DE102017202201A1 - Electronic component - Google Patents

Abstract

The invention relates to an electronic component which is designed as a reliable platform module and thus as an independent component and which has as components a crypto-processor (104) and a microeleco-mechanical structure (108) which serves to generate at least one key. having. The nature of the component has an effect on the at least one property of the microelectromechanical structure (108).

Description

The invention relates to an electronic component in which a key can be stored or stored, and to a method for storing a key in such an electronic component.

State of the art

One of the central challenges for the implementation as well as the acceptance of users in the Internet of Things is security. This requires, among other things, solutions for the generation and secure storage of cryptographic keys.

Furthermore, it should be noted that in modern electrical systems a variety of sensors and actuators are used, which are typically connected to a central controller. This captures sensor data and controls the actuators. The increasing networking of such electrical systems, such as. Via the Internet, requires a hedge of communication between the controller and the sensors and actuators. For this purpose, it is known to encrypt information exchanged by means of encryption methods so that they can not be utilized by unauthorized third parties and possibly manipulated. These encryption methods require keys which, in turn, must be securely generated and stored.

One possible approach to increasing security in these areas is a hardware component called the Trusted Platform Module (TPM). The TPM is, for example, a processor which, for example, is installed on the motherboard of a computer because of the complexity and vulnerability of software as a separate component or chip. With such a TPM, computers or similar devices can be enhanced with basic security features such as encryption or signatures.

It is assumed that the TPM is absolutely trustworthy because it is protected against software manipulation due to the system architecture. The basis of a TPM is the authorization key or endorsement key (EK), which never leaves the TPM and can not be accessed from the outside. A schematic representation of a TPM is in 1 to see.

One approach to generating cryptographic keys is through the use of so-called Physical Unclonable Functions (PUFs). Thus, a method is described in which cryptographic keys can be derived from a physical or physical structure. For this purpose, the physical system is subjected to a so-called challenge. This challenge can vary greatly depending on the approach. The system responds to the challenge with a characteristic response (response) from which cryptographic keys can be generated. Such a Challenge Response Pair (CRP) is unique in the case of a PUF and, in principle, is the fingerprint of the system. This fingerprint is usually based on process variations in the production of the system. The exact expression of the fingerprint can not be predetermined, not even by the manufacturer, which means that the PUF should also be unklonbar. In general, the behavior of a PUF is based on inherent process variations in manufacturing.

An advantage of this hardware-based key generation is that it no longer requires digitally stored keys. Above all, this offers an enormous gain in security, since digitally stored keys can be easily read out and copied. In addition, this solution can be potentially more cost-effective because digitally stored keys must be extensively protected if they are reasonably safe from invasive attacks.

The requirements that a key must meet in order to be used in cryptographic applications, such as: As encryption and authentication to be used, however, are very extensive. So this must, for example, have a maximum entropy, he may z. For example, and it must have a certain minimum length, optimally in the range of 128 bits.

There are already different concepts for PUFs. An overview of these is, for example, given in: Physically Unclonable Functions: Constructions, Properties and Applications, Maes, 2013. Known PUFs are, for example:

- SRAM-based PUFs

One of the most popular PUFs is the SRAM-based PUFs. These make use of the fact that many of the SRAM cells repeatably assume either the status "1" or the status "0" when switched on. The challenge with the SRAM-based PUFs is thus the switching on of the SRAM and the selection of the addresses of the SRAM cells.

- MEMS-based PUFs

MEMS (Micro-Electro-Mechanical Systems) are devices that integrate logic elements and micromechanical structures in a chip or component. These can be mechanical and electrical Process information. Elements of MEMS are, for example, sensors, actuators, oscillators and filters.

