Secure Pseudo-Random Number Generator (PRNG) Reseding

Abstract

This document discloses techniques, devices, and systems for secure pseudorandom number generator (PRNG) reseeding. Integrated circuits (ICs) may use PRNGs to enable cryptographic processes that can protect the IC or electronic device from malicious attacks. In general, an IC (e.g., a security circuit) may seed or reseed a PRNG with entropy useful for generating pseudorandom numbers or bits. However, in generating entropy, the behavior of the IC may change, resulting in circuit characteristics that allow an attacker to determine when the IC operates on entropy-related secret information. In this way, an attacker may identify moments when an attack is more likely to reveal secret information. In aspects of secure PRNG reseeding, a security circuit may manipulate circuit elements to limit the association between circuit operations related to entropy generation and observable circuit characteristics. In doing so, the IC may implement cryptographic operations without allowing detection of circuit operations related to secret information.

Description

[Background technology]

[0001] Electronic devices often contain at least one integrated circuit (IC) that enables various functions on the electronic device. To securely perform some of these functions, the electronic device may store or operate using secret information restricted to certain access levels within the IC. However, an attacker may attempt to unauthorizedly access this secret information on the device in order to impair or alter the operation of the device. However, existing approaches to preventing unauthorized access of ICs are often insufficient to counter evolving software, hardware, and wireless attacks employed by malicious actors attempting to access secret information on electronic devices. Summary of the Invention

[0002] This document discloses techniques, devices, and systems for secure pseudorandom number generator (PRNG) reseeding. Integrated circuits (ICs) may use PRNGs to enable cryptographic processes that can protect the IC or electronic device from malicious attacks. Generally, an IC (e.g., a security circuit) may seed or reseed a PRNG with entropy useful for generating pseudorandom numbers or bits. However, generating entropy can change the behavior of the IC, resulting in circuit characteristics that allow an attacker to determine when the IC operates on secret information. In this way, an attacker may identify moments when an attack is more likely to reveal the secret. In a secure PRNG reseeding aspect, a security circuit may manipulate circuit elements to limit the association between circuit behavior related to entropy generation and observable circuit characteristics. In doing so, the IC may implement cryptographic operations without enabling detection of malicious or other circuit behavior. The term "entropy" here refers to data that is unpredictable (e.g., given information available to a potential adversary), such as data that is fundamentally unpredictable according to the laws of physics (e.g., when the next particle is detected by a Geiger counter), or data that is unpredictable from a practical standpoint (e.g., depends on physical phenomena that are difficult for an adversary to measure, e.g., the timing of actions by a human operator). An entropy source can be a noise source. The term "reseding" refers to resetting the value of the seed used by a PRNG to generate random numbers.

[0003] In some aspects, a method for secure PRNG reseeding includes receiving a request for entropy for reseeding a PRNG-dependent cryptographic module (e.g., a cryptographic module including a pseudorandom number generator (PRNG) configured to generate random numbers using a seed based on received entropy). In response to the request, entropy for reseeding the PRNG-dependent cryptographic module is generated. Each entropy generation operation is performed by an entropy complex (entropy source), while the PRNG-dependent cryptographic module is operated to overlap at least a portion of the power consumption associated with generating entropy for reseeding the PRNG-dependent cryptographic module.

[0004] In some aspects, the PRNG-dependent encryption module operates by performing an encryption operation using current (i.e., previously received) entropy based on a current (i.e., previously received) seed provided to the PRNG-dependent encryption module. In other aspects, the PRNG-dependent encryption module operates by performing an operation to generate a power signature that at least partially overlaps with a power signature generated by an entropy generation process without performing an encryption operation by the PRNG-dependent encryption module. For example, the PRNG-dependent encryption module can generate a power signature that masks the power signature generated by the entropy generation process to obscure the operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the entropy generation process masks the power signature of the PRNG-dependent encryption module to obscure the operation of the PRNG-dependent encryption module. In yet another aspect, the PRNG-dependent encryption module is configured to perform an encryption operation using less entropy than requested by the encryption module.

[0005] Generating entropy for reseeding a PRNG-dependent cryptographic module may include generating one or more bits of entropy with an entropy source and processing one or more bits of entropy with a cryptographically secure random number generator to generate more than the one or more bits of entropy. The more bits of entropy may then be distributed by an entropy distribution network to reseed the PRNG. In some embodiments, the entropy generation may include operating one or more of the entropy source, the cryptographically secure random number generator, or the entropy distribution network at the same time intervals as another of the entropy source, the cryptographically secure random number generator, or the entropy distribution network.

[0006] In various aspects, a system for secure PRNG reseeding may perform the method for secure PRNG reseeding as described herein. In some implementations, the system includes an integrated circuit including an entropy generation circuit configured to generate entropy for reseeding a PRNG-dependent cryptographic module. The PRNG-dependent cryptographic module may include a PRNG and may be configured to perform cryptographic operations using entropy provided by the PRNG, to request entropy for reseeding the PRNG-dependent cryptographic module, and to operate the PRNG-dependent cryptographic module to overlap at least a portion of power consumption associated with generating entropy for reseeding the PRNG-dependent cryptographic module during generation of entropy for reseeding the PRNG-dependent cryptographic module.

[0007] This Summary is provided to introduce simplified concepts for implementing secure PRNG reseeding. The simplified concepts are further described in the Detailed Description below. This Summary is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter.

[0008] One or more aspects of the described systems and methods for secure PRNG reseeding are described in detail below. Where the same reference numbers are used in different instances in the description and figures, they indicate similar elements. [Brief explanation of the drawings]

[0009] [Figure 1] 1 illustrates an exemplary operating environment including an electronic device in which secure PRNG reseeding may be implemented. [Figure 2] 1 illustrates an exemplary security circuit that includes multiple circuit components that can be implemented to support aspects of secure PRNG reseeding. [Figure 3] 1 illustrates an exemplary Advanced Encryption Standard (AES) unit capable of implementing secure PRNG reseeding, according to one or more embodiments. [Figure 4] 1 illustrates an example of entropy generation according to one or more aspects of secure PRNG reseeding. [Figure 5-1] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 5-2] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 5-3] 1 illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. [Figure 6] 1 illustrates an exemplary method for secure PRNG reseeding, according to one or more embodiments. [Figure 7]1 illustrates an exemplary method for continuing to operate a cryptographic module while entropy is generated for reseeding the cryptographic module. [Figure 8] 1 illustrates an exemplary electronic device that can implement secure PRNG reseeding. DETAILED DESCRIPTION OF THE INVENTION

[0010] In general, there are a wide variety of methods that an attacker may use to obtain sensitive information about an integrated circuit's cryptographic process. For example, side-channel analysis (SCA) can be used to extract secret assets (e.g., keys) by measuring the integrated circuit's power consumption, electromagnetic emissions, padding operations, operation timing, etc. during operation. In some cases, SCA can be effective because these channels (e.g., the integrated circuit's power consumption, electromagnetic emissions, padding operations, or operation timing) depend on intermediate values ​​created and / or processed by the integrated circuit.

[0011] To mitigate SCA, many ICs include encryption modules that utilize randomness to perform cryptographic operations that enhance security. For example, encryption modules may utilize PRNGs to provide randomness, which can be used as a mask in Boolean masking, making these channels independent of the true values ​​generated and / or processed by the integrated circuit. However, these PRNGs may require reseeding to consistently generate entropy of the desired quality. Because generating entropy can be an expensive process requiring a significant amount of time, encryption modules that utilize entropy may cease operation if high-quality entropy is not available.

[0012] Terminating the execution of these cryptographic modules may reduce the circuit's power consumption, but this process may result in information leakage to a potential attacker of the integrated circuit. For example, an attacker monitoring any channel of the circuit (e.g., the integrated circuit's power consumption, electromagnetic emissions, padding operations, or timing behavior) may observe changes in circuit characteristics when the cryptographic modules are deactivated. By observing these changes, an attacker may be able to determine when cryptographic processes are running within the IC. Because private keys are often used to enable these cryptographic processes, the disclosed information about the operation of the cryptographic modules may allow an attacker to determine the optimal time to launch and terminate an attack to reveal the chip's secrets.

[0013] Controlled operation of the encryption module or entropy generation process can enable enhanced security to limit information disclosure to an attacker. For example, the encryption module can continue to perform operations that create a power signature that does not indicate deactivation. In certain aspects, because masking does not require high-quality randomness with guaranteed uniformity, terminating execution of the encryption module when reseeding is requested may not be mandatory. Thus, the encryption module can continue encryption operations using randomness based on the current seed while entropy generation occurs. In this way, an attacker may be unable to determine when the encryption module is activated or deactivated, thereby concealing their handling of the encryption key. Furthermore, performing more operations from multiple sources increases the overall noise floor of the circuit characteristics, making it more difficult for an attacker to discern meaningful differences between circuit characteristics at different times.

[0014] Example Environment 1 illustrates an exemplary environment 100 including devices 102 in which aspects of secure PRNG reseeding can be implemented. Devices 102 may be implemented as any suitable devices, some of which are shown as a smartphone 102-1, a tablet computer 102-2, a laptop computer 102-3, a game console 102-4, a desktop computer 102-5, a server computer 102-6, a wearable computing device 102-7 (e.g., a smartwatch), and a broadband router 102-8 (e.g., a mobile hotspot). Although not shown, devices 102 may also be implemented as any of a mobile station (e.g., a fixed or mobile STA), a mobile communications device, a client device, user equipment, a mobile phone, an entertainment device, a mobile game console, a personal media device, a media playback device, a health monitoring device, a drone, a camera, an Internet-enabled home appliance capable of wireless Internet access and browsing, an IoT device, and / or other types of electronic devices. Device 102 may provide other functionality or may include components or interfaces that are omitted from FIG. 1 for clarity or visual simplicity.

