Hardware-based key generation and recovery

• US 8,127,151 B2
• Filed: 10/13/2009
• Issued: 02/28/2012
• Est. Priority Date: 10/13/2009
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Nelson, Patrick A., Adams, Christian
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US12/578,089
• Publication Number:
  US 20110087897A1
• Time in Patent Office: 868 Days
• Field of Search: 713/193
• US Class Current: 713/193
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system and method of recovering encoded information contained in a device by storing and retrieving at least part of the necessary decoding data by setting and measuring the physical characteristics of the device. Storage and recovery options include, but are not limited to, measurement of electronic or optical characteristics of electrically or optically conductive portions of the device using a range of measurement techniques that include, but are not limited to, time-domain reflectometry.

Claims

1. A method of recovering encoded information stored in a data storage device having at least one signal conductor with predetermined transmission characteristics, an encoded information storage portion having at least one input/output (i/o) interface, and a system clock, the method comprising:

detecting a data access attempt that attempts to read at least a portion of encoded information stored in said encoded information storage portion via said i/o interface;

transmitting, in response to said detecting, at least one pulse along the at least one signal conductor, where said pulse is provided to said signal conductor at a pulse transmission location of said conductor;

detecting transmission characteristics of the at least one signal conductor based on said transmitted pulse, where said pulse is detected at a pulse detection location of said conductor, a return signal propagated along said conductor as a result of said pulse transmission; and

generating a decoding key based on the detected transmission characteristics depending upon both of the pulse transmission location and the pulse detection location that define a signal path along the conductor.

2. The method of claim 1, further comprising:

decoding said at least a portion of encoded information using said decoding key; and

providing the decoded information via said i/o interface in response to the data access attempt.

3. The method of claim 2, where decoding includes:

determining whether the generated decoding key is a correct decoding key; and

decoding said encoded information only if the generated decoding key is correct.

4. The method of claim 3, decoding said encoded information including corrupting or destroying said encoded information if the generated decoding key is incorrect.

5. The method of claim 1, where transmitting includes transmitting at least one electrical voltage pulse.

6. The method of claim 5, where said at least one voltage pulse is a uniform pulse.

7. The method of claim 5, where said at least one voltage pulse includes at least a first and a second voltage pulse and where said first and second voltage pulses have different intensities and/or different widths.

8. The method of claim 5, where said at least one voltage pulse includes at least a first, second, and third voltage pulse and where an interval between the first and second pulses is different than an interval between the second and third pulses.

9. The method of claim 5, where said detecting transmission characteristics includes detecting the voltage of said pulse.

10. The method of claim 1, the method further comprising:

providing the decoding key and the encoded information via said i/o interface in response to the data access attempt.

11. The method of claim 1, where said pulse includes an enveloped voltage pulse waveform having a modulated voltage tone.

12. The method of claim 11, where detecting transmission characteristics includes performing spectral analysis on a return signal created by said enveloped voltage pulse.

13. The method of claim 1, where said transmission characteristics are both predetermined and detected based on time-domain reflectometry techniques.

14. The method of claim 13, where said detecting transmission characteristics includes detecting a leading edge of a reflection of said pulse.

15. The method of claim 13, where detecting transmission characteristics includes converting a sampled time-domain reflectometry reception signal into at least one numerical value.

16. The method of claim 1, where said transmission characteristics are both predetermined and detected based on a pulse travel time between said pulse transmission location and said detection location.

17. The method of claim 16, where said detecting transmission characteristics includes detecting the pulse travel time.

18. The method of claim 16, where a width of a detected pulse and the pulse travel time are detected transmission characteristic used in key generation.

19. The method of claim 1, where said transmission characteristics are both predetermined and detected based on counting a predetermined number of clock cycles after said transmitting and detecting transmission characteristics for said number of clock cycles.

20. The method of claim 19, where detecting transmission characteristics includes sampling a return signal caused by said transmitted pulse such that each clock cycle is associated with a sampled signal value.

