Cryptographic Key Pair Update via Fuse Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for securing electronic devices with cryptographic keys require significant on-chip storage, leading to increased manufacturing costs and time due to the need for thousands of fuses, which occupy substantial die area and are time-consuming to program.
Innovation Solution
The technique involves storing a randomly generated, device-specific AES key in fuses and using it to encrypt the RSA private key, allowing the encrypted RSA key and certificate to be stored in external flash memory, reducing the number of fuse bits required and enabling the use of RSA in compute-constrained environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in on-chip fuses, then security is improved, but die area is increased and manufacturing cost is increased
Solution Approach 1:
The cryptographic key storage is segmented into two parts: a small portion (first plurality of bits) stored in on-chip fuses and a larger portion (second plurality of bits) stored in external non-volatile memory. This segmentation allows the device to maintain security through fuse-stored key material while avoiding the need to store entire cryptographic keys on-chip, thereby reducing die area occupation.
Solution Approach 2:
A cryptographic key derivation function acts as an intermediary mechanism that combines the fuse-stored key material with additional key material from external memory to generate the full cryptographic key. This intermediary process enables secure key reconstruction without requiring complete key storage on-chip, resolving the contradiction between security and die area.
2Reliability
If cryptographic keys are stored in on-chip fuses, then security is improved, but manufacturing time is increased
Solution Approach 1:
By segmenting key storage between fuses and external memory, the time-consuming fuse programming process is applied only to a small portion of the key material, while the remaining key material is stored externally. This significantly reduces the overall fuse programming time while maintaining security through the preserved fuse-stored key material.
Solution Approach 2:
The invention uses a cryptographic key derivation function that effectively creates a cryptographic copy or reconstruction of the full key from partial fuse material and external memory data. This copying mechanism allows the system to achieve full key functionality without programming complete keys into time-consuming fuses.
3Reliability
If more fuse bits are used to store cryptographic keys, then security is improved, but device complexity is increased
Solution Approach 1:
The cryptographic key is segmented such that only essential security-critical portions are stored in fuses, while non-critical portions are stored in external memory. This segmentation reduces the number of fuse bits required, thereby simplifying the device structure while maintaining adequate security through the preserved fuse-stored key material.
Solution Approach 2:
The cryptographic key derivation function serves as an intermediary that reconstructs the full cryptographic key from fragmented sources (fuse material and external memory). This intermediary process enables the system to achieve full cryptographic functionality with minimal fuse storage, reducing device complexity while maintaining security.
Data Source
AI summary
A computing device has a processor and a persistent memory, e.g., a fuse-based memory, storing two or more reduced sets of information. The processor is configured to derive a first cryptographic key using a first reduced set of information, e.g., prime numbers, and to use the first cryptographic key for performing cryptographic operations. The processor is also configured to detect a trigger event and, in response to the detected trigger event, derive a second cryptographic key using a second reduced set of information. The processor can then use the second cryptographic key for performing cryptographic operations.