Field
Various features generally relate to secure cryptographic key extraction and storage, and more particularly to extracting and storing a secret cryptographic key during a secure boot process based on physically unclonable features of volatile memory.
Background
Many electronic communication devices, such as mobile phones, tablets, and computers include a device-specific cryptographic key (or keys derived from such a key) that can be used for cryptographic security processes at the electronic communication device. For example, a device-specific key known only to the device and possibly to another trusted entity (e.g., a cellular network authentication server providing communication service to the device) is used to derive keys (e.g., a public-private key pair) that are subsequently used to encrypt communication messages transmitted by the device. Securing the device-specific key from unauthorized access by other parties and/or applications is of utmost importance in order to better guarantee the integrity of cryptographic security protocols employed by the device and/or the communication network.
Moreover, since the memory circuit 106 storing the key 108 is non-volatile memory, the key 108 is stored in the IC 100 (and therefore theoretically accessible) regardless of whether the IC 100 is powered OFF or ON. This exposes the key 108 to greater security vulnerability. For example, the top of the integrated circuit 100 package may be physically opened and an electron microscope can be used to analyze the circuitry (e.g., fuses) used for storing the key 108. Doing so may reveal the key 108 and compromise the security of the device.
There exists a need for methods and apparatuses that provide increased security in key extraction/generation and storage to help prevent unauthorized access to such keys. Improved security in key extraction/generation and storage helps increase confidence and reliability in the cryptographic algorithms and processes that rely on such keys.
One feature provides a method operational at an integrated circuit, the method comprising powering ON a first volatile memory circuit to generate a plurality of initial logical state values, the first volatile memory circuit on the integrated circuit, deriving secret data based on the plurality of initial logical state values, storing the secret data in a secure volatile memory circuit, the secure volatile memory circuit secured by a secure execution environment (SEE), clearing the plurality of initial logical state values in the first volatile memory circuit, executing a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and storing the secret key in the secure volatile memory circuit. According to one aspect, the method is a secure boot flow of the integrated circuit that controls access to the first volatile memory circuit to secure the secret data and the plurality of initial logical state values from one or more insecure applications. According to another aspect, the secure boot flow secures the secret data and the plurality of initial logical state values from the one or more insecure applications by rendering the first volatile memory circuit inaccessible to the one or more insecure applications until at least after the plurality of initial logical state values have been cleared in the first volatile memory circuit.
According to one aspect, the secure boot flow includes a primary boot loader, a first secondary boot loader, and a second secondary boot loader, and the secure boot flow establishes a chain of trust by having the primary boot loader authenticate the first secondary boot loader before the first secondary boot loader executes, the first secondary boot loader authenticate the second secondary boot loader before the second secondary boot loader executes, and the second secondary boot loader authenticate the SEE, and wherein the secret key is extracted and stored in the secure volatile memory circuit during the secure boot flow and prior to execution of the one or more insecure applications. According to another aspect, resetting the first volatile memory circuit causes the secure boot flow to be executed. According to yet another aspect, the secret data is the plurality of initial logical state values.
According to one aspect, after clearing the first volatile memory circuit the first volatile memory circuit is available for data storage for one or more insecure applications. According to another aspect, the first volatile memory circuit is static random access memory (SRAM). According to yet another aspect, the SEE prevents insecure applications from accessing the secure volatile memory circuit.
According to one aspect, the plurality of initial logical state values are substantially the same every time the first volatile memory circuit is powered ON. According to another aspect, the cryptographic algorithm is based on at least one of a block code algorithm, a spreading code algorithm, and/or a repeat code algorithm. According to yet another aspect, the method further comprises storing the secret data in a second volatile memory circuit prior to storing the secret data in the secure volatile memory circuit, and clearing the secret data stored in the second volatile memory circuit after storing the secret data in the secure volatile memory circuit.
