Patent Description:
This document discloses techniques, apparatuses, and systems for secure pseudo-random number generator (PRNG) reseeding. Integrated circuits (ICs) may use PRNGs to enable cryptographic processes that can protect an IC or electronic device against malicious attacks. Generally, an IC (e.g., a security circuit) may seed or reseed a PRNG with entropy useful to generate pseudo-random numbers or bits. In generating entropy, however, operation of the IC may change and result in circuit characteristics that allow attackers to determine when the IC operates on secret information. In this way, attackers may identify moments when attacks have a higher chance of revealing the secret. In aspects of secure PRNG reseeding, security circuitry may operate circuit elements to limit an association between circuit operations related to entropy generation and observable circuit characteristics. In doing so, the IC may implement cryptographic operations without enabling the detection, malicious or otherwise, of circuit operations. Here the term "entropy" refers to data which is unpredictable (e.g. given the information available to an envisaged adversary), such as data which according to the laws of physics is fundamentally unpredictable (e.g. when the next particle is detected by a Geiger counter) or data which is unpredictable from a practical point of view (e.g. dependent on a physical phenomenon which is hard for the adversary to measure, e.g. the timing of an action by a human operator). An entropy source may be a noise source. The term "reseeding" refers to resetting the value of a seed used by a PRNG to generate random numbers.

The present specification discloses a method defined by claim <NUM>.

In some aspects, the PRNG-dependent cryptographic module is operated by performing cryptographic operations using a current (i.e. previously received) entropy based on a current (i.e. previously received) seed provided to the PRNG-dependent cryptographic module. In other aspects, the PRNG-dependent cryptographic module is operated by performing operations that generate a power signature that at least partially overlaps a power signature generated by the entropy generation process without performing cryptographic operations with the PRNG-dependent cryptographic module. For example, the PRNG-dependent cryptographic module may produce a power signature that masks the power signature generated by the entropy generation process to obscure operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the entropy generation process masks the power signature of the PRNG-dependent cryptographic module to obscure operation of the PRNG-dependent cryptographic module. In yet another aspects, the PRNG-dependent cryptographic module is configured to perform cryptographic operations using entropy that is less than the entropy requested by the cryptographic module.

Generating entropy for reseeding the PRNG-dependent cryptographic module may include generating one or more bits of entropy by an entropy source and processing the one or more bits of entropy by a cryptographically secure random number generator to create a greater number of bits of entropy than the one or more bits of entropy. The greater number of bits of entropy may then be distributed by an entropy distribution network to reseed the PRNG. In some implementations, the entropy generation may include operating one or more of the entropy source, the cryptographically secure random number generator, or the entropy distribution network during a same time interval as another of the entropy source, the cryptographically secure random number generator, or the entropy distribution network.

In various aspects, a system for secure PRNG reseeding may perform methods for secure PRNG reseeding as described herein. In some implementations, the system includes an integrated circuit that includes an entropy generation circuit configured to generate entropy for reseeding a PRNG-dependent cryptographic module. The PRNG-dependent cryptographic module may include a PRNG and may be configured to perform cryptographic operations using entropy provided by the PRNG, request entropy for reseeding the PRNG-dependent cryptographic module, and operate the PRNG-dependent cryptographic module to overlap at least a portion of power consumption associated with the generating of the entropy for reseeding the PRNG-dependent cryptographic module during generation of the entropy for reseeding the PRNG-dependent cryptographic module.

This Summary is provided to introduce simplified concepts for implementing secure PRNG reseeding. The simplified concepts are further described below in the Detailed Description. This Summary is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter.

The details of one or more aspects of the described systems and methods for secure PRNG reseeding are described below. The use of the same reference numbers in different instances in the description and the figures indicate similar elements:.

In general, there are a variety of methods that attackers may use to retrieve privileged information about the cryptographic process of an integrated circuit. For example, side-channel analysis (SCA) may be used to extract secret assets (e.g., keys) by measuring, for example, power consumption, electromagnetic emanation, padding operation, or timing behavior of an integrated circuit in operation. In some cases, SCA can be effective because these channels (e.g., the power consumption, electromagnetic emanation, padding operation, or timing behavior of an integrated circuit) depend on the intermediate values being created and/or processed by the integrated circuit.

To mitigate SCA, many ICs include cryptographic modules that utilize randomness to perform cryptographic operations that increase security hardening. For example, cryptographic modules may utilize PRNGs to provide randomness that can be used as masks in Boolean masking to make these channels independent of the true values produced and/or processed by the integrated circuit. These PRNGs, however, may require reseeding to consistently produce entropy of the desired quality. Entropy generation can be an expensive process that requires significant time and thus, cryptographic modules utilizing the entropy may cease operation when high-quality entropy is not available.

While terminating execution of these cryptographic modules may reduce the power consumption of the circuit, this process can produce information leakage to potential attackers of the integrated circuit. For example, an attacker monitoring any channel of the circuit (e.g., the power consumption, electromagnetic emanation, padding operation, or timing behavior of an integrated circuit) may observe changes in circuit characteristics when the cryptographic module is deactivated. By observing these changes, the attacker may be able to determine when cryptographic processes are being performed within an IC. Since secret keys are often used to enable these cryptographic processes, revealed information about operation of the cryptographic module may allow attackers to determine the best time to initiate and terminate attacks to reveal the chip secrets.

To limit the leakage of information to attackers, controlled operation of the cryptographic module or the entropy generation process may enable security hardening. For example, a cryptographic module may continue to perform operations that create a power signature that is not indicative of deactivation. In aspects, masking does not require high-quality randomness with uniformity guarantees and thus, it may not be imperative to terminate execution of the cryptographic module when reseeding is requested. Therefore, the cryptographic module may continue cryptographic operations using randomness based on the current seed while entropy generation occurs. In this way, an attacker may be unable to determine when the cryptographic module is activated or deactivated, thereby hiding the handling of the cryptographic keys. Moreover, by performing a greater number of operations from multiple sources, the overall noise floor of the circuit characteristics will increase and make it more difficult for an attacker to recognize meaningful differences between circuit characteristics at different points in time.

<FIG> illustrates an example environment <NUM> that includes an apparatus <NUM> in which aspects of secure PRNG reseeding can be implemented. The apparatus <NUM> may be implemented as any suitable device, some of which are illustrated as a smart-phone <NUM>-<NUM>, a tablet computer <NUM>-<NUM>, a laptop computer <NUM>-<NUM>, a gaming console <NUM>-<NUM>, a desktop computer <NUM>-<NUM>, a server computer <NUM>-<NUM>, a wearable computing device <NUM>-<NUM> (e.g., smart-watch), and a broadband router <NUM>-<NUM> (e.g., mobile hotspot). Although not shown, the apparatus <NUM> may also be implemented as any of a mobile station (e.g., fixed- or mobile-STA), a mobile communication device, a client device, a user equipment, a mobile phone, an entertainment device, a mobile gaming console, a personal media device, a media playback device, a health monitoring device, a drone, a camera, an Internet home appliance capable of wireless Internet access and browsing, an IoT device, and/or other types of electronic devices. The apparatus <NUM> may provide other functions or include components or interfaces omitted from <FIG> for the sake of clarity or visual brevity.

The apparatus <NUM> includes an integrated circuit <NUM> that utilizes one or more processors <NUM> and computer-readable media (CRM <NUM>), which may include memory media or storage media. The processors <NUM> may be implemented as a general-purpose processor (e.g., of a multicore central-processing unit (CPU) or application processor (AP)), an application-specific integrated circuit (ASIC), graphics processing unit (GPU), or a system on chip (SoC) with other components of the apparatus <NUM> integrated therein. The CRM <NUM> can include any suitable type of memory media or storage media, such as read-only memory (ROM), programmable ROM (PROM), random access memory (RAM), dynamic RAM (DRAM), static RAM (SRAM), or Flash memory. In the context of this discussion, the computer-readable media <NUM> of the apparatus <NUM> is implemented as at least one hardware-based or physical storage device, which does not include transitory signals or carrier waves. Applications, firmware, and/or an operating system (not shown) of the apparatus <NUM> can be embodied on the computer-readable media <NUM> as processor-executable instructions, which may be executed by the processor <NUM> to provide various functionalities described herein. The computer-readable media <NUM> may also store device data <NUM>, such as user data or user media that is accessible through the applications, firmware, or operating system of the apparatus <NUM>.

In this example, the integrated circuit <NUM> contains security circuity <NUM>. The apparatus <NUM>, the integrated circuit <NUM>, or the security circuity <NUM> may implement a secure cryptographic processor. The security circuity <NUM> may be implemented using one or more circuit components <NUM>, for example, circuit component <NUM>-<NUM> through circuit component <NUM>-n. The circuit components <NUM> may be organized to perform any number of operations to enable functionality of the apparatus <NUM>. Examples of circuit components include a processor and multiple functional components as described in <FIG>. The security circuitry <NUM> can be realized as, for example, a protected enclave, a trusted chip platform, a hardware-based root of trust (RoT) chip (e.g., a silicon RoT), and so forth. Regardless of how or where the security circuity <NUM> is incorporated into an electronic device, the security circuity <NUM> may counter many different types of attacks.

