additional bits of entropy 414 to the PRNG. However, in the timing diagram 508, further control of the entropy generation process is used to spoof the operation of the integrated circuit in the power signature.

[0072] Unlike FIG. 5-1, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 do not operate within their respective time intervals. Instead, the entropy source 408 overlaps with the operation of the cryptographically secure random number generator 406 at overlap 510-1, which overlaps with the operation of the entropy distribution network 404 at overlap 510-2. In an aspect, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 can perform operations before the input is provided to the module or after the entropy is output from the module. For example, any of the modules can perform operations on insignificant values ​​that generate a power signature similar to the normal operation of the module. At the end of the operation, the value can be discarded without result.

[0073] Any of the modules in the entropy generation process may be operated in the same time interval. For example, two or more of generating bits of entropy, processing entropy, or distributing bits of entropy may occur at least partially during the same time interval. By overlapping the power signatures of the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404, the overall power signature of the integrated circuit may be spoofed to hide transitions in the entropy generation process. In doing so, an attacker may not be able to determine useful information about the execution of the integrated circuit, thereby limiting the ability to forge future attacks based on circuit operation.

[0074] Also shown in the exemplary timing diagram 508, the encryption module 402 terminates operation in response to operating for a predetermined number of clock 504 cycles during the entropy generation process (i.e., before the entropy distribution network 404 completes sending entropy to the encryption module 402). For example, the encryption module 402 may operate for a predetermined period of time 512. As shown, the encryption module 402 terminates operation before the entropy generation process terminates and the encryption module request 506 is deasserted. In this exemplary implementation, the encryption module 402 may utilize a timer to track clock cycles to ensure that the encryption module does not continue to operate indefinitely if an error occurs during the entropy generation process.

[0075] FIG. 5-3 illustrates an example timing diagram of secure PRNG reseeding according to one or more aspects. Similar to FIGS. 5-1 and 5-2, timing diagram 514 illustrates a periodic clock 504. A cryptographic module request 506 is asserted to indicate that a PRNG associated with cryptographic module 402 has requested reseeding, and cryptographic module 402 operates during entropy generation to overlap at least a portion of the power consumption associated with generating entropy for reseeding PRNG-dependent cryptographic module 402. The illustrated entropy generation process includes an entropy source 408 generating entropy, a cryptographically secure random number generator 406 processing the generated entropy to generate additional bits of entropy, and an entropy distribution network 404 distributing the additional bits of entropy.

[0076] As in FIG. 5-2, further control of the entropy generation process is used to spoof the operation of the integrated circuit in the power signature. However, in timing diagram 514, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 operate randomly or pseudo-randomly in addition to their normal operations during entropy generation. For example, any of the modules used to generate entropy can perform an operation 516 (e.g., operation 516-1, operation 516-2, or operation 516-3), which do not contribute to the entropy generation, but are similar to those performed by the modules during entropy generation. In this way, any of the modules can operate in the same time interval to generate an overall power signature that spoofs the operation of the integrated circuit by overlapping the power signatures from the modules used in entropy generation.

[0077] The entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may operate randomly or pseudo-randomly during the entropy generation process to increase the noise floor of the integrated circuit and limit noticeable differences in the operation of the integrated circuit based on the power signature. In some implementations, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may operate randomly outside of the entropy generation process, for example, when the cryptographic module request 506 is deasserted, to further spoof the operation of the integrated circuit based on the power signature.

[0078] As in Figure 5-2, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 each perform normal entropy generation operations and perform operations non-logically (i.e., actions that do not contribute to entropy generation or distribution) at different times. For example, one or more of the modules may perform entropy generation that can be used to reseed the PRNG when required, while others of the modules perform negligible "random" operations, e.g., operations on placeholder values, the results of which are discarded.

[0079] In any of the described implementations, operating the encryption module 402 during entropy generation can inhibit the ability to determine meaningful differences in the operation of the integrated circuit based on the power signature.

[0080] Exemplary Methods Methods 600 and 700 are illustrated as a set of blocks specifying operations that may be performed, but are not necessarily limited to the order or combinations shown for performing the operations by the respective blocks. Additionally, any of one or more of the operations may be repeated, combined, rearranged, or linked to provide a variety of additional and / or alternative methods. These techniques are not limited to being performed by one entity or multiple entities operating on one device. In some aspects, operations or acts of method 600 are performed by or managed by the secure PRNG reseeding module 314, the entropy complex, and / or the encryption module. For clarity, the method is described with reference to the elements of FIG. 1 and / or the entities, components, or configurations described with reference to FIGS. 1-5.