According to one aspect, after clearing the secret data stored in the second volatile memory circuit, the second volatile memory circuit is available for data storage for one or more insecure applications. According to another aspect, the SEE controls access to the secret key by making it inaccessible to an insecure application, and the method further comprises receiving a request from the insecure application at the SEE for at least one of a secondary key and/or public data, generating the secondary key and/or the public data at the SEE based on the secret key, and providing the secondary key and/or the public data to the insecure application requesting the secondary key and/or the public data. According to yet another aspect, the secondary key and/or the public data is generated based on the secret key and other data provided by the insecure application. According to another aspect, the cryptographic algorithm executed at the SEE to extract the secret key based on the secret data is further based on auxiliary data stored in a non-volatile memory circuit.
Another feature provides an integrated circuit comprising a first volatile memory circuit configured to generate a plurality of initial logical state values upon power ON, a secure volatile memory circuit secured by a secure execution environment (SEE), and a processing circuit communicatively coupled to the first volatile memory circuit and the secure volatile memory circuit, the processing circuit configured to derive secret data based on the plurality of initial logical state values, store the secret data in the secure volatile memory circuit, clear the plurality of initial logical state values in the first volatile memory circuit, execute a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and store the secret key in the secure volatile memory circuit. According to one aspect, the processing circuit executes a secure boot flow by (i) deriving the secret data, (ii) storing the secret data, (iii) clearing the plurality of initial logical state values, (iv) executing the cryptographic algorithm, and (v) storing the secret key, and wherein the secure boot flow controls access to the first volatile memory circuit to secure the secret data and the plurality of initial logical state values from one or more insecure applications.
According to one aspect, the processing circuit is further configured to store the secret data in a second volatile memory circuit prior to storing the secret data in the secure volatile memory circuit, and clear the secret data stored in the second volatile memory circuit after storing the secret data in the secure volatile memory circuit. According to another aspect, the SEE controls access to the secret key by making it inaccessible to an insecure application, and wherein the processing circuit is further configured to receive a request from the insecure application at the SEE for at least one of a secondary key and/or public data, generate the secondary key and/or the public data at the SEE based on the secret key, and provide the secondary key and/or the public data to the insecure application requesting the secondary key and/or the public data.
Another feature provides an integrated circuit comprising means for powering ON a first volatile memory circuit to generate a plurality of initial logical state values, the first volatile memory circuit on the integrated circuit, means for deriving secret data based on the plurality of initial logical state values, means for storing the secret data in a secure volatile memory circuit, the secure volatile memory circuit secured by a secure execution environment (SEE), means for clearing the plurality of initial logical state values in the first volatile memory circuit, means for executing a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and means for storing the secret key in the secure volatile memory circuit.
Another feature provides a computer-readable storage medium having one or more instructions stored thereon, which when executed by at least one integrated circuit, causes the integrated circuit to power ON a first volatile memory circuit to generate a plurality of initial logical state values, the first volatile memory circuit on the integrated circuit, derive secret data based on the plurality of initial logical state values, store the secret data in a secure volatile memory circuit, the secure volatile memory circuit secured by a secure execution environment (SEE), clear the plurality of initial logical state values in the first volatile memory circuit, execute a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and store the secret key in the secure volatile memory circuit. According to one aspect, the one or more instructions is for a secure boot flow of the integrated circuit, which when executed by the integrated circuit causes access to the first volatile memory circuit to be controlled to secure the secret data and the plurality of initial logical state values from one or more insecure applications by rendering the first volatile memory circuit inaccessible to the one or more insecure applications until at least after the plurality of initial logical state values have been cleared in the first volatile memory circuit.
In the following description, specific details are given to provide a thorough understanding of the various aspects of the disclosure. However, it will be understood by one of ordinary skill in the art that the aspects may be practiced without these specific details. For example, circuits may be shown in block diagrams in order to avoid obscuring the aspects in unnecessary detail. In other instances, well-known circuits, structures and techniques may not be shown in detail in order not to obscure the aspects of the disclosure.
The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any implementation or aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects of the disclosure. Likewise, the term “aspects” does not require that all aspects of the disclosure include the discussed feature, advantage, or mode of operation.