The security circuity <NUM> may include one or more advanced encryption security (AES) unit <NUM> that may perform cryptographic operations of the integrated circuit <NUM>. In aspects, the AES unit <NUM> may implement one or more PRNG-dependent cryptographic modules <NUM> that utilize a PRNG <NUM> to perform cryptographic operations, e.g., an operation of encrypting data or decrypting data; the data may for example be image data (e.g. captured by a camera or video camera) or sound data (e.g. captured by a microphone). In one example, the PRNG values may be used to generate a private/public key pair. The public key is transmitted out of the apparatus <NUM> via the transceivers <NUM> and/or the I/O ports <NUM>. The private key may be used to decrypt data (e.g. image/sound data) received by the apparatus <NUM> via the transceivers <NUM> and/or the I/O ports <NUM>, and which is encrypted using the public key. Alternatively or additionally, data (e.g. obtained using the sensors <NUM>), such as image or sound data, may be hashed using the private key to generate a hash digest, and the data and the hash digest may be transmitted out of the apparatus <NUM>, via the transceivers <NUM> and/or the I/O ports <NUM>, such that the hash digest functions as a signature for the data, which a third party can verify using the public key. In another example, the cryptographic module <NUM> may perform Boolean masking and remasking operations on data operated on by the integrated circuit <NUM> based on pseudo-randomness provided by the PRNG <NUM>. In aspects, the crypto module <NUM> and/or PRNG <NUM> may be implemented as or with a secure PRNG reseeding module (not shown, e.g., <FIG>), which may implement methods described herein. The PRNG <NUM>, however, may require reseeding to consistently produce entropy of the desired quality. Over time, pseudo-randomness provided by the PRNG <NUM> may become deterministic and therefore, the cryptographic operations performed based on the pseudo-randomness may be ineffective to protect against various attacks. To ensure the quality of the pseudo-randomness utilized by the cryptographic modules <NUM>, fresh entropy may be generated and consumed to reseed the PRNG <NUM>.

The AES unit <NUM> may handle device secrets that are used to ensure the appropriate usage and performance of the integrated circuit <NUM>, for example, cryptographic keys or other privileged information. To protect the privileged information handled by the AES unit <NUM>, cryptographically secure operations may be performed to protect against various attacks that may release device secrets or information about the integrated circuit <NUM>.

As shown, the security circuitry <NUM> is coupled to an interconnect <NUM>. The interconnect <NUM> can be realized using, for example, a bus, a switching fabric, or a bus network that enables the various circuit components to communicate. Each of the circuit elements may be directly or indirectly coupled to the interconnect <NUM>.

The apparatus <NUM> may also include a display <NUM>, transceivers <NUM>, input/output ports (I/O ports <NUM>) and/or sensors <NUM>. The display <NUM> may be operably coupled with one of the processors <NUM> (e.g., graphics processing unit (GPU)) and configured to graphically present an operating system or applications of the apparatus <NUM>. The transceivers <NUM> may be configured to enable wired or wireless communication of data (e.g., device data <NUM>) over wired or wireless networks according to any suitable communication protocol. The I/O ports <NUM> of the apparatus <NUM> may include universal serial bus (USB) ports, coaxial cable ports, and other serial or parallel connectors (including internal connectors) useful to couple the electronic device to various components, peripherals, or accessories such as keyboards, microphones, or cameras.

The apparatus <NUM> also includes sensors <NUM>, which enable the apparatus <NUM> to sense various properties, variances, stimuli, or characteristics of an environment in which the apparatus <NUM> operates. For example, the sensors <NUM> may include various motion sensors, ambient light sensors, acoustic sensors, capacitive sensors, infrared sensors, temperature sensors, radar sensors, or magnetic sensors. In aspects, the sensors <NUM> may be used to generate entropy for reseeding the PRNG <NUM>. Alternatively or additionally, the sensors <NUM> may enable interaction with, or receive input from, a user of apparatus <NUM>, such as through touch sensing or proximity sensing.

<FIG> illustrates at <NUM> an example processor <NUM> and example security circuitry <NUM> that includes multiple circuit components, including multiple example circuit components <NUM> that can be implemented to support aspects of secure PRNG reseeding. As shown, the security circuitry <NUM> includes a processor <NUM> that is coupled to an interconnect <NUM>. Each of the processor <NUM>, the multiple memories, and the multiple other circuit components <NUM> may be directly or indirectly coupled to the interconnect <NUM>. In aspects, the components of <FIG> may be embodied as a secure computing platform or a secure System-on-Chip that implements a root-of-trust and/or other secure cryptographic features.

In example implementations, the multiple memories can include a read-only memory (ROM <NUM>), a static random-access memory (SRAM <NUM>), and a flash memory <NUM>. In aspects, the ROM <NUM>, SRAM <NUM>, or the flash memory <NUM> may be implemented within the security circuitry <NUM> or within the CRM (e.g., CRM <NUM>). The multiple components <NUM> can include an alert handler <NUM>, an advanced encryption standard (AES) unit (AES unit <NUM>), a hash-based message authentication code (HMAC) engine (HMAC engine <NUM>), and a serial peripheral interface (SPI) device (SPI device <NUM>). The multiple components <NUM> can also include a universal asynchronous receiver/transmitter (UART) unit (UART unit <NUM>), a general-purpose input/output (GPIO) interface (GPIO interface <NUM>), a pin multiplexer (pin mux <NUM>), and a pad controller <NUM>. The multiple components <NUM> can further include a random number generator (RNG <NUM>) and a timer <NUM>. Additionally, the components <NUM> can include any of the memories, as shown in <FIG>. Although certain examples of memories and other components <NUM> are depicted in <FIG> or described herein, a given implementation of the security circuitry <NUM> may include more, fewer, and/or different instances of processors, controllers, memories, modules, or peripheral devices, including duplicates thereof.

The illustrated circuit components can be operated synchronously based on one or more clock signals. Although not shown in <FIG>, the security circuitry <NUM> may include at least one clock generator to generate the clock signals or may include reset circuitry to reset one or more individual components independently of each other, multiple components jointly, or an entire IC chip. Alternatively, the security circuitry <NUM> may receive at least one clock signal or a reset signal from a source that is external to the security circuitry <NUM>, which source may or may not be on a separate chip. One or more separate components <NUM> may operate in respective individual clock domains. For instance, circuit components may be synchronized to a clock that is local to a respective component. Components in different clock domains may operate or communicate asynchronously with respect to one another.

Example implementations of the illustrated components are described below. The processor <NUM> may be realized as a "main," "central," or "core" processor for the security circuitry <NUM>. The processor <NUM> may, by way of example only, be implemented with a <NUM> bit, in-order reduced instruction set computing (RISC) core with a multi-stage pipeline. With, e.g., a RISC-V functionality, the processor may implement an M (machine) and a U (user) mode. Activating a reset pin (not shown) (e.g., through de-assertion of an active-low reset pin) causes the processor <NUM> to exit reset and begin executing code at its reset vector. The reset vector may begin in the ROM <NUM>, which validates code in the emulated embedded flash (e flash) before jumping to it. In other words, the code is expected to have been instantiated into the e flash before the reset is released. In some cases, resets throughout the security circuitry <NUM> can be made asynchronous active-low as per a comportability specification to support interoperability among the various circuit components. A reset may be generated by the alert handler <NUM> as a security countermeasure; by a watchdog timer; and so forth. Reset signals may also be sent to other circuit components, such as one of the memories or one of the other components <NUM>.

Coupled to the processor <NUM> are a debug module <NUM> (DM) and an interrupt controller <NUM> (ItC), either of which may also be made comportable. The debug module <NUM> provides debug-access to the processor <NUM>. By interfacing with certain pins of the IC, logic in the debug module <NUM> allows the processor <NUM> to enter a debug mode and provides an ability to inject code into the device (e.g., by emulating an instruction) or into a memory. The interrupt controller <NUM> may be disposed proximate to the processor <NUM>. The interrupt controller <NUM> can accept a vector of interrupt sources from within the security circuitry <NUM>. The interrupt controller <NUM> can also assign leveling and priority to the interrupts before forwarding them to the processor <NUM> for handling.

The processor <NUM> can provide any desired level of performance or include any internal circuit components. For example, the processor <NUM> can include at least one arithmetic logic unit (ALU) (e.g., including an "additional" ALU to calculate branch targets to remove a cycle of latency on taken conditional branches) and multiple pipeline stages. With multiple pipeline stages, a pipeline can perform register writeback to reduce a cycle of latency from loads and stores and prevent a pipeline stall where a response to a load or store is available the cycle after the request. The processor <NUM> can implement a single-cycle multiplier or produce an imprecise exception on an error response to a store, which allows the processor to continue executing past the store without waiting for the response. Although not depicted, the processor <NUM> specifically, or the security circuitry <NUM> generally, can include an instruction cache to provide single-cycle access times for instructions.

