KR20200097381A - Updating cryptographic keys stored in non-volatile memory - Google Patents

Abstract

Provided is a method for creating a new instance of an N-bit encryption key for storing non-programed cells in a nonvolatile memory having a specific binary value. According to the present invention, the method comprises the steps of: generating a random N-bit updating sequence; and creating a new instance of an N-bit encryption key by invalidating each bit in the current instance of the N-bit encryption key having a specific binary value that is different from the bit at a corresponding position in the random N-bit updating sequence, without invalidating any bits in the current instance of the N-bit encryption key that does not have a specific binary value.

Description

Updating encryption keys stored in non-volatile memory {UPDATING CRYPTOGRAPHIC KEYS STORED IN NON-VOLATILE MEMORY}

The present invention relates to cybersecurity, and more particularly to cryptographic keys used to encrypt communications.

The entropy H(N,p) = H(N,1-p) of the N-bit encryption key quantifies the randomness of the key. Here, p is the probability that any one of the bits in the key is 0 or 1. Higher entropy keys are more secure than lower entropy keys. For keys with randomness, independence and equally distributed (iid) bits, H(N,p) = NH(p) bits, where H(p) = -(plog ₂ p + (1-p) log ₂ (1-p))(For keys having bits that are random, independent, and identically distributed (iid), H(N,p) = NH(p) bits, where H(p) = -(plog ₂ p + (1-p)log ₂ (1-p))). For example, for unbiased iid bits (p = 0.5), one highest value is obtained such that H(p) becomes H(N,p) = N.

A non-volatile memory (NVM) includes a plurality of single-bit memory cells, and each of the single-bit memory cells may be in a programmed state or a non-programmed state. Typically, a programmed cell has a binary value of 0, while an unprogrammed cell has a binary value of 1. In OTP one-time programmable NVM (NVM), the programming operation cannot be canceled, that is, the programmed cell cannot be subsequently deprogrammed (or “erased”).

An apparatus for generating a new instance of an N-bit encryption key for storage in a non-volatile memory (NVM) belonging to a device in which unprogrammed cells have a specific binary value according to some embodiments of the present invention is provided. The device includes a network interface and a processor. The processor is configured to generate a random N-bit updating sequence. The processor is different from the correspondingly-positioned bit in the random N-bit updating sequence, while not invalidating any bits in the current instance of the N-bit encryption key that does not have a specific binary value. It is further configured to generate a new instance of the N-bit encryption key by invalidating each bit in the current instance of the N-bit encryption key having a binary value. The processor is further configured to create a new instance of the N-bit encryption key, using the network interface, and then communicate the new instance of the N-bit encryption key to the device for NVM so storage.

In some embodiments, the specific binary value is 1, and the processor performs a bitwise AND operation between the N-bit encryption key and the random N-bit updating sequence, thereby It is configured to invalidate each bit in the current instance of the N-bit encryption key that is different from the bit in the corresponding position and has a specific binary value.

In some embodiments, the specific binary value is 0, and the processor

By performing a bitwise OR operation between the current instance of the N-bit encryption key and the random N-bit updating sequence, N-bits that are different from the bits at the corresponding positions in the random N-bit updating sequence and have a specific binary value It is configured to invalidate each bit in the current instance of the encryption key.

In some embodiments, the processor is configured to generate each bit in the random N-bit updating sequence with a probability of having a specific binary value greater than 0.5.

In some embodiments,

The probability is equal to n/2 ^m for a predetermined integer m and a variable integer n,

The processor is

Expanding an unbiased random seed having E bits into N m-bit sequences each corresponding to bits of the random N-bit updating sequence,

For each bit in the random N-bit updating sequence, by setting the bit to a specific binary value in response to the value of the corresponding m-bit sequence being less than n,

It is configured to generate a random N-bit updating sequence.

In some embodiments, after communicating the new instance of the N-bit encryption key to the device, the processor is configured to use the new instance of the N-bit encryption key for encrypting and decrypting the communication with the device. More structured.

In some embodiments, the processor is further configured to encrypt the new instance of the N-bit encryption key using the current instance of the N-bit encryption key prior to communicating the new instance of the N-bit encryption key to the device.