Overview
Methods and apparatuses are described herein that extract a secret key during a secure boot flow of an integrated circuit. Specifically, the secure boot flow includes powering ON a first volatile memory circuit to generate a plurality of initial logical state values, deriving secret data based on the plurality of initial logical state values, storing the secret data in a secure volatile memory circuit that is secured by a secure execution environment (SEE), clearing the plurality of initial logical state values in the first volatile memory circuit, executing a cryptographic algorithm at the SEE to extract a secret key based on the secret data, and storing the secret key in the secure volatile memory circuit. The secure boot flow controls access to the first volatile memory circuit to secure the secret data and the plurality of initial logical state values from the insecure applications by rendering the first volatile memory circuit inaccessible to the insecure applications until at least after the plurality of initial logical state values have been cleared in the first volatile memory circuit. Moreover, if the first volatile memory circuit is reset then the secure boot flow is again initiated, and thus the initial logical state values of the first volatile memory circuit is unavailable to insecure applications.
Exemplary Key Extraction During IC Secure Boot Up
Among other things, the RPM circuit 201 supplies power to various circuits and components of the IC 200. For example, the RPM circuit 201 may control the power supplied to the processing circuit 203, the volatile memory circuit 206, and/or the secure volatile memory circuit 212. The RPM circuit 201 represents one example of a means for powering ON the first volatile memory circuit to generate a plurality of initial logical state values.
Upon IC 200 power ON, the IC 200 undergoes/executes a secure boot up process (also referred to herein as “secure boot flow”) by having the processing circuit 203 obtain and execute the secure boot loader (e.g., secure boot code) 202. The secure boot loader 202 may be stored in memory circuits such as but not limited to read-only memory (ROM) and/or other non-volatile memory. The secure boot loader 202 initializes various modules of the IC 200 and performs other basic operations in order to ready the IC 200 for normal operation.
According to one aspect of the disclosure, the volatile memory circuit 206 includes one or more static random access memory (SRAM) circuits that each include a plurality of SRAM circuit cells. According to other aspects, the volatile memory circuit 206 is not limited to SRAM and may be based on other types of volatile memory, such as embedded dynamic random access memory (eDRAM). A portion of the volatile memory circuit 206 (i.e., a number of volatile memory cells) may form the basis of physically unclonable function (PUF).
An on-chip PUF is a chip-unique challenge-response mechanism exploiting manufacturing process variations of integrated circuits (ICs). When a physical stimulus (i.e., challenge) is applied to the PUF, the PUF generates a response in an unpredictable but repeatable way due to the complex interaction of the stimulus with the physical microstructure of the device employing the PUF. This exact microstructure depends on physical factors introduced during manufacture of the device employing the PUF, which are unpredictable. The PUF's “unclonability” means that each device employing the PUF has a unique and unpredictable way of mapping challenges to responses, even if one device is manufactured with the same process as another seemingly identical device. Thus, it is practically infeasible to construct a PUF with the same challenge-response behavior as another device's PUF because exact control over the manufacturing process is infeasible.
In the present disclosure, the volatile memory circuit 206 is a type of volatile memory (e.g., SRAM), where each circuit cell that comprises the volatile memory circuit 206 naturally initializes to an initial, preferred logical state value (e.g., “0” or “1”) at start-up (i.e., when powered ON). For example, SRAM has such a property when powered ON. The initial logical state values of the circuit cells are repeatable in that each volatile memory cell initializes to the same value each time at start-up with a high probability. However, the initial logical state values of the circuit cells are random from one IC to another IC, even if manufactured to be the same. Thus, due to manufacturing process variation, each integrated circuit's volatile memory circuits 206—even if manufactured to be the same—will exhibit different repeatable initial values so that from IC to IC the initial volatile memory circuit startup values are different at the same memory address locations across different ICs. Thus, each IC 200 has a volatile memory circuit 206 (e.g., SRAM circuit) that has a unique, yet repeatable identifier based on the initial power ON states of its volatile memory circuit's cells.
