JP6874042B2 - Updating the encryption key stored in non-volatile memory - Google Patents

Description

The present invention relates to the field of cybersecurity and, in particular, to encryption keys used to encrypt communications.

The entropy H (N, p) = H (N, 1-p) of an N-bit cryptographic key quantifies the randomness of the key (in the formula, p is any of the 0 or 1 keys. Is the probability of one bit of). A key with a relatively high entropy is more secure than a key with a relatively low entropy. Keys with random independent and identically distributed (iid) bits are H (N, p) = NH (p) bits, and H (p) =-(log ₂ p + (1-p)). log ₂ (1-p)). For example, an unbiased iid bit (p = 0.5) is H (N, p) = N because H (p) reaches its maximum value of 1.

Non-volatile memory (NVM) includes a plurality of single-bit memory cells, each of which may be programmed or unprogrammed. Normally, according to convention, unprogrammed cells have a binary value of 1, while programmed cells have a binary value of 0. One-time programmable non-volatile memory (one-time programmable NVM, OTP NVM) is irreversible for program operations. That is, the programmed cell cannot be deprogrammed (or erased) later.

The one-time programmable non-volatile memory (OTPNVM) cannot be erased. Even with other types of non-volatile memory that can be erased, the update operation is not secure and the attacker terminates the operation after erasing the current value of the key and before writing the new value of the key, and is known to be programmed. It may cause the key to "freeze" when not in use.

In some embodiments of the invention, a device that creates a new instance of an N-bit encryption key for an unprogrammed cell to store in a non-volatile memory (NVM) (belonging to a device) with a particular binary value. I will provide a. The device includes a network interface and a processor. The processor is configured to generate a random N-bit update sequence. The processor also negates each bit in the current instance of the N-bit encryption key that has a particular binary value and is different from the correspondingly placed bits in the random N-bit update sequence. It is configured to create a new instance of an N-bit encryption key by not negating any bit in the current instance of the N-bit encryption key that does not have a particular binary value. The processor is further configured to generate a new instance of the N-bit encryption key and then use the network interface to propagate the new instance of the N-bit encryption key to the device and store it in non-volatile memory (NVM). To.

In some embodiments of the invention, the non-volatile cells further include a plurality of single bit cells and are configured to store an N-bit encryption key, of which the unprogrammed cell has a particular binary value. A device including a memory (NVM) and a processor is provided. The processor is configured to generate a random N-bit update sequence. The processor also negates each bit in the current instance of an N-bit encryption key that has a particular binary value and is different from the correspondingly placed bits in the random N-bit update sequence, but is specific. It is configured to create a new instance of the N-bit encryption key by not negating any bit in the current instance of the N-bit encryption key that has no binary value. The processor is further configured to generate a new instance of the N-bit cryptographic key and then replace the current instance of the N-bit cryptographic key with the new instance of the N-bit cryptographic key in non-volatile memory (NVM).

In some embodiments of the invention, it further provides a method of creating a new instance of an N-bit encryption key for storage in a non-volatile memory (NVM) where an unprogrammed cell has a particular binary value. .. This method produces a random N-bit update sequence and within the current instance of an N-bit encryption key that has a particular binary value and is different from the correspondingly placed bits in the random N-bit update sequence. Includes creating a new instance of an N-bit encryption key by negating each bit of, but not negating any bit in the current instance of the N-bit encryption key that does not have a particular binary value.

In some embodiments of the invention, there is further provided a method of facilitating multiple updates of an N-bit encryption key in non-volatile memory (NVM) in which an unprogrammed cell has a particular binary value. This method calculates each different probability {q _i } (i = 1 ... U) for these updates, and each i-th update of these updates is for the current instance of the N-bit encryption key. The expected entropy of the new instance of the N-bit encryption key is not less than a predetermined threshold E less than N, provided that: (i) The new instance of the N-bit encryption key is: Negates each bit in the current instance of an N-bit encryption key that has a specific binary value and is different from the correspondingly placed bits in the random N-bit update sequence, but with a specific binary value Generated by not negating any bit in the current instance of a non-existent N-bit encryption key; (ii) Each bit in a random N-bit update sequence is generated _{with a probability q i having a particular binary value.} Will be done. The method further comprises calculating the probabilities and then providing the probabilities for use when making updates.

Since the non-volatile memory of the present invention uses an encryption key to encrypt communication, the update operation is safe.