MEMS-based structures, e.g. As MEMS sensors are also suitable for use as PUFs. Due to manufacturing variations, a MEMS-based structure has a unique fingerprint based on its intrinsic properties. This has already been shown ( "Mobile Device Identification via Sensor Fingerprinting" by Bojinov et al. in CoRR, 2014 or "Digital Fingerprints for Low Cost Platforms Using MEMS Sensors" from Aysu et al. in Proceedings of the Workshop on Embedded Systems Security, 2013 ).

In the case of MEMS-based PUFs, the challenges can be very different, for example, a signal with a defined voltage amplitude or frequency.

The responses may be mechanical and / or electrical properties, e.g. B. mechanical resonance frequencies, vibration amplitudes, capacities, etc.

In the publication "MEMS Gyroscope as Physical Unclonable Functions", Oliver Willers et al., CCS 16, 24-28 October 2016, Vienna, Austria , the use of MEMS-based structures for the generation of keys is described.

The publication US 2015/0200775 A1 describes a method for determining a key in connection with a MEMS structure. In this, a plurality of physical quantities of the device and a feature vector of the device having a plurality of values are determined. Each value corresponds to a different physical quantity of the plurality of physical quantities. The key is derived from this feature vector. It should be noted that the MEMS device may also include multiple MEMS structures. In this case, a feature vector is determined for each MEMS structure.

In addition to the generation of the keys, it should be noted that they must be stored in such a way that they are protected against attacks. Thus, the aim is to improve the safety of TPMs or similar modules, especially against invasive attacks.

It has been shown in the past that common TPMs can be "cracked" by invasive attacks. This is particularly because TPMs work with digitally stored keys, with the EK residing in nonvolatile memory, which can be read, analyzed, modified and copied using invasive attacks. A promising approach to improve the safety of TPMs or similar modules, especially against invasive attacks, is the use of PUFs. So far, SRAM-based solutions have been the focus of attention. B. "Providing Root of Trust for ARM Trust Zone Using On-Chip SRAM", by Zhao et al. in Cryptology ePrint Archive, Report 2014/464, 2014 ,

It should be noted, however, that SRAM-based PUFs, as well as other purely electrical PUF approaches, do not offer completely safe protection against invasive attacks. For SRAM-based PUFs, successful attacks have already been documented, in which the secret key was read out by an invasive attack and the system itself was subsequently physically cloned ( "Cloning Physically Unclonable Functions" by Helfmeier et al. in HOST, 2013 ).

Disclosure of the invention

Against this background, an electronic component according to claim 1 and a method according to claim 8 are presented. Embodiments emerge from the dependent claims and from the description.

It can be seen that microelectromechanical or MEMS-based structures offer significantly better protection than known approaches. This is in particular because here mechanical properties, eg. B. mechanical resonance frequencies, vibration amplitudes, etc. are used, which are much more sensitive to changes in their environmental conditions, eg. B. change of mechanical stress state, and thus provide intrinsic protection against invasive attacks. In addition, the key generation is based on analogue measured values, which are determined in a self-contained system. Interventions from the outside, z. As a contact of electrical connections between MEMS and evaluation, lead to a change in the electrical parasite and thus to a change of absolute measures. The prerequisite is that the MEMS-based structure, the unit for controlling and evaluating it, and the unit performing the cryptographic operations are in one package or package (System-in-Package: SiP). Due to manufacturing variations, each MEMS structure has a unique fingerprint based on its intrinsic properties.

It is now a MEMS structure with at least one property that is used for the generation of keys, inaccessible in a component, the proposed electronic component included. This can be achieved that the at least one property or the Properties of the MEMS or the MEMS structure are not accessible to unauthorized persons, ie that they can not access the properties. The component, which in this case is designed as a reliable platform module or trusted platform module and thus as an independent component or chip, represents a closed package or a corresponding packaging. When the package is opened, the properties of the product change with respect to environmental influences sensitive MEMS, so that the key or keys are not readable or are. This means that the nature of the electronic component or of the component has an effect on the at least one property of the microelectromechanical structure. The key or keys is thus dependent on the at least one property of the MEMS structure.

