A key management system based on a physically unclonable function, the key management system being characterised by comprising: a plurality of key management components (KMCs) (101 to 10N), each KMC comprising: a PUF unit (111, 11N); a key derivation function logic (121, 12N) coupled to the PUF unit (111, 11N); a key wrap logic (141, 14N) coupled to the PUF unit (111, 11N); and a memory (131, 13N) coupled to the KDF logic and the KWP logic (141, 14N); a load balancer coupled to the plurality of key management components and configured to dispatch a key generation request including a parameter from an external device according to workload of each KMC; and a backup channel coupled to the plurality of key management components; wherein a KMC having minimum workload among the plurality of KMCs (101 to 10N) is designated as the key-generation KMC and the key generation request is dispatched thereto, and remaining KMCs of the plurality of KMCs (101 to 10N) are designated as backup KMCs; wherein upon receiving the key generation request, a PUF unit of the key-generation KMC is configured to generate a first PUF sequence, a KDF logic of the key-generation KMC is configured to generate a key according to the parameter and the first PUF sequence, the key-generation KMC is configured to transmit a key storage request including the key and a first identifier associated therewith to the backup KMCs through the backup channel and transmit the first identifier to the external device, a KWP logic of the key-generation KMC is disabled, and a memory of the key-generation KMC is configured to store the first identifier and the parameter associated therewith; and wherein once the backup KMCs receive the key storage request, a PUF unit of each backup KMC is configured to generate a second PUF sequence, a KDF logic of the each backup KMC is disabled, a KWP logic of the each backup KMC is configured to generate a wrapped key according to the key and the second PUF sequence, and a memory of the each backup KMC is configured to store the first identifier and the wrapped key associated therewith. a plurality of key management components (KMCs) (101 to 10N), each KMC comprising: a PUF unit (111, 11N); a key derivation function logic (121, 12N) coupled to the PUF unit (111, 11N); a key wrap logic (141, 14N) coupled to the PUF unit (111, 11N); and a memory (131, 13N) coupled to the KDF logic and the KWP logic (141, 14N); a PUF unit (111, 11N); a key derivation function logic (121, 12N) coupled to the PUF unit (111, 11N); a key wrap logic (141, 14N) coupled to the PUF unit (111, 11N); and a memory (131, 13N) coupled to the KDF logic and the KWP logic (141, 14N); a load balancer coupled to the plurality of key management components and configured to dispatch a key generation request including a parameter from an external device according to workload of each KMC; and a backup channel coupled to the plurality of key management components; wherein a KMC having minimum workload among the plurality of KMCs (101 to 10N) is designated as the key-generation KMC and the key generation request is dispatched thereto, and remaining KMCs of the plurality of KMCs (101 to 10N) are designated as backup KMCs; wherein upon receiving the key generation request, a PUF unit of the key-generation KMC is configured to generate a first PUF sequence, a KDF logic of the key-generation KMC is configured to generate a key according to the parameter and the first PUF sequence, the key-generation KMC is configured to transmit a key storage request including the key and a first identifier associated therewith to the backup KMCs through the backup channel and transmit the first identifier to the external device, a KWP logic of the key-generation KMC is disabled, and a memory of the key-generation KMC is configured to store the first identifier and the parameter associated therewith; and wherein once the backup KMCs receive the key storage request, a PUF unit of each backup KMC is configured to generate a second PUF sequence, a KDF logic of the each backup KMC is disabled, a KWP logic of the each backup KMC is configured to generate a wrapped key according to the key and the second PUF sequence, and a memory of the each backup KMC is configured to store the first identifier and the wrapped key associated therewith.