In the illustrated example <NUM>, the components of the security circuitry <NUM> includes or have access to three memory address spaces for instructions and data. The ROM <NUM> is the target for the processor <NUM> after release of a reset. The ROM <NUM> contains hard-coded instructions to perform a subset of platform checking before checking the next stage of code. The next stage of code-e.g., a boot loader stored in e-flash memory-can be the first piece of code that is not hard-coded into the silicon of the device. This next stage of code is, therefore, signature-checked for integrity to increase security. The ROM <NUM> can execute this signature check by implementing a Rivest-Shamir-Adleman-check (RSA-check) algorithm on the full contents of the boot loader.

The flash memory <NUM> can be implemented as e-flash memory for code storage. This e-flash can house the boot loader mentioned herein, as well as an operating system and applications that layer on top. The SPI device <NUM> can be used to bulk-load the e-flash memory. The debug module <NUM> may also be used for code loading. The SRAM <NUM> can be operated as a scratch pad SRAM that is available for data storage by the processor <NUM> (e.g., for stack and heap information). The SRAM <NUM> can also store code.

The security circuitry <NUM> can include circuit components <NUM> that may be subservient execution units that are coupled to the processor <NUM> via the interconnect <NUM>. Each of these components <NUM> can follow an interface framework that ensures comportability with each other and with the processor <NUM>. A comportability scheme can specify how the processor <NUM> communicates with a given circuit component (e.g., using the interconnect <NUM>), how a circuit component communicates with the processor <NUM> (e.g., using interrupts), how a circuit component communicates security events (e.g., using alert indications) to other circuit components, like the alert handler <NUM>; how a circuit component communicates with peripheral devices (e.g., through a chip I/O); or combinations thereof. The depicted components <NUM> can comprise circuit components relative to the alert-related functionality provided by the alert handler <NUM>, relative to the processor <NUM>, relative to one or more the memories, relative to a chip I/O, and so forth. Thus, the memories can also comprise components <NUM> relative to each other or the other depicted circuit components.

Circuit or chip I/O include the pin mux <NUM> and the pad controller <NUM>. The pin mux <NUM> provides signaling routes between at least a portion of the components <NUM> and available multiplexable I/O nodes of the security circuitry <NUM> (e.g., pins of the chip in which the various components are integrated or an interface to other portions of an SoC). The pad controller <NUM> manages control or pad attributes like drive strength, technology, pull up versus pull down, and the like of each of the circuits' components. The pin mux <NUM> and the pad controller <NUM> may themselves be peripheral devices on the interconnect <NUM>. Accordingly, each may have or may otherwise be associated with at least one collection of registers that provide software configurability.

The UART unit <NUM> can implement UART features, such as single-lane duplex UART functionality. The outputs and inputs thereof can be configured to connect to any circuit I/O via the pin mux <NUM>. The GPIO interface <NUM> creates G bits of bidirectional communication to external circuitry via the pin mux <NUM>, where G is a positive integer like <NUM>, <NUM>, or <NUM>. Regarding memory I/O, the SPI device <NUM> can implement a firmware mode. Here, the firmware mode can enable a feature that provides the ability for external drivers to send firmware upgrade code into a bank of the flash memory <NUM> for in-field firmware updates. The firmware mode can include addressing of the memories using SPI transactions. Although not depicted, the security circuitry <NUM> can include an inter-integrated circuit (I2C) host to enable command of I2C devices. This command of I2C devices may include standard, full, and fast modes.

Several "core security" components are also depicted, including the encryption engines and the alert handler <NUM>. The AES unit <NUM>, which may be implemented as described with reference to <FIG>, can provide various symmetric encryption and decryption functionalities, such as by using one or more protocols and/or varying key sizes, like 128b, 192b, or 256b. In aspects, the AES unit <NUM> may include a crypto module <NUM> and/or PRNG <NUM>, along with a secure PRNG reseeding module (not shown, e.g., <FIG>), which may implement methods described herein. The component can select encryption or decryption of data that arrives in, e.g., <NUM>-byte quantities to be encrypted or decrypted using different block cipher modes of operation. The AES unit <NUM> can support electronic codebook (ECB) mode, cipher block chaining (CBC) mode, cipher feedback (CFB) mode, output feedback (OFB) mode, counter (CTR) mode, and the like. Data transfer can be made processor-available, e.g., key and data material may be passed into the cryptographic engine via register writes. Alternatively, private channels for the transfer of key and data material may be included to reduce exposure from potentially untrusted processor activity.

The HMAC engine <NUM> may utilize, for instance, a secure hash algorithm (SHA) SHA-<NUM> as a hashing algorithm. SHA-<NUM> is a member of the SHA-<NUM> family of hashing algorithms in which the digest (or hash output) is of 256b length, regardless of the data size of the input to be hashed. The data is sent into the HMAC engine <NUM> after declaring the beginning of a hash request. This zeroes out the internal state to initial conditions, e.g., 32b at a time. Once the data has been sent by a component client, the client can indicate the completion of the hash request (with optional partial-word final write). In accordance with an example portability interface scheme, the HMAC engine <NUM> produces the hash result and makes it available for register read by the requesting client. The data transfer may be made processor-available or may be made private to reduce exposure to potentially untrusted processor activity.

HMAC is a message authentication protocol layered on top of a hashing function (e.g., SHA-<NUM>), and HMAC mixes in a secret key for cryptographic purposes. HMAC is a particular application of appending the secret key in a prescribed manner, such as twice, around the hashing (via SHA-<NUM>) of the message. To provide this functionality, a 256b key may be programmed into the circuit component before the message hash begins. The timing of authentication completion can vary and may be longer in latency than using native SHA-<NUM>. Here again, the hashing information or the secret key may be made processor-available for convenience or processing efficiency or may be rendered private in some manner for increased security.

The alert handler <NUM> is responsible for processing and responding to alerts, including ones provided from other components <NUM>. The alerts can be considered security-sensitive interrupts that are to be handled in a timely manner to respond to a perceived security threat. Unlike "standard" interrupts, alerts may not be handled solely by software executing on the processor <NUM>. Alerts can trigger a first-stage request to be handled by software as a "regular" interrupt. If, however, the software is not able to respond and properly remedy the alert-triggered interrupt, then the alert handler <NUM> triggers a second-stage response. The second-stage response can include enacting a security countermeasure, including terminating a process, erasing or otherwise deleting data, withdrawing power from a circuit portion, or resetting an IC chip or portion thereof. This ensures that the underlying issue-the perceived security threat-is addressed even if the processor <NUM> is busy, wedged, or also under attack.

Thus, an alert can be implemented as an elevated interrupt-type signal or alert indication that the alert handler <NUM> receives from other circuit components and that is indicative of a potential security threat. In operation, the alert handler <NUM> can gather alerts from other circuit components <NUM> of the security circuitry <NUM> and convert them into interrupts that the processor <NUM> can address. If the processor <NUM> does not clear the interrupt, however, the alert handler <NUM> provides hardware responses to address the potential security threat.

The security circuitry <NUM> can also include the RNG <NUM>. Generally, randomness can contribute to the security functionality by providing variations in execution that can keep attackers from predicting a good time to launch an attack. A random number, for instance, can provide secret material used for identity and cryptographic purposes. The RNG <NUM> can be seeded into algorithmic computation to obscure sensitive data values. In aspects, the RNG <NUM> can be utilized in the entropy generation process to reseed the PRNG. Generally, the RNG <NUM> provides better performance as its number generation increasingly becomes truly random and to the extent it can also be hardened against attack. In some cryptographic processes, strong randomness guarantees may not be required. The RNG <NUM> may be implemented as a "true" RNG (TRNG), which may involve a design having an analog portion to take advantage of some physical event or process that is non-deterministic. Example TRNG designs rely on metastability, electronic noise, timing variations, thermal noise, quantum variation, and so forth. The TRNG filters the resulting variable(s) and sends them into a pool of entropy that the device can sample at a given time for a current randomized function. In some cases, an interface to the entropy pool can include a read request of available random bits. The TRNG interface indicates how many bits are available, and the requesting circuit components or software can read from this pool to the extent bits are available. Attempted reading of entropy bits that are not available can trigger an interrupt or an alert.

