Electronic system of PUF-based root key entanglement with multiple digital input sequences and root key extractor
The present invention discloses a system for entangling multiple root keys with multiple arbitrary user-defined and self-generated input data using a Physically Unclonable Function (PUF) and a proposed digital algorithmic system. The key innovation lies in the combination of a PUF-based dynamically measurable entropy source and the proposed invention, enabling the generation of multiple true random keys. These keys serve as a secure foundation for establishing cryptographic channels, allowing the creation of isolated secure channels for different stakeholders and applications. The ability to create isolated secure channels with multiple root keys enables the establishment of multiple roots of trust, enhancing the integrity and security of cryptographic operations. The invention finds applications in various domains, such as FIDO authentications, point-to-point encryptions, crypto wallets, and encryption key management systems.
1 . An electronic system to create and recover a multitude of intrinsic unique digital sequences, comprising:
a physically unclonable function input source, designed to output a different bit stream PUF Raw Data after each different measurement requests that is capable of being requested independently from power cycle at any given time;
a root key extractor that is configured to produce both root keys and associated digital helper data in an enrollment mode, add new associated digital helper data in accordance with new user input to entangle a root key with the new user input in an update mode, and recover the produced root keys using adequate valid inputs and PUF raw data;
a set of cryptographic digital inputs that is capable of being established through various sources, stored or volatile, and corresponding to a certain bit length of digital sequences, accessed by the root key extractor;
a set of helper data, each section associated with a particular root key and one or more arbitrary user-defined input, accessed by the root key extractor; and
a cryptographic services module that is configured to use as input the root keys created or recovered by the root key extractor;
wherein the input of the root key extractor comprises:
a certain number of bit stream from a source of PUF raw data that is configured to generate true random numbers, and an original true random root key;
a digital input sequence from the set of arbitrary user-defined digital inputs, that is capable of taking any bit length and be from various sources;
a particular section of stored helper data generated during a root key enrollment process or updated during an update process and used as input during a root key recovery process or update process, entangled with a particular user-defined digital input;
a locally or externally stored specific helper data section.
2 . The electronic system according to claim 1 , wherein the root key extractor has locally access to one or more indexed non-volatile memory via standard serial and, or bus peripheral communication protocols.
3 . The electronic system according to claim 1 , wherein the root key extractor operates in the root key enrollment process without using any user-defined input but a system-defined hardcoded one, and create root key associated helper data indexed section in accessible non-volatile memory.
4 . The electronic system according to claim 1 , wherein the root key extractor operates in a root key recovery mode using a user-defined input, and create root key associated helper data indexed section in accessible non-volatile memory.
5 . The electronic system according to claim 1 , wherein the root key extractor operates in root key update mode using a user-defined input, and append new a chunk of recovery data to the root key associated helper data indexed section in accessible non-volatile memory.
6 . The electronic system according to claim 1 , wherein the root key extractor operates in any mode associated with a root key and obtained raw data from a different physically unclonable function than the one that have been used for one other and many other root key extractor operation modes.
7 . A root key extractor, to extract several unique intrinsic digital root keys with several non-random and random digital inputs, and producing both digital outputs and its own digital inputs helper data, the root key extractor comprising:
a key extractor controller that is a digital circuit in charge of managing a system input and output message, as well as controlling the sequence and operation flow of data between each unit composing the root key extractor;
a key derivation function unit that is configured to produce a unique random key used to encrypt a specific root key generated by a true random number generator during a root key enrollment process, and takes as input a user-defined digital input, true random numbers and a discrete measured version of the PUF source data, different at each measurement;
the true random number generator that is configured to use a certain number of input from the PUF source and produce as much true random numbers as required by the system, generating original root keys and creating random vectors used in helper data for root key recovery process;
a fuzzy extractor that is capable of producing a specific vector from a version of PUF raw data during the root key enrollment process, and use the latest specific vector to correct a new version of PUF source data into the initial one measured and used during the root key enrollment process to create a root key;
a message authentication code unit that generates vectors that serve to validate a certain key based on a certain bit stream value from the PUF source, the bit stream from the PUF source coming directly from the PUF Source during root key enrollment process, and coming from the fuzzy extractor correction mechanism during the root key recovery process;
a format preserving encryption unit that is configured to be used a symmetrical encryption and decryption unit, encrypting the root key in helper data during the root key enrollment process and decrypting the root key for output after validation of successful recovery by the message authentication code unit; and
a memory storage for accessing a set of helper data that is configured to be used in writing operation mode during the root key enrollment process and in reading in recovery mode, wherein it stored digital values created by the fuzzy extractor, format preserving encryption unit, the true random number generator and message authentication code unit;
wherein the root key extractor operates in an enrollment mode to generate a root key based on inputs;
wherein, in a recovery mode, the system operates to recover the generated root key based on identical predictable digital inputs and different unpredictable digital inputs from a PUF source with certain amount of bit variations;
wherein, in an update mode, which is a combination of the enrollment mode and the recovery mode, the system operates to add additional root key digital input entanglement.
8 . The key extractor according to claim 7 , wherein the key extractor controller operates in the root key enrollment process using user-defined input when defined and random bit data from a physically unclonable source to generate a random root key and associated helper data.
9 . The key extractor according to claim 7 , wherein the key extractor controller operates in a root key recovery mode using identical user-defined input as the one used for target root key, associated helper data created during the enrollment mode, and random bit data from physically unclonable source.
10 . The key extractor according to claim 7 , wherein the key extractor controller operates in Root Key update mode using an additional user-defined input, random bit data from a physically unclonable source, associated helper data, and append new chunk of recovery data to the associated root key helper data section to include the new user-defined input as authorized digital input to launch successful recovery of the same root key.