[0015] The device 102 includes an integrated circuit 104 that utilizes one or more processors 106 and a computer-readable medium (CRM 108), which may include a memory medium or a storage medium. The processor 106 may be implemented as a general-purpose processor (e.g., a multi-core central processing unit (CPU) or application processor (AP)), an application-specific integrated circuit (ASIC), a graphics processing unit (GPU), or a system-on-chip (SoC) integrated with other components of the device 102. The CRM 108 may include any suitable type of memory or storage medium, examples of which include read-only memory (ROM), programmable ROM (PROM), random-access memory (RAM), dynamic RAM (DRAM), static RAM (SRAM), or flash memory. In the context of this description, the computer-readable medium 108 of the device 102 is implemented as at least one hardware-based or physical storage device that does not include a transitory signal or carrier wave. Applications, firmware, and / or an operating system (not shown) of the device 102 may be implemented on the computer-readable medium 108 as processor-executable instructions and executed by the processor 106 to provide various functions described herein. The computer-readable medium 108 may also store device data 110, such as user data or media, accessible via the applications, firmware, or operating system of the device 102.

[0016] In this example, the integrated circuit 104 includes a security circuit 112. The device 102, the integrated circuit 104, or the security circuit 112 may implement a secure cryptographic processor. The security circuit 112 may be implemented using one or more circuit components 114, e.g., circuit component 114-1 through circuit component 114-n. The circuit components 114 may be configured to perform any number of operations to enable functionality of the device 102. Examples of circuit components include a processor and multiple functional components, as illustrated in FIG. 2. The security circuit 112 may be implemented, for example, as a protected enclave, a trusted chip platform, a hardware-based Root of Trust (RoT) chip (e.g., a silicon RoT), or the like. Regardless of how or where the security circuit 112 is incorporated into the electronic device, the security circuit 112 may resist many types of attacks.

[0017] The security circuit 112 may include one or more Advanced Encryption Security (AES) units 116 capable of performing cryptographic operations for the integrated circuit 104. In an aspect, the AES units 116 may implement one or more PRNG-dependent encryption modules 118 that utilize a PRNG 120 to perform cryptographic operations, such as data encryption or data decryption, where the data may be, for example, image data (e.g., captured by a camera or video camera) or audio data (e.g., captured by a microphone). In one example, a PRNG value may be used to generate a private / public key pair. The public key is transmitted from the device 102 via the transceiver 126 and / or I / O port 128. Data (e.g., image / audio data) encrypted using the public key and received by the device 102 via the transceiver 126 and / or I / O port 128 may be decrypted using the private key. Alternatively or additionally, data such as image data or audio data (e.g., data acquired using sensor 130) may be hashed using a private key to generate a hash digest, and the data and hash digest may be transmitted from device 102 via transceiver 126 and / or I / O port 128, such that the hash digest serves as a signature for the data and can be verified by a third party using the public key. In another embodiment, encryption module 118 may perform Boolean masking and remasking operations on data manipulated by integrated circuit 104 based on the pseudorandomness provided by PRNG 120. In some aspects, encryption module 118 and / or PRNG 120 may be implemented as or in conjunction with a secure PRNG reseeding module (not shown, e.g., FIG. 4), which may implement the methods described herein. However, PRNG 120 may require reseeding to consistently generate entropy of a desired quality. Over time, the pseudorandomness provided by the PRNG 120 may become deterministic, and therefore cryptographic operations performed based on the pseudorandomness may not be effective in protecting against various attacks.To ensure the quality of the pseudo-randomness utilized by the encryption module 118 , fresh entropy may be generated and consumed to reseed the PRNG 120 .

[0018] The AES unit 116 may handle device secrets, such as cryptographic keys or other sensitive information, used to ensure proper use and performance of the integrated circuit 104. To protect the sensitive information handled by the AES unit 116, cryptographically secure operations may be performed to protect against various attacks that could expose the device secrets or information about the integrated circuit 104.

[0019] As shown, security circuitry 112 is coupled to interconnect 122. Interconnect 122 may be implemented using, for example, a bus, a switching fabric, or a bus network that allows various circuit components to communicate. Each circuit element may be directly or indirectly coupled to interconnect 122.

[0020] The device 102 may also include a display 124, a transceiver 126, input / output ports (I / O ports 128), and / or sensors 130. The display 124 may be operatively coupled to one of the processors 106 (e.g., a graphics processing unit (GPU)) and configured to graphically display the operating system or applications of the device 102. The transceiver 126 may be configured to enable wired or wireless communication of data (e.g., device data 110) across a wired or wireless network according to any suitable communication protocol. The I / O ports 128 of the device 102 may include universal serial bus (USB) ports, coaxial cable ports, and other serial or parallel connectors (including internal connectors) useful for coupling electronic devices to various components, peripherals, or accessories (such as a keyboard, microphone, or camera).

[0021] The device 102 also includes sensors 130 that enable the device 102 to sense various properties, changes, stimuli, or characteristics of the environment in which the device 102 operates. For example, the sensors 130 may include various motion sensors, ambient light sensors, acoustic sensors, capacitance sensors, infrared sensors, temperature sensors, radar sensors, or magnetic sensors. In an aspect, the sensors 130 may be used to generate entropy for reseeding the PRNG 120. Alternatively or additionally, the sensors 130 may enable the device 102 to interact with or accept input from a user, such as through touch sensing or proximity sensing.

[0022] Exemplary Circuit Components 2 illustrates, at 200, an exemplary security circuit 112 including an exemplary processor 106 and multiple circuit components, including multiple exemplary circuit components 114 that can be implemented to support aspects of secure PRNG reseeding. As shown, the security circuit 112 includes a processor 106 coupled to an interconnect 122. Each processor 106, multiple memories, and multiple other circuit components 114 may be directly or indirectly coupled to the interconnect 122. In some aspects, the components of FIG. 2 may be embodied as a secure computing platform or secure system-on-chip that implements a root of trust and / or other secure cryptographic functions.

[0023] In an exemplary embodiment, the memories may include a read-only memory (ROM 202), a static random access memory (SRAM 204), and a flash memory 206. In an aspect, the ROM 202, the SRAM 204, or the flash memory 206 may be implemented within the security circuit 112 or within a CRM (e.g., the CRM 108). The circuit components 114 may include an alert handler 208, an advanced encryption standard (AES) unit (AES unit 116), a hash-based message authentication code (HMAC) engine (HMAC engine 210), and a serial peripheral interface (SPI) device (SPI device 212). The components 114 may also include a universal asynchronous receiver / transmitter (UART) unit (UART unit 214), a general-purpose input / output (GPIO) interface (GPIO interface 216), a pin multiplexer (pin MUX 218), and a pad controller 220. The plurality of components 114 may further include a random number generator (RNG 222) and a timer 224. Additionally, the components 114 may include any memory, as shown in Figure 2. Although particular examples of memory and other components 114 are shown in Figure 2 or described herein, a given implementation of the security circuit 112 may include more, fewer, and / or different instances of processors, controllers, memory, modules, or peripheral devices (including duplicates thereof).

[0024] The illustrated circuit components can operate synchronously based on one or more clock signals. Although not shown in FIG. 2 , the security circuit 112 may include at least one clock generator for generating clock signals or a reset circuit for resetting one or more individual components independently of one another, for resetting multiple components jointly, or for resetting the entire IC chip. Alternatively, the security circuit 112 may receive at least one clock or reset signal from a source external to the security circuit 112, which may or may not be on a separate chip. One or more separate components 114 may each operate in an individual clock domain. For example, the circuit components may synchronize to a clock local to the respective component. Components in different clock domains may operate or communicate asynchronously with respect to one another.

[0025] Exemplary implementations of the illustrated components are described below. The processor 106 may be realized as the “main,” “central,” or “core” processor of the security circuit 112. The processor 106 may be implemented, by way of example only, as a 32-bit in-order reduced instruction set computing (RISC) core with a multi-stage pipeline. For example, using RISC-V features, the processor may implement M (machine) mode and U (user) mode. Activating a reset pin (not shown) (e.g., by deasserting an active-low reset pin) causes the processor 106 to exit reset and begin executing code at its reset vector. The reset vector may begin in ROM 202, thereby enabling that code before jumping to emulated embedded flash (eFlash). In other words, it is expected that code will be instantiated in the eFlash before reset is released. In some cases, the reset for the entire security circuit 112 can be asynchronous active-low according to compatibility specifications to support interoperability between various circuit components. The reset may be generated by the alert handler 208 as a security measure, may be generated by a watchdog timer, etc. The reset signal may also be sent to other circuit components (such as one of the memories or one of the other components 114).

[0026] A debug module 226 (DM) and an interrupt controller 228 (ITC) are coupled to the processor 106 and may be compatible with either one. The debug module 226 provides debug access to the processor 106. Logic in the debug module 226 interfaces with specific pins on the IC to allow the processor 106 to enter debug mode and provide the ability to inject code into a device (e.g., by emulating instructions) or memory. The interrupt controller 228 may be located close to the processor 106. The interrupt controller 228 may accept a vector of interrupt sources from within the security circuit 112. The interrupt controller 228 may also assign a level and priority to the interrupt before forwarding it to the processor 106 for processing.

[0027] The processor 106 can provide any desired level of performance or include any internal circuit components. For example, the processor 106 can include at least one arithmetic logic unit (ALU) (e.g., an “extra” ALU that calculates branch targets to remove latency cycles for conditional branches) and multiple pipeline stages. Using multiple pipeline stages, the pipeline can perform register writeback to reduce latency cycles from loads and stores and prevent pipeline stalls, where the response to a load or store is available the cycle after the request. The processor 106 can implement a single-cycle multiplier or generate an imprecise exception in error response to a store, allowing the processor to continue execution beyond the store without waiting for a response. While not shown, the processor 106 specifically, or the security circuit 112 generally, can include an instruction cache that provides single-cycle access times for instructions.

[0028] In the illustrated example 200, the components of the security circuit 112 include or have access to three memory address spaces for instructions and data. ROM 202 is the target of the processor 106 after it comes out of reset. ROM 202 contains hard-coded instructions to perform a subset of platform checks before checking the next stage code. The next stage code (e.g., a boot loader stored in e-flash memory) may be the first piece of code not hard-coded into the device's silicon. Therefore, this next stage code is signature checked for integrity to improve security. ROM 202 can perform this signature check by implementing a Rivest-Shamir-Adleman check (RSA check) algorithm on all of the boot loader's contents.