The accompanying drawings are included for further understanding of the principles of the present invention, incorporated herein by reference, and constitute a portion thereof. The drawings exemplify embodiments of the present invention and serve to explain the principles of the present invention as well as explain them.

It is the schematic of the system which updates the encryption key which concerns on some Embodiments of this invention. It is a schematic diagram of the generation of a new instance of a cryptographic key according to some embodiments of the present invention. It is the schematic of the technique which generates the random sequence which concerns on some embodiments of this invention. It is the schematic of the technique which calculates the bit generation probability which concerns on some embodiments of this invention. It is a flow diagram of the method which facilitates the renewal of a plurality of encryption keys which concerns on some embodiments of this invention.

[Introduction]
In the content of the present application, including claims, "updating" an encryption key is (i) calculating a new instance of the key, (ii) exchanging the current instance of the key with a new instance of the key in memory, or (iii). Refers to both (i) and (ii).

The present specification generally assumes that in non-volatile memory (NMV), unprogrammed cells have a binary value of 1, while programmed cells have a binary value of 0. Hereinafter, although it will be described clearly with reference to FIG. 2, the technique described here can also be applied to a non-volatile memory (NMV) using the reverse convention.

[Overview]
It is difficult to update the encryption key stored in non-volatile memory. For example, as described above in the background art, the one-time programmable non-volatile memory (OTPNVM) cannot be erased. Also, with other types of non-volatile memory that can be erased, the update operation is not secure and the attacker terminates the operation after erasing the current value of the key and before writing the new value of the key. May cause the key to "freeze" unprogrammed.

To address this issue, embodiments of the present invention update a key by changing only one (unprogrammed) bit in the key and not changing the (programmed) 0 bit. Specifically, an N-bit random sequence S _i (hereinafter referred to as "S _i ") of bits is generated in consideration of the current N-bit instance K _i (hereinafter referred to as "K _{i") of the key.} Then, _{by performing a bitwise AND operation for each bit between K i} and S _i , or any equivalent operation, a new instance of the key K _{i + 1} (hereinafter, "K _{i + 1")} ”) Is calculated. To have sufficient entropy new instance of keys for the current instance (i.e., in order attacker with knowledge K _i 'from being able infer K _{i + 1),} 0-bit and 1-bit If you want to update both, make the key length N longer than necessary.
(Note that, using another descriptive convention, _Ki and _{Ki + 1} can be considered as different keys rather than different instances or values of the same key, so for example, _{Ki + 1,} can be said to be a new key to replace the K _i.)

Usually, to be able to perform as many updates, S _i is biased (Biasedly) generating the probability q _i for each bit in the same S _i to 1 (hereinafter, denoted by "q _i") is 0. Greater than 5. _{(In some cases, q i is} exactly 0.5 for the last update of the key.) Specifically, _{after numerically calculating the maximum q i} value that provides the required entropy, this maximum value is calculated. Use to generate _{S i.}

In some embodiments, just before the i-update _{, each q i} value is calculated taking into account the _{current key K i.} As a prelude, it should be noted, considering the K _i, the entropy of K _{i + 1} is equal to _{N1 i * H (q i)} . In the equation, N1 _i is the number of 1 bit in _{K i , and H (q i} ) =-(q _i log ₂ q _i + (1-q _i ) log ₂ (1-q _i )). is there. For this entropy greater than or equal to a predetermined threshold E (hereinafter referred to as "E"), H (q _i ) must be greater than or equal to E / N1 _i. Therefore, the quantity E / N1 _i can be calculated before the i-th update. Then, provided that E / N1 _i is less than or equal to 1 (the maximum possible value of H (q)), the equation H (q) = E / N1 _i is numerically given to q. Can be solved. (Note that the accuracy of calculating this solution depends on the numerical method used and the means by which the method is implemented.) The smallest _{solution q i} ^* (or q _i ^{*) of this equation.} A close and appropriate value) can be used as the value of _{q i.}

（式中、ｑ₀は、１）を使用して、Ｋ_iを考慮してＫ_i+1のエントロピーを推測することにより、必要なエントロピーＥに到達する。Ｈ（ｑ_i）は、

）よりも大きいか、それに等しくなければならない。（この量は、より簡潔に

と記載してもよく、λ＝Ｅ／Ｎである。）そのため、

）が１よりも大きいことが確定されるまで（ｉ＝Ｕ＋１に対し）、ｑ₁で始まるｑ_i値を繰り返し解くことができる。 In another embodiment, a set of q _i values {q ₁ , q ₂ , ... q _U } used to update the key U times is pre-computed before any update is performed. For this calculation, the expected value of _{N1 i,}

(Wherein, q ₀ is 1) is used by guessing the entropy of K _{i + 1} in view of the K _i, to reach the required entropy E. H (q _i ) is

) Must be greater than or equal to. (This amount is more concise

It may be described as, and λ = E / N. )so that,

) Is to (i = U + 1 until it is determined greater than 1) can be solved repeatedly q _i values beginning with q _1.