According to some embodiments of the present invention, non-programmed ones of cells having a specific binary value, non-including plurality of single-bit cells configured to store an N-bit encryption key. An apparatus comprising a volatile memory (NVM) and a processor is further provided. The processor is configured to generate a random N-bit updating sequence. The processor differs from the bit at the corresponding position in the random N-bit updating sequence, and does not invalidate any bits in the current instance of the N-bit encryption key that do not have a specific binary value, and N-bits with a specific binary value. It is further configured to create a new instance of the N-bit encryption key by invalidating each bit in the current instance of the bit encryption key. The processor is configured to create a new instance of the N-bit encryption key and then replace the current instance of the N-bit encryption key with a new instance of the N-bit encryption key in the NVM.

In some embodiments,

The processor is configured to generate each bit in the random N-bit updating sequence with a specific probability to have a specific binary value,

The processor is further configured to calculate a specific probability prior to generating the random N-bit updating sequence such that the expected entropy of the new instance of the key for the current instance of the key is not less than a predefined threshold E less than N.

In some embodiments, the specific probability is greater than 0.5.

According to some embodiments of the present invention, there is further provided a method of generating a new instance of an N-bit encryption key for storing non-programmed cells in a non-volatile memory (NVM) having a specific binary value. The method comprises the steps of generating a random N-bit updating sequence and of a corresponding position in the random N-bit updating sequence, without invalidating any bits in the current instance of the N-bit cryptographic key having a specific binary value. Creating a new instance of the N-bit encryption key by invalidating each bit in the current instance of the N-bit encryption key that is different from the bit and has a specific binary value.

In some embodiments, generating the random N-bit updating sequence includes generating each bit in the random N-bit updating sequence with a probability of having a specific binary value greater than 0.5.

In some embodiments, the method further includes, prior to generating a random N-bit updating sequence, identifying a number N1 of bits in a current instance of an N-bit encryption key having a specific binary value; for q -(qlog ₂ q + (1-q) log ₂ (1-q)) = step of solving E/N1 -E is a predefined entropy threshold -; And deriving the probability from q.

In some embodiments, deriving a probability from q includes deriving a probability from q by setting the probability to q.

In some embodiments, deriving the probability from q includes deriving the probability from q by setting the probability to a maximum value n/2 ^m not greater than q. Here, m is a predetermined integer and n is a variable integer.

In some embodiments, the method prior to generating the random N-bit updating sequence,

Identifying a number N1 of bits in the current instance of the N-bit encryption key having a specific binary value; And

-(qlog ₂ q + (1-q) log ₂ (1-q)) is not less than E/N1, further comprising the step of setting the probability as a maximum value among multiple predefined values of q. Here, E is a predefined entropy threshold.

According to some embodiments of the present invention, a method is further provided that enables multiple updates of an N-bit encryption key in a non-volatile memory (NVM) in which non-programmed cells have a specific binary value. The method is different for updates, such that for each i-th update of the updates, the expected entropy of the new instance of the N-bit encryption key for the current instance of the N-bit encryption key is not less than a predefined threshold E less than N. And calculating each probability {q _i }(i = 1??U). Here, (i) a new instance of the N-bit encryption key is located at a corresponding position in the N-bit random updating sequence, without invalidating any bits in the current instance of the N-bit encryption key having a specific binary value. Generated by invalidating each bit in the current instance of the N-bit encryption key that is different from the bit and has a specific binary value, and (ii) the probability that each bit in the N-bit random updating sequence has a specific binary value q _i Is created with The method further includes providing probabilities that will be used to perform the updates after calculating probabilities.

In some embodiments, each of the probabilities is greater than 0.5.

을 푸는 단계(여기서, q₀는 1) 및 q로부터 q_i를 도출하는 단계를 포함한다.In some embodiments, calculating the probabilities comprises, for each i-th update of the updates, for q

Solving (where q ₀ is 1) and deriving q _i from q.

By setting the In some embodiments, deriving the q _i q from the q _i to q, and a step of deriving from q _i q.

By setting the In some embodiments, deriving from q _i q is the maximum value n / 2 ^m is not greater than q q _i, and a step of deriving from q _i q. Here, m is a predetermined integer and n is a variable integer.

보다 작지 않은 q의 다중 미리 정의된 값들 중 최대값으로 q_i를 설정하는 단계를 포함한다. 여기서, q0은 1이다.In some embodiments, calculating the probabilities comprises, for each i-th update of the updates, -(qlog ₂ q + (1-q)log ₂ (1-q)) is

And setting q _i to a maximum value among multiple predefined values of q not less than. Here, q0 is 1.

The invention will be more fully understood from the detailed description of the following embodiments in conjunction with the drawings.