[0029] The flash memory 206 can be implemented as e-flash memory for code storage. This e-flash can contain the boot loader mentioned herein as well as overlying operating systems and applications. The SPI device 212 can be used to bulk load the e-flash memory. The debug module 226 can also be used for code loading. The SRAM 204 can operate as a scratchpad SRAM available for data storage by the processor 106 (e.g., for stack and heap information). The SRAM 204 can also store code.

[0030] The security circuit 112 may include circuit components 114, which may be subordinate execution units, coupled to the processor 106 via the interconnect 122. Each of these components 114 may adhere to an interface framework that ensures compatibility with each other and with the processor 106. The compatibility scheme may specify how the processor 106 communicates with a given circuit component (e.g., using the interconnect 122), how the circuit component communicates with the processor 106 (e.g., using interrupts), how the circuit component communicates security events (e.g., using alert indications) to other circuit components such as the alert handler 208, how the circuit component communicates with peripheral devices (e.g., through chip I / O), or a combination thereof. The illustrated components 114 may include circuit components associated with alert-related functions provided by the alert handler 208, associated with the processor 106, associated with one or more memories, associated with the chip I / O, etc. Thus, memory may also comprise components 114 associated with each other or with other illustrated circuit components.

[0031] The circuit or chip I / O includes a pin MUX 218 and a pad controller 220. The pin MUX 218 provides signaling routes between at least some of the components 114 and available multiplexable I / O nodes of the security circuit 112 (e.g., pins of the chip on which various components are integrated, or interfaces to other parts of the SoC). The pad controller 220 manages control or pad attributes such as drive strength, technology, pull-up vs. pull-down, etc. of each circuit component. The pin MUX 218 and the pad controller 220 may themselves be peripheral devices on the interconnect 122. As such, each may have or be associated with at least one register collection that provides software configurability.

[0032] The UART unit 214 can implement UART characteristics, such as single-lane dual-UART functionality. Its outputs and inputs can be configured to connect to any circuit I / O via the pin MUX 218. The GPIO interface 216 creates G-bit bidirectional communication to external circuits via the pin MUX 218, where G is a positive integer, such as 16, 32, or 64. Regarding memory I / O, the SPI device 212 can implement a firmware mode, where the firmware mode can enable a feature that provides an external driver with the ability to send firmware update code to a bank of the flash memory 206 for in-field firmware updates. The firmware mode can include addressing the memory using SPI transactions. Although not shown, the security circuit 112 can include an Inter-Integrated Circuit (I2C) host to enable I2C device commands. These commands can include standard mode, full mode, and high-speed mode.

[0033] Several “core security” components are also illustrated, including an encryption engine and an alert handler 208. The AES unit 116, which may be implemented as described with reference to FIG. 1, can provide various symmetric encryption and decryption functions, such as by using one or more protocols and / or various key sizes, such as 128b, 192b, or 256b. In certain aspects, the AES unit 116 may include an encryption module 118 and / or a PRNG 120, along with a secure PRNG reseeding module (not shown, e.g., FIG. 4), capable of implementing the methods described herein. Components can select to encrypt or decrypt data arriving in 16-byte amounts, for example, encrypted or decrypted using different block cipher modes of operation. The AES unit 116 can support an electronic codebook (ECB) mode, a cipher block chain (CBC) mode, a cipher feedback (CFB) mode, an output feedback (OFB) mode, a counter (CTR) mode, etc. Data transfers can be made available to the processor. For example, keys and data material may be passed to the encryption engine via register writes. Alternatively, a private channel for transferring keys and data material may be included to reduce exposure from potentially untrusted processor activity.

[0034] The HMAC engine 210 can utilize a hash algorithm, such as the Secure Hash Algorithm (SHA) SHA-256. SHA-256 is part of the SHA-2 family of hash algorithms, which has a digest (or hash output) length of 256 bits, regardless of the input data size being hashed. After announcing the start of a hash request, data is sent to the HMAC engine 210, which zeroes out the internal state to an initial condition (e.g., 32 bits at a time). Once the data is sent by the component client, the client can indicate completion of the hash request (optionally using a partial-word last write). According to an exemplary portability interface scheme, the HMAC engine 210 generates a hash result, which is available for read in a register by the requesting client. The data transfer can be made available to the processor or private to reduce exposure to potentially untrusted processor activity.

[0035] HMAC is a message authentication protocol layered on top of a hash function (e.g., SHA-256) and mixed with a secret key for encryption. HMAC is a specific application of adding a secret key in a prescribed manner (e.g., twice) to the message hashing (via SHA-256). To provide this functionality, a 256b key can be programmed into circuitry before the message hashing begins. The timing of authentication completion may vary and may result in longer latency than using native SHA-256. Again, the hash information or secret key may be made available to the processor for convenience or processing efficiency, or may be kept private in some fashion to improve security.

[0036] The alert handler 208 is responsible for processing and responding to alerts, including alerts provided by other components 114. Alerts can be considered security-critical interrupts that must be processed in a timely manner to respond to a perceived security threat. Unlike “standard” interrupts, alerts are not handled solely by software running on the processor 106. An alert can trigger a first-stage request that is handled by software as a “normal” interrupt. However, if the software is unable to respond to and appropriately correct the alert-triggered interrupt, the alert handler 208 triggers a second-stage response. The second-stage response can include taking security measures, such as terminating processing, erasing or otherwise removing data, removing power from a circuit portion, or resetting an integrated circuit chip or part thereof. This ensures that the underlying issue (the perceived security threat) is addressed even if the processor 106 is busy, unresponsive, or under attack.

[0037] Thus, an alert can be implemented as an elevated interrupt-type signal or alert indication that the alert handler 208 receives from other circuit components and that indicates a potential security threat. In operation, the alert handler 208 can collect alerts from other circuit components 114 of the security circuit 112 and convert them into interrupts that the processor 106 can address. However, if the processor 106 does not clear the interrupt, the alert handler 208 provides a hardware response to address the potential security threat.

[0038] The security circuit 112 may also include a random number generator (RNG) 222. Generally, random numbers contribute to security functions by introducing variability during execution, preventing an attacker from predicting the appropriate timing to launch an attack. For example, random numbers can provide secret material used for identification or encryption. Seeding an RNG 222 into algorithmic calculations can obscure sensitive data values. In some embodiments, the RNG 222 can be utilized in the entropy generation process to reseed the PRNG. Generally, the RNG 222 provides better performance as its number generation becomes increasingly truly random, and can also be hardened against attacks. Some cryptographic processes may not require strong randomness guarantees. The RNG 222 may be implemented as a "true" random number generator (TRNG) or may involve a design with analog portions to exploit some non-deterministic physical event or process. Exemplary TRNG designs rely on metastability, electronic noise, timing fluctuations, thermal noise, quantum fluctuations, etc. The TRNG filters the resulting variable(s) and sends them to an entropy pool that the device can sample at a given time for the current randomization function. In some cases, the interface to the entropy pool includes a read request for available random bits. The TRNG interface indicates the number of bits available, and the requesting circuitry or software can read from this pool within the range of available bits. Attempting to read entropy bits that are not available may trigger an interrupt or alert.

[0039] Two other components 114 include a timer 224 and a flash controller (not shown), the latter of which is described in the next paragraph. The timer 224 can support accurate performance by the processor 106, for example. The timer 224 is comprised of multiple bits (e.g., 64 bits) and operates as a free-running timer with a guaranteed frequency within a certain percentage. The timer 224 may enable the circuit component 114 to determine an appropriate time interval for performing an operation. For example, the PRNG in the AES unit 116 can request reseeding according to the timer 224. Another timer (not explicitly shown) can function as a watchdog timer to assist the processor 106 if the processor becomes unresponsive. The unresponsiveness may be due to wedged development code, a security attack, or the like.

[0040] Although not shown, a flash controller can control the flash memory 206 available for code and data storage. The primary read path for this data can reside within a standard memory address space. However, because flash memory is not written in a standard manner, writes to that address space can be ignored. Instead, software interacts with the flash controller to write to the flash memory 206. Flash functionality can include three primary commands: read, erase, and program. Read commands can be standardized and use the address space of the chip memory. Erase commands are performed at the page level, with the page size parameterizable by the flash controller. Upon receiving an erase request, the flash controller erases the contents of the target page, forcing the data to a "1" state (e.g., 0xFFFFFFFF per word). Software can then program individual words to any value. Because flash bits never return to a "1" state unless erased again, future contents are effectively changed by ANDing the current contents with the written value. Erase and program commands are relatively slow. Typical erase times are measured in milliseconds, while program times are in the microsecond range. Security is also a concern as sensitive data may be stored in flash memory 206. Therefore, a flash controller may provide some degree of memory protection.

[0041] The security circuit 112 is illustrated in FIG. 2 with a specific set of circuit components. However, a given security circuit 112 may have more, fewer, or different circuit components. Also, the circuit components may be interconnected or operated differently from the exemplary manner described herein. Furthermore, some circuit components may be omitted, while others are implemented in multiple instances. For example, the alert handler 208 may be duplicated or distributed, or there may be multiple AES units 116 in a given security circuit. Furthermore, if the security circuit 112 is an integrated circuit chip that forms only one of several dozen cores, the GPIO interface 216 may be omitted from the components 114 of the security circuit 112.

[0042] In certain aspects, any of the circuit components 114 may include a cryptographic processor 230 that performs the cryptographic operations of the component. In some implementations, the cryptographic processor 230 is separate from the processor 106 of FIG. 1. In other implementations, the cryptographic processor 230 is implemented within the processor 106. Additionally, any of the circuit components 114 may include a cryptographic processor 230 (or processing core) for performing the particular function of that component.

[0043] 3 illustrates an exemplary AES unit 116 that can implement secure PRNG reseeding according to one or more aspects. The AES unit 116 can provide symmetric encryption and decryption using one or more protocols and various key sizes, such as 128b, 192b, or 256b. Components can select to encrypt or decrypt data arriving in 16-byte amounts, for example, that are encrypted or decrypted using different block cipher modes of operation.