Two other components <NUM> include the timer <NUM> and a flash controller (not shown), the latter of which is described in the following paragraph. The timer <NUM> can, for example, support accurate performance by the processor <NUM>. The timer <NUM> is formed from multiple bits (e.g., <NUM> bits) and operates as a free-running timer with a guaranteed frequency to within some percentage. The timer <NUM> may enable the circuit components <NUM> to determine appropriate time intervals to perform operations. For example, a PRNG within the AES unit <NUM> may request reseeding in accordance with the timer <NUM>. Another timer (not explicitly shown) can act as a watchdog timer to backstop the processor <NUM> in case the processor becomes unresponsive. The unresponsiveness may be due to development code that is wedged, a security attack, and so forth.

Although not shown, a flash controller may control the flash memory <NUM>, which is available for code and data storage. The primary read path for this data can be in the standard memory address space. Writes to that address space can be ignored, however, because flash is not written to in a standard way. Instead, to write to the flash memory <NUM>, software interacts with the flash controller. The flash functionality can include three primary commands: read, erase, and program. Read commands can be standardized and can use the chip memory address space. Erase commands are performed at a page level, where the page size is parameterizable by the flash controller. Upon receiving an erase request, the flash controller wipes the contents of the target page, which renders the data into a "<NUM>" state (e.g., 0xFFFFFFFF per word). Afterward, software can program individual words to any value. A flash bit is not returned to a "<NUM>" state without another erase, so future content is effectively changed with an AND of the current content and the written value. Erase and program commands are relatively slow. A typical erase time is measured in milliseconds, and program times are in the range of microseconds. Security is also a concern because secret data may be stored in the flash memory <NUM>. Some memory protection can therefore be provided by the flash controller.

The security circuitry <NUM> is depicted in <FIG> with a particular set of circuit components. A given security circuitry <NUM> can, however, have more, fewer, or different circuit components. The circuit components may also be interconnected differently or operate in manners besides those example manners described herein. Further, some circuit components may be omitted while other circuit components are implemented in multiple instances. For example, the alert handler <NUM> may be duplicated or distributed, or multiple AES units <NUM> may be present in some security circuitry <NUM>. Further, a GPIO interface <NUM> may be omitted from among the components <NUM> of security circuitry <NUM> for IC chips in which the security circuitry <NUM> forms but one core among dozens.

In aspects, any of the circuit components <NUM> may include a cryptographic processor <NUM> that executes the cryptographic operations of the component. In some implementations, the cryptographic processor <NUM> is separate from the processor <NUM> of <FIG>. In other implementations, the cryptographic processor <NUM> is implemented within the processors <NUM>. Further, any of the circuit components <NUM> may include a cryptographic processor <NUM> (or processing core) to perform the specific functions of that component.

<FIG> illustrates an example AES unit <NUM> that can implement secure PRNG reseeding in accordance with one or more aspects. The AES unit <NUM> can provide symmetric encryption and decryption using one or more protocols and varying key sizes, like 128b, 192b, or 256b. The component can select encryption or decryption of data that arrives in, e.g., <NUM>-byte quantities to be encrypted or decrypted using different block cipher modes of operation.

In aspects, the AES unit <NUM> includes a PRNG <NUM> that generates pseudo-randomness to determine a mask. The mask is mixed with the input data using Boolean masking to create the masked data. The masked data may be multiplexed and stored in a state register <NUM>. The input data may then undergo non-linear operations within the masked SubBytes <NUM>. The masked SubBytes <NUM> may include any number of substitution boxes or Galois-Field (GF) multipliers. During the SubBytes <NUM> process, a byte of the input data may be substituted and shifted to produce a cryptographically secure method to reduce the correlation between the input bits and the output bits. In aspects, the data may be remasked at the SubBytes <NUM>.

The masked data may then pass through a ShiftRows <NUM> stage where the rows of the masked data are shifted during the forward process. Within the ShiftRows <NUM> stage, the rows of the masked data (e.g., state array) may be circularly shifted to scramble the byte order of the input data. The masked data may then be passed through a MixColumn <NUM>-<NUM> stage where each byte in a column is replaced by a function of all of the bytes in the same column.

The AES unit <NUM> can provide symmetric encryption and decryption and thus, the full key data may be encrypted using the initial key or encrypted using a decryption key <NUM>. During encryption or decryption, the respective key may be masked and operated on by a number of substitution boxes and GF multipliers at the Masked KeyExpand <NUM> stage. The respective key may be operated on at a MixColumn <NUM>-<NUM> stage and mixed with the masked data to enable encryption or decryption. The output may be fed back through the state register <NUM>, and the process may be performed iteratively until all stages of the encryption or decryption process are complete. In aspects, the AES unit <NUM> may include a secure PRNG reseeding module <NUM>, which may manage or coordinate operations of components of the AES unit <NUM>, entropy complexes, cryptographic modules, and/or other entities described herein to implement aspects of secure PRNG reseeding. Alternatively or additionally, the secure PRNG reseeding module <NUM> may be implemented (e.g., as hardware and/or software) with or as part of other components described, such as entropy circuits or cryptographic modules.

<FIG> illustrates at <NUM> an example of entropy generation in accordance with one or more aspects of secure PRNG reseeding. The illustrated entropy generation may be implemented within the security circuitry <NUM> to supply entropy to one or more PRNGs <NUM> (e.g., PRNG <NUM> of <FIG>) of the cryptographic modules <NUM> (e.g., cryptographic module <NUM> of <FIG>). As illustrated, the cryptographic modules <NUM> are PRNG-dependent because entropy is supplied to PRNG <NUM>-<NUM> through PRNG <NUM>-N, and the PRNGs <NUM> pseudo-randomness for performing cryptographic operations of cryptographic module <NUM>-<NUM> through cryptographic module <NUM>-N, respectively. In aspects, the entropy generation circuit may include or be associated with a secure PRNG reseeding module <NUM>, which may interact with various components and modules described herein to implement one or more aspects of secure PRNG reseeding.

In aspects, the PRNGs <NUM> provide pseudo-randomness because the randomness is not produced with cryptographic guarantees that the values are uniformly distributed and untraceable. For masking and remasking purposes, these guarantees may not be required, and thus PRNGs <NUM> may be used to efficiently provide randomness for these cryptographic operations. However, masking and remasking operations may require high-bandwidth entropy generation that can support masking operations at every clock cycle. In this way, the entropy generation circuit may be required to support multiple bits of entropy generation every clock cycle (e.g., hundreds of bits of randomness per clock cycle).

The entropy generation circuit may be restricted by circuit area constraints because a large number of entropy generation circuits may be used in a single integrated circuit. It may be important to simplify the design of the entropy generation circuit to a lower circuit area by loosening the constraints that ensure backward secrecy and uniformity that may not be required for masking and remasking operations. In this way, the circuit cost may be reduced due to the decrease in circuit area.

To satisfy these requirements, any number of PRNG implementations may be used. In one example, a PRNG may be defined that utilizes linear feedback shift registers. For example, a value may be input from a feedback source (e.g., movement on a mouse, radiation, or any other available feedback) and mixed with the current value through logic gates to produce pseudo-randomness. In other examples, a multiplier may be used to multiply random data with the value to produce pseudo-randomness. It should be appreciated that any number of PRNG implementations may be applied without extending beyond the scope of this document.

In general, PRNGs <NUM> may be reseeded at various times to provide an initial value to produce randomness from the updated seed. By periodically reseeding the initial value, operations to produce pseudo-randomness may produce better statistical behavior over a period of time. Without reseeding the PRNGs <NUM>, the randomness produced by the PRNGs <NUM> may become deterministic, therefore an entropy generation framework may be necessary to provide fresh randomness to reseed the PRNGs <NUM>.

In aspects, PRNGs <NUM> provide pseudo-randomness to the cryptographic modules <NUM> using a current seed provided to the PRNGs <NUM>. At any time, the cryptographic modules <NUM> may determine that reseeding is needed and request entropy from an entropy distribution network <NUM>. The cryptographic modules <NUM> or the PRNGs <NUM> may determine that entropy is needed for reseeding and assert the requests <NUM> (e.g., request <NUM>-<NUM> or request <NUM>-N) in any number of appropriate methods. For example, the cryptographic modules <NUM> may maintain a counter that enables the cryptographic modules <NUM> to request <NUM> reseeding if the PRNGs <NUM> have operated using a current seed across a certain number of clock cycles. In other implementations, the cryptographic modules <NUM> may determine the quality of the entropy being consumed by the cryptographic modules <NUM> and request <NUM> reseeding when the quality falls below a desired quality.

The entropy distribution network <NUM> may interface to multiple cryptographic modules <NUM>. When any of the PRNGs <NUM> request <NUM> entropy from the entropy distribution network <NUM>, the entropy distribution network <NUM> may determine if entropy <NUM> is available to provide to the PRNGs <NUM>. If entropy is available, the entropy distribution network <NUM> may provide the entropy <NUM> (e.g., entropy <NUM>-<NUM> or entropy <NUM>-N) to the one or more PRNGs <NUM> that request <NUM> reseeding. In some implementations, entropy <NUM> may be provided to each of the PRNGs <NUM>. If entropy <NUM> is not available, however, the entropy distribution network <NUM> may request <NUM> entropy <NUM> from a cryptographically secure random number generator <NUM>.