[0081] FIG. 6 illustrates an exemplary method 600 for secure PRNG reseeding, according to one or more aspects. At 602, a request for entropy to reseed the PRNG-dependent encryption module 118 is received by an entropy generation circuit. In an aspect, the request for entropy to reseed the PRNG-dependent encryption module 118 is asserted by the PRNG 120 or the PRNG-dependent encryption module 118. In some implementations, the request for entropy for reseeding is in response to determining that the current entropy consumed by the encryption module 118 is below a desired quality (defined according to a quality criterion, such as a measure of the predictability of the current entropy). Thus, the encryption module 118 can ensure that the encryption process utilizes pseudorandomness that meets certain quality guarantees. In an aspect, the entropy is requested to reseed the PRNG-dependent encryption module 118 in response to the completion of a timer. In this manner, it can be ensured that the PRNG 120 of the encryption module 118 is reseeded at certain time intervals.

[0082] At 604, entropy for reseeding the PRNG-dependent encryption module 118 is generated in a random number generator based on an entropy source. In an aspect, entropy generation may be performed in three operations: entropy generation, entropy processing, and entropy distribution. High quality entropy may be generated by an entropy source and processed by a cryptographically secure random number generator by performing quality checks and increasing the bandwidth of the entropy generation. The cryptographically secure random number generator may create a larger number of bits of entropy than are generated by the entropy source, and more bits of entropy may be provided to an entropy distribution network. The entropy distribution network may distribute the larger number of bits of entropy to one or more encryption modules 118 for reseeding the PRNG 120.

[0083] In some implementations, entropy generation, entropy processing, or entropy distribution may occur at separate times during entropy generation, entropy processing, or entropy distribution. In this manner, the power signature of the integrated circuit may not be indicative of individual processes within the entropy generation, and the overall noise floor of the power signature may be increased. In certain aspects, entropy generation may be implemented by further hiding the processes occurring within the entropy generation by randomly manipulating an entropy source, a cryptographically secure random number generator, or an entropy distribution network (i.e., having those modules perform operations that contribute to entropy generation or distribution).

[0084] At 606, the PRNG-dependent encryption module 118 is operated during entropy generation to overlap at least a portion of the respective power consumption operating the PRNG-dependent encryption module with the power consumption generating entropy for reseeding the PRNG-dependent encryption module 118. For example, the PRNG-dependent encryption module 118 may generate a power signature that masks the power signature generated by the entropy generation process to obscure the operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the random number generator or other entropy component masks the power signature of the PRNG-dependent encryption module 118 to obscure the operation of the PRNG-dependent encryption module 118. In an aspect, the PRNG-dependent encryption module 118 uses pseudorandomness provided by the PRNG 120 to perform the masking and remasking operations. The masking and remasking operations may not require quality assurance that may be required for other encryption operations. Thus, PRNG-dependent encryption module 118 may continue to perform masking and remasking operations using the current seed value, even when a new seed is required. For example, PRNG-dependent encryption module 118 may continue to perform operations during entropy generation using the pseudorandomness provided by PRNG 120 based on the current seed. In this manner, an attacker may not be able to determine important characteristics about the operation of the integrated circuit based on the deactivation of the encryption module during entropy generation.

[0085] In some implementations, it may be desirable to ensure that cryptographic operations are not performed using entropy below a desired quality. Thus, the PRNG-dependent encryption module 118 may continue to perform operations to generate a power signature that overlaps at least a portion of the power consumption associated with the generation of entropy of the PRNG-dependent encryption module 118 without performing cryptographic operations by the PRNG-dependent encryption module 118. For example, the encryption module 118 may continue to perform operations on data of similar size and complexity to the data used in the cryptographic operations, but the data may be discarded after the operations are completed. In doing so, the encryption module 118 may continue to generate power signatures that do not indicate deactivation of the PRNG-dependent encryption module 118 without adversely affecting security enhancements that may result from the use of low-quality entropy in the encryption process.