[0044] In one aspect, the AES unit 116 includes a PRNG 120 that generates pseudorandom numbers to determine a mask. The mask is mixed with the input data using a Boolean mask to create masked data. The masked data may be multiplexed and stored in a state register 302. The input data may then undergo nonlinear operations within the masked subbytes 304. The masked subbytes 304 may include any number of permutation boxes or Galois Field (GF) multipliers. During the processing of the subbytes 304, bytes of the input data may be permuted and shifted, creating a cryptographically secure method of weakening the correlation between the input and output bits. In one aspect, the data may be re-masked with the subbytes 304.

[0045] The masked data may then pass through a row shift 306 stage, where rows of the masked data are shifted during the forward process. In the row shift 306 stage, rows of the masked data (e.g., state array) are circularly shifted and the byte order of the input data may be scrambled. The masked data may then pass through a column mix 308-1 stage, where each byte in a column is replaced with a function of all bytes in the same column.

[0046] The AES unit 116 can provide symmetric encryption and decryption using keys, so that full-key data can be encrypted using either an initial key or a decryption key 310. During encryption or decryption, each key may be masked and manipulated by multiple substitution boxes and GF multipliers in the masked key expansion 312 stage. Each key may be manipulated and mixed with the masked data in the column mixing 308-2 stage to enable encryption or decryption. The output is fed back to the status register 302, and the process may be performed iteratively until all stages of the encryption or decryption process are complete. In certain aspects, the AES unit 116 can include a secure PRNG reseeding module 314, which can manage or coordinate the operation of the components of the AES unit 116, the entropy complex, the encryption module, and / or other entities described herein to implement aspects of secure PRNG reseeding. Alternatively or additionally, the secure PRNG reseeding module 314 may be implemented (e.g., as hardware and / or software) in conjunction with or as part of other described components, such as entropy circuitry or encryption modules.

[0047] Exemplary Entropy Generation for Secure PRNG Reseding FIG. 4 illustrates, at 400, an example of entropy generation according to one or more aspects of secure PRNG reseeding. The illustrated entropy generation may be implemented within security circuitry 112 to provide entropy to one or more PRNGs 410 (e.g., PRNG 120 of FIG. 1 ) of encryption module 402 (e.g., encryption module 118 of FIG. 1 ). As illustrated, encryption module 402 is PRNG-reliant, with entropy provided via PRNGs 410-1 through 410-N to perform cryptographic operations for encryption modules 402-1 through 402-N, respectively. In certain aspects, the entropy generation circuitry may include or be associated with a secure PRNG reseeding module 314, which may interact with various components and modules described herein to implement one or more aspects of secure PRNG reseeding.

[0048] In certain aspects, the PRNG 410 provides pseudo-randomness because the randomness is not generated with cryptographic guarantees that values ​​are uniformly distributed and untraceable. For purposes of masking and remasking, these guarantees may not be required, and thus the PRNG 410 can be used to efficiently provide randomness for these cryptographic operations. However, masking and remasking operations may require high-bandwidth entropy generation capable of supporting the masking operation on every clock cycle. As such, the entropy generation circuitry may need to support multiple bits of entropy generation per clock cycle (e.g., hundreds of bits of randomness per clock cycle).

[0049] Entropy generation circuits may be limited by circuit area constraints, as multiple entropy generation circuits may be used on a single integrated circuit. It may be important to simplify the design of entropy generation circuits to smaller circuit areas by relaxing constraints ensuring backward secrecy and uniformity, which may not be required for masking and remasking operations. In this way, circuit area may be reduced, thereby reducing circuit costs.

[0050] Any number of PRNG implementations may be used to meet these requirements. In one example, a PRNG utilizing a linear feedback shift register may be defined. For example, a value may be input from a feedback source (e.g., mouse movement, radiation, or any other available feedback) and mixed with the current value via logic gates to generate pseudorandomness. In another example, a multiplier may be used to multiply random data by a value to generate pseudorandomness. It should be understood that any number of PRNG implementations may be applied without going beyond the scope of this document.

[0051] In general, the PRNG 410 may be reseeded at various times to provide an initial value and generate randomness from the updated seed. By periodically reseeding the initial value, the operation of generating pseudorandomness may yield better statistical behavior over a period of time. Without reseeding the PRNG 410, the randomness generated by the PRNG 410 may become deterministic, and therefore an entropy generation framework may be required to provide fresh randomness for reseeding the PRNG 410.

[0052] In one embodiment, the PRNG 410 provides pseudorandomness to the encryption module 402 using a current seed provided to the PRNG 410. At any time, the encryption module 402 can determine that reseeding is necessary and request entropy from the entropy distribution network 404. The encryption module 402 or the PRNG 410 can determine that entropy is needed for reseeding and can assert a request 412 (e.g., request 412-1 or request 412-N) in any number of suitable ways. For example, the encryption module 402 can maintain a counter that allows the encryption module 402 to request 412 reseeding if the PRNG 410 has been operating using the current seed for a particular number of clock cycles. In other embodiments, the encryption module 402 can determine the quality of entropy being consumed by the encryption module 402 and can request 412 reseeding if the quality falls below a desired quality.

[0053] The entropy distribution network 404 may interface to multiple encryption modules 402. When any of the PRNGs 410 requests entropy 412 from the entropy distribution network 404, the entropy distribution network 404 may determine whether entropy 414 is available to provide to the PRNG 410. If entropy is available, the entropy distribution network 404 may provide entropy 414 (e.g., entropy 404-1 or entropy 404-N) to one or more PRNGs 410 requesting reseeding 412. In some embodiments, entropy 414 may be provided to each of the PRNGs 410. However, if entropy 414 is not available, the entropy distribution network 404 may request 416 entropy 418 from the cryptographically secure random number generator 406.

[0054] The cryptographically secure random number generator 406 may include an AES engine that allows the entropy 422 provided by the entropy source 408 to be scaled in a cryptographically secure manner. When a request 416 for entropy 418 is made from the entropy distribution network 404 to the cryptographically secure random number generator 406, the cryptographically secure random number generator 406 may determine that the entropy 418 is available and provide the entropy 418 to the distribution network 404. If it is determined that the entropy 418 is not available at the cryptographically secure random number generator 406, a request 420 may be made to the entropy source 408.

[0055] The entropy source 408 may generate high-quality entropy 422 with low bandwidth. As a non-limiting example, the entropy source 408 may generate on the order of 2 bits of entropy 422 per clock cycle, 2 bits of entropy 422 per 10 clock cycles, or 2 bits of entropy 422 per 100 clock cycles. In one embodiment, the entropy source 408 generates entropy 422 by measuring and combining different measurement sources (e.g., spatial radiation or the movement of a mouse (e.g., by a human operator) within a time frame). The measurement sources may be independent and may provide measurements of respective phenomena that are statistically uncorrelated with each other. The entropy source 408 may then generate entropy 422 by forming values ​​and passing them through circuitry that performs quality checks (e.g., uniformity and reverse secrecy). Once entropy 422 is generated, it may be provided by the entropy source 408 to the cryptographically secure random number generator 406.

[0056] In the cryptographically secure random number generator 406, the entropy 422 may be further whitened and the bandwidth may be increased to generate more bits of entropy 418 per clock cycle. For example, 2 bits of entropy 422 may be generated by the entropy source 408 every 100 clock cycles, and the cryptographically secure random number generator 406 may generate 2 bits of entropy 418 per clock cycle or every 10 clock cycles. The entropy 418 generated by the cryptographically secure random number generator 406 may then be provided to the entropy distribution network 404, which provides the entropy 414 to the PRNG 410 as a seed, enabling the PRNG 410 to provide high-bandwidth entropy usable for masking and remasking operations in the encryption module 402.

[0057] Note that the entropy generation process can be a relatively long and expensive operation. For example, it may take more than 100 clock cycles for entropy to reach the PRNG 410 from the entropy source 408. Furthermore, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 may each create a strong power signature during operation. The entropy distribution network 404 may provide entropy to different circuit components across a large portion of the integrated circuit. Thus, the entropy distribution network 404 may include powerful drivers and transistors that generate a large power signature. Similarly, the cryptographically secure random number generator 406 may utilize AES encryption within a module that requires multiple transistors to perform its operation. The entropy source 408 may also include a cryptographic module that creates a large power signature during operation. In this manner, it may be possible to determine the isolated operation of these modules by observing the power signature of the integrated circuit.

[0058] In typical operation of the encryption module 402, the encryption operations may terminate when a request 412 to reseed the PRNG 410 is made. However, the termination operation of the encryption module 402 may isolate a critical power signature of the IC that may characterize the secret key and other cryptographic information. In some implementations, the power signature of the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may indicate that an old cycle of the encryption process has ended and a new cycle of encryption operations has begun. In this way, an attacker may be able to observe a change in the power signature as a result of a number of transistors in the encryption module switching to an inactive state.

[0059] With regard to enhanced security, visual observation of the activation and deactivation of the encryption module 402 may provide an attacker with security-sensitive information that enables better-tailored attacks. Specifically, the encryption module 402 may maintain cryptographically secure keys used to perform specific encryption operations. By knowing when the encryption keys are used in an operation, an attacker may be able to observe characteristics associated with the operation of the integrated circuit to extract the encryption keys or bypass security measures. If the cyclical operation of the encryption module 402 is known by an attacker, attacks may be directed to extracting encryption keys or bypassing security measures with each operating cycle of the encryption module 402. Thus, typical entropy generation processes may exacerbate cryptographic attacks against integrated circuits.

[0060] To reduce the ability to determine details about the operation of the integrated circuit, the encryption module 402 and other modules (e.g., the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404) may be controlled during entropy generation. Various examples of controlling the encryption module 402, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 are described with respect to Figures 5-1 through 5-3.

[0061] 5-1 illustrates an example timing diagram 502 for secure PRNG reseeding in accordance with one or more aspects. In the timing diagram 502, a periodic clock 504 is shown. A cryptographic module request 506, which may be an example of a request 412, is asserted to indicate that a PRNG associated with the cryptographic module 402 has requested reseeding. The timing diagram 502 illustrates the operation of the cryptographic module 402, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404.