Usually, _{q i} has a form of n / 2 ^m for a predetermined integer m and a variable integer n in order to facilitate the generation of _{S i.} In _{order to generate S i} , an unbiased random seed X _i (hereinafter referred to as “X _i ”) containing an E bit is generated or acquired. Then, X _i is expanded to N m-bit sequences corresponding to the N bits of _{S i (for example, using the hash function).} Subsequently, the value of each m-bit sequence is compared with n. If the value is less than n _{, set the corresponding bit in S i} to 1; otherwise, set the bit to 0.

[System description]
First, with reference to FIG. 1, FIG. 1 is a schematic diagram of a system 20 for updating an encryption key according to some embodiments of the present invention. The particular embodiment shown in FIG. 1 uses an N-bit encryption key "K" to provide an Internet of Things (IoT) device 22 and an Internet service provider (ISP) on the Internet 24. Encrypt the communication between.

Generally, assuming that the device 22 holds the same ISP, the security of the key is not breached and there is no need to update the key. However, if the device 22 is switched to a different ISP, or if the security of the key is breached, the key needs to be updated.

For example, FIG. 1 shows a case where the device 22 has received the service of the first ISP26a, but is planning to receive the service of the second ISP26b from now on. In this case, the 2ISP26b is, to request the current instance K _i of the key from the first 1ISP26a. In response to this request, the 1ISP26a transmits a K _i to the 2ISP26b over the Internet 24. The first ISP26a can further transmit the value of i to the second ISP26b. That is, the first ISP26a can specify the number of updates to the already executed encryption key. Subsequently, the 2ISP26b After generating a new instance K _{i + 1} of the key, for example, via a router 28 that provides service to a WiFi network which the device 22 belongs, on the Internet 24, the K _{i + 1} device Communicate to 22. (Generally, the 2ISP26b, before transmitting the K _{i + 1} to the device 22, for example, using the K _i, K _{i + 1} is encrypted.) Subsequently, the device 22 and the 2ISP26b is , K _{i + 1} can be used to initiate communication with each other and encrypt and decrypt the communication.

The second ISP 26b includes a processor 30 and, for example, a network interface 32 that includes a network interface controller (NIC). The processor 30 is configured to exchange communications with the second ISP 26b and the device 22 (along with other devices) via the network interface 32. Processor 30 is further configured to update the encryption key used to encrypt communication with device 22. For example, as described above, the processor 30 can update the key by initializing communication with the device 22. Alternatively, or in addition, the processor 30 can update the key in response to the processor 30 (or an external cybersecurity system) by recognizing that the key may have been stolen by an attacker.

Similarly, the device 22 includes a processor 34 and a communication interface 36. The processor 34 is configured to exchange communication with the second ISP 26b (along with other devices) via the communication interface 36. For example, the communication interface 36 may include a WiFi card that the processor 34 can use to exchange communications via the router 28.

The device 22 further includes a memory 38 in which the processor 34 stores the encryption key. Therefore, for example, a memory 38, first, holds the K _i. After receiving the K _{i + 1} from the 2ISP26b, processor 34 is able to override the K _{i + 1} to K _i.

Typically, the memory 38 is non-volatile, for example, the memory 38 is an electrically erasable programmable read-only memory, such as a one-time programmable non-volatile memory (OTPNVM), a flash memory, or an electrically erasable programmable read-only memory. EEPROM) may be used. However, advantageously, as will be further described below with reference to FIG. 2, updating the encryption key does not require deprogramming the memory cells in the memory 38.

