Embedded HSM Using PUF Seed for Volatile Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory devices lack effective embedded hardware security modules (HSMs) that can securely generate and manage cryptographic keys without persistent storage, making them susceptible to offline attacks and increasing costs due to the need for non-volatile memory.
Innovation Solution
An embedded HSM with a physically unclonable function (PUF) generates a unique seed value from uninitialized SRAM, using it to create cryptographic keys stored in volatile memory, eliminating the need for non-volatile storage and reducing susceptibility to offline attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If non-volatile memory is used to store cryptographic keys, then key persistence is improved, but security against offline attacks deteriorates
Solution Approach 1:
The patent extracts the cryptographic keys from persistent non-volatile storage and keeps them only in volatile memory during operation. The HSM generates keys using a PUF-based RNG and stores them temporarily in volatile memory, eliminating the security vulnerability of offline attacks while maintaining key functionality during the device's operational lifetime.
Solution Approach 2:
The patent changes the storage state parameter of cryptographic keys from persistent (non-volatile) to temporary (volatile). This parameter change fundamentally alters the security model by ensuring keys exist only in memory during active use and are automatically erased when power is removed, preventing extraction attacks.
2Duration of action of stationary object
If non-volatile memory is used for key storage, then key persistence is improved, but device cost increases
Solution Approach 1:
The patent removes the requirement for non-volatile key storage hardware from the HSM design. By extracting this function and relying solely on volatile memory for key residence during operation, the device eliminates the need for expensive secure non-volatile storage components while maintaining adequate key persistence through controlled memory management.
3Reliability
If volatile memory is used for key storage, then security against offline attacks is improved, but key persistence deteriorates
Solution Approach 1:
The patent implements a self-service approach where the volatile memory automatically erases cryptographic keys when power is removed or the HSM is reset. This self-erasing mechanism provides adequate persistence for the device's operational lifetime without requiring external intervention or additional hardware, balancing security and functionality.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
The solution provides secure key generation and operation without persistent storage, enhancing security by preventing offline attacks and reducing device costs through the use of volatile memory only.
Implementation Method 1
In an embodiment, the HSM can include a physically unclonable function (PUF) that can generate a random number.
Implementation Method 2
In one embodiment, the HSM creates a PUF from one kilobyte of uninitialized controller static random-access memory (SRAM) that is not subsequently used for any other purpose.
Data Source
AI summary
The disclosed embodiments relate to hardware security modules. In one embodiment, a method is disclosed comprising reading a random value from a physically unclonable function (PUF); generating a seed value from the random value; generating a cryptographic key using the seed value; and processing a cryptographic operation using the cryptographic key.