Device keys protection
A method to protect a device key in a device comprising at least one secure element locally connected to at least one time programmable memory storing a global value in form of a bit string comprising locked bits and unlocked bits. The locked bits are irreversibly pre-programmed in the one-time-programmable memory during an initialization phase of the device while the un-locked bits remaining in an initial state may be programmable by the secure element. The secure element is configured to generate, at initialization of the device, a device specific value by using the global value, program the device specific value previously obtained in the one time programmable memory, and erase the global value by programming the unlocked bits of the corresponding bit string. A further object of the disclosure includes a device configured to carry out the method.
1. A method to protect a device key in a device, the method comprising:
storing a global value in a form of a bit string comprising locked bits and unlocked bits,
the locked bits being irreversibly preprogrammed in at least one one-time-programmable memory locally connected to at least one secure element, and
the unlocked bits remaining in an initial state to be programmable by the at least one secure element:
generating, by the at least one secure element, a device-specific value by using the stored global value;
programming, by the at least one secure element, the generated device-specific value in the at least one one-time-programmable memory; and
erasing, by the at least one secure element, the stored global value by programming the unlocked bits of the bit string.
2. The method according to claim 1 ,
wherein the stored global value comprises an asymmetric global private key pair including a global private key and a global public key, and
wherein the generated device-specific value comprises an asymmetric device key pair including a device private key and a device public key.
3. The method according to claim 2 , further comprising calculating, by the at least one secure element, a signature of the device public key by signing a digest resulting from an application of a hash function on the device public key with the global private key, the global public key being used to verify the calculated signature.
4. The method according to claim 3 , wherein the stored global value includes a global key to be used to determine an effective value of a global private key of a unique asymmetric global key pair, the global private key is hard-coded in the at least one secure element during an initialization phase of the device.
5. The method according to claim 4 , wherein the at least one secure element encrypts the hard-coded global private key with the global key such that a result obtained represents the effective value of the global private key used by the device for generating a device key pair and to calculate the signature of the device public key.
6. The method according to claim 3 ,
wherein the device private key, the device public key, and the signature previously verified are programmed by the at least one secure element in the at least one one-time-programmable memory, and
wherein the global private key or the asymmetric global private key pair stored in the one-time-programmable memory is erased by programming the unlocked bits of a corresponding bit string.
7. The method according to claim 2 , wherein the global private key is hard-coded, during an initialization phase of the device, into the at least one secure element and is blinded with a blinding value stored in the at least one one-time-programmable memory.
8. The method according to claim 7 , wherein the at least one secure element applies a blinding operation including a predetermined mathematical function or algorithm using the blinding value as a parameter of a value of the hard-coded global private key, such that a result obtained represents an effective value of the global private key used by the device to generate the asymmetric device key pair and to calculate a signature of the device public key.
9. A device, comprising:
at least one one-time-programmable memory configured to store a global value in a form of a bit string comprising locked bits and unlocked bits,
the locked bits being irreversibly pre-programmed in the at least one one-time-programmable memory, and
the unlocked bits remaining in an initial state to be programmable by a secure element; and
at least one secure element locally connected to the at least one one-time-programmable memory, and comprising a processor configured to:
generate a device-specific value by using the global value,
program the device-specific value in the at least one one-time-programmable memory, and
erase the global value by programming the unlocked bits of the bit string.
10. The device according to claim 9 ,
wherein the global value comprises an asymmetric global private key pair including a global private key and a global public key, and
wherein the device-specific value comprises an asymmetric device key pair including a device private key and a device public key.
11. The device according to claim 10 , wherein the processor is further configured to calculate a signature of the device public key by signing a digest resulting from an application of a hash function on the device public key with the global private key, the calculated signature being verified by the global public key.
12. The device according to claim 11 , wherein the processor is further configured to:
program the device private key, the device public key, and the signature previously verified in the at least one one-time-programmable memory, and
erase the global private key or the asymmetric global private key pair stored in the at least one one-time-programmable memory by programming the unlocked bits of a corresponding bit string.
13. The device according to claim 10 , wherein the global private key is hard-coded, during an initialization phase of the device, into the at least one secure element and is blinded with a blinding value stored in the at least one-time-programmable memory.
14. The device according to claim 13 , wherein the processor is further configured to:
apply a blinding operation including a predetermined mathematical function or algorithm using the blinding value as a parameter of a value of the hard-coded global private key, and
use a result obtained, representing an effective value of the global private key, for generating the asymmetric device key pair.
15. The device according to claim 9 , wherein the global value includes a global key, the processor being further configured to use the global key for determining an effective value of a global private key of a unique asymmetric global key pair, the global private key is hard-coded in the at least one secure element during an initialization phase of the device, the at least one secure element being further configured to encrypt the hard-coded global private key with the global key, such that a result obtained represents the effective value of the global private key.