In some embodiments, the second ISP 26b uses the parameters contained in the datasheet provided by the server 40 (particularly the bit generation probabilities q _i ), as further described below with reference to FIG. , K _{i + 1} is generated. For example, by using the network interface 44, the server 40 can publish the datasheet to a website. Immediately before generating K _{i + 1} , the second ISP26b can retrieve the datasheet from the website and search the datasheet for the parameters required to generate _{K i + 1.} Alternatively, _{at any time before generating Ki + 1} , the server 40 can propagate the datasheet to the second ISP26b (eg, on the Internet 24), after which the second ISP26b volatile the datasheet. It can be stored in sex or non-volatile memory (not shown). Subsequently, _{just before generating Ki + 1} , the second ISP 26b can retrieve the datasheet from memory and then retrieve the relevant parameters.

In another embodiment, the processor 34 of the device 22 _{generates K i + 1} and then _{transmits K i + 1} to the second ISP 26b. In such an embodiment, the processor 34 can receive the above-mentioned data sheet from the server 40. Alternatively, the server 40 or other suitable third party may _{generate the K i + 1} and then transfer the K _{i + 1} to both the device 22 and the second ISP 26b.

The server 40 includes a processor 42 and, for example, a network interface 44 including a NIC. The processor 42 is configured to exchange communications with a second ISP 26b (and / or device 22) via a network interface 44.

It should be emphasized that the components and arrangement of the system 20 are provided merely as an example. In general, each technique described herein can be performed by the appropriate processor belonging to the appropriate system. For example, the techniques described here can be used to update encryption keys stored in an embedded SIM (embedded subscriber identification module, eSIM) or embedded secure element (eSE) belonging to a mobile phone. .. For example, the service provider of the mobile telephone generates a K i _{+ 1,} the K i _{+ 1} can be transmitted to the mobile phone, then the cellular phone, the K _{i + 1} in the non-volatile memory belonging to the phone Can be saved.

In general, each processor described herein may be embedded as a single processor or may be a collection of co-networked or clustered processors. In some embodiments, the function of at least one of the processors described herein is, for example, one or more Application-Specific Integrated Circuits (ASICs) or Field-Specific Integrated Circuits (ASICs) or Field-Specific Integrated Circuits (ASICs). It may be implemented independently in hardware using Programmable Gate Array, FPGA). In another embodiment, the functionality of each processor described herein is at least partially implemented in software. For example, in some embodiments, each processor described herein is embedded as a programmed digital calculator that includes at least a central processing unit (CPU) and random access memory (RAM). .. Program code, including software programs, and / or data is loaded into RAM and executed and processed by the CPU. The program code and / or data can be downloaded to the processor in electronic form, for example, over a network. Alternatively, or in addition, the program code and / or data may be provided and / or stored on non-transitory tangible media such as magnetic, optical, or electronic memory. Such program code and / or data, when provided to a processor, produces a machine or special purpose computer configured to perform the tasks described herein.

Create a new instance of the key
Here, with reference to FIG. 2, FIG. 2 is a schematic diagram of the generation of a new instance of a cryptographic key according to some embodiments of the present invention.

Figure 2 is related to the situation described in FIG. 1, the processor 30 (or other processor described above), taking into account the current instance K _i key, a new instance K _{i + 1} of the N-bit cryptographic key Generate. As described in the review, with reference to FIG. 1, and generates a K i _{+ 1,} by replacing a K _i and K _{i + 1} in the non-volatile memory, must be de-programming is eliminated the memory cell. However, as described in more detail below with reference to FIG. 4, the expected entropy of K _{i + 1} for the K _i is not smaller than the predetermined threshold entropy E. (The threshold E, which is less than the number of bits N in the encryption key, can be defined, for example, by the security architect of system 20.)

Specifically, in _{order to generate K i + 1} , the processor first generates a random N-bit update sequence S _i . The processor has a binary value 1, and will be negated each bit corresponding to a different K _i for the arranged bits in the S _i, the K _i with no binary value 1 Generate _{K i + 1} by not negating any bit of. FIG. 2 shows two negated bits, each represented by an upward arrow.

Normally, as shown in FIG. 2, the processor generates _{K i + 1} by performing a bit-by-bit AND operation between _{K i} and S _i. Therefore, some 1-bit in the K _i, but is replaced by 0 bit in the K i _{+ 1,} 0 bit of the K _i, because it is not replaced by 1 bit, without de-programmed cells , Can be updated in non-volatile memory.