[0086] The operations of the PRNG dependent encryption module 118 may occur in coordination with any number of signaling mechanisms. For example, the encryption module 118 may receive signaling during the entropy generation process indicating entropy generation, and the encryption module 118 may perform operations until the signaling indicating entropy generation is no longer received. In other embodiments, the encryption module 118 may maintain a timer that initiates operations in response to sending a request for entropy to reseed the PRNG dependent encryption module 118. In this embodiment, the encryption module 118 may perform operations to generate a power signature that does not indicate deactivation of the PRNG dependent encryption module 118 until entropy for reseeding is received by the PRNG dependent encryption module 118 or until the timer reaches a predetermined value.

[0087] At 608, the entropy generated by the cryptographically secure random number generator is provided to the PRNG dependent encryption module 118 to reseed the PRNG dependent encryption module 118 for subsequent encryption operations. In an aspect, the entropy may be distributed to multiple PRNGs 120 in multiple PRNG dependent encryption modules 118 by an entropy distribution network.

[0088] 7 illustrates an exemplary method for continuing to operate the encryption module 118 while entropy is being generated for reseeding the encryption module 118. At 702, the PRNG-dependent encryption module 118 is operated to enable encryption operations based on previously received seed entropy. In an aspect, the PRNG-dependent encryption module 118 can utilize entropy generated by the PRNG 120 based on previously received seed entropy.

[0089] At 704, entropy for reseeding the PRNG-dependent encryption module 118 may be requested. In some implementations, requesting entropy for reseeding is in response to determining that the current entropy consumed by the encryption module 118 is below a desired quality. In other implementations, entropy is requested for reseeding the PRNG-dependent encryption module 118 in response to completion of a timer. One or more of the PRNGs 120 or encryption modules 118 may request entropy at the same time or at different times. In one aspect, the request for entropy is received by an entropy distribution network, which determines whether entropy is available for distribution. If entropy is not available (or more generally, if the amount of available entropy is below a threshold, such as an amount of entropy sufficient to satisfy the request for entropy), an entropy generation process may be initiated.

[0090] At 706, the entropy source is operated to generate entropy for reseeding the PRNG-dependent cryptographic module 118. The entropy source 408 may generate low-bandwidth, high-quality entropy 422. In an embodiment, the entropy source 408 generates the entropy 422 by measuring and combining different measurement sources (e.g., spatial radiation or mouse movement within a time frame). The entropy source 408 may then form a value and pass the value through a circuit that performs quality checks (e.g., uniformity and reverse secrecy). Once the entropy 422 is generated, it may be provided by the entropy source 408 to the cryptographically secure random number generator 406.

[0091] At 708, the PRNG dependent encryption module 118 may continue to operate based on the previously received seed entropy during the entropy generation process beginning at 706. In contrast to a typical encryption module, the encryption module 118 may continue to operate to overlap at least a portion of the power consumption associated with generating entropy for reseeding the PRNG dependent encryption module 118. In some implementations, generating entropy with a random number generator generates a first power signature indicative of generating entropy, and operating the PRNG dependent encryption module 118 while generating entropy generates a second power signature that at least partially overlaps the first power signature to obscure the operation of the PRNG dependent encryption module 118 or the operation of the random number generator to generate entropy.

[0092] In one aspect, the PRNG dependent encryption module 118 is operated without performing an encryption operation by the PRNG dependent encryption module to generate a power signature that does not indicate deactivation of the PRNG dependent encryption module 118. Alternatively, the PRNG dependent encryption module 118 is operated to perform an encryption operation by the PRNG dependent encryption module 118 with a current seed to generate a power signature that does not indicate deactivation of the PRNG dependent encryption module 118.

[0093] Optionally, at 710, the encryption module 118 may be reseeded using the partially generated entropy. In an aspect, the encryption module 118 may be configured to consume an amount of entropy less than the amount of entropy requested. For example, the encryption module 118 may receive less entropy than requested because the amount of entropy requested is not available in the random number generator. The encryption module 118 may use the lesser amount of entropy provided to the PRNG 120 to perform encryption operations based on the entropy provided by the PRNG 120. In this manner, the encryption module 402 may be able to continue operating and perform encryption operations using any amount of fresh entropy available.

[0094] At 712, the entropy process may continue, where entropy from the entropy source may be processed with a cryptographically secure random number generator to generate more bits of entropy. The cryptographically secure random number generator may include an AES engine that allows the entropy provided by the entropy source to be scaled in a cryptographically secure manner. Once entropy is generated by the cryptographically secure random number generator, it may be provided to an entropy distribution network that distributes entropy to the PRNG 120 or the PRNG-dependent encryption module 118.

