SoC Enrolment Module Key Regeneration via PUF Helper Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing system on chip (SoC) technologies do not allow for the change of a unique encryption key after the initial enrolment phase, limiting flexibility and security updates.
Innovation Solution
The enrolment module is kept enabled after the first enrolment, enabling the generation of new helper data based on a new encryption key, allowing for the regeneration of the unique encryption key during firmware updates and normal operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the enrolment module is disabled after the first enrolment phase, then the initial security key is established, but the ability to change encryption keys later is lost
Solution Approach 1:
The enrolment module transitions from a static disabled state to a dynamic enabled state, allowing it to be activated conditionally after initial enrolment. This enables the system to adapt between maintaining security and allowing key changes based on operational needs.
Solution Approach 2:
The system changes the operational parameter of the enrolment module from permanently disabled to conditionally enabled. By controlling the enablement state through specific conditions (such as firmware update verification), the system can switch between security modes without redesigning the architecture.
2Adaptability or versatility
If the enrolment module remains enabled after first enrolment, then key flexibility is improved, but security risks from unauthorized key changes increase
Solution Approach 1:
The system implements a feedback mechanism where the enrolment module's operation is controlled by verification of firmware authenticity. The module remains enabled but only responds to authorized key change requests that pass security verification, creating a closed-loop control system that balances flexibility and security.
Solution Approach 2:
A security verification mechanism acts as an intermediary between the enabled enrolment module and the key change operation. This intermediary checks firmware authenticity and controls whether the enrolment module can actually perform key changes, preventing unauthorized modifications while maintaining the flexibility of an enabled module.
3Reliability
If error correction is applied to PUF response, then key reconstruction reliability is improved, but additional processing steps are required
Solution Approach 1:
Error correction capabilities are built into the key reconstruction process from the beginning. The system preliminarily establishes error correction mechanisms during the enrolment phase, so that subsequent key reconstructions can reliably correct PUF response errors without adding complex real-time processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Deriving a device unique encryption key of a system on chip using a physical unclonable function Method implemented in a computer system for deriving a device unique encryption key of a system on chip using a physical unclonable function, the method including .the following steps - challenging the physical unclonable function during the enrolment phase, - error correcting the response of the physical unclonable function, - generating helper data (H-D) by using the corrected response of the physical unclonable function and a manufacturer's encryption key (OR-K), - generating a reconstructed encryption key (REC-K) by using the helper data (H-D), - feeding the corrected response of the physical unclonable function to the enrolment module (ENR), - generating helper data (H-D) in the enrolment module (ENR) by using the corrected response of the physical unclonable function and the said manufacturer's key (OR-K), - storing the helper data (H-D) and keeping the enrolment module enabled after first enrolment.