Virtual PUF Key Derivation for Scalable Hardware Root of Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PUF technologies in FPGAs are limited by reliance on physical hardware, lack scalability, and provide inadequate security due to the generation of a single cryptographic key per device, which is susceptible to physical attacks and break-once-run-everywhere attacks.
Innovation Solution
The generation of multiple virtual physical unclonable function (vPUF) keys from a single PUF key, enabling efficient scaling and secure cryptographic services through microservice management circuitry, verification circuitry, and vPUF management circuitry, which derive and verify physical unclonable keys, providing a hardware root of trust.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional PUFs are used in FPGAs, then hardware root of trust is provided, but scaling is limited and only single key per device is generated
Solution Approach 1:
The patent creates virtual copies of the PUF key by deriving multiple vPUF keys from a single physical PUF key. The vPUF management circuitry generates multiple virtual keys that behave like independent PUF keys but are all rooted to the same physical PUF, enabling one device to serve multiple cryptographic purposes without requiring multiple physical PUF instances.
Solution Approach 2:
The single physical PUF key is made universal by deriving multiple vPUF keys from it, allowing one PUF to fulfill multiple cryptographic roles. The system provides multi-functionality where a single hardware root of trust can support multiple applications, devices, or security domains through the derived virtual keys.
2Adaptability or versatility
If multiple PUF keys are generated per device, then cryptographic versatility is improved, but security against break once run everywhere attacks is weakened
Solution Approach 1:
Instead of generating multiple independent PUF keys that would each be vulnerable to break once run everywhere attacks, the patent creates virtual copies derived from a single physical PUF key. All vPUF keys share the same physical root, so compromising one virtual key does not compromise the physical PUF itself or other virtual keys derived from it.
Solution Approach 2:
The patent introduces an intermediary layer (the vPUF management circuitry and derivation mechanism) between the physical PUF key and the multiple cryptographic applications. This intermediary derives virtual keys that provide the needed versatility while maintaining security, as the physical PUF key never directly exposes multiple independent secrets.
3Productivity
If virtual PUF keys are derived from single PUF key, then scaling efficiency is improved, but derivation mechanism complexity increases
Solution Approach 1:
The patent implements a virtual key derivation mechanism that efficiently generates multiple vPUF keys from a single physical PUF key. This copying approach allows rapid key generation without requiring multiple physical PUF instances, improving productivity while keeping the physical hardware simple.
Solution Approach 2:
The patent replaces the mechanical/physical approach of having multiple separate PUF hardware instances with a computational derivation mechanism. Instead of physically multiplying PUF components, the system uses software-based derivation to generate multiple virtual keys, reducing physical complexity while maintaining security properties.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes: instructions; and processor circuitry to execute the instructions to: retrieve a random number and a physical unclonable function (PUF) from a trusted environment; generate a virtual PUF (vPUF) based on a trusted operation including the random number and the PUF; and store the vPUF and the random number in a persistent storage.