The processor generates each bit of the probability q _i is 1 at S _i, usually, q _i is greater than 0.5. (As explained in the overview, q _{i may be exactly 0.5 for the last update of the key.) In some embodiments, q i} is as described above with reference to FIG. , Specified in the datasheet provided by server 40. Such a datasheet can include, for example, a lookup table that specifies _{q i} for each value of i, one or more values of N, and one or more values of E. In another embodiment, the processor computes _{q i. Hereinafter, the calculation of q i} will be described in more detail with reference to FIG.

For the reverse non-volatile memory convention where unprogrammed memory cells have a binary value of 0, the processor produces each bit with a probability q _{i of 0 at S i.} Then, the processor negates each 0 bit in _{K i} different from the correspondingly arranged bits in _{S i} by performing a bit-by-bit OR operation between _{K i} and S _i.

[Generate a random sequence]
Here, with reference to FIG. 3, FIG. 3 is a schematic diagram of a technique for generating a _{random sequence S i according to some embodiments of the present invention.} This technique assumes that for a given integer m and a variable integer n, q _i is equal to n / 2 ^m. (For example, m may be 10, and q _i = n / 1024.)

To generate S _i , the processor first generates or obtains _{an unbiased random seed X i} with an E bit from an external source. (X _i is unbiased and _{each bit in X i} has a probability of 0.5.) The processor further searches or calculates _{q i} = n / 2 ^m. Subsequently, the processor _{expands X i} into N m-bit sequences {Z _{ij } corresponding to the bits of S i} (j = 1 ... N). For example, the processor applies the hash function f (X, c) to X _i using N different individual counters c, so that, for example, the first m-bit sequence Z corresponding to the first bit of _{S i. i1} is equal to f (X _i , 1), and the second m-bit sequence Z _{i2 corresponding to the second bit of S i} is equal to f (X _i , 2) (the same applies hereinafter). Examples of suitable hash functions include secure hash algorithms (Sha) such as SHA-2, SHA-256, SHA-512, and SHA-3.

Next, _{for each bit in S i} , the processor sets the bit to 1 according to the value of the corresponding m-bit sequence less than n. For example, if Z _i1 is less than n _{, each first bit in S i} is set to 1; otherwise, the bit is set to 0.

A particular technique has been shown in FIG. 3, but it should be noted that _{assuming that each bit in S i} has a probability q _i of 1, (even if q _i is not in the form n / 2 ^m). other suitable techniques may be used to generate a S _i using.

[Calculate the bit generation probability for one update]
Here, with reference to FIG. 4, FIG. 4 is a schematic diagram of a technique for calculating the _{bit generation probability q i according to some embodiments of the present invention.}

In some embodiments, the processor that produces _{K i + 1} calculates _{q i} before generating _{S i.} Normally, in such an embodiment, the processor first identifies the number N1 _i of a bit in K _i. Next, as shown in FIG. 4, the processor solves H (q) = − (qlog ₂ q + (1-q) log ₂ (1-q)) = E / N1 _i with respect to q. This solution is shown in FIG. 4 by the notation q _i ^* . (In most cases, there are two solutions to the equation; the processor chooses the larger of the two solutions.) Then the processor gets q _i from q _i ^* . For example, the processor may _{set q i} to q _i ^* , or may set the maximum value n / 2 ^m _{less than or equal to q i} ^*. (In other words, the processor finds the largest integer n for which ^{n / 2 m} is less than or equal to q _i ^*.)

As explained in the overview, considering _{K i} , the entropy of _{K i + 1} is equal to _{N1 i} * H (q _i). Therefore, _{by setting q i} to q _i ^* or _{the closest appropriate value less than q i} ^* , the processor effectively sets the maximum appropriate value of _{q i} to provide at least the entropy of E. You can choose.

Instead of solving q _i ^* , the processor may define multiple values of q and then set q _i to the maximum of values where H (q) is _{not less than E / N1 i.} Good. For example, the processor produces a sequence of values [2 ^m-1 / 2 ^m , (2 ^m-1 + 1) / 2 ^m , ... (2 ^m- 1) / 2 ^m ], and then q _i is H ( q) can be set to the maximum value among the values not smaller than E / N1 _i.

If E / N1 _i is greater than 1, the processor will not generate _{K i + 1} because the required entropy E cannot be obtained. In this case, the processor can generate, for example, an appropriate error message indicating that memory 38 (FIG. 1) of device 22 needs to be replaced or erased.