The portion/number of volatile memory cells of the volatile memory circuit 206 used as the basis for the PUF 210 may vary depending on the application. According to one example, an 8 kilobyte portion of the volatile memory circuit 206 may comprise the PUF 210. In practice, however, the amount of memory used for the PUF 210 may be any value, such as but not limited to 512 bytes, 1 kilobyte, 2 kilobytes, 4 kilobytes, 8 kilobytes, 16 kilobytes, etc. The size of the entire volatile memory circuit 206 is typically larger than the portion used for the PUF 210. As just one example, the volatile memory circuit 206 may be 384 kilobytes. However, the volatile memory circuit 206 may be any size, such as but not limited to 64 kilobytes, 128 kilobytes, 256, kilobytes, 384 kilobytes, 512 kilobytes, 768 kilobytes, 1,024 kilobytes, 2,048 kilobytes, etc.
As described above, when the volatile memory circuit 206 is powered ON, its memory circuit cells each settle to an initially preferred logical state value based on minute manufacturing variation among the cells. The portion of memory used as the PUF 210 is no different: its memory cells too will initially settle to preferred initial logical state values. In this sense, the PUF challenge may be considered powering ON the PUF's 210 volatile memory circuit cells and the response is the initial logical state values of its memory circuit cells.
Once the PUF's 210 memory circuit cells have settled to their initial logical state values, the secure boot loader 202 may derive secret data based on the initial logical state values. According to one aspect, the secret data may be equal to the initial logical state values. According to another aspect, the secret data may be derived based on some function of the initial logical state values. Some non-limiting examples of the function that the secret data is based on include but are not limited to: the secret data equal to every other (or some other multiple) bit of the initial logical state values, the secret data equal to a value based on one or more mathematical operations (addition, subtraction, concatenation, etc.) performed on the initial logical state values, etc. The secure boot loader 202 then stores the secret data in the secure volatile memory circuit 212 controlled by the SEE 208. Next, the secure boot loader 202 clears/deletes the PUF's 210 memory circuit cells of their initial logical state values. It may accomplish this by writing a logical state “0” or “1” to all the PUF's 210 memory circuit cells or by randomly changing their logical state values (random “0” or “1”). In a similar fashion, the secure boot loader 202 also clears/deletes any of the secret data that may have been temporarily stored elsewhere outside of the secure volatile memory circuit 212. Once cleared, the memory circuit cells that originally stored the initial logical state values are free to be used for general data storage as needed. For example, once the high level operating system (HLOS) and user applications are loaded and executed they may use these cleared memory circuit cells.
Thus, the secure boot loader 202 represents one example of a means for deriving secret data based on the plurality of initial logical state values. The secure boot loader 202 also represents one example of a means for storing the secret data in the secure volatile memory circuit 212. Moreover, the secure boot loader 202 represents one example of a means for clearing the plurality of initial logical state values in the first volatile memory circuit 206.
The SEE 208 is a secure mode of operation of the IC 200. For example, the SEE 208 may comprise and have access to specific hardware modules and circuits, such as control logic, buses, and memory circuits that are unavailable to other applications running in an insecure operational mode of the IC 200. The SEE 208 may have complete control and access over its secure volatile memory circuit 212 such that other applications (e.g., user applications, HLOS, and even some or all types of boot loaders) cannot access (e.g., read and/or write) to the secure volatile memory circuit 212.
The SEE 208 (e.g., using its own control logic) may then extract a secret key (e.g., generate the secret key) based on the secret data that is stored in its secure volatile memory circuit 212. The SEE 208 uses a cryptographic security algorithm to accomplish this. The algorithm used is not limited to any one specific type of algorithm or family of algorithms. Some non-limiting examples include block code algorithms, spreading code algorithms, and/or repeat code algorithms. In one example, in addition to the secret data, auxiliary data may be used by the algorithm to extract the secret key. The auxiliary data may be stored in insecure memory that is accessible by insecure applications. That is, there is no requirement that the auxiliary data be securely stored since its exposure by itself does not jeopardize the security of the secret key and/or initial logical state values of the first volatile memory circuit 206.
Since the volatile memory (e.g., SRAM) based PUF 210 provides substantially the same initial logical state values upon power ON, the SEE's cryptographic algorithm is able to extract the same secret key every time. The cryptographic algorithm may use error correction techniques to extract the same secret key even if some of the initial logical state values are different between different power ON cycles. The secret key extracted is unique to the specific IC 200 since the initial logical state values of the PUF 210 are different across different ICs 200 even if manufactured to be the same.