1 is a schematic diagram of a system for updating an encryption key according to some embodiments of the present invention.
2 is a schematic diagram of creation of a new instance of an encryption key according to some embodiments of the present invention.
3 is a schematic diagram of a technique for generating a random sequence according to some embodiments of the present invention.
4 is a schematic diagram of a technique for calculating a bit-generation probability according to some embodiments of the present invention.
5 is a schematic diagram of a method for enabling multiple updates of an encryption key according to some embodiments of the present invention.

Introduction

In the context of the present application, including the claims, "update" of an encryption key means (i) calculation of a new instance of the key, (ii) replacement of the current instance of the key with a new instance of the key in memory, or (iii) It may refer to both (i) and (ii).

This specification generally assumes that in NVM, programmed cells have a binary value of 0, while non-programmed cells have a binary value of 1. However, as explicitly mentioned below with reference to FIG. 2, the techniques described herein may also be utilized in NVMs using a reverse convention.

summary

It can be difficult to update the encryption key in non-volatile memory. For example, as described above in the technology behind the invention, the OTP NVM does not allow erasure. In addition, for other types of non-volatile memory that allows for erasure, the update operation can be unstable, and an attacker can terminate the operation after erasing the current value of the key and before writing the new value of the key. Is "freezing" to a known unprogrammed state.

To solve this problem, embodiments of the present invention update the key by changing only the (unprogrammed) 1 bits in the key, without changing any (programmed) 0 bits. In particular, given the current N-bit instance K _i of the key (hereinafter referred to as “K _i ”), an N-bit random sequence of bits S _i (hereinafter referred to as “S _i ”) is generated, and A new instance of the key K _i+1 (hereinafter referred to as “K _i+1 ”) is calculated by performing a bitwise AND operation or any equivalent operation between K _i and S _i . (To ensure that there is enough hard An attacker with knowledge of words, K _i to assume the K _{i + 1),} a new instance of the keys to ensure gateum enough entropy for the current instance, the length of the key N becomes longer than if both 0 bits and 1 bits should be updated.

(It should be noted that, using an alternate descriptive convention, K _i and K _i+1 may be referred to as different keys, not as different instances or values of the same key. Therefore, for example, For example, we can say that K _i+1 is the new key to replace K _i .)

Typically, in order to allow a number of possible update, it S _i is an (indicated below, "q _i") probability q _i for each bit within the same S _i and 1 are generated by biased to greater than 0.5. (In some cases, for the final update of the key, q _i can be exactly 0.5.) In particular, the maximum q _i value that gives the required entropy is calculated numerically, and this maximum value generates S _i Used to do.

In some embodiments, each q _i value is calculated just before the i th update, taking into account the current key K _i . By introduction, when K _i is given, the entropy of K _i+1 is equal to N1 _i *H(q _i ), N1 _i is the number of 1 bits in K _i , and H(q _i ) = -(q _i log ₂ q _i + (1-q _i ) log ₂ (1-q _i )). In order for this entropy to be greater than or equal to a specific threshold E (hereinafter referred to as “E”), H(q _i ) must be greater than or equal to E/N1 _i . Therefore, before the i th update, the quantity E/N1 _i can be calculated. Then, if E/N1i is less than or equal to 1 (the maximum possible value of H(q)), the equation H(q) = E/N1 _i can be solved numerically with respect to q. (It should be noted that the accuracy with which this solution is calculated can be determined by the numerical method used and the manner in which it is implemented. The solution to this equation is q _i * or the closest less than q _i *. A suitable value can be used as the value of q _i .

(여기서, q₀는 1),의 기대값은 K_i가 주어진 K_i+1의 엔트로피를 추정하는 데 이용되므로, 요구되는 엔트로피 E를 획득하기 위해 H(q_i)은

보다 크거나 같아야 한다. (이 양은

(여기서,

= E/N)로 보다 간결하게 작성될 수 있다.) q_i 값들은

이 1보다 큰 것으로 (i=U+1) 확인될 때까지 q₁으로 시작하여 반복적으로 풀릴 수 있다.In other embodiments, the set of q _i values {q ₁ , q ₂ , ... q _U } for use in performing U updates of the key is pre-computed before performing any updates. For this calculation, N1 _i ,

(Wherein, q is _0. 1), the expected value of H (q _i), because used for estimating the entropy of the K _{i + 1} is given K _i, to obtain the required entropy E which is

Must be greater than or equal to (This amount is

(here,

= E/N) can be written more concisely.) q _i values are

It can be solved iteratively starting with q ₁ until it is confirmed to be greater than 1 (i=U+1).