The components of the presented electronic component can thus not be accessed. These are safely included in the package without being accessed by unauthorized persons.

In an embodiment, the use of MEMS-based structures that provide intrinsic protection against invasive attacks for the secure storage of a secret key, eg. As a grant key or an endorsement key (EK), in a trusted module, eg. As a TPM proposed.

The presented method serves to store a key and provides that it is stored in a MEMS structure which is provided in a component of the type described. The key is typically defined by the characteristics of the MEMS structure and can be derived therefrom as needed. It will then be available temporarily, but will never be permanently stored digitally.

If necessary, the key can be recreated again. However, this is nowhere permanently stored.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the respectively specified combination but also in other combinations or in isolation, without departing from the scope of the present invention.

list of figures

• 1 shows a schematic representation of a TPM according to the prior art.
• 2 shows a schematic representation of an embodiment of the presented electronic component.

Embodiments of the invention

The invention is schematically illustrated by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

1 shows in a schematic representation of a TPM, the whole with the reference numeral 10 is designated. This TPM 10 is as an integrated building block 12 executed. In the building block 12 are secured inputs and outputs 14 , an encryption or cryptography processor 16 , a non-volatile memory 18 and a volatile memory 20 intended.

The TPM 10 is a device that adds a basic security feature to a computer or similar device. These functions serve, for example, the objectives of license protection or data protection. The chip behaves in part like a built-in smart card, but with the difference that it is not tied to a specific user, but to the local computer.

A device with a TPM, specially adapted operating system and corresponding software together form a so-called Trusted Computing Platform (TC platform), which is particularly protected against software manipulation of third parties.

In the cryptography processor 16 are a random generator 30 , a key generator 32 , in particular an RSA key generator, a hash generator 34 and an encryption / decryption and signature unit 36 intended.

In the non-volatile memory 18 are a grant key or endorsement key 40 and a storage root key 42 intended. The endorsement key (EK) 40 is the TPM 10 uniquely assigned. The key length is set to 2048 bits and the algorithm to the RSA method. For security and privacy reasons, the private part of the EK 40 may use the TPM 10 never leave. This also excludes a backup. The public part of the EK 40 can be read with a given command. The reading can be blocked with a given command, this one typically final and can not be repealed.

The Storage Root Key (SRK) 42 is an RSA key with a length of 2048 bits. It serves to encrypt further used keys, such as private keys for a user's e-mail communication, and therefore represents the root of the TPM key tree. If the owner of the computer changes, a new SRC is typically created. It should be noted that the SRK is not migratable.

RSA (Rivest, Shamir and Adleman) is an asymmetric, cryptographic technique that can be used for both encryption and digital signing. The method uses a private key for decryption and a public key for encryption.

In the volatile memory 20 are a platform configuration register 50 , Identity confirmation keys or attestation identity keys 52 and stored keys 54 intended. Attestation Identity Keys 52 (AIK) are RSA keys with a fixed length of 2048 bits a fixed public exponent e = 2 ¹⁶ + 1. These are not migratable and are allowed by the TPM 10 used only for the signature of values in the so-called platform configuration register 50 or Platform Configuration Register (PCR). PCR is part of the volatile memory in the TPM 10 and responsible for storing state images of the current configuration of software and hardware.

These AIKs were introduced because the EK of a TPM can not be directly used for the certification of platform integrity.

As previously mentioned, the MEMS-based structure, the unit for driving and evaluating it, and the unit performing the cryptographic methods should be in a package. It is on this 2 directed.

2 shows an embodiment of the proposed electronic module, the whole with the reference numeral 100 is designated. This building block 100 includes an interface 102 and a crypto processor 104 whose task is to perform the cryptographic operations, such as encryption, signatures, RSA key generator, random number generator, hash generator. The building block 100 also includes a volatile memory 106 and a MEMS structure 108 containing an application specific integrated circuit (ASIC) 110 assigned.