The SEE 208 stores the secret key extracted in secure volatile memory, such as the secure volatile memory circuit 212 shown in
Moreover, since the secret key is only stored in secure volatile memory 212, the secret key is lost when the IC 200 is powered OFF. It must again be re-extracted upon power ON based on the PUF's 210 initial logical state values as described above. A nefarious party attempting to gain unauthorized access to the secret key by physically opening up the IC 200 and inspecting memory circuits would be unable to obtain the key since it is not stored in non-volatile memory.
According to one aspect, the IC 200 and/or the volatile memory circuit 206 is designed such that upon reset (i.e., powered OFF and powered ON and/or returned to its initial state) the secure boot flow is immediately executed (e.g., the IC 200 is also reset). According to one aspect, the RPM circuit 201 may be in sole control of resetting the volatile memory circuit 206. As such an insecure application 204 cannot reset the PUF 210 and/or the volatile memory circuit 206 and gain access to the PUF's 210 initial logical state values. Resetting the IC 200 would terminate the insecure application 204 running and cause the secure boot flow to start again.
According to one aspect, the specific volatile memory circuit cells that make up the PUF 210 may be selected in various ways. According to one example, the PUF 210 memory cells may be a contiguous block of memory circuit cells chosen for reliability (i.e., increased likelihood of producing consistent logical state values upon power ON). According to another example, the PUF 210 memory cells may be non-contiguous to one another, and even chosen at random from various sites of the volatile memory circuit 206. However, once the specific volatile memory circuit cells that make up the PUF 210 are chosen, the same specific volatile memory circuit cells are again chosen every time at power ON to be the basis of the PUF 210.
Although the volatile memory circuit 206 and the secure volatile memory circuit 212 are shown as independent circuit blocks in
The secure volatile memory circuit 212 includes one or more secure volatile memory circuits each comprising a plurality of memory cells. The secure volatile memory circuit 212 may be any type volatile memory, such as but not limited to eDRAM, SRAM, etc. The secure volatile memory circuit 212 stores the secret data and also the secret key extracted by the control logic 402 based, in part, on the secret data. The SEE 208 exercises complete control over the secure volatile memory circuit 212 such that other applications (e.g., insecure applications) cannot access the secure volatile memory circuit 212. For example, the SEE 208 may physically lock down (shown as disable bus logic 406) any bus 408 lines that couple the secure volatile memory circuit 212 to other, insecure circuitry of the IC 200.
The insecure applications loader 503 may include a third secondary boot loader (SBL3) 508, an application secondary boot loader 510, the HLOS 512, and user applications 514. The insecure applications loader 503 is considered “insecure” in that unauthorized user code may be executed and/or injected during execution and/or authentication of one or more of these loaders 508, 510, 512, 514.
Referring to
After the SBL2 506 is authenticated, the SBL2 506 executes and may, among other things, copy the secret data from an insecure memory circuit to the secure volatile memory circuit 212. The SBL2 506 may also: initialize one or more processing circuits (e.g., processing circuit 203) of the IC 200; configure memory circuits external to the IC 200 (e.g., external DRAM and/or SRAM); and load and authenticate the SEE 208, other firmware, and/or the SBL3 508. After authentication of the SBL3 508, the SBL3 508 executes and may, among other things, check storage mode for software flashing. The SBL3 508 may also load and authenticate the HLOS 512 and/or the application secondary boot loader 510. In a similar fashion, subsequent boot up processes are loaded, authenticated, and executed in successive order, such as the application secondary boot loader 510, the HLOS 512, and user applications 514. The order in which these processes 502, 504, 506, 508, 510, 512 are loaded and executed may vary from that shown in
The non-volatile memory circuit 604 includes auxiliary data 606. According to one example, the non-volatile memory circuit 604 is part of the IC 600 (i.e., it is “on-chip”). According to another example, the non-volatile memory circuit 604 is not part of the IC 600 and is a separate circuit that is in communication with the IC 600 (i.e., it is “off-chip”). Some or all of the auxiliary data 606 may be insecure in that it can be accessed by insecure applications. The first secure volatile memory circuit 608 represents one example of a means for storing the secret data in a secure volatile memory circuit, and the second secure volatile memory circuit 610 represents one example of a means for storing the secret key in a secure volatile memory circuit.