Typically, in order to enable the S _i generated, q _i is in the form of a n / 2 ^m for a predetermined integer n, and m an integer variable. To generate S _i , an unbiased random seed X _i (hereinafter referred to as “X _i ”) including E bits is generated or obtained. Then, X _i is expanded into N m-bit sequences each corresponding to the N bits of S _i -eg, using a hash function. Then, the value of each m-bit sequence is compared to n. If the bit value is less than n corresponding in S _i is set to 1, otherwise the bit is set to zero.

System description

First, reference is made to Fig. 1, which is a schematic diagram of a system 20 for updating an encryption key according to some embodiments of the present invention. In the specific embodiment shown in FIG. 1, the N-bit encryption key "K" is used to encrypt communication between an Internet service provider (ISP) and an Internet of Things (IoT) device 22 via the Internet 24. .

In general, if the device 22 is kept with the same ISP and the security of the key is not compromised, there is no need to update the key. However, if the device 22 switches to another ISP, or the security of the key is compromised, it may be necessary to update the key.

For example, FIG. 1 shows a scenario in which the device 22 is serviced by a first ISP 26a, but thereafter by a second ISP 26b. In this scenario, the second ISP 26b requests the current instance of the key K _i from the first ISP 26a. In response to this request, the first ISP 26a communicates K _i via the Internet 24 to the second ISP 26b. The first ISP 26a may further communicate the value of i to the second ISP 26b. That is, the first ISP 26a may specify the number of updates to the previously performed encryption key. Subsequently, the second ISP 26b creates a new instance of the key K _i+1 , and thereafter, to the device 22, for example, through the router 28 serving the WiFi network to which the device 22 belongs. It communicates K _i+1 through the Internet (24). (Typically, the 2 ISP (26b) by using a, for example, K _i before communicating the K _{i + 1} to the device 22, and encrypts the K _{i + 1.)} Subsequently, the device 22 and the The second ISP 26b may start communication with each other by using K _i+1 for encryption and decryption of communication.

The second ISP 26b comprises a processor and a network interface 43 including, for example, a network interface controller (NIC). The processor 30 is configured to exchange communication with the first ISP 26a and the device 22 (like other devices) via a network interface 32. Processor 30 is further configured to update the encryption key used to encrypt communication with device 22. For example, as described above, the processor 30 may update the key when initiating communication with the device 22. Optionally or additionally, processor 30 may update the key in response to processor 30 (or an external cybersecurity system) to identify that the key has been stolen by an attacker.

Similarly, device 22 includes a processor 34 and a communication interface 36. The processor 34 is configured to exchange communication with the second ISP 26b (like other devices) via the communication interface 36. For example, the communication interface 36 may include a WiFi card that the processor 34 can use to exchange communications through the router 28.

The device 22 further includes a memory 38 in which the processor 34 stores an encryption key. Thus, for example, the memory 38 can initially hold K _i . After receiving K _i+1 from the second ISP 26b, the processor 34 may overwrite K _i with K _i+1 .

Typically, memory 38 is non-volatile. For example, the memory 38 may be an OTP NVM, a flash memory, or an electrically erasable programmable read-only memory (EEPROM). Advantageously, however, as described further below with reference to FIG. 2, updating the cryptographic key does not require deprogramming any memory cells in memory 38.

In some embodiments, as described below with reference to FIG. 5, the second ISP 26b uses a parameter (specifically, the bit-generation probability q _i ) included in the data sheet provided by the server 40. To produce K _i+1 . For example, using network interface 44, server 40 may publish a data sheet on a website. Immediately before generating K _i+1 , the second ISP 26b can retrieve the data sheet from the website and look up the parameters necessary to generate K _i+1 in the data sheet. Alternatively, at any time prior to the creation of K _i+1 , the server 40 can communicate a data sheet (eg, via the Internet 24) to the second ISP 26b, after which the second ISP 26b may store data sheets in volatile or non-volatile memory (not shown). Then, just before generating K _i+1 , the second ISP 26b can retrieve the data sheet from the memory and then look up the relevant parameter.

In other embodiments, the processor 34 of the device 22 will generate a K _{i + 1,} and thereafter communicating the K _{i + 1} to the ISP 2 (26b). In these embodiments, processor 34 may receive the aforementioned data sheet from server 40. In another embodiment, server 40 or any other suitable third party creates K _i+1 , and then K _i+1 to both device 22 and second ISP 26b. Can communicate.

The server 40 includes a processor 42 and a network interface 44 comprising, for example, a NIC. The processor 42 is configured to exchange communication with the second ISP 26b (and/or the device 22) via the network interface 44.