21. The method of claim 20, where said sampling a return signal includes associating a first value with each clock cycle where at least one leading edge of a return signal associated with said at least one pulse is detected and associating a second value with each clock cycle where no leading edge of said return signal is detected.

22. The method of claim 19, where generating a decoding key includes generating a decoding key based on the number of clock cycles and on the transmission characteristics detected at each clock cycle.

23. The method of claim 22, where generating includes:

creating a binary number with a number of bits equal to the number of clock cycles such that each bit is associated with a particular clock cycle; and

assigning a value to each bit based on the transmission characteristics detected at the clock cycle associated with a particular bit.

24. The method of claim 1, where said detecting transmission characteristics includes detecting a leading edge of said pulse.

25. The method of claim 1, where said transmission characteristics include characteristics that indicate the total length of said conductor.

26. The method of claim 1, said generating including symmetrically generating a decoding key.

27. The method of claim 1, said generating including asymmetrically generating a decoding key.

28. An apparatus that recovers encoded information stored in a data storage device, the apparatus comprising:

at least one signal conductor with predetermined transmission characteristics;

an encoded information storage portion having at least one input/output (i/o) interface;

a system clock;

an access detection portion that detects an attempt to read at least a portion of encoded information stored in said encoded information storage portion;

a transmitter that transmits, at a pulse transmission location, at least one pulse along said at least one signal conductor;

a detector that determines transmission characteristics of said at least one signal conductor by detecting, at a pulse detection location, a return signal propagated along said conductor as a result of said pulse transmission; and

a key generator that generates a decoding key based on the detected transmission characteristics depending upon both of the pulse transmission location and the pulse detection location that define a signal path along the conductor.

29. The apparatus of claim 28, where the transmitter is an electrical pulse transmitter and the detector is an electrical signal detector.

30. The apparatus of claim 29, where the transmitter is a voltage pulse generator and the detector is a sampling detector.

31. The apparatus of claim 30, where the signal conductor includes a closed loop.

32. The apparatus of claim 29, where the transmitter and detector are part of a time-domain reflectometry measurement device.

33. The apparatus of claim 30, where the signal conductor includes multiple termination points.

34. The apparatus of claim 30, where the signal conductor has a single termination point.

35. The apparatus of claim 30, where the signal conductor has a non-uniform composition.

36. The apparatus of claim 35, where said non-uniform composition includes impedance discontinuities caused by at least one of changes in material composition of the conductor over its length, the presence or absence of a dielectric substrate below the conductor, and the presence of an electrical element along the conductor.

37. The apparatus of claim 30, where the signal conductor includes electrical elements in its conduction path.

38. The apparatus of claim 28, where the transmission location and detection location are the same physical location on the conductor.

39. The apparatus of claim 28, where the transmitter is an optical pulse transmitter and the detector is an optical detector.

40. The apparatus of claim 39, where the signal conductor includes a closed loop.

41. The apparatus of claim 39, where the signal conductor includes multiple termination points.

42. The apparatus of claim 39, where the signal conductor has a single termination point.

43. The apparatus of claim 39, where the signal conductor has a non-uniform composition.

44. The apparatus of claim 43, where the signal conductor includes empty space and optically reflective elements.

45. The apparatus of claim 39, where the signal conductor includes optical elements in its conduction path.

46. The apparatus of claim 28, the apparatus further comprising:

a decoder that decodes said at least a portion of encoded information using said decoding key and provides the decoded information via said i/o interface in response to the data access attempt.

47. The apparatus of claim 46, where the decoder includes:

a key validation sub-unit that determines whether the generated decoding key is a correct decoding key; and

a decoding sub-unit that decodes said encoded information if the generated decoding key is correct.

48. The apparatus of claim 28, where the transmitter is an ultrasonic transmitter and the detector is an ultrasonic detector.

49. The apparatus of claim 28, where the transmission characteristics are both predetermined and detected based on a pulse travel time along the signal path.

50. The apparatus of claim 28, where the transmission characteristics include characteristics that indicate the total length of said conductor.