[Pre-calculate bit generation probability for multiple updates]
In some embodiments, the processor that produces _{K i + 1} calculates _{q i} without using _{N1 i.} Instead, the processor, at each update, the expected value of N1 _i, based on the N1 _i ^*, advance to calculate a sequence of q _i values for a plurality of key update. Alternatively, server 40 (FIG. 1) may generate a datasheet that specifies each sequence of _{q i} values for one or more pairs of N or E values. Subsequently, as described above with reference to FIG. 1, the server 40 sends the data sheet to a third party (for example, the second ISP26b) who wants to update the encryption key by the method described with reference to FIGS. Can be provided.

In this regard, with reference to FIG. 5, FIG. 5 is a flow diagram of a method 46 that facilitates the renewal of a plurality of encryption keys according to some embodiments of the present invention. _{Specifically, in method 46, a data sheet that specifies a {q i} } sequence for one or more different (N, E) pairs (ie, (i) N (the number of bits in the encryption key) and (Ii) One or more different pairs of values consisting of E (entropy threshold)) are generated and provided. Method 46 is typically performed by processor 42 of server 40, as described above. Alternatively, a subset of the steps in method 46 (eg, _{the calculation of {q i} } for a single (N, E) pair) is performed on a processor, eg, processor 30 of the second ISP 26b that updates the key.

Method 46 begins with a selection step 47 of selecting the next predefined (N, E) pair for the sequence in which the processor 42 wants to calculate the sequence of bit generation probabilities. (Each (N, E) pair can be provided to processor 42, for example, by a security expert.) Next, the processor has different probabilities {qi} (i =) for each U update of the key. 1 ... U) is calculated. Calculate each q _i value so that the expected entropy of the new instance of the key (K _{i + 1 ) with respect to the current instance of the key (K i} ) is not less than E, but in Figures 2-3. As mentioned above, subject to the creation of a new instance of the key. That is, q _i usually uses the expected entropy of K _{i + 1 for K i} (H (q) * N1 _i ^* ) instead of the actual entropy (which cannot be known in advance), FIG. Is calculated as described above with reference to.

を計算する。次に、第１確認ステップ５２において、プロセッサは、Ｅ／Ｎ１_i ^＊が１よりも小さい、またはそれに等しいかどうかを確認する。ＹＥＳの場合、プロセッサは、設定ステップ５４において、ｑ_iをＨ（ｑ）がＥ／Ｎ１_i ^＊よりも小さくないｑの最大の適切な値に設定する。例えば、図４を参照して上述したように、プロセッサは、ｑ_iをｑ_i ^＊に（ここで、Ｈ（ｑ_i ^＊）は、Ｅ／Ｎ１_i ^＊）、またはｑ_i ^＊よりも小さい最も近い適切な値に設定することができる。続いて、増加ステップ５６において、プロセッサは、インデックスｉを増加させる。 More specifically, after the selection step 47, the processor _{sets q 0} to 1 and initializes the index i to 1 in the initialization step 48. The processor then _{iteratively computes q i} and increments the index until the expected entropy of the new instance of the key is less than E. To calculate q _i , the processor first, in calculation step 50,

To calculate. Next, in the first confirmation step 52, the processor _{confirms whether E / N1 i} ^* is less than or equal to 1. If YES, the processor sets q _i to the maximum appropriate value of q in setting step 54, where H (q) is _{not less than E / N1 i} ^*. For example, as described above with reference to FIG. 4, the processor changes q _i to q _i ^* (where H (q _i ^* ) is E / N1 _i ^* ), or the smallest smaller than _{q i} ^*. It can be set to a close and appropriate value. Subsequently, in the increase step 56, the processor increases the index i.

In the first confirmation step 52, after confirming that E / N1 _i ^* is larger than 1, the processor does not calculate _{q i with respect to the current index i.} On the contrary, in the datasheet update step 58, the sequence {q ₁ , q ₂ , ... q _U } calculated so far (U (one smaller than the current index) is the maximum number of key updates allowed). To the datasheet below (N, E).

After the data sheet update step 58, the processor checks in the second confirmation step 60 whether more (N, E) pairs remain. If YES, the processor returns to selection step 47, _{calculates {q i} } for the selected (N, E) pairs, and then updates the datasheet. Otherwise, the processor will provide the completed datasheet and use it for updating the encryption key in provision step 62. For example, as described above with reference to FIG. 1, the processor may upload the datasheet to a website or transmit the datasheet to another device.

