Secure Encryption IC Using Segmented Persistent Memory Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programmable logic circuits face vulnerabilities in protecting decryption keys from power analysis attacks and unauthorized access, as existing encryption methods are susceptible to key discovery through monitoring power consumption variations during decryption operations.
Innovation Solution
The use of multiple cryptographic keys, where each key is independently generated and used to decrypt specific portions of a bitstream, with the initial key stored in persistent memory, and the subsequent keys being encrypted within the bitstream, reduces the effectiveness of power analysis attacks by limiting the data samples available for key identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single decryption key is stored in persistent memory of the programmable IC, then the decryption operation can be performed, but the key becomes vulnerable to power analysis attacks
Solution Approach 1:
The configuration bitstream is divided into multiple encrypted portions, each encrypted with a different cryptographic key. The decryption keys are also segmented and stored separately in persistent memory. This segmentation prevents attackers from gathering sufficient data samples through power analysis attacks on a single key, as each key is used only for decrypting a specific portion of the bitstream.
2Object-affected harmful factors
If multiple cryptographic keys are used to encrypt different portions of the configuration bitstream, then power analysis attack effectiveness is reduced, but the device complexity increases
Solution Approach 1:
Multiple cryptographic keys are pre-loaded into persistent memory before the configuration process begins. The configuration bitstream is pre-divided into portions and each portion is pre-encoded with its corresponding key identifier. During configuration, the system simply needs to match portions with their corresponding pre-loaded keys, eliminating the need for complex real-time key selection or generation mechanisms.
3Ease of manufacture
If the configuration bitstream is encrypted with a single key, then the encryption process is simple, but the decrypted key can be easily obtained through power analysis
Solution Approach 1:
The configuration bitstream is segmented into multiple portions, and each portion is encrypted with a different cryptographic key. This segmentation maintains relative encryption simplicity while dramatically improving key security, as attackers can only obtain partial key information through power analysis rather than the complete decryption key.
Data Source
AI summary
In one embodiment, a cryptographic device is provided. The cryptographic device includes a persistent memory and a decryption control circuit coupled to the persistent memory. The decryption control circuit is configured to receive an encrypted data stream and decrypt a first portion of the encrypted data stream using a first cryptographic key stored in the persistent memory, the first portion including a second cryptographic key. The decryption circuit is configured to decrypt a second portion of the encrypted data stream using the second cryptographic key, the second portion of the encrypted data stream including payload data.