Secure Microcontroller Key Management via Address Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure microcontrollers face challenges in managing cryptographic keys effectively, particularly in ensuring data confidentiality and integrity against threats like fault injection attacks, where existing solutions may not adequately protect against new attack methods and may expose memory and communication buses physically.
Innovation Solution
A secure microcontroller system that employs a cryptographic processor, universal memory controller, and dedicated secure link to automatically and transparently manage logic or physical address-based keys, using a serial data interface for key transfer and integrity verification, ensuring that each memory region is associated with a specific key for enhanced data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory encryption is used to protect data in external memory, then data confidentiality is improved, but the physical security perimeter is limited to the microcontroller while memory and communication buses remain exposed
Solution Approach 1:
A dedicated secure link acts as an intermediary between the cryptographic processor and key sources, providing a physically protected channel for key transfer that is separate from the exposed memory buses. This mediator enables confidential key communication while the main memory interface remains physically accessible.
2Ease of operation
If cryptographic keys are stored in external memory for easy access, then key availability is improved, but key security is worsened due to physical exposure and potential attacks
Solution Approach 1:
The system segments key storage and key usage by maintaining keys in secure key sources separate from the cryptographic processor, with keys transferred only when needed through a dedicated secure link. This segmentation allows keys to be easily accessible during operations while remaining secure during storage.
Solution Approach 2:
The dedicated secure link serves as a mediator that enables secure key transfer between separated key sources and cryptographic processor, maintaining both accessibility and security by providing a protected communication path.
3Reliability
If a dedicated secure link is implemented for key transfer, then key security is improved, but device complexity increases
Solution Approach 1:
The system architecture is segmented into distinct functional blocks (cryptographic processor, key sources, universal memory controller) connected by dedicated secure links, which organizes complexity into manageable, security-focused modules rather than a monolithic structure.
Data Source
AI summary
The present invention relates to key management in a secure microcontroller, and more particularly, to systems, devices and methods of automatically and transparently employing logic or physical address based keys that may also be transferred using dedicated buses. A cryptographic engine translates a logic address to at least one physical address, and processes a corresponding data word based on at least one target key. The target key is selected from a plurality of keys based on the logic or physical address. A universal memory controller stores each processed data word in the corresponding physical address within a memory. Each key is associated with a memory region within the memory, and therefore, the logic or physical address associated with a memory region may be used to automatically identify the corresponding target key. A dedicated secure link may be used to transport key request commands and the plurality of keys.