TAMPER-PROTECTED HARDWARE AND METHOD FOR USING SAME

• US 20160359636A1
• Filed: 08/19/2016
• Published: 12/08/2016
• Est. Priority Date: 03/11/2011
• Status: Active Grant

• Current Assignee: Emsycon GmbH
• Original Assignee: Emsycon GmbH
• Inventors: Kreft, Heinz
• Granted Patent: US 9,893,898 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits
• CPC Class Codes: G06Q 20/223 based on the use of peer-to-peer networks
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3278 : using physically unclonable functions [PUF]

Abstract

One of the various aspects of the invention is related to suggesting various techniques for improving the tamper-resistibility of hardware. The tamper-resistant hardware may be advantageously used in a transaction system that provides the off-line transaction protocol. Amongst these techniques for improving the tamper-resistibility are trusted bootstrapping by means of secure software entity modules, a new use of hardware providing a Physical Unclonable Function, and the use of a configuration fingerprint of a FPGA used within the tamper-resistant hardware.

Claims

1. A method for generating a software module, the method comprising:

providing an entity block to be included to the software module, the entity block providing an executable piece of software,

generating a fingerprint of the entity block using a hash function, wherein the fingerprint allows the verification of the integrity of the entity block,

encrypting the fingerprint using the private key of a public key pair, to thereby generate a digital signature of the entity block,

combining the entity block and the encrypted fingerprint to form an integrity protected entity block,

encrypting the integrity protected entity block using a random secret key to thereby form an encrypted and integrity protected entity block,

encrypting the random secret key using the private key of a public key pair, and

generating the software module by combining the encrypted and integrity protected entity block, and the encrypted random secret key.

2. The method according to claim 1, wherein the integrity protected entity block is encrypted using symmetric-key encryption.

3. The method according to claim 1, further comprising the step of compressing the entity block prior to encrypting and combining the entity block and the encrypted fingerprint thereof to form the integrity protected entity block.

4. The method according to claim 1, wherein the entity block of the software module comprises instructions to execute another software module.

5. The method according to claim 4, wherein the instructions enable:

decryption of an encrypted random secret key of the other software module,

decryption of the encrypted and integrity protected entity block of the other software module using the decrypted random secret key, to thereby obtain an integrity protected entity block of the other software module,

decryption of an encrypted fingerprint comprised in the integrity protected entity block of the other software module and

generation of another fingerprint of the entity block using the same hash function as used to generate the encrypted fingerprint of the other software module,

verification of the integrity of the entity block of the integrity protected entity block of the other software module by comparing the decrypted fingerprint with the other generated fingerprint, and

execution of the entity block of the other software module, only in case the integrity of the entity block of the other software module is verified.

6. The method according to claim 1, wherein the private key used for encrypting the fingerprint is different from the private key used for encrypting the random secret key.

7. The method according to claim 6, wherein the public keys corresponding to the private keys for encrypting the fingerprint and random secret key, respectively, are signed by a root certification authority using a private signing key of a signing key pair, the public key of which is provided immune to counterfeit in a device to execute the software module.

8. A method for bootstrapping a hardware by executing a set of software modules in a given order, the method comprising:

a) decrypting an encrypted random secret key of one of said set of software modules to be executed next,

b) decrypting an encrypted and integrity protected entity block of the software module to be executed next, using the decrypted random secret key, to thereby obtain an integrity protected entity block of the software module to be executed,

c) decrypting an encrypted fingerprint comprised in the integrity protected entity block of the software module to be executed next, and

d) generating another fingerprint of the entity block using the same hash function as used to generate the encrypted fingerprint,

e) verifying the integrity of the entity block of the integrity protected entity block of the software module to be executed next by comparing the fingerprint decrypted in step c) with the fingerprint generated in step d), and

f) only in case the integrity of the entity block of the software module to be executed next is successfully verified, executing the entity block of the software module to be executed next,

wherein steps a) to f) are performed for each software module of the set of software modules thereby realizing a chain of trust.

9. The method according to claim 8, wherein the functionality to perform steps a) to f) for the first software module of the set of software modules is implemented in hardware.