As mentioned above with reference to FIG. 2, each q _i value is usually greater than 0.5. (But _{sometimes q U is} just 0.5). As can be seen by observing the graph of H (q) shown in FIG. 4, considering that _{E / N1 i} ^* _{increases with i} , the value of _{q i} ^* (hence, q i) increases i. It decreases as it goes. For example, for E = 80 and N = 256, Method 46 has _{a reduction sequence of 11q i} ^* values: 0.943, 0.938, 0.933, 0.926, 0.918, 0.907, 0. It returns to 893, 0.872, 0.841, 0.785, and 0.623. (The above means updating the 256-bit key 11 times using the technique described here, provided that the required entropy is no more than 80 bits.)

With this datasheet in mind, the processor that creates the new instance of the key (eg, processor 30 of the second ISP26b) takes N, E, and i into account and searches _{for the appropriate q i value.} (As described above with reference to FIG. 1, the first ISP 26a designates i as the second ISP 26b.) Subsequently, as described above with reference to FIGS. 2 to 3, the processor uses q _i. after generating the update sequence S _i Te, generating a K _{i + 1} from the K _i using the S _i.

The present invention relates to an encryption key used to encrypt a communication.

20 System 22 IoT Device 24 ISP on the Internet
26a 1st ISP
26b 2nd ISP
28 Router 30, 34, 42 Processor 32, 44 Network Interface 36 Communication Interface 38 Memory 40 Server 46 Method 47, 48, 50, 52, 54, 56, 58, 60, 62 Step K _i Current instance of key K _{i +} New instance of _{1 key q i} Probability S _i Bit random sequence X _i Unbiased random seed {Z _ij } m bit sequence

Claims (15)