Next, the first secondary boot loader (SBL1) 504 locates the memory circuit cells of the volatile memory circuit 206 whose initial logical state values will be used (i.e., the portion of memory designated the first volatile memory circuit 210), and derives secret data based on those initial logical state values 704. As described above, the secret data may be equal to the initial logical state values, or the secret data may be derived based on some function of the initial logical state values. After the secret data is derived, the SBL1 504 stores the secret data in the second (i.e., reserved) memory portion 302 of the volatile memory circuit 706. Then, the SBL1 504 clears the first volatile memory circuit's 210 initial logical state values so that no trace of the initial logical state values can be found at those memory address locations by subsequent processes/applications (e.g., insecure applications). Once cleared, the first volatile memory circuit 210 is available for general data storage (i.e., any subsequent process/application may use that first volatile memory circuit 210) 708.
Next, the second secondary boot loader (SBL2) 506 copies/transfers the secret data stored in the second memory portion 302 over to the secure volatile memory circuit 212 of the SEE 208. For example, the secure data may be stored at the first secure volatile memory circuit 608. The SBL2 506 then clears the second memory portion 302 of the volatile memory circuit 206 and/or clears the entire volatile memory circuit 206 in order to eliminate any trace of the secret data in the volatile memory circuit 206. Once cleared, the reserved memory portion 302 is available for general data storage (i.e., any subsequent process/application may use that reserved memory portion 302) 712.
Further, the SEE 208 then extracts a secret key based on the secret data. For example, the control logic circuitry 402 at the SEE 208 obtains the secret data stored at the first secure volatile memory circuit 608 and auxiliary data 606 stored at the non-volatile memory circuit 604. After obtaining this data, the control circuitry 402 executes a cryptographic algorithm (e.g., at least one of a block code algorithm, a spreading code algorithm, a repeat code algorithm, etc.) using the auxiliary data 606 and secret data as inputs to extract the secret key. The cryptographic algorithm may include error correction techniques to extract the same secret key despite some differences between the secret data and/or initial logical state values from one boot to the next. The secret key is also stored in secure volatile memory 212 (e.g., the second secure volatile memory circuit 610) 714.
Since the secret key is stored securely within the SEE's 208 control at the secure volatile memory circuit 212, the secret key cannot be accessed by other insecure applications. Such insecure applications may send requests to the SEE 208 for SEE output data (e.g., as described above includes cryptographic data and/or public data) based on the secret key 716. The control logic circuitry 402 at the SEE 208 may then generate the SEE output data based on the secret key and provide the SEE output data to the requesting insecure application 718.
Since the secret key is only stored in the secure volatile memory 212, the secret key is lost when the IC 600 is powered OFF. It must again be re-extracted upon power ON through the secure boot flow 700 based on the PUF's 210 initial logical state values as described above. A nefarious party attempting to gain unauthorized access to the secret key by physically opening up the IC 600 and inspecting memory circuits would be unable to obtain the key since it is not stored in non-volatile memory.
According to one aspect, the IC 600 and/or the volatile memory circuit 206 is designed such that upon reset the secure boot flow 700 is immediately executed (e.g., the IC 600 is also reset). According to one aspect, the RPM circuit 201 may be in sole control of resetting the volatile memory circuit 206. As such an insecure application cannot reset the PUF 210 and/or the volatile memory circuit 206 and gain access to the PUF's 210 initial logical state values. Resetting the IC 600 would terminate the insecure application running and cause the secure boot flow 700 to again commence.
According to one aspect, the specific volatile memory circuit cells that make up the PUF 210 may be selected in various ways. According to one example, the PUF 210 memory cells may be a contiguous block of memory circuit cells chosen for reliability (i.e., increased likelihood of producing consistent logical state values upon power ON). According to another example, the PUF 210 memory cells may be non-contiguous to one another, and even chosen at random from various sites of the volatile memory circuit 206. However, once the specific volatile memory circuit cells that make up the PUF 210 are chosen, the same specific volatile memory circuit cells are again chosen every time at power ON to be the basis of the PUF 210.