It is emphasized that the components and configuration of system 20 are provided by way of example only. In general, each of the various techniques described herein can be implemented by any suitable processor belonging to any suitable system. For example, the techniques described herein may be used to update an encryption key stored in an embedded subscriber identification module (eSIM) or embedded secure element (eSE) belonging to a mobile phone. For example, the service provider for the mobile phone generates a K _{i + 1,} and communicates the K _{i + 1} to the mobile phone, then the mobile phone is non-belonging to the phone the K _{i + 1} - can be stored in volatile memory, have.

In general, each of the processors described herein may be embedded as a single processor or as a set of cooperative networked or clustered processes. In some embodiments, the functionality of at least one of the processors described herein is implemented only in hardware using, for example, one or more Application-Specific Integrated Circuits (ASICs) or Field-Programmable Gate Arrays (FPGAs). In other embodiments, the functionality of each of the processes described herein is implemented at least partially in software. For example, in some embodiments, each of the processors described herein is embedded as a programmed digital computing device that includes at least a central processing unit (CPU) and random access memory (RAM). Program code, including software programs and/or data, is loaded into RAM for execution and processing by the CPU. The program code and/or data can be downloaded to the processor in electronic form, for example via a network. Optionally or additionally, program code and/or data may be provided and/or stored on non-transitory tangible media such as magnetic, optical or electronic memory. Such program code and/or data, when provided to a processor, creates a machine or special-purpose computer configured to perform the tasks described herein.

Create a new instance of the key

Reference is now made to Fig. 2, which is a schematic diagram of the creation of a new instance of a cryptographic key, in accordance with some embodiments of the present invention.

Figure 2 relates to the scenario shown in Figure 1, if the processor 30 (or, as described above, any other processor) is given the current instance K _i of the key, a new instance K of the N-bit encryption key Generate _i+1 As described in the overview with reference to FIG. 1, K _i+1 is created so that replacing K _i with K _i+1 in the NVM does not require deprogramming arbitrary memory cells. Nevertheless, with reference to Figure 4 as will be described in detail below, the expected entropy of the K _{i + 1} for the K _i is not less than a predefined threshold, entropy E. (Threshold E less than the number of bits N in the encryption key can be defined, for example, by the security architect of the system 20).

In particular, to generate the K _{i + 1,} the processor generates a first random bit N- updating sequence S _i. Next, the processor invalidates each bit in K _i that differs from the bit in the corresponding position in S _i and has a binary value of 1, without invalidating any bits in K _i that do not have a binary value of 1. Generate _i+1 2 shows two negative bits, respectively, indicated by upward arrows.

Typically, as illustrated in Figure 2, the processor produces a K _{i + 1} by performing a bit-wise AND operation between K _i and S _i. Thus, K _i within some one bits, but replaced with K _{i + 1} in bit 0, K _i within 0 bits are not replaced by one bit, so that keys are updated in NVM without having to also de-program certain cells I can.

The processor generating a respective bit _i within S 1 was the probability q and _i, q _i is typically greater than 0.5. (As mentioned in the overview, in some cases, q _i may be exactly 0.5 for the last update of the key.) In some embodiments, q _i is described above with reference to FIG. 1 by the server 40. As such, it is specific to the data sheet provided. Such a data sheet may for example include a lookup table specifying q _i for one or more values of E, one or more values of N and various values of _i . In other embodiments, the processor computes q _i . Further details regarding the calculation of q _i are described below with reference to FIG. 4.

For the unprogrammed memory cells have a binary value inverse NVM rules having 0 (NVM reverse convention), the processor generates each bit in S _i to zero probability q _i. After that, the processor, for example by performing a bit-wise OR operation between K _i and S _i, K _i invalidates the bit which is different in each of the 0 bit position S _i in response.

Generate random sequence

Reference is now made to Figure 3 a schematic view of a technique for generating a random sequence S _i in accordance with some embodiments of the present invention. This technique assumes that q _i is equal to n/2 ^m for a predetermined integer m and a variable integer n. (For example, m can be 10, so q _i = n/1024)

To produce the S _i, the processor will first create or obtain the unbiased random seed X _i has the E-bit from an external source. (X _i, so that each bit of a probability of 1 in 0.5, X _i is biased language.) The processor further look-up the q _i = n / 2 ^m or calculated. Then, the processor extends the X _i corresponding to the N-bit sequence {m- Zij} (where, j = 1 N ??), each of the bits of S _i. For example, the processor first m- bit sequence by applying a hash function f (X, c) the X _i with each of the N different counter c, for example, corresponding to the first bits of S _i Z _i1 is the same as f(X _i , 1), and the second m-bit sequence Z _i2 corresponding to the second bit of S _i is the same as f(X _i , 2). Examples of suitable hash functions include secure hash algorithm (SHA) functions such as SHA-2, SHA-256, SHA-512, and SHA-3.

