SoC Safeguarding via Physical Unclonable Function Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for safeguarding system-on-a-chip (SoC) against malicious attacks, such as manipulation and unlicensed duplication, are inadequate as they fail to ensure secrecy and are susceptible to side channel attacks and reverse engineering.
Innovation Solution
A method involving the generation of a unique physical unclonable function (PUF) key pair during the SoC programming process, using a PUF to authenticate and encrypt the firmware, and a security module signed with a private key for secure boot and operation, ensuring the private key remains within the SoC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encryption methods (e.g., AES) are used to safeguard the data stream of the SoC, then the confidentiality of the data is improved, but the SoC cannot be safeguarded against manipulation at the hardware level and is susceptible to side channel attacks
Solution Approach 1:
The patent introduces a PUF (Physical Unclonable Function) as an intermediary mechanism that leverages inherent physical variations in the hardware to generate unique cryptographic keys. This PUF-based key generation system acts as a mediator between the hardware identity and the encryption schemes, providing both confidentiality and hardware-level protection simultaneously. The PUF keys are derived from physical characteristics that are impossible to clone or manipulate, thus resolving the contradiction between data confidentiality and hardware manipulation protection.
Solution Approach 2:
The patent replaces traditional software-based encryption mechanisms with a physics-based PUF system. Instead of relying solely on cryptographic algorithms that can be implemented in software and are vulnerable to side channel attacks, the solution uses physical unclonable functions that are inherently tied to the hardware's physical structure. This substitution of mechanical/physical principles for software-based security mechanisms provides robust protection against both data theft and hardware manipulation.
2Reliability
If signature methods with public and private keys are used to check integrity and authenticity, then the authenticity of the data is improved, but secrecy of the data is not ensured
Solution Approach 1:
The patent segments the cryptographic key generation into two distinct parts: PUF keys derived from physical characteristics for secrecy, and traditional public-private key pairs for authentication. The PUF keys remain entirely within the hardware and never leave the device, ensuring secrecy. The public-private key pairs are used separately for signature and verification purposes, ensuring authenticity. This segmentation allows both secrecy and authenticity to coexist without compromising either.
Solution Approach 2:
The patent extracts the secret key generation function into a separate PUF-based subsystem that operates independently from the traditional public-private key infrastructure. The PUF keys are extracted from physical variations in the hardware and are used exclusively for generating encryption keys, while the public-private key pairs handle authentication. This extraction ensures that the secret cryptographic material never leaves the secure boundary of the PUF subsystem, maintaining secrecy while enabling authentication through separate mechanisms.
3Reliability
If the private key is stored in the SoC for secure boot and operation, then the authenticity verification is improved, but the risk of key extraction and unauthorized access increases
Solution Approach 1:
The PUF system is self-service in that it generates cryptographic keys on-demand from its own physical characteristics without requiring external key storage. The private keys are never stored in the traditional sense; instead, they are continuously regenerated from the physical unclonable function embedded in the hardware. This self-service approach eliminates the vulnerability of stored keys to extraction attacks while maintaining the ability to verify authenticity through the consistent physical characteristics of the PUF.
Solution Approach 2:
The patent changes the fundamental parameter of key storage from static (stored in memory or registers) to dynamic (continuously generated from physical characteristics). By transforming the key from a stored value to a derived value based on physical parameters, the system eliminates the attack surface for key extraction. The private key exists only transiently in memory during cryptographic operations and is immediately discarded, making extraction impossible while maintaining authenticity verification through the unchangeable physical characteristics.
Data Source
AI summary
A method for safeguarding a system-on-a-chip includes a hardware-programmable logic unit. In the course of a programming process, a public PUF key and a private PUF key are generated in the hardware-programmable logic unit with the aid of a physical unclonable function, and the public PUF key is signed with the aid of a second private key. The public PUF key and its signature are stored in an external memory of the system-on-a-chip, a security module is signed with the aid of a third private key, the security module and its signature are stored in the external memory of the system-on-a-chip, and the security module includes software which is used for safeguarding the system-on-a-chip.