On-Chip KEK Generation and OTP Logging for Secure Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing integrated circuits for generating key encryption keys (KEKs) lack sufficient security measures, as the keys are often externally generated and stored in one-time programmable (OTP) memories, making them vulnerable to external access and manipulation.
Innovation Solution
An integrated circuit that generates a KEK using a random number generator and logs the key in an OTP memory within the circuit, ensuring the key is unreadable by external devices, and includes a log generator to verify the key's integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the KEK is generated externally and stored in OTP memory, then the manufacturing process is simple, but the security level is insufficient due to external access vulnerability
Solution Approach 1:
The patent merges the random number generator, KEK generation logic, and OTP memory into a single integrated circuit. The RNG is directly connected to the OTP memory through internal buses, eliminating external key generation and storage interfaces. This integration ensures that the KEK generation and storage process occurs entirely within the secure boundary of the IC, preventing external access while maintaining manufacturing simplicity.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where the KEK is used to authenticate the OTP memory content. The system generates authentication data by encrypting the KEK with the stored key, and verifies this authentication data to ensure the integrity of the stored key. This intermediary verification layer enhances security without requiring complex external validation systems.
2Reliability
If the KEK is stored in OTP memory without logging, then the storage process is simple, but the key integrity cannot be verified
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously verifies the integrity of the stored key by generating authentication data and comparing it with expected values. The log generator creates a record of the KEK generation process, and this log is used to verify that the key has not been tampered with. This feedback loop ensures key integrity while providing auditability without requiring complex external verification systems.
Solution Approach 2:
The patent performs preliminary logging of the KEK generation process before the key is potentially exposed or used. The log generator records essential information about the key generation event, including timestamps and verification results, so that future integrity checks can be performed efficiently. This preliminary action establishes a baseline for verification without adding complexity to the key generation process itself.
3Reliability
If the KEK is exposed to external devices for verification, then the verification process is simple, but the security protection is reduced
Solution Approach 1:
The patent extracts the verification process from external devices and moves it entirely within the integrated circuit. The authentication data is generated internally using the KEK and stored key, and the verification is performed by comparing this generated data with expected authentication values. This extraction eliminates the need for external device access to verify the KEK, maintaining security while enabling verification through internal cryptographic operations.
Data Source
AI summary
An operating method of an integrated circuit according to the present disclosure includes generating a key encryption key (KEK) using a random number generator; generating log data corresponding to the KEK using a log generator, and storing the KEK and the log data in a one-time programmable (OTP) memory, where the KEK is used to encrypt a master key of the integrated circuit for a cryptographic operation, and where the random number generator and the log generator are comprised in the integrated circuit.