Telefonaktiebolaget Lm Ericsson (Publ)

Niklas Lindskog

Håkan Englund

Systems and methods are disclosed herein for protecting data in a storage device by encrypting or decrypting the data with a Data Encryption Key (DEK). The storage device is communicatively coupled to a host. In one example, the storage device receives a credential from the host and authenticates the credential with a transformed credential. A Physically Unclonable Function (PUF) generates a PUF response based on a challenge, responsive to successful authentication of the credential from the host. Based on the PUF response, a DEK generation module in the storage device generates a DEK. A crypto module in the storage device uses the DEK and performs encryption of data to be stored in the storage device and/or decryption of data being assessed by the host.

Storage device authenticating host credential and utilizing physically unclonable function (PUF) for data encryption/decryption

Systems and methods are disclosed herein for implementing a secure hardware component by dividing a single Physically Unclonable Function (PUF) into several PUF challenge space subsets and mapping each subset to each requesting entity. In one example of the secure hardware component, the controller divides a challenge space of the PUF into multiple challenge space subsets and performs a mapping of allowed requesting entities to the plurality of challenge space subsets, respectively. The secure hardware component receives a request for an output from the requesting entity, which comprises a set of parameters. The controller determines whether the request is a valid request based on the set of parameters and forwards the challenge to the response generation subsystem. The response generation subsystem generates the output based on the challenge and forwards it to the requesting entity.

Systems and methods for PUF slicing

Systems and methods are disclosed herein for protecting data in a storage device by encrypting or decrypting the data with a Data Encryption Key (DEK). The storage device is communicatively coupled to a host and is locked with the host by secret sharing. In one example, the storage device comprises a Physically Unclonable Function (PUF) configured to, during a key generation phase of operation, generate a set of DEK responses based on a set of DEK challenges (chalDEK) and an assembler configured to obtain a set of SED DEK secret shares (SS) based on the first set of DEK responses, receive additional data, and assemble at least the set of SED DEK secret shares (SS) and the additional data to create a DEK master secret. The storage device also comprises a crypto module configured to receive a DEK based on the master secret and perform encryption and/or decryption of data using the DEK.

Storage device utilizing physically unclonable function (PUF) based secret sharing scheme for data encryption/decryption

A security component () for a device () is disclosed. The security component comprises a Physically Unclonable Function (PUF) () that is operable to accept a plurality of challenges and to generate a corresponding plurality of responses. The security component further comprises control logic () configured to generate a challenge for submission to the PUF on the basis of at least one of measurements of components booted on the device or a measurement of a hardware state of the device. The PUF comprises a plurality of sub functions (), and the challenge determines how the sub functions are used by the PUF to generate a PUF response. Also disclosed is a method () for operating a security component.

Security component having physically unclonable function (PUF) and method of operation

A security component () for a device () is disclosed. The security component () comprises a Physically Unclonable Function (PUF) () having a plurality of sub functions (), and a management module () that is configured to manage the PUF () in accordance with a policy. The management module () comprises a measurement module () configured to receive, from a device boot process, at least one of a measurement of a component on the device or a measurement of a hardware state of the device, and a rule module () configured to compare the received measurement to at least one rule that implements the policy, and to enter a policy state on the basis of the comparison. The management module further comprises a control module () configured to configure the PUF () in accordance with a policy state entered by the rule module. Also disclosed is a method () for operating a security component.

Security component and method of operation

There is provided a verifiable OTP memory device, the memory device including an MTP memory block and an OTP memory block for storing data, and a memory controller. The memory controller is configured to handle write requests and read requests. Each write request and read request pertains to writing data to, and reading data from, respectively, a requested position in either the MTP memory block or the OTP memory block. The memory controller is configured to, in response to the write requests, write the data to the requested position in either the MTP memory block or the OTP memory block. The memory controller is configured to, in response to the read requests, output data as combined from the requested position in the MTP memory block and the requested position in the OTP memory block, regardless if the read requests are for the MTP memory block or the OTP memory block.

Growing community of inventors

LUND, Sweden

Niklas Lindskog