[0062] Initially, the encryption module 402 is shown as operating before the encryption module request 506 is asserted. If the encryption module request 506 is asserted and it is determined that entropy generation is necessary, the encryption module 402 can continue to operate during entropy generation. The encryption module 402 may be signaled to perform operations during entropy generation in any number of ways. In some embodiments, the encryption module request 506 can signal the start or end of entropy generation. For example, entropy generation can begin when the encryption module request is asserted, and entropy generation can end when the encryption module request 506 is deasserted. In an aspect, the encryption module can activate a timer that tracks the number of clock cycles since the encryption module request 506 is asserted. Operation of the cryptographic module to generate a power signature that does not indicate deactivation of the cryptographic module may continue until a predetermined time value is reached or until cryptographic module request 506 is deasserted, indicating that the PRNG has been reseeded. Thus, the cryptographic module may not operate indefinitely or after the quality of the randomness provided by the PRNG has deteriorated beyond an acceptable level.

[0063] In other embodiments, signaling may be received by the encryption module 402 to indicate that entropy generation is occurring. For example, the encryption module 402 may receive signaling indicating the generation of entropy from any of the modules utilized during the entropy generation process. The encryption module 402 may continue to operate to generate power signatures that do not indicate deactivation of the encryption module 402 as long as the signal is received.

[0064] In one aspect, the encryption module 402 can continue to perform encryption operations (e.g., masking and remasking) using entropy generated based on the current seed value provided to the PRNG. Continuing to perform these encryption operations may be possible because the entropy for masking and remasking operations may not need to adhere to the same guarantees (e.g., uniformity and reverse secrecy) as other encryption operations. In this manner, the encryption module 402 can continue to perform operations while entropy is being generated.

[0065] Specifically, the encryption module 402 may continue to operate during entropy generation by the entropy source 408, entropy processing by the cryptographically secure random number generator 406 to generate additional entropy bits, and / or entropy distribution for the entropy bits by the entropy distribution network 404. Entropy generation is described in more detail with respect to FIG. 3. In certain aspects, operation of the encryption module 402 during entropy generation may limit an attacker's ability to determine the operation of the encryption module 402 from a power signature or any other channel. For example, maintaining operation of the encryption module 402 may increase the noise floor of the power signature, thereby making it more difficult to distinguish individual differences in the power signature that may provide information about the operation of the integrated circuit. By operating the encryption module 402 in a manner that generates a power signature that does not indicate deactivation of the encryption module 402, the power signature or other channel signature of the integrated circuit may not include significant changes that indicate the beginning and end of the encryption module 402. Additionally, the encryption module 402 can operate more efficiently without having to terminate operation during entropy generation.

[0066] In other embodiments, the encryption module 402 may operate without performing cryptographic operations during entropy generation. For example, the encryption module request 506 may be asserted to indicate that entropy is required to reseed the PRNG. The encryption module 402 may begin performing operations that do not include cryptographic operations and generate a power signature that does not indicate deactivation of the encryption module 402. In doing so, the power signature of the integrated circuit may not indicate the start or end of the encryption module 402. Furthermore, by continuing operation of the encryption module 402 without performing cryptographic operations, it may be ensured that masking and remasking operations are never performed with entropy below a certain quality, providing enhanced security.

[0067] In either implementation, the encryption module 402 may operate to generate a power signature that does not indicate deactivation of the encryption module 402. Once entropy has been distributed by the entropy distribution network 404, the encryption module request 506 may be deasserted, the PRNG may be reseeded using fresh entropy, and the encryption module 402 may continue encryption operations using the new seed provided by the fresh entropy.

[0068] It should also be noted that the entropy generation process may not include all of the steps shown. For example, the encryption module request 506 may be asserted and entropy may be determined to be available on the entropy distribution network 404. In this case, the entropy may be distributed by the entropy distribution network 404 and the request may not be sent to the cryptographically secure random number generator 406. Thus, the encryption module 402 may operate during any entropy generation process.

[0069] In some implementations, the encryption module 402 may be configured to consume an amount of entropy that is less than the requested amount of entropy. For example, the encryption module 402 may request 8 bits of entropy from the entropy distribution network 404. The entropy distribution network 404 may determine that only a 4-bit entry is available for consumption and provide the 4 bits of entropy to the encryption module 402 for reseeding the PRNG. The encryption module 402 may use the lesser amount of entropy provided to the PRNG to perform encryption operations based on the entropy provided by the PRNG. In this manner, the encryption module 402 may be able to continue operating and perform encryption operations using any amount of fresh entropy available.

[0070] In addition to providing entropy to the PRNG for reseeding, the entropy distribution network 404 can request more entropy from the cryptographically secure random number generator 406. If entropy is available, it can be provided to the encryption module 402. If entropy is not available, the cryptographically secure random number generator can request entropy from the entropy source 408. In this way, the encryption module 402 can be provided with all available entropy and entropy generation can begin to produce entropy for later use.

[0071] FIG. 5-2 illustrates an exemplary timing diagram 508 of secure PRNG reseeding according to one or more embodiments. Similar to FIG. 5-1, the timing diagram 508 illustrates a periodic clock 504, a cryptographic module request 506 being asserted to indicate that a PRNG associated with the cryptographic module 402 has requested reseeding, and the cryptographic module 402 operating during entropy generation. As described with respect to FIG. 4, the entropy generation process includes the entropy source 408 generating entropy 422, the cryptographically secure random number generator 406 processing the generated entropy to generate additional bits of entropy 418, and the entropy distribution network 404 distributing 410 the additional bits of entropy 414 to the PRNG. However, in the timing diagram 508, additional control of the entropy generation process is used to disguise the operation of the integrated circuit within the power signature.

[0072] Unlike FIG. 5-1, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 do not operate within their respective time intervals. Instead, the entropy source 408 overlaps with the operation of the cryptographically secure random number generator 406 at overlap 510-1, which overlaps with the operation of the entropy distribution network 404 at overlap 510-2. In some aspects, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 can perform operations before input is provided to the module or after entropy is output from the module. For example, any of the modules can perform an operation with an insignificant value that produces a power signature similar to the module's normal operation. At the end of the operation, the value can be discarded without consequence.

[0073] Any of the modules in the entropy generation process may operate during the same time interval. For example, two or more of generating bits of entropy, processing entropy, or distributing bits of entropy may occur at least partially during the same time interval. By overlapping the power signatures of the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404, the overall power signature of the integrated circuit may be spoofed to hide transitions in the entropy generation process. In doing so, an attacker may not be able to determine useful information about the execution of the integrated circuit, thereby limiting their ability to fortify future attacks based on circuit operation.

[0074] Also shown in exemplary timing diagram 508, the encryption module 402 terminates operation in response to operating for a predetermined number of clock 504 cycles during the entropy generation process (i.e., before the entropy distribution network 404 completes sending entropy to the encryption module 402). For example, the encryption module 402 may operate for a predetermined period of time 512. As shown, the encryption module 402 terminates operation before the entropy generation process ends and the encryption module request 506 is deasserted. In this exemplary implementation, the encryption module 402 may utilize a timer to track clock cycles to ensure that the encryption module does not continue to operate indefinitely if an error occurs during the entropy generation process.

[0075] FIG. 5-3 illustrates an exemplary timing diagram for secure PRNG reseeding according to one or more aspects. Similar to FIGS. 5-1 and 5-2, timing diagram 514 illustrates a periodic clock 504. A cryptographic module request 506 is asserted to indicate that a PRNG associated with cryptographic module 402 has requested reseeding, and cryptographic module 402 operates during entropy generation to overlap at least a portion of the power consumption associated with generating entropy for reseeding PRNG-dependent cryptographic module 402. The illustrated entropy generation process includes entropy source 408 generating entropy, cryptographically secure random number generator 406 processing the generated entropy to generate additional bits of entropy, and entropy distribution network 404 distributing the additional bits of entropy.

[0076] As in FIG. 5-2, further control of the entropy generation process is used to disguise the operation of the integrated circuit in the power signature. However, in timing diagram 514, the entropy source 408, the cryptographically secure random number generator 406, and the entropy distribution network 404 operate randomly or pseudo-randomly in addition to their normal operations during entropy generation. For example, any of the modules used to generate entropy can perform operation 516 (e.g., operation 516-1, operation 516-2, or operation 516-3), which do not contribute to entropy generation but are similar to those performed by the modules during entropy generation. In this way, any of the modules can operate at the same time interval to generate an overall power signature that disguises the operation of the integrated circuit by overlapping power signatures from modules used in entropy generation.

[0077] The entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may operate randomly or pseudo-randomly during the entropy generation process to increase the noise floor of the integrated circuit and limit noticeable differences in the operation of the integrated circuit based on the power signature. In some implementations, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may operate randomly outside of the entropy generation process, for example, when the cryptographic module request 506 is deasserted, to further disguise the operation of the integrated circuit based on the power signature.

[0078] As in Figure 5-2, the entropy source 408, the cryptographically secure random number generator 406, or the entropy distribution network 404 may, at different times, perform normal entropy generation operations and perform operations non-logically (i.e., actions that do not contribute to entropy generation or distribution). For example, one or more of the modules may perform entropy generation that can be used to reseed the PRNG when required, while others of the modules perform negligible "random" operations, e.g., operations on placeholder values, the results of which are discarded.

[0079] In any of the described implementations, operating the encryption module 402 during entropy generation can inhibit the ability to determine meaningful differences in the operation of the integrated circuit based on the power signature.

[0080] Exemplary Methods Methods 600 and 700 are illustrated as a set of blocks specifying operations that may be performed, but are not necessarily limited to the order or combination shown for performing the operations by the respective blocks. Furthermore, any one or more operations may be repeated, combined, rearranged, or linked to provide a variety of additional and / or alternative methods. These techniques are not limited to being performed by one entity or multiple entities operating on a single device. In some aspects, operations or acts of method 600 are performed by or managed by the secure PRNG reseeding module 314, the entropy complex, and / or the encryption module. For clarity, the methods are described with reference to the elements of FIG. 1 and / or the entities, components, or configurations described with reference to FIGS. 1-5.