The cryptographically secure random number generator <NUM> may include an AES engine that enables the entropy <NUM> provided by an entropy source <NUM> to be scaled in a cryptographically safe manner. When a request <NUM> for entropy <NUM> is made from the entropy distribution network <NUM> to the cryptographically secure random number generator <NUM>, the cryptographically secure random number generator <NUM> may determine that entropy <NUM> is available and provide the entropy <NUM> to the distribution network <NUM>. If it is decided that entropy <NUM> is not available at the cryptographically secure random number generator <NUM>, a request <NUM> may be made to the entropy source <NUM>.

The entropy source <NUM> may produce high-quality entropy <NUM> at a low bandwidth. As non-limiting examples, the entropy source <NUM> may produce around two bits of entropy <NUM> per clock cycle, two bits of entropy <NUM> per ten clock cycles, or two bits of entropy <NUM> per hundred clock cycles. In aspects, the entropy source <NUM> produces entropy <NUM> by measuring and combining different measurement sources (e.g., cosmic radiation or the movement (e.g. by a human operator) of a mouse within a timeframe). The measurement sources may be independent and may make measurements of respective phenomena which are statistically uncorrelated with each other. The entropy source <NUM> may then pass the values through a circuit that shapes the values and performs quality checks (e.g., for uniformity and reverse secrecy), to generate the entropy <NUM>. Once the entropy <NUM> is generated, it may be provided by the entropy source <NUM> to the cryptographically secure random number generator <NUM>.

At the cryptographically secure random number generator <NUM>, the entropy <NUM> may be whitened further, and the bandwidth may be increased to produce a greater number of bits of entropy <NUM> at each clock cycle. For example, two bits of entropy <NUM> may be produced by the entropy source <NUM> per hundred clock cycles, and the cryptographically secure random number generator <NUM> may produce two bits of entropy <NUM> every clock cycle or every ten clock cycles. The entropy <NUM> produced by the cryptographically secure random number generator <NUM> may then be provided to the entropy distribution network <NUM> that provides the entropy <NUM> to the PRNGs <NUM> as a seed to enable the PRNGs <NUM> to provide high-bandwidth entropy usable for masking and remasking operations in the cryptographic modules <NUM>.

It should be noted that the entropy generation process may be a relatively long and expensive operation. For example, it may take more than one hundred clock cycles for entropy to reach the PRNGs <NUM> from the entropy source <NUM>. Moreover, each of the entropy source <NUM>, the cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM> may create a strong power signature during operation. The entropy distribution network <NUM> may span across large parts of the integrated circuit to provide entropy to different circuit components. Thus, the entropy distribution network <NUM> may contain strong drivers and transistors that produce a large power signature. Similarly, the cryptographically secure random number generator <NUM> may utilize an AES cipher within the module that requires multiple transistors to perform operations. The entropy source <NUM> may also include cryptographic modules that create large power signatures during operation. In this way, it may be possible to determine the isolated operation of these modules by observing the power signature of the integrated circuit.

In typical operation of cryptographic module <NUM>, cryptographic operations may be terminated when a request <NUM> is made to reseed the PRNGs <NUM>. However, terminating operation of the cryptographic module <NUM> may isolate critical power signatures of the IC that may characterize secret keys and other cryptographic information. In some implementations, the power signatures of the entropy source <NUM>, the cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM> may indicate that an old cycle of cryptographic processes have terminated and a new cycle of cryptographic operations are about to begin. In this way, an attacker may be able to observe changes in the power signature as a result of the large number of transistors within the cryptographic modules switching to a deactivated state.

With respect to security hardening, visible observation of the activation and deactivation of the cryptographic module <NUM> may provide security-sensitive information to attackers that allows for better-tuned attacks. Specifically, cryptographic modules <NUM> may maintain cryptographically secure keys that are used to perform certain cryptographic operations. By knowing when the cryptographic keys will be used in operations, an attacker may be able to observe characteristics associated with operation of the integrated circuit to extract the cryptographic key or bypass security measures. If the cyclical operation of the cryptographic modules <NUM> is known by an attacker, attacks may be directed to extract the cryptographic key or bypass security measures at each cycle of operation of the cryptographic modules <NUM>. Therefore, typical entropy generation processes may aggravate cryptographic attacks on the integrated circuit.

To reduce the ability to determine details about integrated circuit operation, the cryptographic module <NUM> and other modules (e.g., the entropy source <NUM>, the cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM>) may be controlled during entropy generation. Various examples of controlling the cryptographic modules <NUM>, the entropy source <NUM>, the cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM> are described with respect to <FIG>.

<FIG> illustrates an example timing diagram <NUM> for secure PRNG reseeding in accordance with one or more aspects. In the timing diagram <NUM>, a cyclical clock <NUM> is illustrated. A cryptographic module request <NUM>, which may be an example of the request <NUM>, is asserted to indicate that a PRNG associated with the cryptographic module <NUM> has requested reseeding. The timing diagram <NUM> illustrates the operation of the cryptographic module <NUM>, the entropy source <NUM>, the cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM>.

Initially, the cryptographic module <NUM> is illustrated as operating before the cryptographic module request <NUM> is asserted. When the cryptographic module request <NUM> is asserted and it is determined that entropy generation is needed, the cryptographic module <NUM> may continue operation during entropy generation. The cryptographic module <NUM> may be signaled to perform operations during entropy generation in any number of ways. In some implementations, the cryptographic module request <NUM> may signal the initiation or termination of entropy generation. For example, entropy generation may begin when the cryptographic module request is asserted, and entropy generation may terminate when the cryptographic module request <NUM> is deasserted. In aspects, the cryptographic module may activate a timer that tracks the number of clock cycles since the cryptographic module request <NUM> was asserted. Operation of the cryptographic module to produce a power signature that is not indicative of deactivation of the cryptographic module may continue until a predetermined time value is reached or until the cryptographic module request <NUM> is deasserted, indicating that the PRNG has been reseeded. As such, the cryptographic module may not operate indefinitely or after the quality of the randomness provided by the PRNG degrades beyond an acceptable level.

In other implementations, signaling may be received by the cryptographic module <NUM> to indicate that entropy generation is occurring. For example, the cryptographic module <NUM> may receive signaling indicative of the generation of entropy from any of the modules utilized during the entropy generation process. The cryptographic module <NUM> may continue operation to produce a power signature that is not indicative of deactivation of the cryptographic module <NUM> as long as the signal is received.

In aspects, the cryptographic module <NUM> may continue performing cryptographic operations (e.g., masking and remasking) using entropy generated based on a current seed value provided to the PRNG. It may be possible to continue performing these cryptographic operations because entropy for masking and remasking operations may not be required to conform to the same guarantees (e.g., uniformity and reverse secrecy) as other cryptographic operations. In this way, the cryptographic module <NUM> may continue to perform operations while entropy is being generated.

Specifically, the cryptographic module <NUM> may continue to operate during entropy generation by the entropy source <NUM>, during entropy processing by the cryptographically secure random number generator <NUM> to produce additional bits of entropy, and/or during entropy distribution on the bits of entropy by the entropy distribution network <NUM>. Entropy generation is described in detail with respect to <FIG>. In aspects, operation of the cryptographic module <NUM> during entropy generation may limit the ability of an attacker to determine the operation of the cryptographic module <NUM> from the power signature or any other channel. For example, maintaining operation of the cryptographic module <NUM> may allow for the noise floor of the power signature to increase, thereby making it more difficult to distinguish individual differences in the power signature that may provide information about the operations of the integrated circuit. By operating the cryptographic module <NUM> in a way that produces a power signature that is not indicative of deactivating the cryptographic module <NUM>, the power signature or other channel signatures of the integrated circuit may not include large changes that indicate the initiation and termination of the cryptographic module <NUM>. Additionally, the cryptographic module <NUM> may operate more efficiently without having to terminate operations during entropy generation.

In other implementations, the cryptographic module <NUM> may be operated without performing cryptographic operation during entropy generation. For example, the cryptographic module request <NUM> may be asserted to indicate that entropy is requested for reseeding the PRNG. The cryptographic module <NUM> may begin performing operations that do not include cryptographic operations and produce a power signature that is not indicative of deactivation of the cryptographic module <NUM>. In doing so, the power signature of the integrated circuit may not indicate the initiation or termination of the cryptographic module <NUM>. Additionally, by continuing operation of the cryptographic module <NUM> without performing cryptographic operations it may be ensured that masking and remasking operations are never performed with entropy below a particular quality, thus increasing security hardening.

In either implementation, the cryptographic module <NUM> may operate to produce a power signature that is not indicative of deactivation of the cryptographic module <NUM>. Once the entropy is distributed by the entropy distribution network <NUM>, the cryptographic module request <NUM> may be deasserted, the PRNGs may be reseeded using the fresh entropy, and the cryptographic module <NUM> may continue cryptographic operations using the new seed provided by the fresh entropy.