Referring to
One or more of the components, steps, features, and/or functions illustrated in
Moreover, in one aspect of the disclosure, the processing circuit 203 illustrated in
Also, it is noted that the aspects of the present disclosure may be described as a process that is depicted as a flowchart, a flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination corresponds to a return of the function to the calling function or the main function.
Moreover, a storage medium may represent one or more devices for storing data, including read-only memory (ROM), random access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other machine-readable mediums and, processor-readable mediums, and/or computer-readable mediums for storing information. The terms “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” may include, but are not limited to non-transitory mediums such as portable or fixed storage devices, optical storage devices, and various other mediums capable of storing or containing instruction(s) and/or data. Thus, the various methods described herein may be fully or partially implemented by instructions and/or data that may be stored in a “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” and executed by one or more processors, machines and/or devices.
Furthermore, aspects of the disclosure may be implemented by hardware, software, firmware, middleware, microcode, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine-readable medium such as a storage medium or other storage(s). A processor may perform the necessary tasks. A code segment may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc.
The various illustrative logical blocks, modules, circuits, elements, and/or components described in connection with the examples disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic component, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing components, e.g., a combination of a DSP and a microprocessor, a number of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
The methods or algorithms described in connection with the examples disclosed herein may be embodied directly in hardware, in a software module executable by a processor, or in a combination of both, in the form of processing unit, programming instructions, or other directions, and may be contained in a single device or distributed across multiple devices. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor.
Those of skill in the art would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system.
The various features of the invention described herein can be implemented in different systems without departing from the invention. It should be noted that the foregoing aspects of the disclosure are merely examples and are not to be construed as limiting the invention. The description of the aspects of the present disclosure is intended to be illustrative, and not to limit the scope of the claims. As such, the present teachings can be readily applied to other types of apparatuses and many alternatives, modifications, and variations will be apparent to those skilled in the art.
Number | Name | Date | Kind |
---|---|---|---|
5363447 | Rager | Nov 1994 | A |
6675303 | Lam | Jan 2004 | B1 |
20120210115 | Park et al. | Aug 2012 | A1 |
20120290870 | Shah et al. | Nov 2012 | A1 |
20130051552 | Handschuh et al. | Feb 2013 | A1 |
Number | Date | Country |
---|---|---|
WO-2012045627 | Apr 2012 | WO |
Entry |
---|
Areno M et al., “Securing Trusted Execution Environments with PUF Generated Secret Keys”, Trust, Security and Privacy in Computing and Communications (TRUSTCOM), 2012 IEEE 11th International Conference on, IEEE, Jun. 25, 2012 (Jun. 25, 2012), pp. 1188-1193, XP032233551, DOI: 10.1109/TRUSTCOM.2012.255, ISBN: 978-1-4673-2172-3. |
International Search Report and Written Opinion—PCT/US2015/011991—ISA/EPO—dated Apr. 30, 2015. |
Bohm C., et al., “A microcontroller SRAM-PUF,” 2011 5th International Conference on Network and System Security (NSS), Sep. 2011, pp. 269-273. |
Handschuh, H., “Hardware-Anchored Security Based on SRAM PUFs, Part 1,” IEEE Security and Privacy, vol. 10, No. 3, 2012, pp. 80-83. |
Handschuh H., “Hardware-Anchored Security Based on SRAM PUFs, Part 2,” IEEE Security & Privacy, Copublished by the IEEE Computer and Reliability Societies, vol. 10 (4), Gutmann P., Ed., Jul./Aug. 2012, pp. 80-81. |
Schaller A., et al., “Bootloader Protection Using Inherent PUFs,” Security Engineering, Cased, Mar. 11, 2013, Slide 1 to Slide 19. |
Number | Date | Country | |
---|---|---|---|
20150207624 A1 | Jul 2015 | US |