[0081] FIG. 6 illustrates an example method 600 for secure PRNG reseeding according to one or more aspects. At 602, a request for entropy to reseed the PRNG-dependent encryption module 118 is received by an entropy generation circuit. In an aspect, the request for entropy to reseed the PRNG-dependent encryption module 118 is asserted by the PRNG 120 or the PRNG-dependent encryption module 118. In some implementations, the request for entropy for reseeding is in response to determining that the current entropy consumed by the encryption module 118 is below a desired quality (defined according to a quality criterion, such as a measure of the predictability of the current entropy). Thus, the encryption module 118 can ensure that the encryption process utilizes pseudorandomness that meets certain quality guarantees. In an aspect, entropy is requested to reseed the PRNG-dependent encryption module 118 in response to the expiration of a timer. In this manner, it can be ensured that the PRNG 120 of the encryption module 118 is reseeded at certain time intervals.

[0082] At 604, entropy for reseeding the PRNG-dependent encryption module 118 is generated in a random number generator based on an entropy source. In one aspect, entropy generation may be performed in three operations: entropy generation, entropy processing, and entropy distribution. High-quality entropy may be generated by an entropy source and processed by a cryptographically secure random number generator by performing quality checks and increasing the bandwidth of the entropy generation. The cryptographically secure random number generator may create a larger number of bits of entropy than generated by the entropy source, and more bits of entropy may be provided to an entropy distribution network. The entropy distribution network may distribute the larger number of bits of entropy to one or more encryption modules 118 for reseeding the PRNG 120.

[0083] In some implementations, entropy generation, entropy processing, or entropy distribution may occur at separate times during entropy generation, entropy processing, or entropy distribution. In this manner, the power signature of the integrated circuit may not be indicative of individual processes within entropy generation, and the overall noise floor of the power signature may be increased. In certain aspects, entropy generation may be implemented by further hiding the processes occurring within entropy generation by randomly operating an entropy source, a cryptographically secure random number generator, or an entropy distribution network (i.e., having those modules perform operations that contribute to entropy generation or distribution).

[0084] At 606, the PRNG-dependent encryption module 118 is operated during entropy generation to overlap at least a portion of the respective power consumption operating the PRNG-dependent encryption module with the power consumption generating entropy for reseeding the PRNG-dependent encryption module 118. For example, the PRNG-dependent encryption module 118 can generate a power signature that masks the power signature generated by the entropy generation process to obscure the operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the random number generator or other entropy component masks the power signature of the PRNG-dependent encryption module 118 to obscure the operation of the PRNG-dependent encryption module 118. In one aspect, the PRNG-dependent encryption module 118 uses pseudorandomness provided by the PRNG 120 to perform masking and remasking operations. The masking and remasking operations may not require quality assurance that may be required for other encryption operations. Thus, PRNG-dependent encryption module 118 can continue to perform masking and remasking operations using the current seed value, even when a new seed is required. For example, PRNG-dependent encryption module 118 can continue to perform operations during entropy generation using the pseudorandomness provided by PRNG 120 based on the current seed. In this way, an attacker may not be able to determine important characteristics about the operation of the integrated circuit based on the deactivation of the encryption module during entropy generation.

[0085] In some implementations, it may be desirable to ensure that cryptographic operations are not performed using entropy of less than a desired quality. Thus, PRNG-dependent encryption module 118 may continue to perform operations to generate a power signature that overlaps at least a portion of the power consumption associated with generating entropy for PRNG-dependent encryption module 118 without performing cryptographic operations by PRNG-dependent encryption module 118. For example, encryption module 118 may continue to perform operations on data of similar size and complexity to the data used in the cryptographic operations, but the data may be discarded after the operations are completed. In this way, encryption module 118 may continue to generate power signatures that do not indicate deactivation of PRNG-dependent encryption module 118 without adversely affecting security enhancements that may result from using low-quality entropy in the encryption process.

[0086] The operations of the PRNG-dependent encryption module 118 may occur in coordination with any number of signaling mechanisms. For example, the encryption module 118 may receive signaling indicating entropy generation during the entropy generation process, and the encryption module 118 may perform operations until the signaling indicating entropy generation is no longer received. In other embodiments, the encryption module 118 may maintain a timer that begins operations in response to sending a request for entropy to reseed the PRNG-dependent encryption module 118. In this embodiment, the encryption module 118 may perform operations that generate a power signature that does not indicate deactivation of the PRNG-dependent encryption module 118 until entropy for reseeding is received by the PRNG-dependent encryption module 118 or until the timer reaches a predetermined value.

[0087] At 608, the entropy generated by the cryptographically secure random number generator is provided to the PRNG-dependent encryption module 118 to reseed the PRNG-dependent encryption module 118 for subsequent encryption operations. In an aspect, the entropy may be distributed to multiple PRNGs 120 in multiple PRNG-dependent encryption modules 118 by an entropy distribution network.

[0088] 7 illustrates an exemplary method for continuing to operate encryption module 118 while entropy is generated for reseeding encryption module 118. At 702, PRNG-dependent encryption module 118 is operated to enable encryption operations based on previously received seed entropy. In an aspect, PRNG-dependent encryption module 118 can utilize entropy generated by PRNG 120 based on previously received seed entropy.

[0089] At 704, entropy may be requested for reseeding the PRNG-dependent encryption module 118. In some embodiments, requesting entropy for reseeding is in response to determining that the current entropy consumed by the encryption module 118 is below a desired quality. In other embodiments, entropy is requested for reseeding the PRNG-dependent encryption module 118 in response to the expiration of a timer. One or more PRNGs 120 or encryption modules 118 may request entropy simultaneously or at different times. In one aspect, the request for entropy is received by an entropy distribution network, which determines whether entropy is available for distribution. If entropy is not available (or more generally, if the amount of available entropy is below a threshold, such as an amount of entropy sufficient to satisfy the entropy request), an entropy generation process may be initiated.

[0090] At 706, the entropy source is operated to generate entropy for reseeding the PRNG-dependent cryptographic module 118. The entropy source 408 may generate low-bandwidth, high-quality entropy 422. In one embodiment, the entropy source 408 generates entropy 422 by measuring and combining different measurement sources (e.g., spatial radiation or mouse movement within a time frame). The entropy source 408 may then form a value and pass the value through circuitry that performs quality checks (e.g., uniformity and reverse secrecy). Once the entropy 422 is generated, it may be provided by the entropy source 408 to the cryptographically secure random number generator 406.

[0091] At 708, PRNG-dependent encryption module 118 may continue to operate based on the previously received seed entropy during the entropy generation process beginning at 706. In contrast to typical encryption modules, encryption module 118 may continue to operate in a manner that overlaps at least a portion of the power consumption associated with generating entropy for reseeding PRNG-dependent encryption module 118. In some implementations, generating entropy with a random number generator generates a first power signature indicative of generating entropy, and operating PRNG-dependent encryption module 118 while generating entropy generates a second power signature that at least partially overlaps the first power signature to obscure the operation of PRNG-dependent encryption module 118 or the operation of the random number generator to generate entropy.

[0092] In one aspect, operating the PRNG-dependent encryption module 118 without performing an encryption operation with the PRNG-dependent encryption module generates a power signature that does not indicate deactivation of the PRNG-dependent encryption module 118. Alternatively, operating the PRNG-dependent encryption module 118 to perform an encryption operation with the PRNG-dependent encryption module 118 using the current seed generates a power signature that does not indicate deactivation of the PRNG-dependent encryption module 118.

[0093] Optionally, at 710, the encryption module 118 may be reseeded using the partially generated entropy. In certain aspects, the encryption module 118 may be configured to consume an amount of entropy that is less than the amount of entropy requested. For example, the encryption module 118 may receive less entropy than requested because the requested amount of entropy is not available in the random number generator. The encryption module 118 may use the lesser amount of entropy provided to the PRNG 120 to perform encryption operations based on the entropy provided by the PRNG 120. In this manner, the encryption module 402 may be able to continue operation and perform encryption operations using any amount of fresh entropy available.

[0094] At 712, the entropy process may continue, where entropy from the entropy source may be processed with a cryptographically secure random number generator to generate more bits of entropy. The cryptographically secure random number generator may include an AES engine that allows the entropy provided by the entropy source to be scaled in a cryptographically secure manner. Once entropy is generated by the cryptographically secure random number generator, it may be provided to an entropy distribution network that distributes entropy to the PRNG 120 or PRNG-dependent encryption module 118.

[0095] At 714, more bits of entropy from the cryptographically secure random number generator may be distributed to the encryption module 118 or PRNG via an entropy distribution network. The entropy distribution network may span large portions of the integrated circuit, providing entropy to different circuit components. Thus, the entropy distribution network may include powerful drivers and transistors that generate large power signatures. The entropy distribution network may provide entropy to one or more PRNGs 120 or encryption modules 118 that require reseeding.

[0096] At 716, the encryption module 118 (e.g., the PRNG 120) is reseeded using the entropy received from the entropy distribution network. For example, the PRNG 120 may utilize the entropy provided from the entropy distribution network as a seed to generate pseudorandomness for the PRNG-dependent encryption module 118.

[0097] At 718, the encryption module 118 may operate to enable encryption operations that utilize pseudorandomness based on the reseeded entropy. For example, the encryption module 118 may operate to perform masking and remasking operations based on the pseudorandomness provided by the PRNG 120.

[0098] In certain aspects, reseeding of a secure PRNG described herein can create power signatures or other channel signatures that disguise the operation of an integrated circuit. In this manner, a malicious attacker may be unable to determine when an integrated circuit processes sensitive information, and thus be able to ensure the intended operation of the integrated circuit. Thus, the techniques, apparatus, and systems disclosed herein may provide a cryptographically secure method for reseeding a PRNG.