[0095] At 714, more bits of entropy from the cryptographically secure random number generator may be distributed to the encryption module 118 or PRNG via an entropy distribution network. The entropy distribution network may span across a large portion of the integrated circuit and provide entropy to different circuit components. Thus, the entropy distribution network may include powerful drivers and transistors that generate large power signatures. The entropy distribution network may provide entropy to one or more PRNGs 120 or encryption modules 118 that require reseeding.

[0096] At 716, the encryption module 118 (e.g., the PRNG 120) is reseeded using the entropy received from the entropy distribution network. For example, the PRNG 120 may utilize the entropy provided from the entropy distribution network as a seed to generate pseudorandomness for the PRNG-dependent encryption module 118.

[0097] At 718, the encryption module 118 may operate to enable encryption operations that utilize pseudorandomness based on the reseeded entropy. For example, the encryption module 118 may operate to perform masking and remasking operations based on the pseudorandomness provided by the PRNG 120.

[0098] In certain aspects, reseeding of a secure PRNG as described herein can create power signatures or other channel signatures that spoof the operation of an integrated circuit. In this manner, a malicious attacker may be unable to determine when an integrated circuit processes sensitive information, and thus be able to ensure the intended operation of the integrated circuit. Thus, the techniques, apparatus, and systems disclosed herein may provide a cryptographically secure method for PRNG reseeding.

[0099] Exemplary System FIG. 8 illustrates various components of an exemplary electronic device 800 that can implement secure PRNG reseeding according to one or more aspects. The electronic device 800 may be implemented as any one or more of a fixed, mobile, standalone or embedded device. It may also be implemented in any form of consumer, computer, portable, user, server, communication, telephone, navigation, gaming, audio, camera, messaging, media playback, and / or other types of electronic devices 800, such as a smartphone, shown in FIG. 1 as device 102. One or more of the illustrated components may be implemented as separate components or as integrated components on at least one integrated circuit of the electronic device 800. In general, the various components of the electronic device 800 are coupled via an interconnect 122 and / or one or more fabrics that support communication between the components according to one or more aspects of secure PRNG reseeding.

[0100] The electronic device 800 may include one or more communications transceivers 126 that enable wired and / or wireless communication of device data 110, such as, for example, received data, transmitted data, or other information identified herein. Examples of communications transceivers 126 include near field communication (NFC) transceivers, wireless personal area network (PAN) (WPAN) radios conforming to the various IEEE 802.15 (Bluetooth®) standards, wireless local area network (LAN) (WLAN) radios conforming to any of the various IEEE 802.11 (WiFi®) standards, wireless wide area network (WAN) (WWAN) radios for cellular phones (e.g., those conforming to the 3rd Generation Partnership Project (3GPP®)), wireless metropolitan area network (MAN) (WMAN) radios conforming to the various IEEE 802.16 (WiMAX™) standards, infrared (IR) transceivers conforming to the Infrared Data Association (IrDA) protocol, and wired local area network (LAN) (WLAN) Ethernet transceivers.

[0101] The electronic device 800 may also include one or more data input ports 128 through which any type of data, media content, and / or other input may be received. Examples include user selectable inputs, messages, applications, music, television content, recorded video content, and any other type of audio, video, and / or image data received from any content and / or data source, including sensors such as microphones or cameras. The data input ports 128 may include USB ports, coaxial cable ports, fiber optic ports for fiber optic interconnects or cables, and other serial or parallel connectors (including internal connectors) for flash memory, DVDs, CDs, and the like. These data input ports 128 may be used to couple the electronic device to components, peripherals, or accessories such as keyboards, microphones, cameras, or other sensors.

[0102] The electronic device 800 of this example includes at least one processor 106 (e.g., any one or more of an application processor, a microprocessor, a digital signal processor (DSP), a controller, etc.), which may include a combined processor and memory system (e.g., implemented as part of an SoC) that processes (e.g., executes) computer-executable instructions to control the operation of the device. The processor 106 may be implemented as an application processor, an embedded controller, a microcontroller, a security processor, an artificial intelligence (AI) accelerator, etc. In general, the processor or processing system may be implemented at least in part in hardware and may include components of integrated circuits or on-chip systems, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations in silicon and / or other materials.

[0103] Alternatively or additionally, electronic device 800 may be implemented with any one or combination of electronic circuitry, which may include software, hardware, firmware, or fixed logic circuitry implemented in conjunction with processing and control circuitry, generally designated 802 (as electronic circuitry 802). This electronic circuitry 802 may implement executable or hardware-based modules (not shown in FIG. 8), such as by processing / computer-executable instructions stored on a computer-readable medium, logic circuitry, and / or hardware (e.g., FPGAs, etc.).