It should also be noted that the entropy generation process may not involve all of the steps illustrated. For example, the cryptographic module request <NUM> may be asserted and it may be determined that entropy is available at the entropy distribution network <NUM>. In this case, the entropy may be distributed by the entropy distribution network <NUM> and a request may not be sent to the cryptographically secure random number generator <NUM>. As such, the cryptographic module <NUM> may operate during any entropy generation process.

In some implementations, the cryptographic module <NUM> may be configured to consume an amount of entropy less than the amount of entropy requested. For example, the cryptographic module <NUM> may request eight bits of entropy from the entropy distribution network <NUM>. The entropy distribution network <NUM> may determine that only four bits of entry are available to be consumed and provide the four bits of entropy to the cryptographic module <NUM> for reseeding the PRNG. The cryptographic module <NUM> may perform cryptographic operations based on the entropy provided by the PRNG using the lesser amount of entropy provided to the PRNG. In this way, the cryptographic module <NUM> may be able to continue operation and perform cryptographic operations using any amount of fresh entropy available.

In addition to providing the entropy to the PRNG for reseeding, the entropy distribution network <NUM> may request more entropy from the cryptographically secure random number generator <NUM>. If entropy is available, the entropy may be provided to the cryptographic module <NUM>. If entropy is not available, the cryptographically secure random number generator may request entropy from the entropy source <NUM>. In this way, the cryptographic module <NUM> may be provided all available entropy, and entropy generation may be initiated to produce entropy for later use.

<FIG> illustrates an example timing diagram <NUM> for secure PRNG reseeding in accordance with one or more aspects. Similar to <FIG>, timing diagram <NUM> illustrates a cyclical clock <NUM>, a cryptographic module request <NUM> is asserted to indicate that a PRNG associated with the cryptographic module <NUM> has requested reseeding, and the cryptographic module <NUM> operates during entropy generation. As described with respect to <FIG>, the entropy generation process includes the entropy source <NUM> generating entropy <NUM>, the cryptographically secure random number generator <NUM> processing the generated entropy to produce additional bits of entropy <NUM>, and the entropy distribution network <NUM> distributing the additional bits of entropy <NUM> to the PRNGs <NUM>. In the timing diagram <NUM>, however, further control of the entropy generation process is used to disguise the operations of the integrated circuit within the power signature.

Unlike in <FIG>, the entropy source <NUM>, cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM> do not operate within respective time intervals. Instead, the entropy source <NUM> overlaps with operation of the cryptographically secure random number generator <NUM> at overlap <NUM>-<NUM>, which overlaps operation of the entropy distribution network <NUM> at overlap <NUM>-<NUM>. In aspects, the entropy source <NUM>, cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM> may perform operations before an input is provided to the module or after the entropy is output from the module. For example, any of the modules may perform operations on insignificant values that produce a power signature similar to normal operation of the modules. At the end of the operations, the values may be discarded without consequence.

Any of the modules during the entropy generation processes may be operated during a same time interval. For example, two or more of generating the bits of entropy, processing the entropy, or distributing the bits of entropy may occur at least in part during a same time interval. By overlapping the power signature of the entropy source <NUM>, the cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM>, the overall power signature of the integrated circuit may be disguised to hide the transitions within the entropy generation process. In doing so, the attacker may be unable to determine useful information about the execution of the integrated circuit, thereby limiting the ability to strengthen future attacks based on the circuit operations.

Also shown in the example timing diagram <NUM>, the cryptographic module <NUM> terminates operation during the entropy generation process (i.e. prior to the entropy distribution network <NUM> completing the transmission of the entropy to the cryptographic module <NUM>) responsive to operating for a predetermined number of clock <NUM> cycles. For example, the cryptographic module <NUM> may operate for the predetermined time period <NUM>. As shown, the cryptographic module <NUM> terminates operation before the entropy generation process terminates and the cryptographic module request <NUM> is deasserted. In this example implementation, the cryptographic module <NUM> may utilize a timer to track clock cycles and ensure that the cryptographic module does not continue operating indefinitely in the case of an error during the entropy generation process.

<FIG> illustrates an example timing diagram for secure PRNG reseeding in accordance with one or more aspects. Similar to <FIG> and <FIG>, timing diagram <NUM> illustrates a cyclical clock <NUM>. A cryptographic module request <NUM> is asserted to indicate that a PRNG associated with the cryptographic module <NUM> has requested reseeding, and the cryptographic module <NUM> operates during entropy generation to overlap at least a portion of power consumption associated with the generating of the entropy for reseeding the PRNG-dependent cryptographic module <NUM>. The entropy generation process illustrated includes the entropy source <NUM> generating entropy, the cryptographically secure random number generator <NUM> processing the generated entropy to produce additional bits of entropy, and the entropy distribution network <NUM> distributing the additional bits of entropy.

Like in <FIG>, further control of the entropy generation process is used to disguise the operations of the integrated circuit within the power signature. In the timing diagram <NUM>, however, the entropy source <NUM>, the cryptographically secure random number generator <NUM>, and the entropy distribution network <NUM> operate randomly or pseudo-randomly in addition to their normal operation during entropy generation. For example, any of the modules used to generate entropy may perform operations <NUM> (e.g., operation <NUM>-<NUM>, operation <NUM>-<NUM>, or operation <NUM>-<NUM>) which do not contribute to the entropy generation but which are similar to those performed by the module during entropy generation. In this way, any of the modules may operate during a same time interval to produce an overall power signature that disguises the operations of the integrated circuit by overlapping the power signatures from the modules used in entropy generation.

The entropy source <NUM>, the cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM> may operate randomly or pseudo-randomly during the entropy generation process to increase the noise floor of the integrated circuit and limit noticeable differences in the operation of the integrated circuit based on the power signature. In some implementations, the entropy source <NUM>, the cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM> may operate randomly outside of the entropy generation process, for example, when the cryptographic module request <NUM> is deasserted, to further disguise the operations of the integrated circuit based on the power signature.

Like in <FIG>, the entropy source <NUM>, the cryptographically secure random number generator <NUM>, or the entropy distribution network <NUM> each at different times perform normal entropy generation operations and perform operations inconsequentially (that is, actions which do not contribute to the entropy generation or distribution). For example, one or more of the modules may perform entropy generation may be used for reseeding the PRNGs when requested, while other of the modules perform inconsequential "random" operations, e.g. operations on placeholder values, the results of which are discarded.

In any implementation described, operating the cryptographic module <NUM> during entropy generation may inhibit the ability to determine meaningful differences in the operation of the integrated circuit based on the power signature.

Methods <NUM> and <NUM> are illustrated as a set of blocks that specify operations that may be performed but are not necessarily limited to the order or combinations shown for performing the operations by the respective blocks. Further, any of one or more of the operations may be repeated, combined, reorganized, or linked to provide a wide array of additional and/or alternate methods. The techniques are not limited to performance by one entity or multiple entities operating on one device. In some aspects, operations or acts of the methods <NUM> are implemented by or managed by a secure PRNG reseeding module <NUM>, an entropy complex, and/or cryptography module. For clarity, the methods are described with reference to the elements of <FIG> and/or entities, components, or configurations described with reference to <FIG>.

<FIG> illustrates an example method <NUM> for secure PRNG reseeding in accordance with one or more aspects. At <NUM>, a request for entropy for reseeding a PRNG-dependent cryptographic module <NUM> is received by an entropy generation circuit. In aspects, the request for entropy for reseeding a PRNG-dependent cryptographic module <NUM> is asserted by the PRNG <NUM> or the PRNG-dependent cryptographic module <NUM>. In some implementations, requesting entropy for reseeding is responsive to determining that the current entropy consumed by the cryptographic module <NUM> is below a desired quality (defined according to a quality criterion, such as a measure of the predictability of the current entropy). As such, the cryptographic module <NUM> may ensure that cryptographic processes utilize pseudo-randomness that meets certain quality assurances. In aspects, entropy is requested for reseeding the PRNG-dependent cryptographic module <NUM> in response to completion of a timer. In this way, it may be ensured that the PRNG <NUM> of the cryptographic module <NUM> is reseeded at certain time intervals.

At <NUM>, entropy for reseeding the PRNG-dependent cryptographic module <NUM> is generated with a random number generator based on an entropy source. In aspects, the entropy generation may be performed in three operations: entropy generation, entropy processing, and entropy distribution. High-quality entropy may be generated by an entropy source and processed at a cryptographically secure random number generator by performing quality checks and increasing the bandwidth of the entropy generation. The cryptographically secure random number generator may create a greater number of bits of entropy than produced by the entropy source, and the greater number of bits of entropy may be provided to the entropy distribution network. The entropy distribution network may distribute the greater number of bits of entropy to one or more cryptographic modules <NUM> for reseeding the PRNGs <NUM>.

