Configuration-Mask Hardware Root of Trust With Low Area Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hardware roots of trust face challenges in balancing security demands with functionality and testability, leading to high area overhead and complex design flows, deterring integrated circuit vendors from adoption.
Innovation Solution
A configuration mask-based hardware root of trust scheme incorporating a random number generator, hashing circuitry, and retrieving circuitry, along with descrambling and scrambling capabilities, to enhance security and testability while minimizing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing hardware roots of trust are implemented, then security protection is improved, but area overhead and device complexity increase
Solution Approach 1:
The hardware root of trust is divided into separate functional modules: a random number generator module, a hashing module, and a configuration mask storage module. Each module performs a specific security function independently, allowing for optimized implementation of each component while reducing overall area overhead through modular design.
Solution Approach 2:
The hardware root of trust is designed to perform multiple security functions within a unified structure, including generating random numbers, computing hash values, storing configuration masks, and providing authentication. This multi-functional approach eliminates the need for separate dedicated security modules for each function, thereby reducing total area overhead.
2Reliability
If existing hardware roots of trust are implemented, then security protection is improved, but design flow complexity increases
Solution Approach 1:
The configuration masks are pre-computed and stored in the hardware root of trust during the design phase. The hashing algorithm and random number generation parameters are predetermined and embedded in the hardware structure. This preliminary preparation eliminates the need for complex runtime configuration and simplifies the design flow during implementation.
Solution Approach 2:
The hardware root of trust is designed to be self-configuring and self-verifying. The random number generator automatically generates cryptographic material, the hashing module automatically verifies integrity, and the system performs self-testing without requiring external intervention or complex setup procedures, thereby simplifying the design flow.
3Area of stationary object
If lightweight hardware root of trust is implemented, then area overhead is reduced, but security strength may be compromised
Solution Approach 1:
The system uses configurable parameter settings to optimize the balance between area overhead and security strength. The random number generator can be configured with different output lengths and entropy levels, the hashing module can select from multiple algorithm variants, and the configuration mask storage can be adjusted to store only essential data. These parameter changes allow the system to achieve adequate security with minimal area overhead.
Data Source
AI summary
A circuit comprises: a random number generator configured to generate a random number: hashing circuitry configured to mimic a hashing function that can transform the random number into a hash value; and retrieving circuitry configured to use the hash value to retrieve one or more configuration masks from a response signal received by the circuit. The response signal is generated based on the random number by a computing device. The generation of the response signal comprises: generating the hash value for the random number, and combining the hash value with the one or more configuration masks. The random number generator may comprise a ring generator and one or more inverter-based ring oscillators configured to inject bits into the ring generator at a plurality of location.