PUF-Based Storage Encryption Without Stored Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure storage devices face vulnerabilities due to the need to store keys on the device, making them susceptible to offline brute-force attacks and physical attacks, and they lack robust entropy generation for secure key derivation.
Innovation Solution
A secure storage device authenticates a host credential using a Physically Unclonable Function (PUF) to generate a Data Encryption Key (DEK) on demand, eliminating the need to store keys in volatile memory and enhancing resistance to attacks by deriving keys from device-unique PUF responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If keys are stored in volatile memory for decryption operations, then decryption functionality is enabled, but the device becomes susceptible to offline brute-force attacks and physical attacks
Solution Approach 1:
The patent extracts the key material from volatile memory by using PUF circuits that generate cryptographic keys on-demand through physical challenges. The actual key never resides in memory, eliminating the attack surface for offline brute-force and physical attacks while maintaining decryption functionality through dynamic key generation.
Solution Approach 2:
The PUF circuit acts as an intermediary between the stored challenge data and the cryptographic key. Instead of directly storing keys, the system stores challenges and uses the PUF's physical response to generate keys when needed, creating a secure mediation layer that prevents direct key extraction.
2Productivity
If cryptographic keys are stored on the device, then encryption and decryption operations can be performed, but the device lacks robust entropy generation for secure key derivation
Solution Approach 1:
The device serves itself by using its own unique physical characteristics through the PUF circuit to generate high-entropy cryptographic keys. The PUF leverages inherent manufacturing variations in the silicon to create unpredictable, device-unique responses that serve as robust entropy sources for key derivation, eliminating the need for external key management.
3Reliability
If keys are stored in the device, then data encryption can be implemented, but attackers can replicate or crack the keys
Solution Approach 1:
The cryptographic key becomes dynamic rather than static. The PUF generates different key responses based on the specific challenge presented, meaning the effective key changes with each operation. This dynamic nature prevents attackers from replicating or cracking a single static key, as the key material is continuously regenerated from physical responses.
Solution Approach 2:
The system changes the fundamental parameter of key storage from static memory-resident keys to dynamic physically-generated keys. By transitioning from stored key values to challenge-response pairs with PUF-generated outputs, the system fundamentally alters how key material exists and behaves, making traditional key replication and cracking methods ineffective.
Data Source
AI summary
Systems and methods are disclosed herein for protecting data in a storage device by encrypting or decrypting the data with a Data Encryption Key (DEK). The storage device is communicatively coupled to a host. In one example, the storage device receives a credential from the host and authenticates the credential with a transformed credential. A Physically Unclonable Function (PUF) generates a PUF response based on a challenge, responsive to successful authentication of the credential from the host. Based on the PUF response, a DEK generation module in the storage device generates a DEK. A crypto module in the storage device uses the DEK and performs encryption of data to be stored in the storage device and/or decryption of data being assessed by the host.