In some implementations, the entropy generation, the entropy processing, or the entropy distribution may occur during a same time as another of the entropy generation, the entropy processing, or the entropy distribution. In this way, the power signature of the integrated circuit may not be indicative of the individual processes within entropy generation, and the overall noise floor of the power signature may be increased. In aspects, entropy generation may be implemented by randomly operating the entropy source, the cryptographically secure random number generator, or the entropy distribution network (i.e. causing those modules to perform operations which do contribute to entropy generation or distribution) to further conceal the processes occurring within entropy generation.

At <NUM>, the PRNG-dependent cryptographic module <NUM> is operated during entropy generation to overlap at least a portion of respective power consumption of operating the PRNG-dependent cryptographic module with that of generating the entropy for reseeding the PRNG-dependent cryptographic module <NUM>. For example, the PRNG-dependent cryptographic module <NUM> may produce a power signature that masks the power signature generated by the entropy generation process to obscure operation of the random number generator during entropy generation. Alternatively or additionally, the power signature generated by the random number generator or other entropy components masks the power signature of the PRNG-dependent cryptographic module <NUM> to obscure operation of the PRNG-dependent cryptographic module <NUM>. In aspects, the PRNG-dependent cryptographic module <NUM> performs masking and remasking operations using pseudo-randomness provided by a PRNG <NUM>. For masking and remasking operations, quality assurances that may be necessary for other cryptographic operations may not be required. Thus, the PRNG-dependent cryptographic module <NUM> may continue performing masking and remasking operations using a current seed value, even when a new seed is requested. For example, the PRNG-dependent cryptographic module <NUM> may continue performing operations during entropy generation using the pseudo-randomness provided by the PRNG <NUM> based on the current seed. In this way, attackers may be unable to determine important characteristics about the operation of the integrated circuit based on deactivation of the cryptographic module during entropy generation.

In some implementations, it may be desirable to ensure that cryptographic operations are not performed using entropy that is below a desired quality. As such, the PRNG-dependent cryptographic module <NUM> may continue performing operations to produce a power signature that overlaps at least a portion of power consumption associated with generating the entropy of the PRNG-dependent cryptographic module <NUM> without performing cryptographic operations with the PRNG-dependent cryptographic module <NUM>. For example, the cryptographic module <NUM> may continue to perform operations on data of similar size and complexity to the data used in cryptographic operations, but the data may be discarded after completion of the operations. In doing so, the cryptographic module <NUM> may continue to produce a power signature that is not indicative of deactivating the PRNG-dependent cryptographic module <NUM> without adverse effects to security hardening that may occur from a usage of low-quality entropy in cryptographic processes.

Operating the PRNG-dependent cryptographic module <NUM> may occur in coordination with any number of signaling mechanisms. For example, the cryptographic module <NUM> may receive signaling indicative of entropy generation during the entropy generation process, and the cryptographic module <NUM> may perform operations until the signaling indicative of entropy generation is no longer received. In other implementations, the cryptographic module <NUM> may maintain a timer that begins operation in response to sending a request for entropy to reseed the PRNG-dependent cryptographic module <NUM>. In this implementation, the cryptographic module <NUM> may perform operation to produce a power signature that is not indicative of deactivation of the PRNG-dependent cryptographic module <NUM> until entropy for reseeding is received by the PRNG-dependent cryptographic module <NUM> or until the timer reaches a predetermined value.

At <NUM>, entropy generated with the cryptographically secure random number generator is provided to the PRNG-dependent cryptographic module <NUM> to reseed the PRNG-dependent cryptographic module <NUM> for subsequent cryptographic operations. In aspects, the entropy may be distributed by an entropy distribution network to multiple PRNGs <NUM> within multiple PRNG-dependent cryptographic modules <NUM>.

<FIG> illustrates an example method for continuing to operate a cryptographic module <NUM> while entropy is generated for reseeding the cryptographic module <NUM>. At <NUM>, a PRNG-dependent cryptographic module <NUM> is operated to enable cryptographic operations based on previously-received seed entropy. In aspects, the PRNG-dependent cryptographic module <NUM> may utilize entropy produced by a PRNG <NUM> based on the previously received seed entropy.

At <NUM>, entropy for reseeding the PRNG-dependent cryptographic module <NUM> may be requested. In some implementations, requesting entropy for reseeding is responsive to determining that the current entropy consumed by the cryptographic module <NUM> is below a desired quality. In other implementations, entropy is requested for reseeding the PRNG-dependent cryptographic module <NUM> in response to completion of a timer. The one or more PRNGs <NUM> or cryptographic modules <NUM> may request entropy simultaneously or at different moments in time. In aspects, the request for entropy is received by the entropy distribution network, which determines whether entropy is available for distribution. If entropy is not available (or, more generally, if the amount of available entropy is below a threshold, such as the amount of entropy sufficient to satisfy the request for entropy), the entropy generation process may begin.

At <NUM>, an entropy source is operated to generate entropy for reseeding the PRNG-dependent cryptographic module <NUM>. The entropy source <NUM> may produce high-quality entropy <NUM> at a low bandwidth. In aspects, the entropy source <NUM> produces entropy <NUM> by measuring and combining different measurement sources (e.g., cosmic radiation or the movement of a mouse within a timeframe). The entropy source <NUM> may then pass the values through a circuit that shapes the values and performs quality checks (e.g., for uniformity and reverse secrecy). Once the entropy <NUM> is generated, it may be provided by the entropy source <NUM> to the cryptographically secure random number generator <NUM>.

At <NUM>, the PRNG-dependent cryptographic module <NUM> may continue to operate based on the previously received seed entropy during the entropy generation process that begins at <NUM>. In contrast to typical cryptographic modules, the cryptographic module <NUM> may continue to operate to overlap at least a portion of power consumption associated with the generating of the entropy for reseeding the PRNG-dependent cryptographic module <NUM>. In some implementations, generating the entropy with the random number generator produces a first power signature indicative of generating the entropy, and operating the PRNG-dependent cryptographic module <NUM> while generating the entropy generates a second power signature that at least partially overlaps the first power signature to obscure operation of the PRNG-dependent cryptographic module <NUM> or the operation of the random number generator to generate the entropy.

In aspects, operating the PRNG-dependent cryptographic module <NUM> generates a power signature that is not indicative of deactivating the PRNG-dependent cryptographic module <NUM> without performing cryptographic operations with the PRNG-dependent cryptographic module. Alternatively, operating the PRNG-dependent cryptographic module <NUM> generates a power signature that is not indicative of deactivating the PRNG cryptographic module <NUM> by performing cryptographic operations with the PRNG-dependent cryptographic module <NUM> using a current seed.

Optionally, at <NUM> the cryptographic module <NUM> may be reseeded using partially generated entropy. In aspects, the cryptographic module <NUM> may be configured to consume an amount of entropy less than the amount of entropy requested. For example, the cryptographic module <NUM> may receive less entropy than requested because the amount of entropy requested is not available within the random number generator. The cryptographic module <NUM> may perform cryptographic operations using the entropy provided by the PRNG <NUM> that is based on the lesser amount of entropy provided to the PRNG <NUM>. In this way, the cryptographic module <NUM> may be able to continue operation and perform cryptographic operations using any amount of fresh entropy available.

At <NUM>, the entropy process may continue and the entropy from the entropy source may be processed with a cryptographically secure random number generator to produce a greater number of bits of entropy. The cryptographically secure random number generator may include an AES engine that enables the entropy provided by the entropy source to be scaled in a cryptographically safe manner. Once entropy is produced by the cryptographically secure random number generator, the entropy may be provided to an entropy distribution network that distributes the entropy to the PRNGs <NUM> or the PRNG-dependent cryptographic modules <NUM>.

At <NUM>, the greater number of bits of entropy from the cryptographically secure random number generator may be distributed to the cryptographic module <NUM> or the PRNG through the entropy distribution network. The entropy distribution network may span across large parts of the integrated circuit to provide entropy to different circuit components. Thus, the entropy distribution network may contain strong drivers and transistors that produce a large power signature. The entropy distribution network may provide entropy to the one or more PRNGs <NUM> or cryptographic modules <NUM> that request reseeding.

At <NUM>, the cryptographic module <NUM> (e.g., the PRNG <NUM>) is reseeded using the entropy received from the entropy distribution network. For example, the PRNG <NUM> may utilize the entropy provided from the entropy distribution network as a seed to generate pseudo-randomness for the PRNG-dependent cryptographic module <NUM>.

At <NUM>, the cryptographic module <NUM> may operate to enable cryptographic operations that utilize pseudo-randomness that is based on the reseeded entropy. For example, the cryptographic module <NUM> may operate to perform masking and remasking operations based on pseudo-randomness provided by the PRNG <NUM>.

