On-Chip Key Derivation for Secure IC Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The provisioning of secret keys to integrated circuits is a costly and time-consuming process due to the need for secure key transport and programming, which often requires expensive secure environments and operation overhead, especially when using hardware solutions for secure key loading and bit-by-bit programming in one-time programmable memory.
Innovation Solution
A method where confidential data is received and stored in integrated circuits in encrypted form, with the encryption key derived within the IC, eliminating the need for high-security transport and allowing key derivation without exposing sensitive information outside the IC, using cryptographic algorithms like AES for encryption and decryption, and storing identifiers in one-time programmable memory to reduce configuration time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware solutions for secure key transport and loading are used, then security is improved, but operation overhead and cost increase significantly
Solution Approach 1:
The patent extracts the key derivation function from external hardware security modules and implements it within the integrated circuit itself. The IC derives the transport key locally from a seed key and customer identifier, eliminating the need for complex external hardware security systems while maintaining security through self-contained key generation.
Solution Approach 2:
The integrated circuit performs self-service by deriving its own transport key using a key derivation function that combines a seed key stored in the IC with a customer identifier. This self-key-derivation mechanism eliminates dependency on external secure hardware systems, reducing operation overhead while maintaining security.
2Reliability
If secure key transport channels and closed secure environments are used, then key security is improved, but setup and maintenance costs increase
Solution Approach 1:
The patent removes the need for closed secure programming environments by implementing key derivation within the IC itself. The transport key is derived from a seed key and customer identifier using a key derivation function that executes inside the IC, eliminating the requirement for expensive secure factory environments while maintaining key security.
Solution Approach 2:
The patent introduces a key derivation function as an intermediary that transforms a seed key and customer identifier into a transport key. This intermediary mechanism allows secure key generation without requiring physical secure environments, as the derivation process can occur remotely within the IC using standard communication channels.
3Ease of operation
If traditional clear text key programming via JTAG interface is used, then programming simplicity is maintained, but security is compromised and time consumption increases
Solution Approach 1:
The patent applies preliminary action by encrypting the confidential data with the transport key before transmission to the IC. The data is prepared in advance in encrypted form, and the IC only receives and processes the encrypted version, eliminating the need for secure clear text transmission while maintaining programming simplicity through automated encrypted loading.
Solution Approach 2:
The patent extracts the encryption operation from the programming process and integrates it into the IC's key derivation function. The transport key is derived and used to encrypt data locally within the IC, eliminating the need for external encryption operations and secure clear text programming while maintaining ease of operation.
4Manufacturing precision
If bit-by-bit programming of eFuses is performed, then programming precision is achieved, but time consumption increases significantly
Solution Approach 1:
The patent extracts the time-consuming bit-by-bit programming process and replaces it with parallel programming capabilities. The encrypted confidential data is loaded and processed in parallel operations within the IC, maintaining programming precision for secure key storage while significantly reducing the overall programming time through efficient parallel execution of the key derivation and data encryption processes.
Data Source
Figure 1~2
Figure 3a~3b
Figure 4a~4b
AI summary
A method for provisioning an integrated circuit 100 with confidential data, the method comprising receiving 310 in the integrated circuit encrypted confidential data, the encrypted confidential data having been encrypted with a transport key, deriving 320 in the integrated circuit the transport key by applying a key derivation function to a customer identifier, the customer identifier having been previously stored in the integrated circuit, decrypting 330 in the integrated circuit the encrypted confidential data with the transport key to obtain decrypted confidential data, deriving 340 in the integrated circuit a product key by applying a key derivation function to an integrated circuit identifier, the integrated circuit identifier having been previously stored in the integrated circuit, encrypting 350 in the integrated circuit the decrypted confidential data with the product key to obtain re-encrypted confidential data, and storing 360 the re-encrypted confidential data in a confidential data memory of the integrated circuit.