Next, for each bit within the S _i, the processor sets a bit to 1 in response to the value of the bit sequence corresponding m- smaller than n. For example, if Z, if _i1 is smaller than n, S _i is within the first bit is set to one, otherwise, the bit is set to zero.

Notwithstanding the specific technique shown in Fig. 3, S _i is generated using any other suitable technique (even if q _i is not in n/2 ^m form) if each bit in S _i has a probability q _i It should be noted that it can be.

Computing the bit-generated probability for a single update

Reference is now made to Fig. 4, which is a schematic diagram of a technique for calculating a bit-generated probability q _i in accordance with some embodiments of the present invention.

In some embodiments, a processor for generating a K _{i + 1} and calculates a q _i before generating the S _i. Typically, in these embodiments, the processor first identifies the number of 1 bits N1 _i in K _i . Next, as shown in Figure 4, the processor solves H(q) = -(qlog ₂ q + (1-q)log ₂ (1-q)) = E/N1 _i for q, and this solution Is represented in FIG. 4 by the notation q _i ^* . (In most cases, there are two solutions for the equation, the processor selects the larger of the two solutions from the solution.) After that, the processor derives from q _i q _i ^*. For example, the processor can set q _i to q _i ^* or to a maximum n/2 ^m less than or equal to q _i ^* . (In other words, the processor finds the highest integer n where n/2 ^m is less than or equal to q _i ^* .)

As described above in summary, given the K _i entropy of K _{i + 1} is equal to the _{N1 i * H (q i)} . Therefore, by setting q _i to the nearest suitable value less than q _i ^* or q _i ^* , the processor effectively selects the largest suitable value of q _i giving at least the entropy of E.

Instead of solving q _i ^* , the processor defines multiple values of q and then sets q _i to the largest of these values where H(q) is not less than E/N1 _i . For example, the processor is an array of values [2 ^m-1 /2 ^m , (2 ^m-1 +1)/2 ^m , ?? (2 ^m -1)/2 ^m ], then set q _i to the maximum of these values where H(q) is not less than E/N1 _i .

When E/N1 _i is greater than 1, the processor does not generate K _i+1 because the required entropy E cannot be obtained. In this case, the processor may, for example, generate an appropriate error message indicating that the memory 38 in the device 22 needs to be replaced or erased.

Precompute bit-generated probabilities for multiple updates

In some embodiments, the processor generating K _i+1 does not use N1 _i to compute q _i . Rather, the processor precomputes a sequence of q _i values for multiple updates of the key based on the expected value N1 _i ^* of N1 _i at each update. Alternatively, server 30 (FIG. 1) may generate a data sheet specifying respective sequences of q _i values for one or more pairs of N and E values. Subsequently, as described above with reference to Fig. 1, the server 40 is configured with any party (such as the second ISP 26b) that wants to update the encryption key in the manner described above with reference to Figs. party) can provide a data sheet.

In this regard, reference is now made to Fig. 5, which is a flow diagram of a method 46 for enabling multiple updates of a cryptographic key in accordance with some embodiments of the present invention. In particular, in method 46, for one or more different (N,E) pairs (i.e., one or more different pairs of values consisting of (i) the number of bits in the encryption key N and (ii) the entropy threshold E) q _i } A data sheet specifying the sequences is created and provided. Method 46 is typically performed by processor 42 of server 40 as described above. Alternatively, a subset of the steps of method 46 (e.g., calculation of {q _i } for a single (N,E) pair) may be applied to a processor such as processor 30 of second ISP 26b to update the key. Can be done by

The method 46 begins with a selection step 47 where the processor 42 selects the next predefined (N,E) pair from which the sequence of bit-generated probabilities is to be calculated. (Each (N,E) pair can be provided to the processor 42 by a security expert, for example.) Next, the processor, for U updates of the key, has different respective probabilities {q _i } ( Here, i = 1??U) is calculated. Key prediction of the new instance of the (K _{i + 1)} for the current instance of the computed each q _i value, when a new instance of a key, see Fig. 2 and 3 to generate, as described above, the key (K _i) Intropy is not less than E. That is, q _i is generally calculated as described above with reference to FIG 4, K _i expected entropy of K _{i + 1} for the (H (q) * N1 _i ^*) is the actual entropy (unknown in advance) Is used instead.