[0104] In one aspect, electronic device 800 includes an interconnect 122, which may include any one or more of a system bus, interconnect, crossbar, data transfer system, or other switch fabric that couples various components within the device and enables various aspects of signaling and / or communication in a sparse encoding. The system bus or interconnect may include any one or combination of a variety of bus structures, examples of which include a memory bus or memory controller, a peripheral bus, a parity block, an error correction code (ECC) block, a universal serial bus, and / or a processor bus or local bus utilizing any of a variety of bus architectures.

[0105] The electronic device 800 also includes one or more memory devices 804 that enable data storage, examples of which include random access memory (RAM), non-volatile memory (e.g., read only memory (ROM), flash memory, erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM)), and disk storage devices. Thus, the memory device(s) 804 may be distributed throughout various logical storage levels of the system and among various physical components. The memory device(s) 804 provide a data storage mechanism for storing device data 110, other types of code and / or data, and various device applications 806 (e.g., software applications or programs). For example, an operating system 808 may be maintained as software instructions in the memory device 804 and executed by the processor 106.

[0106] In some implementations, electronic device 800 also includes an audio and / or video processing system 810 that processes audio data and / or passes audio and video data to an audio system 812 and / or a display system 814 (e.g., a video buffer or a smartphone or camera screen). Audio system 812 and / or display system 814 may include any device that processes, displays, and / or otherwise renders audio, video, display, and / or image data. Display data and audio signals can be communicated to the audio and / or display components via other similar communication links, such as an RF (radio frequency) link, an S-video link, an HDMI (high definition multimedia interface), a composite video link, a component video link, a DVI (digital video interface), an analog audio connection, a video bus, or a media data port 816. In some implementations, audio system 812 and / or display system 814 are external or separate components of electronic device 800. Alternatively, for example, the display system 814 can be an integrated component of the example electronic device 800, such as part of an integrated touch interface.

[0107] The electronic device 800 of Figure 8 is an exemplary implementation of the apparatus 102 of Figure 1, i.e., an exemplary implementation of a device capable of implementing secure PRNG reseeding as described with reference to Figures 1-7. Thus, the electronic device 800 can include a security circuit 112, which can be a separate IC chip or can be included as part of another IC chip or device, such as the processor 106, the electronic circuit 802 or the memory device 804. Thus, one or more of the illustrated components may be integrated on the same IC chip, such as a SoC, or at least on a single printed circuit board (PCB).

[0108] The security circuit 112 may include an AES unit 116 that performs cryptographically secure operations using encryption or decryption. The AES unit 116 may include any number of encryption modules configured to perform cryptographically secure operations using randomness or pseudorandomness provided by a RNG or PRNG. For example, the encryption modules may perform masking and remasking operations to distance the channel signature of the electronic device 800 from the generated / processed values. The security circuit 112 may include an entropy generation circuit that is responsible for reseeding the PRNG of the encryption module. The entropy generation circuit may include a high-quality entropy source, a cryptographically secure random number generator, and an entropy distribution network. Thus, the principles of secure PRNG reseeding described herein may be implemented by or in conjunction with the electronic device 800 of FIG. 8.

[0109] Unless the context dictates otherwise, use of the word "or" herein may be considered as "inclusive or," or as use of a term permitting the inclusion or application of one or more items linked by the word "or" (e.g., the phrase "A or B" may be interpreted as permitting only "A," permitting only "B," or permitting both "A" and "B"). Also, as used herein, a phrase referring to "at least one" of a list of items refers to any combination of those items, including single members. For example, "at least one of a, b, c" can cover not only a, b, c, ab, ac, bc, abc, but also any combination containing multiples of the same element (e.g., aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, ccc, or any other order of a, b, c). Additionally, items indicated in the accompanying drawings and terms described herein may indicate one or more items or terms, and thus may refer interchangeably to the singular or plural of the items and terms in this description. Although implementations of the secure cryptographic processor have been described in language specific to particular functions and / or methods, the subject matter of the appended claims is not necessarily limited to the particular functions or methods described. Rather, the particular functions and methods are disclosed as exemplary implementations of secure cryptographic operations.

[0110] Further Examples An example of secure PRNG reseeding is provided below.