[0099] Exemplary System FIG. 8 illustrates various components of an exemplary electronic device 800 capable of implementing secure PRNG reseeding in accordance with one or more aspects. The electronic device 800 may be implemented as any one or more of a fixed, mobile, standalone, or embedded device. It may also be implemented in the form of any consumer, computer, portable, user, server, communication, telephone, navigation, gaming, audio, camera, messaging, media playback, and / or other type of electronic device 800, such as a smartphone, shown in FIG. 1 as device 102. One or more of the illustrated components may be implemented as separate components or as integrated components on at least one integrated circuit of the electronic device 800. Generally, the various components of the electronic device 800 are coupled via an interconnect 122 and / or one or more fabrics that support communication between the components in accordance with one or more aspects of secure PRNG reseeding.

[0100] The electronic device 800 may include one or more communications transceivers 126 that enable wired and / or wireless communication of device data 110, such as, for example, received data, transmitted data, or other information identified herein. Examples of communications transceivers 126 include near field communication (NFC) transceivers, wireless personal area network (PAN) (WPAN) radios conforming to various IEEE 802.15 (Bluetooth®) standards, wireless local area network (LAN) (WLAN) radios conforming to any of the various IEEE 802.11 (WiFi®) standards, wireless wide area network (WAN) (WWAN) radios for cellular phones (e.g., those conforming to the 3rd Generation Partnership Project (3GPP®)), wireless metropolitan area network (MAN) (WMAN) radios conforming to various IEEE 802.16 (WiMAX™) standards, infrared (IR) transceivers conforming to the Infrared Data Association (IrDA) protocol, and wired local area network (LAN) (WLAN) Ethernet transceivers.

[0101] The electronic device 800 may also include one or more data input ports 128, through which any type of data, media content, and / or other input may be received. Examples include user-selectable input, messages, applications, music, television content, recorded video content, and any other type of audio, video, and / or image data received from any content and / or data source, including sensors such as microphones or cameras. The data input ports 128 may include USB ports, coaxial cable ports, fiber optic ports for fiber optic interconnects or cables, and other serial or parallel connectors (including internal connectors) for flash memory, DVDs, CDs, etc. These data input ports 128 may be used to couple the electronic device to components, peripherals, or accessories such as keyboards, microphones, cameras, or other sensors.

[0102] The electronic device 800 of this example includes at least one processor 106 (e.g., one or more of an application processor, a microprocessor, a digital signal processor (DSP), a controller, etc.), which may include a combined processor and memory system (e.g., implemented as part of an SoC) that processes (e.g., executes) computer-executable instructions to control the operation of the device. The processor 106 may be implemented as an application processor, an embedded controller, a microcontroller, a security processor, an artificial intelligence (AI) accelerator, etc. In general, the processor or processing system may be implemented at least partially in hardware and may include components of integrated circuits or on-chip systems, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations in silicon and / or other materials.

[0103] Alternatively or additionally, electronic device 800 may be implemented with any one or combination of electronic circuitry, which may include software, hardware, firmware, or fixed logic circuitry implemented in conjunction with processing and control circuitry, generally designated 802 (as electronic circuitry 802). This electronic circuitry 802 may implement executable or hardware-based modules (not shown in FIG. 8), such as by processing / computer-executable instructions stored on a computer-readable medium, logic circuitry, and / or hardware (e.g., FPGA, etc.).

[0104] In some aspects, electronic device 800 includes an interconnect 122, which may include any one or more of a system bus, interconnect, crossbar, data transfer system, or other switch fabric that couples various components within the device and enables various aspects of sparsely encoded signaling and / or communication. The system bus or interconnect may include any one or combination of various bus structures, examples of which include a memory bus or memory controller, a peripheral bus, a parity block, an error correction code (ECC) block, a universal serial bus, and / or a processor bus or local bus utilizing any of a variety of bus architectures.

[0105] The electronic device 800 also includes one or more memory devices 804 that allow for data storage, examples of which include random access memory (RAM), non-volatile memory (e.g., read-only memory (ROM), flash memory, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)), and disk storage devices. Thus, the memory device(s) 804 may be distributed throughout various logical storage levels of the system and among various physical components. The memory device(s) 804 provide a data storage mechanism for storing device data 110, other types of code and / or data, and various device applications 806 (e.g., software applications or programs). For example, an operating system 808 may be maintained as software instructions in the memory device 804 and executed by the processor 106.

[0106] In some implementations, electronic device 800 also includes an audio and / or video processing system 810 that processes audio data and / or passes audio and video data to audio system 812 and / or display system 814 (e.g., a video buffer or a smartphone or camera screen). Audio system 812 and / or display system 814 may include any device that processes, displays, and / or otherwise renders audio, video, display, and / or image data. Display data and audio signals can be communicated to the audio and / or display components via other similar communication links, such as an RF (radio frequency) link, an S-video link, an HDMI (high-definition multimedia interface), a composite video link, a component video link, a DVI (digital video interface), an analog audio connection, a video bus, or a media data port 816. In some implementations, audio system 812 and / or display system 814 are external or separate components of electronic device 800. Alternatively, for example, the display system 814 may be an integrated component of the exemplary electronic device 800, such as part of an integrated touch interface.

[0107] The electronic device 800 of Figure 8 is an exemplary implementation of the apparatus 102 of Figure 1, i.e., an exemplary implementation of a device capable of implementing secure PRNG reseeding as described with reference to Figures 1-7. Accordingly, the electronic device 800 may include a security circuit 112, which may be a separate IC chip or may be included as part of another IC chip or device, such as the processor 106, the electronic circuit 802, or the memory device 804. Accordingly, one or more of the illustrated components may be integrated on the same IC chip, such as an SoC, or at least on a single printed circuit board (PCB).

[0108] The security circuit 112 may include an AES unit 116 that performs cryptographically secure operations using encryption or decryption. The AES unit 116 may include any number of encryption modules configured to perform cryptographically secure operations using randomness or pseudorandomness provided by a RNG or PRNG. For example, the encryption modules may perform masking and remasking operations to distance the channel signature of the electronic device 800 from generated / processed values. The security circuit 112 may include an entropy generation circuit responsible for reseeding the PRNG of the encryption module. The entropy generation circuit may include a high-quality entropy source, a cryptographically secure random number generator, and an entropy distribution network. Thus, the principles of secure PRNG reseeding described herein may be implemented by or in conjunction with the electronic device 800 of FIG. 8.

[0109] Unless the context dictates otherwise, use of the word "or" herein may be considered an "inclusive or" or use of a term permitting the inclusion or application of one or more items linked by the word "or" (e.g., the phrase "A or B" may be interpreted as permitting only "A," permitting only "B," or permitting both "A" and "B"). Also, as used herein, a phrase referring to "at least one" of a list of items refers to any combination of those items, including single members. For example, "at least one of a, b, c" can cover not only a, b, c, ab, ac, bc, abc, but also any combination containing multiples of the same element (e.g., aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, ccc, or any other order of a, b, c). Additionally, items indicated in the accompanying drawings and terms described herein may indicate one or more items or terms, and thus, the singular or plural of the items and terms in this description may be referred to interchangeably. Although implementations of the secure cryptographic processor are described in language specific to particular functions and / or methods, the subject matter of the appended claims is not necessarily limited to the particular functions or methods described. Rather, the particular functions and methods are disclosed as exemplary implementations of secure cryptographic operations.

[0110] Further Examples An example of secure PRNG reseeding is provided below.

[0111] Example 1: A method comprising: receiving a request for entropy for reseeding a pseudorandom number generator (PRNG)-dependent cryptographic module from the pseudorandom number generator (PRNG)-dependent cryptographic module, the PRNG-dependent cryptographic module including a PRNG configured to generate random numbers using a seed based on received entropy; generating, by the random number generator, the entropy for reseeding the PRNG-dependent cryptographic module based on an entropy source; and operating the PRNG-dependent cryptographic module while generating the entropy for reseeding the PRNG-dependent cryptographic module such that at least a portion of power consumption associated with operation of the PRNG-dependent cryptographic module overlaps with power consumption associated with the generation of the entropy for reseeding the PRNG-dependent cryptographic module.

[0112] Example 2: A method according to any of the preceding examples, wherein generating the entropy with the random number generator generates a first power signature indicating the generation of the entropy, and operating the PRNG-dependent cryptographic module while generating the entropy generates a second power signature that at least partially overlaps the first power signature, thereby obscuring the operation of the PRNG-dependent cryptographic module or the operation of the random number generator to generate the entropy.

[0113] Example 3: A method according to any of the preceding examples, wherein operating the PRNG-dependent cryptographic module while generating the entropy generates a power signature that does not indicate deactivation of the PRNG-dependent cryptographic module without performing a cryptographic operation by the PRNG-dependent cryptographic module.

[0114] Example 4: The method of any preceding example, wherein generating the entropy for reseeding the PRNG-dependent cryptographic module includes: generating, by an entropy source, one or more bits of entropy; processing, by a cryptographically secure random number generator in response to generating the one or more bits of entropy, the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy; and distributing, by an entropy distribution network, the number of bits of entropy to the pseudo-random number generator.

[0115] Example 5: A method as described in any preceding example, wherein two or more of generating the one or more bits of entropy, processing the one or more bits of entropy, or distributing the greater number of entropies occurs, at least in part, simultaneously.

[0116] Example 6: The method of any preceding example, wherein the method further includes, during generation of the entropy for reseeding the PRNG-dependent cryptographic module, performing an operation of generating, using at least one of the entropy source, the cryptographically secure random number generator, or the entropy distribution network, a third power signature that at least partially overlaps the first power signature or the second power signature.

[0117] Example 7: A method according to any of the preceding examples, wherein the operation of generating the third power signature does not contribute to the generation of the one or more bits of entropy, the processing of the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy, or the distribution of the number of bits of entropy greater than the one or more bits of entropy to the pseudorandom number generator.

[0118] Example 8: A method according to any of the preceding examples, wherein operating the PRNG-dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module includes receiving, by the PRNG-dependent encryption module, signaling indicating the generation of entropy for reseeding the PRNG-dependent encryption module, and operating the PRNG-dependent encryption module upon receiving the signaling indicating the generation of entropy for reseeding the PRNG-dependent encryption module.