를 계산한다. 다음으로, 제1 검사 단계(52)에서, 프로세서는 E/N1_i ^*이 1보다 작거나 같은지 여부를 체크한다. 만약 그렇다면, 프로세서는 설정 단계(54)에서 q_i를 H(q)가 E/N1_i ^*보다 작지 않은 q의 최대 적합한 값으로 설정한다. 예를 들어, 도 4를 참조하여 전술한 바와 같이, 프로세서는 q_i를 (H(q_i ^*) = E/N1_i ^*인) q_i ^* 또는 q_i ^*보다 낮은 가장 가까운 적합한 값으로 설정할 수 있다. 이어서, 증가 단계(56)에서, 프로세서는 인덱스 i를 증가시킨다.More specifically, following the selection step 47, the processor sets q ₀ to 1 and initializes the index i to 1 in the initialization step 48. Then, the processor iteratively computes q _i until the expected entropy of the new instance of the key is less than E, and increments the index. In order to calculate q _i , the processor first in the calculation step 50

Calculate Next, in a first check step 52, the processor checks whether E/N1 _i ^* is less than or equal to 1. If so, the processor sets q _i to the maximum suitable value of q in which H(q) is not less than E/N1 _i ^* in the setting step 54. For example, as described above with reference to FIG. 4, the processor may set q _i to the nearest suitable value lower than (H(q _i ^* ) = E/N1 _i ^* ) q _i ^* or q _i ^*. have. Then, in increment step 56, the processor increments index i.

In the first check step 52, if E/N1 _i ^* is found to be greater than 1, the processor does not calculate q _i for the current index i. Rather, the sequence computed so far {q ₁ , q ₂ , ?? q _U } (where _U (less than the current index) is the maximum number of updates allowed for the key) is added as (N,E) to the data sheet in the data-sheet-update step 58.

Following the data-sheet-update step 58, the processor checks in a second check step 60 whether there are more (N,E) pairs left. If so, the processor returns to selection step 47, computes {q _i } for the selected (N,E) pair, and then updates the data sheet. Otherwise, the processor provides a completed data sheet for use in updating the cryptographic key in the provision step 62. For example, as described above with reference to FIG. 1, the processor may upload a data sheet to a website or communicate the data sheet to another device.

As described above with reference to FIG. 2, each q _i value is typically greater than 0.5. (Although, in some cases, q _U may be exactly 0.5.) As can be seen by observing the graph of H(q) shown in Fig. 4, if E/N1 _i ^* increases with i, i increases The values of q _i ^* (and hence q _i ) decrease as you do. For example, for E=80 and N=256, method 46 is a decreasing sequence of 11 q _i ^* values (0.943, 0.938, 0.933, 0.926, 0.918, 0.907, 0.893, 0.872, 0.841, 0.785 and 0.623) is returned. (The meaning above is that the 256-bit key can be updated 11 times using the technique described here, provided the required entropy does not exceed 80 bits.)

Given the data sheet, the processor creating a new instance of the key, such as processor 30 of the second ISP 26b, looks up the appropriate q _i values given by N, E and i. (As described above with reference to FIG. 1, the first ISP 26a may specify i as the second ISP 26b.) Subsequently, as described above in FIGS. 2 and 3, the processor q _i using the generated updating the sequence S _i, and then using the S _i to generate a K _{i + 1} from the K _i.

Claims (15)