[0111] Example 1: A method comprising: receiving a request for entropy for reseeding the PRNG-dependent cryptographic module from a pseudorandom number generator (PRNG) dependent cryptographic module, the PRNG dependent cryptographic module including a PRNG configured to generate random numbers using a seed based on received entropy; generating, by the random number generator, the entropy for reseeding the PRNG dependent cryptographic module based on an entropy source; and operating the PRNG dependent cryptographic module while generating the entropy for reseeding the PRNG dependent cryptographic module to overlap at least a portion of power consumption associated with operation of the PRNG dependent cryptographic module with power consumption associated with the generation of the entropy for reseeding the PRNG dependent cryptographic module.

[0112] Example 2: A method according to any of the preceding examples, wherein generating the entropy with the random number generator generates a first power signature indicating generating the entropy, and operating the PRNG-dependent cryptographic module while generating the entropy generates a second power signature that at least partially overlaps the first power signature, thereby obscuring the operation of the PRNG-dependent cryptographic module or the operation of the random number generator to generate the entropy.

[0113] Example 3: A method according to any of the preceding examples, wherein a power signature is generated that does not indicate deactivation of the PRNG-dependent cryptographic module without performing cryptographic operations by the PRNG-dependent cryptographic module by operating the PRNG-dependent cryptographic module while generating the entropy.

[0114] Example 4: A method according to any of the preceding examples, wherein generating the entropy for reseeding the PRNG-dependent cryptographic module includes: generating one or more bits of entropy by an entropy source; in response to generating the one or more bits of entropy by a cryptographically secure random number generator, processing the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy; and distributing the number of bits of entropy to the pseudo-random number generator by an entropy distribution network.

[0115] Example 5: A method as described in any of the preceding examples, wherein two or more of generating the one or more bits of entropy, processing the one or more bits of entropy, or distributing the greater number of entropies occurs, at least in part, simultaneously.

[0116] Example 6: A method according to any of the preceding examples, wherein the method further includes, during generation of the entropy for reseeding the PRNG-dependent cryptographic module, performing an operation of generating a third power signature that at least partially overlaps the first power signature or the second power signature using at least one of the entropy source, the cryptographically secure random number generator, or the entropy distribution network.

[0117] Example 7: A method as described in any of the preceding examples, wherein the operation of generating the third power signature does not contribute to the generation of the one or more bits of entropy, the processing of the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy, or the distribution of the greater number of bits of entropy to the pseudorandom number generator.

[0118] Example 8: A method according to any of the preceding examples, wherein operating the PRNG dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG dependent encryption module includes receiving, by the PRNG dependent encryption module, signaling indicating the generating of entropy for reseeding the PRNG dependent encryption module, and operating the PRNG dependent encryption module upon receiving the signaling indicating the generating of entropy for reseeding the PRNG dependent encryption module.

[0119] Example 9: A method according to any of the preceding examples, wherein operating the PRNG dependent cryptographic module to generate the power signature that does not indicate deactivating the PRNG dependent cryptographic module includes activating a timer in response to requesting the entropy for reseeding the PRNG dependent cryptographic module, by the PRNG dependent cryptographic module, and terminating execution of the PRNG dependent cryptographic module in response to the timer reaching a predetermined time value if the entropy for reseeding has not been received by the PRNG dependent cryptographic module.

[0120] Example 10: A method according to any of the preceding examples, wherein the method further includes determining, by the PRNG-dependent encryption module, that a current entropy used by the PRNG-dependent encryption module is below a desired quality, and wherein receiving the request for entropy to reseed the PRNG-dependent encryption module is in response to determining that the current entropy used by the PRNG-dependent encryption module is below the desired quality.

[0121] Example 11: A method according to any of the preceding examples, wherein operating the PRNG-dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module includes performing an encryption operation by the PRNG-dependent encryption module using current entropy.

[0122] Example 12: A method according to any of the preceding examples, further comprising: receiving, in a PRNG of the PRNG-dependent encryption module, the entropy for reseeding the PRNG-dependent encryption module; and performing, by the PRNG-dependent encryption module, an encryption operation using new entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module.

[0123] Example 13: A method according to any of the preceding examples, further comprising: receiving, in a PRNG of the PRNG-dependent encryption module, a partial amount of new entropy for reseeding the PRNG-dependent encryption module; and performing, by the PRNG-dependent encryption module, an encryption operation using the partial amount of new entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module, wherein the partial amount of new entropy received by the PRNG-dependent encryption module comprises less entropy than an amount of entropy requested for reseeding the PRNG-dependent encryption module.