In the cryptography processor 104 may include a random number generator, a key generator, in particular an RSA key generator, a hash generator and / or an encryption / decryption and signature unit 36 be provided.

In the volatile memory 106 For example, a platform configuration register, attestation identity keys, and stored keys may be stored.

The MEMS-Struktor 108 and the ASIC 110 are two separate components that are typically interconnected by bond wires, typically within a SiP. It is also conceivable that the ASIC 110 the cap of a sensor of the MEMS structure 108 replaced, this is called ASIC cap. In this case, in principle, only one component is provided.

Compared to the TPM 10 according to 1 it can be seen that the non-volatile memory (reference numeral 18 in 1 ) is now replaced by the MEMS and its ASIC. This means that the EC is now stored in the MEMS-based structure itself, providing intrinsic protection against invasive attacks.

The MEMS structure typically does not have its own memory. The key, when needed, is generated by the ASIC from the mechanical and / or electrical properties of the MEMS structure 108 derived. Ie. the key is stored in the structure itself.

The statements regarding the volatile memory (reference numeral 20 in 1 ) and the crypto-processor (reference numeral 16 in 1 ) also apply to the volatile memory 106 and the crypto processor 104 of the electronic component 100 according to 2 to.

Another advantage is that nobody, even the manufacturer, can know the EK. This is the case, since the precise expression of the properties of the MEMS and thus the EK is defined only during packaging, since in particular during the molding process a certain mechanical stress state and the electrical parasites, eg. Between the connections between MEMS and ASIC. This means, on the one hand, that the user no longer has to rely on having to trust the manufacturer of the TPM, since even this one does not know the EK.

The proposed device and method can be used to develop a new generation of TPMs with increased safety against invasive attacks.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2015/0200775 A1 [0016]

Cited non-patent literature

• "Mobile Device Identification via Sensor Fingerprinting" by Bojinov et al. in CoRR, 2014 or "Digital Fingerprints for Low Cost Platforms Using MEMS Sensors" [0012]
• Aysu et al. in Proceedings of the Workshop on Embedded Systems Security, 2013 [0012]
• "MEMS Gyroscope as Physical Unclonable Functions", Oliver Willers et al., CCS 16, October 24-28, 2016, Vienna, Austria. [0015]
• "Providing Root of Trust for ARM Trust Zone Using On-Chip SRAM", by Zhao et al. in Cryptology ePrint Archive, Report 2014/464, 2014 [0018]
• "Cloning Physically Unclonable Functions" by Helfmeier et al. in HOST, 2013 [0019]

Claims (10)

Electronic component, which is designed as a reliable platform module and thus as an independent building block and which has as components a cryptography processor (104) and a microelectromechanical structure (108) which serves to generate at least one key with at least one property wherein the electronic component is configured such that its nature has an effect on the at least one property of the microelectromechanical structure (108). Electronic component after Claim 1 in which an application-specific circuit (110) is assigned to the microelectromechanical structure (108). Electronic component comprising as an additional component an interface (102). An electronic component comprising as a further component a volatile memory (106). Electronic component after Claim 4 in which volatile memory (106) stores platform configuration registers, identity confirmation keys and / or stored keys. Electronic component according to one of Claims 1 to 5 in which a random number generator, an RSA key generator, a hash generator and / or an encryption / decryption and signature unit are provided in the cryptographic processor (104). Electronic component according to one of Claims 1 to 6 in which at least one key is deposited in the microelectromechanical structure (108), which is dependent on the at least one property of the microelectromechanical structure (108). Method for storing a key in an electronic component (100), which is designed as a reliable platform module and thus as an independent component, in particular an electronic component (100) according to one of the Claims 1 to 7 wherein the key is stored in a microelectromechanical structure (108) provided in the electronic component (100) as a component. Method according to Claim 8 in which the key is defined by at least one property of the microelectromechanical structure (108). Method according to Claim 9 where the key is derived from the at least one property as needed.

Images