An apparatus for generating a new instance of an N-bit encryption key for storage in a non-volatile memory (NVM) belonging to a device, wherein non-programmed cells have a specific binary value,
Network interface; And
Processor
Including,
The processor is
Generate a random N-bit updating sequence,
Different from the bit at the corresponding position in the random N-bit updating sequence, and having the specific binary value, without invalidating any bits in the current instance of the N-bit encryption key that does not have the specific binary value. Creating the new instance of the N-bit encryption key by invalidating each bit in the current instance of the N-bit encryption key,
Using the network interface, after generating the new instance of the N-bit encryption key, communicating a new instance of the N-bit encryption key to the device for storage in the NVM,
Device. The method of claim 1,
The processor is
By performing a bitwise AND operation between the current instance of the N-bit encryption key and the random N-bit updating sequence, it is different from the bit at the corresponding position in the random N-bit updating sequence, and the specific binary Configured to invalidate each bit in the current instance of the N-bit encryption key having a value,
Device. The method of claim 1,
The processor is
Configured to generate each bit in the random N-bit updating sequence with a probability of having the specific binary value greater than 0.5,
Device. The method of claim 3,
The probability is equal to n/2 ^m for a predetermined integer m and a variable integer n,
The processor is
An unbiased random seed having E bits is extended into N m-bit sequences respectively corresponding to bits of the random N-bit updating sequence, and for each bit in the random N-bit updating sequence, the Configured to generate the random N-bit updating sequence by setting the bit to the specific binary value in response to the value of the corresponding m-bit sequence being less than n,
Device. A non-volatile memory (NVM) comprising a plurality of single-bit cells, configured to store an N-bit encryption key, the non-programmed one of the cells having a specific binary value; And
Processor
Including,
The processor is
Generate a random N-bit updating sequence,
Different from the bit at the corresponding position in the random N-bit updating sequence, and having the specific binary value, without invalidating any bits in the current instance of the N-bit encryption key that does not have the specific binary value. By invalidating each bit in the current instance of the N-bit encryption key, a new instance of the N-bit encryption key is created,
After creating the new instance of the N-bit encryption key, replacing the current instance of the N-bit encryption key with the new instance of the N-bit encryption key in the NVM,
Device. The method of claim 5,
The processor is
Configured to generate each bit in the random N-bit updating sequence with a specific probability to have the specific binary value,
The processor is
Prior to generating the random N-bit updating sequence so that the expected entropy of the new instance of the N-bit encryption key for the current instance of the N-bit encryption key is not less than a predetermined threshold E less than N, , Further configured to calculate the specific probability,
Device. The method of claim 6,
The specific probability is greater than 0.5,
Device. In a method of creating a new instance of an N-bit encryption key for storage in a non-volatile memory (NVM), in which non-programmed cells have a specific binary value,
Generating a random N-bit updating sequence; And
Different from the bit at the corresponding position in the random N-bit updating sequence, and having the specific binary value, without invalidating any bits in the current instance of the N-bit encryption key that does not have the specific binary value. Generating the new instance of the N-bit encryption key by invalidating each bit in the current instance of the N-bit encryption key
Containing,
Way. The method of claim 8,
The invalidation step
Performing a bitwise AND operation between the current instance of the N-bit encryption key and the random N-bit updating sequence
Containing,
Way. The method of claim 8,
Generating the random N-bit updating sequence comprises:
Generating each bit in the random N-bit updating sequence with a probability of having the specific binary value greater than 0.5
Containing,
Way. The method of claim 10,
Prior to generating the random N-bit updating sequence,
Identifying the number of bits N1 in the current instance of the N-bit encryption key having the specific binary value
for q -(qlog ₂ q + (1-q) log ₂ (1-q)) = step of solving E/N1 -E is a predefined entropy threshold -; And
deriving the probability from q
Further comprising,
Way. The method of claim 11,
The step of deriving the probability from q is
Deriving the probability from q by setting the probability to q
Containing,
Way. The method of claim 11,
The step of deriving the probability from q is
Deriving the probability from q by setting the probability to the highest value n/2 ^m not greater than q -m is a predetermined integer, n is a variable integer-
Containing,
Way. The method of claim 10,
The above probability is
Is equal to n/2 ^m for a predetermined integer m and a variable integer n,
Generating the random N-bit updating sequence comprises:
Extending an unbiased random seed having E bits into N M-bit sequences respectively corresponding to bits of the random N-bit updating sequence; And
For each bit in the random N-bit updating sequence, setting the bit to the specific binary value in response to the value of the corresponding m-bit sequence being less than n
Containing,
Way. In a method for enabling multiple updates of an N-bit encryption key in a non-volatile memory (NVM), in which non-programmed cells have a specific binary value,
For each i-th update of the updates, such that the expected entropy of the new instance of the N-bit cryptographic key for the current instance of the N-bit cryptographic key is not less than a predefined threshold E less than N, the updates Calculating each probabilities that are different for {q _i } (i = 1??U); And
After calculating the probabilities, providing the probabilities to be used to perform the updates.
Including,
The new instance of the N-bit encryption key is
Different from the bit at the corresponding position in the N-bit random updating sequence, and having the specific binary value without invalidating any bits in the current instance of the N-bit encryption key that does not have the specific binary value Generated by invalidating each bit in the current instance of the N-bit encryption key,
Each bit in the N-bit random updating sequence is
Generated by the probability q _i having the specific previous value
Way.

Images