[0124] Example 14: A method according to any of the preceding examples, wherein operating the PRNG-dependent cryptographic module while generating the entropy for reseeding the PRNG-dependent cryptographic module includes operating the cryptographic module to perform cryptographic operations using the new entropy that is less than the amount of entropy requested while generating new entropy to satisfy the request for entropy.

[0125] Example 15: An apparatus comprising: an encryption module including a first pseudorandom number generator (PRNG) configured to operate based on entropy; an entropy generation circuit operatively coupled to the encryption module, the entropy generation circuit including an entropy source, a random number generator, and an entropy distribution network; and a secure PRNG reseeding module configured to perform any one of the methods of the embodiments described herein.

[0126] Example 16: An integrated circuit comprising an entropy generation circuit configured to generate entropy for reseeding a pseudorandom number generator (PRNG) dependent encryption module, the PRNG dependent encryption module including a PRNG, the PRNG dependent encryption module configured to perform encryption operations using entropy provided by the PRNG, request entropy for reseeding the PRNG dependent encryption module, and operate the PRNG dependent encryption module during entropy generation to overlap at least a portion of power consumption associated with the generation of the entropy for reseeding the PRNG dependent encryption module.

[0127] Example 17: An integrated circuit as described in any of the preceding examples, wherein the entropy generation circuit includes an entropy source configured to generate one or more bits of entropy, a cryptographically secure random number generator configured to process the one or more bits of entropy to create a number of entropy greater than the one or more bits of entropy, and an entropy distribution network configured to distribute the greater number of bits of entropy to the pseudo-random number generator.

[0128] Example 18: An integrated circuit as described in any of the preceding examples, wherein one or more of the entropy source, the cryptographically secure random number generator, or the entropy distribution network are further configured to perform operations to generate a power signature that at least partially overlaps with a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent cryptographic module.

[0129] Example 19: An integrated circuit as described in any of the preceding examples, wherein the PRNG dependent encryption module is configured to operate the PRNG dependent encryption module to generate a power signature that does not indicate deactivation of the PRNG dependent encryption module without performing a cryptographic operation using the PRNG dependent encryption module.

[0130] Example 20: An integrated circuit as described in any of the preceding examples, wherein the PRNG-dependent encryption module is further configured to determine that a quality of a current entropy is less than a predetermined quality, and in response to determining that the quality of the current entropy is below the predetermined quality, request entropy for reseeding the PRNG-dependent encryption module.

[0131] Example 21: An integrated circuit as described in any of the preceding examples, wherein the PRNG-dependent encryption module is configured to use the current entropy to operate the PRNG-dependent encryption module during entropy generation to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module.

[0132] Example 22: An integrated circuit as described in any of the preceding examples, wherein the PRNG is further configured to receive the entropy for reseeding the PRNG-dependent encryption module and generate new entropy based on the entropy for reseeding the PRNG-dependent encryption module, and the PRNG-dependent encryption module is further configured to receive the new entropy from the PRNG and perform an encryption operation based on the new entropy.

[0133] conclusion Although aspects of the described apparatus, systems, and methods for implementing secure PRNG reseeding have been described in function- and / or method-specific language, the subject matter of the appended claims is not necessarily limited to the specific functions or methods described, as incorporated by any of the preceding examples. Rather, the specific functions and methods are disclosed as exemplary implementations of secure PRNG reseeding, and other equivalent functions and methods are intended to be within the scope of the appended claims. Additionally, various aspects of secure PRNG reseeding have been described, with it being understood that each described aspect can be implemented independently or in conjunction with one or more other described aspects.

Claims

1. 1. A method comprising: receiving a request for entropy to reseed the pseudorandom number generator (PRNG) dependent cryptographic module from a pseudorandom number generator (PRNG) dependent cryptographic module, the PRNG dependent cryptographic module including a PRNG configured to generate random numbers using a seed based on received entropy; generating, by a random number generator, the entropy for reseeding the PRNG-based cryptographic module based on an entropy source; operating the PRNG dependent encryption module while generating the entropy for reseeding the PRNG dependent encryption module such that at least a portion of power consumption associated with operation of the PRNG dependent encryption module overlaps with power consumption associated with the generation of the entropy for reseeding the PRNG dependent encryption module; A method comprising:

2. generating the entropy with the random number generator to generate a first power signature indicative of generating the entropy; operating the PRNG-dependent cryptographic module while generating the entropy to generate a second power signature that at least partially overlaps the first power signature to obscure the operation of the PRNG-dependent cryptographic module or the operation of the random number generator to generate the entropy; The method of claim 1.