In aspects, secure PRNG reseeding as described herein may create a power signature or other channel signatures that disguise the operations of the integrated circuit. In this way, malicious attackers may be unable to determine when the integrated circuit handles sensitive information and thus, may ensure the intended operation of the integrated circuit. As such, the techniques, apparatuses, and systems disclosed herein may provide a cryptographically secure method for PRNG reseeding.

<FIG> illustrates various components of an example electronic device <NUM> that can implement secure PRNG reseeding in accordance with one or more aspects. The electronic device <NUM> may be implemented as any single or multiple of a fixed, mobile, stand-alone, or embedded device; in any form of a consumer, computer, portable, user, server, communication, phone, navigation, gaming, audio, camera, messaging, media playback, and/or other type of electronic device <NUM>, such as the smartphone that is depicted in <FIG> as the apparatus <NUM>. One or more of the illustrated components may be realized as discrete components or as integrated components on at least one integrated circuit of the electronic device <NUM>. Generally, the various components of the electronic device <NUM> are coupled via an interconnect <NUM> and/or one or more fabrics that support communication between the components in accordance with one or more aspects of secure PRNG reseeding.

The electronic device <NUM> can include one or more communication transceivers <NUM> that enable wired and/or wireless communication of device data <NUM>, such as received data, transmitted data, or other information identified herein. Example communication transceivers <NUM> include near-field communication (NFC) transceivers, wireless personal area network (PAN) (WPAN) radios compliant with various IEEE <NUM> (BluetoothTM) standards, wireless local area network (LAN) (WLAN) radios compliant with any of the various IEEE <NUM> (WiFiTM) standards, wireless wide area network (WAN) (WWAN) radios (e.g., those that are Third Generation Partnership Project compliant (3GPP-compliant)) for cellular telephony, wireless metropolitan area network (MAN) (WMAN) radios compliant with various IEEE <NUM> (WiMAXTM) standards, infrared (IR) transceivers compliant with an Infrared Data Association (IrDA) protocol, and wired local area network (LAN) (WLAN) Ethernet transceivers.

The electronic device <NUM> may also include one or more data input ports <NUM> via which any type of data, media content, and/or other inputs can be received, such as user-selectable inputs, messages, applications, music, television content, recorded video content, and any other type of audio, video, and/or image data received from any content and/or data source, including a sensor like a microphone or a camera. The data input ports <NUM> may include USB ports, coaxial cable ports, fiber optic ports for optical fiber interconnects or cabling, and other serial or parallel connectors (including internal connectors) for flash memory, DVDs, CDs, and the like. These data input ports <NUM> may be used to couple the electronic device to components, peripherals, or accessories such as keyboards, microphones, cameras, or other sensors.

The electronic device <NUM> of this example includes at least one processor <NUM> (e.g., any one or more of application processors, microprocessors, digital signal processors (DSPs), controllers, and the like), which can include a combined processor and memory system (e.g., implemented as part of an SoC), that processes (e.g., executes) computer-executable instructions to control operation of the device. The processor <NUM> may be implemented as an application processor, embedded controller, microcontroller, security processor, artificial intelligence (AI) accelerator, and the like. Generally, a processor or processing system may be implemented at least partially in hardware, which can include components of an integrated circuit or on-chip system, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), and other implementations in silicon and/or other materials.

Alternatively or additionally, the electronic device <NUM> can be implemented with any one or combination of electronic circuitry, which may include software, hardware, firmware, or fixed logic circuitry that is implemented in connection with processing and control circuits, which are generally indicated at <NUM> (as electronic circuitry <NUM>). This electronic circuitry <NUM> can implement executable or hardware-based modules (not shown in <FIG>), such as through processing/computer-executable instructions stored on computer-readable media, through logic circuitry and/or hardware (e.g., such as an FPGA), and so forth.

In aspects, the electronic device <NUM> includes an interconnect <NUM>, which may include any one or more of a system bus, interconnect, crossbar, data transfer system, or other switch fabric that couples the various components within the device to enable various aspects of signaling and/or communication with sparse encoding. A system bus or interconnect can include any one or a combination of different bus structures, such as a memory bus or memory controller, a peripheral bus, parity blocks, error correction code (ECC) blocks, a universal serial bus, and/or a processor or local bus that utilizes any of a variety of bus architectures.

The electronic device <NUM> also includes one or more memory devices <NUM> that enable data storage, examples of which include random access memory (RAM), non-volatile memory (e.g., read-only memory (ROM), flash memory, erasable programable read-only memory (EPROM), electrically erasable programable read-only memory (EEPROM)), and a disk storage device. Thus, the memory device(s) <NUM> can be distributed across different logical storage levels of a system as well as at different physical components. The memory device(s) <NUM> provides data storage mechanisms to store the device data <NUM>, other types of code and/or data, and various device applications <NUM> (e.g., software applications or programs). For example, an operating system <NUM> can be maintained as software instructions within the memory device <NUM> and executed by the processor <NUM>.

In some implementations, the electronic device <NUM> also includes an audio and/or video processing system <NUM> that processes audio data and/or passes through the audio and video data to an audio system <NUM> and/or to a display system <NUM> (e.g., a video buffer or a screen of a smartphone or camera). The audio system <NUM> and/or the display system <NUM> may include any devices that process, display, and/or otherwise render audio, video, display, and/or image data. Display data and audio signals can be communicated to an audio component and/or to a display component via an RF (radio frequency) link, S video link, HDMI (high-definition multimedia interface), composite video link, component video link, DVI (digital video interface), analog audio connection, video bus, or other similar communication link, such as a media data port <NUM>. In some implementations, the audio system <NUM> and/or the display system <NUM> are external or separate components of the electronic device <NUM>. Alternatively, the display system <NUM>, for example, can be an integrated component of the example electronic device <NUM>, such as part of an integrated touch interface.

The electronic device <NUM> of <FIG> is an example implementation of the apparatus <NUM> of <FIG>, an example implementation of a device that can implement secure PRNG reseeding as described with reference to <FIG>. The electronic device <NUM> can thus include security circuitry <NUM>, which can be a separate IC chip or included as part of another IC chip or device, like the processor <NUM>, the electronic circuitry <NUM>, or the memory device <NUM>. Accordingly, one or more of the illustrated components may be integrated on the same IC chip, like an SoC, or at least on a single printed circuit board (PCB).

The security circuitry <NUM> may include an AES unit <NUM> that performs cryptographically safe operations using encryption or decryption. The AES unit <NUM> may include any number of cryptographic modules configured to perform cryptographically safe operations using randomness or pseudo-randomness provided by an RNG or PRNG. For example, the cryptographic modules may perform masking and remasking operations to distance the channel signatures of the electronic device <NUM> from the produced/processed values. The security circuitry <NUM> may include an entropy generation circuit responsible for reseeding the PRNGs of the cryptographic modules. The entropy generation circuit may include a high-quality entropy source, a cryptographically secure random number generator, and an entropy distribution network. The principles of secure PRNG reseeding as described herein can therefore be implemented by, or in conjunction with, the electronic device <NUM> of <FIG>.

Unless context dictates otherwise, use herein of the word "or" may be considered use of an "inclusive or," or a term that permits inclusion or application of one or more items that are linked by the word "or" (e.g., a phrase "A or B" may be interpreted as permitting just "A," as permitting just "B," or as permitting both "A" and "B"). Also, as used herein, a phrase referring to "at least one of" a list of items refers to any combination of those items, including single members. For instance, "at least one of a, b, or c" can cover a, b, c, a-b, a-c, b-c, and a-b-c, as well as any combination with multiples of the same element (e.g., a-a, a-a-a, a-a-b, a-a-c, a-b-b, a-c-c, b-b, b-b-b, b-b-c, c-c, and c-c-c, or any other ordering of a, b, and c). Further, items represented in the accompanying figures and terms discussed herein may be indicative of one or more items or terms, and thus reference may be made interchangeably to single or plural forms of the items and terms in this written description. Although implementations for a secure cryptographic processor have been described in language specific to certain features and/or methods, the subject of the appended claims is not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as example implementations for secure cryptographic processing.

Claim 1:
A method (<NUM>) comprising:
receiving (<NUM>), from a pseudo-random number generator (PRNG) dependent cryptographic module that comprises a pseudo-random number generator (PRNG) configured to generate random numbers using a seed based on received entropy, a request for entropy for reseeding the PRNG-dependent cryptographic module; and
generating (<NUM>), with a random number generator and based on an entropy source, the entropy for reseeding the PRNG-dependent cryptographic module;
and characterized by further comprising:
operating (<NUM>), while generating the entropy for reseeding the PRNG-dependent cryptographic module, the PRNG-dependent cryptographic module to overlap at least a portion of power consumption associated with operating the PRNG-dependent cryptographic module with power consumption associated with the generating of the entropy for reseeding the PRNG-dependent cryptographic module.