[0119] Example 9: A method according to any preceding example, wherein operating the PRNG-dependent cryptographic module to generate the power signature that does not indicate deactivation of the PRNG-dependent cryptographic module includes activating a timer in response to the PRNG-dependent cryptographic module requesting the entropy for reseeding the PRNG-dependent cryptographic module, and terminating execution of the PRNG-dependent cryptographic module in response to the timer reaching a predetermined time value if the entropy for reseeding has not been received by the PRNG-dependent cryptographic module.

[0120] Example 10: The method of any of the preceding examples, wherein the method further includes determining, by the PRNG-dependent encryption module, that the current entropy used by the PRNG-dependent encryption module is below a desired quality, and wherein receiving the request for entropy to reseed the PRNG-dependent encryption module is in response to determining that the current entropy used by the PRNG-dependent encryption module is below the desired quality.

[0121] Example 11: A method according to any of the preceding examples, wherein operating the PRNG-dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module includes performing an encryption operation by the PRNG-dependent encryption module using current entropy.

[0122] Example 12: A method according to any of the preceding examples, further comprising: receiving, in a PRNG of the PRNG-dependent encryption module, the entropy for reseeding the PRNG-dependent encryption module; and performing, by the PRNG-dependent encryption module, an encryption operation using new entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module.

[0123] Example 13: A method according to any of the preceding examples, further comprising: receiving, in a PRNG of the PRNG-dependent encryption module, a partial amount of new entropy for reseeding the PRNG-dependent encryption module; and performing, by the PRNG-dependent encryption module, an encryption operation using the partial amount of new entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module, wherein the partial amount of new entropy received by the PRNG-dependent encryption module comprises less entropy than an amount of entropy requested for reseeding the PRNG-dependent encryption module.

[0124] Example 14: A method according to any preceding example, wherein operating the PRNG-dependent cryptographic module while generating the entropy for reseeding the PRNG-dependent cryptographic module includes generating new entropy to satisfy the request for entropy, while operating the cryptographic module to perform cryptographic operations using the new entropy that is less than the amount of required entropy.

[0125] Example 15: An apparatus comprising: an encryption module including a first pseudorandom number generator (PRNG) configured to operate based on entropy; an entropy generation circuit operably coupled to the encryption module, the entropy generation circuit including an entropy source, a random number generator, and an entropy distribution network; and a secure PRNG reseeding module configured to perform the method of any one of the examples described herein.

[0126] Example 16: An integrated circuit comprising an entropy generation circuit configured to generate entropy for reseeding a pseudorandom number generator (PRNG)-dependent encryption module, the PRNG-dependent encryption module including a PRNG, the PRNG-dependent encryption module configured to perform encryption operations using entropy provided by the PRNG, request entropy for reseeding the PRNG-dependent encryption module, and operate the PRNG-dependent encryption module during entropy generation to overlap at least a portion of power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module.

[0127] Example 17: An integrated circuit as described in any of the preceding examples, wherein the entropy generation circuit includes: an entropy source configured to generate one or more bits of entropy; a cryptographically secure random number generator configured to process the one or more bits of entropy to create a number of entropy greater than the one or more bits of entropy; and an entropy distribution network configured to distribute the greater number of bits of entropy to the pseudo-random number generator.

[0128] Example 18: An integrated circuit as described in any of the preceding examples, wherein one or more of the entropy source, the cryptographically secure random number generator, or the entropy distribution network are further configured to perform operations to generate a power signature that at least partially overlaps a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent cryptographic module.

[0129] Example 19: An integrated circuit as described in any of the preceding examples, wherein the PRNG-dependent encryption module is configured to operate the PRNG-dependent encryption module to generate a power signature that does not indicate deactivation of the PRNG-dependent encryption module without performing a cryptographic operation using the PRNG-dependent encryption module.

[0130] Example 20: An integrated circuit as described in any of the preceding examples, wherein the PRNG-dependent encryption module is further configured to determine that a quality of current entropy is less than a predetermined quality, and in response to determining that the quality of the current entropy is below the predetermined quality, request entropy for reseeding the PRNG-dependent encryption module.

[0131] Example 21: An integrated circuit as described in any of the preceding examples, wherein the PRNG-dependent encryption module is configured to use the current entropy to operate the PRNG-dependent encryption module during entropy generation to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module.

[0132] Example 22: An integrated circuit as described in any of the preceding examples, wherein the PRNG is further configured to receive the entropy for reseeding the PRNG-dependent encryption module and generate new entropy based on the entropy for reseeding the PRNG-dependent encryption module, and the PRNG-dependent encryption module is further configured to receive the new entropy from the PRNG and perform an encryption operation based on the new entropy.

[0133] conclusion Although aspects of the described apparatus, systems, and methods for implementing secure PRNG reseeding have been described in function- and / or method-specific language, the subject matter of the appended claims is not necessarily limited to the specific functions or methods described, as incorporated by any of the preceding examples. Rather, the specific functions and methods are disclosed as exemplary implementations of secure PRNG reseeding, and other equivalent functions and methods are intended to be within the scope of the appended claims. Furthermore, various aspects of secure PRNG reseeding have been described, and it will be understood that each described aspect can be implemented independently or in conjunction with one or more other described aspects.

Claims

1. 1. A method comprising: receiving a request for entropy to reseed a pseudorandom number generator (PRNG) dependent cryptographic module from the PRNG dependent cryptographic module, the PRNG dependent cryptographic module including a PRNG configured to generate random numbers using a seed based on received entropy; generating, by a random number generator, the entropy for reseeding the PRNG-dependent cryptographic module based on an entropy source; operating the PRNG dependent encryption module such that, while generating the entropy for reseeding the PRNG dependent encryption module, at least a portion of the power consumption associated with operation of the PRNG dependent encryption module overlaps with the power consumption associated with generating the entropy for reseeding the PRNG dependent encryption module; A method comprising:

2. generating the entropy with the random number generator to generate a first power signature indicating generating the entropy; operating the PRNG-dependent cryptographic module while generating the entropy to generate a second power signature that at least partially overlaps the first power signature, obfuscating the operation of the PRNG-dependent cryptographic module or the operation of the random number generator to generate the entropy; The method of claim 1.

3. 3. The method of claim 1 or claim 2, wherein operating the PRNG-dependent encryption module while generating the entropy generates a power signature that does not indicate deactivation of the PRNG-dependent encryption module without performing a cryptographic operation by the PRNG-dependent encryption module.

4. Generating the entropy for reseeding the PRNG-based cryptographic module comprises: generating, by an entropy source, one or more bits of entropy; responsive to generating the one or more bits of entropy with a cryptographically secure random number generator, processing the one or more bits of entropy to produce a number of bits of entropy greater than the one or more bits of entropy; distributing the greater number of bits of entropy to the pseudorandom number generator via an entropy distribution network; The method according to any one of claims 1 to 3, comprising:

5. 5. The method of claim 4, wherein two or more of generating the one or more bits of entropy, processing the one or more bits of entropy, or distributing the greater number of bits of entropy occur at least partially concurrently.

6. The method further comprises, during generation of the entropy for reseeding the PRNG-dependent cryptographic module: the entropy source; said cryptographically secure random number generator; or the entropy distribution network 6. The method of claim 4 or claim 5 when dependent on claim 2, further comprising performing an operation of generating a third power signature that at least partially masks the first power signature or the second power signature using at least one of:

7. 7. The method of claim 6, wherein the act of generating the third power signature does not contribute to the generation of the one or more bits of entropy, the processing of the one or more bits of entropy to create a number of bits of entropy greater than the one or more bits of entropy, or the distribution of the number of bits of entropy to the pseudorandom number generator.

8. Operating the PRNG-dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module comprises: receiving, by the PRNG-dependent encryption module, signaling indicating generating entropy for reseeding the PRNG-dependent encryption module; operating the PRNG dependent encryption module upon receiving signaling indicating generating entropy for reseeding the PRNG dependent encryption module; The method according to any one of claims 1 to 7, comprising:

9. Operating the PRNG dependent cryptographic module to generate the power signature that does not indicate deactivating the PRNG dependent cryptographic module includes: activating, by the PRNG-dependent encryption module, a timer in response to requesting the entropy for reseeding the PRNG-dependent encryption module; terminating execution of the PRNG-dependent encryption module in response to the timer reaching a predetermined time value if the entropy for reseeding has not been received by the PRNG-dependent encryption module; The method of claim 3, or any of claims 4 to 7 when dependent on claim 3, comprising:

10. The method further includes determining, by the PRNG-dependent encryption module, that a current entropy used by the PRNG-dependent encryption module is below a desired quality; receiving the request for entropy to reseed the PRNG-dependent encryption module is in response to determining that the current entropy being used by the PRNG-dependent encryption module is below the desired quality.

10. The method of claim 9.

11. 2. The method of claim 1, wherein operating the PRNG-dependent encryption module to overlap at least a portion of the power consumption associated with the generation of the entropy for reseeding the PRNG-dependent encryption module comprises performing an encryption operation by the PRNG-dependent encryption module using current entropy.

12. receiving, in a PRNG of the PRNG dependent encryption module, the entropy for reseeding the PRNG dependent encryption module; performing, by the PRNG-dependent encryption module, an encryption operation using the entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module; The method of claim 1 further comprising:

13. receiving, in a PRNG of the PRNG dependent encryption module, the entropy for reseeding the PRNG dependent encryption module; performing, by the PRNG-dependent encryption module, an encryption operation using the entropy generated by the PRNG based on the entropy for reseeding the PRNG-dependent encryption module; further comprising the entropy received by the PRNG-dependent encryption module includes less entropy than an amount of entropy required to reseed the PRNG-dependent encryption module; The method of claim 1.

14. 14. The method of claim 13, wherein operating the PRNG dependent encryption module while generating the entropy for reseeding the PRNG dependent encryption module comprises generating new entropy to satisfy the request for entropy, while operating the PRNG dependent encryption module to perform encryption operations using the new entropy that is less than the amount of requested entropy.

15. a cryptographic module including a first pseudo-random number generator (PRNG) configured to operate based on entropy; an entropy generation circuit operatively coupled to the cryptographic module, the entropy generation circuit including an entropy source, a random number generator, and an entropy distribution network; a secure PRNG reseeding module configured to perform the method of any one of claims 1 to 14; An apparatus comprising:

Images