3. 3. The method of claim 1 or claim 2, wherein operating the PRNG dependent encryption module while generating the entropy generates a power signature that does not indicate deactivation of the PRNG dependent encryption module without performing a cryptographic operation by the PRNG dependent encryption module.

4. Generating the entropy for reseeding the PRNG based cryptographic module comprises: generating, by an entropy source, one or more bits of entropy; responsive to generating the one or more bits of entropy with a cryptographically secure random number generator, processing the one or more bits of entropy to produce a number of bits of entropy that is greater than the one or more bits of entropy; distributing the greater number of bits of entropy to the pseudorandom number generator via an entropy distribution network; The method according to any one of claims 1 to 3, comprising:

5. 5. The method of claim 4, wherein two or more of generating the one or more bits of entropy, processing the one or more bits of entropy, or distributing the greater number of entropies occurs at least in part simultaneously.

6. The method further comprises, during generation of the entropy for reseeding the PRNG dependent cryptographic module, the entropy source, said cryptographically secure random number generator; or The entropy distribution network 6. The method of claim 4 or claim 5 when dependent on claim 2, further comprising performing an operation of generating a third power signature that at least partially masks the first power signature or the second power signature using at least one of:

7. 7. The method of claim 6, wherein the act of generating the third power signature does not contribute to the generation of the one or more bits of entropy, the processing of the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy, or the distribution of the number of bits of entropy to the pseudorandom number generator.

8. Operating the PRNG based encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG based encryption module, comprising: receiving, by the PRNG dependent encryption module, signaling indicating the generating of entropy for reseeding the PRNG dependent encryption module; operating the PRNG dependent encryption module upon receiving signaling indicating the generating entropy for reseeding the PRNG dependent encryption module; 13. A method according to any preceding claim, comprising:

9. Operating the PRNG dependent cryptographic module to generate the power signature that does not indicate deactivating the PRNG dependent cryptographic module includes: activating, by the PRNG dependent cryptographic module, a timer in response to requesting the entropy for reseeding the PRNG dependent cryptographic module; terminating execution of the PRNG dependent encryption module in response to the timer reaching a predetermined time value if the entropy for reseeding has not been received by the PRNG dependent encryption module; A method according to claim 3, or any of claims 4 to 7 when dependent on claim 3, comprising:

10. The method further includes determining, by the PRNG dependent encryption module, that a current entropy used by the PRNG dependent encryption module is below a desired quality; receiving the request for entropy for reseeding the PRNG dependent encryption module is responsive to determining that the current entropy used by the PRNG dependent encryption module is below the desired quality.

10. The method of claim 9.

11. 2. The method of claim 1 , wherein operating the PRNG dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG dependent encryption module comprises performing an encryption operation by the PRNG dependent encryption module using current entropy.

12. receiving new entropy in a PRNG of the PRNG dependent encryption module for reseeding the PRNG dependent encryption module; performing, by the PRNG dependent encryption module, an encryption operation using the new entropy generated by the PRNG based on the entropy for reseeding the PRNG dependent encryption module; The method of claim 1 further comprising:

13. receiving, in a PRNG of the PRNG dependent encryption module, a portion of new entropy for reseeding the PRNG dependent encryption module; performing, by the PRNG dependent encryption module, an encryption operation using a fraction of the new entropy generated by the PRNG based on the entropy for reseeding the PRNG dependent encryption module; Further comprising: the partial amount of new entropy received by the PRNG dependent encryption module includes less entropy than an amount of entropy required to reseed the PRNG dependent encryption module. The method of claim 1.

14. 14. The method of claim 13, wherein operating the PRNG dependent encryption module while generating the entropy for reseeding the PRNG dependent encryption module comprises generating new entropy to satisfy the request for entropy, while operating the encryption module to perform encryption operations using the new entropy that is less than the amount of requested entropy.

15. a cryptographic module including a first pseudorandom number generator (PRNG) configured to operate based on entropy; an entropy generation circuit operatively coupled to the cryptographic module, the entropy generation circuit including an entropy source, a random number generator, and an entropy distribution network; A secure PRNG reseeding module configured to perform the method according to any one of claims 1 to 14; An apparatus comprising:

Images