A system in which an unprogrammed cell creates a new instance of an N-bit cryptographic key for storage in non-volatile memory with a particular binary value.
The system includes an IoT device having a first ISP, a second ISP and the non-volatile memory.
The second ISP is a network interface, a processor, and
Including
The processor
When the IoT device has received the service of the first ISP, but will receive the service of the second ISP from now on, the second ISP requests the current instance of the N-bit encryption key from the first ISP. ,
Generating a random N-bit update sequence and
Each bit in the current instance of the N-bit encryption key that has the particular binary value and is different from the correspondingly arranged bits in the random N-bit update sequence is negated, but the particular two. The bits in the current instance of the N-bit encryption key that have a decimal value and are not different from the correspondingly arranged bits in the random N-bit update sequence or that do not have the particular binary value. Creating the new instance of the N-bit encryption key by not negating each bit in the current instance of the N-bit encryption key,
After creating the new instance of the N-bit encryption key, the network interface is used to transmit the new instance of the N-bit encryption key to the IoT device and store it in the non-volatile memory.
System that will be configured to perform. The processor has the specific binary value and has the random N-bit update by performing a bit-by-bit AND operation between the current instance of the N-bit encryption key and the random N-bit update sequence. The system of claim 1, wherein each bit in the current instance of the N-bit encryption key that is different from the correspondingly arranged bits in the sequence is configured to negate. The system of claim 1, wherein the processor is configured to generate each bit in the random N-bit update sequence with a probability of having the particular binary value greater than 0.5. The probability is equal to ^{n / 2 m} for a given integer m and a variable integer n.
The processor
Extending an unbiased random seed with E bits to N m-bit sequences corresponding to the bits of the random N-bit update sequence, respectively.
For each bit in the random N-bit update sequence, the bit is set to the particular binary value according to the value of the corresponding m-bit sequence less than n.
The system according to claim 3, wherein the random N-bit update sequence is generated by performing the above. A system that creates a new instance of an N-bit encryption key
The system includes a first ISP, a second ISP and an IoT device.
The IoT device
A non-volatile memory that includes a plurality of single bit cells and is configured to store the N-bit encryption key, the unprogrammed cell of the cells having a specific binary value, and a processor.
The processor
Generating a random N-bit update sequence and
If the IoT device has received the service of the first ISP but is going to receive the service of the second ISP from now on, it has the specific binary value and corresponds within the random N-bit update sequence. Each bit in the current instance of the N-bit encryption key that differs from the placed bits is negated, but has the particular binary value and is correspondingly placed in the random N-bit update sequence. The N by not negating each bit in the current instance of the N-bit encryption key that is not different from a bit or each bit in the current instance of the N-bit encryption key that does not have a particular binary value. Creating a new instance of the bit encryption key and
After creating the new instance of the N-bit encryption key, replacing the current instance of the N-bit encryption key with the new instance of the N-bit encryption key in the non-volatile memory.
The N-bit cryptographic key the system that will be configured to perform a to a new instance is transmitted to the first 2ISP of. The processor is configured to generate each bit in the random N-bit update sequence with a particular probability of having the particular binary value.
The processor further calculates the particular probability before generating the random N-bit update sequence to expect the new instance of the N-bit encryption key relative to the current instance of the N-bit encryption key. The system according to claim 5, wherein the entropy is not less than a predetermined threshold E smaller than N. The system according to claim 6, wherein the specific probability is greater than 0.5. A method in which an unprogrammed cell creates a new instance of an N-bit cryptographic key for storage in non-volatile memory with a particular binary value.
The method applies a system comprising a first ISP, a second ISP with a processor and an IoT device with the non-volatile memory.
The above method
When the processor receives the service of the first ISP, but is planning to receive the service of the second ISP, the second ISP obtains the current instance of the N-bit encryption key from the first ISP. To request and
That the processor generates a random N-bit update sequence,
The processor negates each bit in the current instance of the N-bit encryption key that has the particular binary value and is different from the correspondingly arranged bits in the random N-bit update sequence. Each bit in the current instance of the N-bit encryption key having the particular binary value and not different from the correspondingly arranged bits in the random N-bit update sequence or the particular binary value. Creating the new instance of the N-bit encryption key by not negating any bits in the current instance of the N-bit encryption key that it does not have.
How to include. The method of claim 8, wherein negating comprises performing a bit-by-bit AND operation between the current instance of the N-bit encryption key and the random N-bit update sequence. 8. The eighth aspect of claim 8, wherein generating the random N-bit update sequence includes generating each bit in the random N-bit update sequence with a probability of having the particular binary value greater than 0.5. Method. Before generating the random N-bit update sequence,
The processor identifies the number N1 of bits in the current instance of the N-bit encryption key having the particular binary value.
The processor solves − (qlog ₂ q + (1-q) log ₂ (1-q)) = E / N1 with respect to q, and E is a predefined entropy threshold.
When the processor obtains the probability from q,
10. The method of claim 10. The method of claim 11, wherein obtaining the probability from q comprises obtaining the probability from q by setting the probability to q. Obtaining the probability from q includes obtaining the probability from q by setting the probability to a maximum value n / 2 ^m not greater than q, where m is a predetermined integer and n is. The method according to claim 11, which is a variable integer. The probability is equal to ^{n / 2 m} for a given integer m and a variable integer n.
Generating the random N-bit update sequence can
The processor extends an unbiased random seed with E bits to N m-bit sequences corresponding to the bits of the random N-bit update sequence, respectively.
The processor sets the bits to the particular binary value for each bit in the random N-bit update sequence, depending on the value of the corresponding m-bit sequence less than n.
10. The method of claim 10. A method of facilitating multiple updates of an N-bit cryptographic key in non-volatile memory in which an unprogrammed cell has a particular binary value.
The method applies a system comprising a first ISP, a second ISP with a processor and an IoT device with the non-volatile memory.
The above method
When the processor receives the service of the first ISP, but is planning to receive the service of the second ISP, the second ISP obtains the current instance of the N-bit encryption key from the first ISP. To request and
That the processor generates a random N-bit update sequence,
The processor calculates each different probability {q _i } (i = 1 ... U) for the update, and for each i-update of the updates, for the current instance of the N-bit encryption key. and said N-bit expected entropy of a new instance of the encryption key is to not less than a small predetermined threshold E than N,
Including that the processor provides the probabilities for use when making the updates after calculating the probabilities.
Among them, the above update is further
In the current instance of the N-bit encryption key, the new instance of the N-bit encryption key has the particular binary value and is different from the correspondingly arranged bits in the random N-bit update sequence. Each bit in the current instance of the N-bit encryption key that negates each bit, but has the particular binary value and is not different from the correspondingly arranged bits in the random N-bit update sequence. It is generated by not negating each bit in the current instance of the N-bit encryption key that does not have that particular binary value.
Each bit in the random N-bit update sequence is generated _{with the probability q i having the particular binary value.}
And be subject to,
How to include.

Images