10. The method according to claim 8, further comprising:

g) obtaining a certificate comprising one or more public keys, wherein the one or more public keys are signed by a root certification authority using a private signing key of a signing key pair, the public key of which is provided immune to counterfeit in the hardware, and

h) verifying integrity of the one or more public keys comprises in the certificate using the public key provided immune to counterfeit in the hardware, and

wherein one verified public key of the certificate is used for decrypting the encrypted random secret key in step a) and one verified public key of the certificate is used for decrypting the encrypted fingerprint in step c).

11. The method according to claim 10, wherein the functionality to perform steps g) and h) for the first software module of the set of software modules is implemented in hardware.

12. The method according to claim 8, wherein the functionality to perform steps a) to h) for a software module other than the first software module is implemented in hardware within the hardware or is implemented in software within the entity block of the software module executed prior to said given software module.

13. The method according to claim 8, wherein the unsuccessful execution of one or more of steps a) to h) results in interrupting the bootstrapping of the hardware thereby making it temporarily or permanently unusable.

14. The method according to claim 8, wherein the hardware is a tamper-protected hardware module and the functionality provided by the software modules includes at least one of:

an interface filter for cooperating with a filter controller of the tamper-protected hardware module and for controlling messages exchanged via an input/output (I/O)-interface of the tamper-protected hardware module for interfacing with a host device comprising the tamper-protected hardware module,

a license check module implementing an Identification Friend or Foe (IFF) functionality to analyze the local tamper-protected hardware module,

an initial program loader module to coordinate the boot process,

an embedded operation system kernel to handle the various operations of the tamper-protected hardware module'"'"'s application module,

an implementation of an off-line transaction protocol for a transfer of electronic tokens between two tamper-protected hardware modules, and

termination handler of the off-line transaction protocol, in case of an interruption of the execution of the off-line transaction protocol, including a generation of a proof of loss of electronic tokens in response to the off-line transaction protocol terminating in an unfair state.

trusted time source handler comprised in the tamper-protected hardware module,

on-line refresh handler of the trusted time source,

initialization handler of the I/O-key-unit for real-time I/O-encryption and decryption of information exchanged via an I/O-interface of the tamper-protected hardware module,

compensation handler for a loss of electronic tokens using a proof of loss of electronic tokens provided in response to the off-line transaction protocol terminating in an unfair state, and

a die-wrapping cocoon fingerprint checking handler of the tamper-protected hardware module, wrapped by said cocoon.

15. The method according to claim 8, further comprising receiving an update of one or more of the software modules from a third party.

16. A device comprising:

a memory adapted to store a set of set of software modules that are to be executed in a given order; and

a processor adapted to perform the following operations;

a) decrypting an encrypted random secret key of one of said set of software modules to be executed next,

b) decrypting an encrypted and integrity protected entity block of the software module to be executed next, using the decrypted random secret key, to thereby obtain an integrity protected entity block of the software module to be executed,

c) decrypting an encrypted fingerprint comprised in the integrity protected entity block of the software module to be executed next, and

d) generating another fingerprint of the entity block using the same hash function as used to generate the encrypted fingerprint,

e) verifying the integrity of the entity block of the integrity protected entity block of the software module to be executed next by comparing the fingerprint decrypted in step c) with the fingerprint generated in step d), and

f) only in case the integrity of the entity block of the software module to be executed next is successfully verified, executing the entity block of the software module to be executed next,

wherein the processor performs the operations a) to f) are performed for each software module of the set of software modules thereby realizing a chain of trust.

17. A device comprising:

a memory adapted to store an entity block to be included to the software module, the entity block providing an executable piece of software, and

a processor adapted to perform the following operations;

generating a fingerprint of the entity block using a hash function, wherein the fingerprint allows the verification of the integrity of the entity block,

encrypting the fingerprint using the private key of a public key pair, to thereby generate a digital signature of the entity block,

combining the entity block and the encrypted fingerprint to form an integrity protected entity block,

encrypting the integrity protected entity block using a random secret key to thereby form an encrypted and integrity protected entity block,

encrypting the random secret key using the private key of a public key pair, and

generating the software module by combining the encrypted and integrity protected entity block, and the encrypted random secret key.