Secure computing hardware apparatus
A secure computing hardware apparatus includes at least a secret generator module, the at least a secret generator module configured to generate a module-specific secret, and a device identifier circuit communicatively connected to the at least a secret generator, the device identifier circuit configured to produce at least an output comprising a secure proof of the module-specific secret. Secret generator module may implement one or more physically unclonable functions to generate the module-specific secret.
1. A secure computing hardware apparatus, the secure computing hardware apparatus comprising:
at least a secret generator module, wherein the at least a secret generator module is configured to generate a module-specific secret;
a device identifier circuit communicatively connected to the at least a secret generator module, wherein:
the device identifier circuit is configured to produce at least an output comprising a secure proof of the module-specific secret; and
the secure proof further comprises at least a delegable, partially anonymizable signature including a modified message, wherein the at least a delegable, partially anonymizable signature is configured to delegate the module-specific secret.
2. The apparatus of claim 1 , wherein the at least a secret generator module further includes at least a non-analyzable circuit element.
3. The apparatus of claim 2 , wherein the at least a non-analyzable circuit element further comprises a circuit element denatured by probing.
4. The apparatus of claim 2 , wherein the at least a non-analyzable circuit element includes at least a circuit element having an output unpredictable by circuit analysis.
5. The apparatus of claim 2 , wherein the at least a non-analyzable circuit element further comprises an element that performs a physically unclonable function.
6. The apparatus of claim 5 , wherein the physically unclonable function further comprises a quantum confinement physically unclonable function.
7. The apparatus of claim 1 , wherein the secret generator module is further configured to output a plurality of bits as a function of the module-specific secret.
8. The apparatus of claim 1 , wherein the at least a secret generator module further comprises at least a first secret generator module having at least a first secret share of the module-specific secret and at least a second secret generator module having a second secret share of the module-specific secret.
9. The apparatus of claim 1 , wherein the device identifier circuit is further configured to perform the secure proof using a challenge-response protocol.
10. The apparatus of claim 1 , wherein the device identifier circuit is further configured to perform the secure proof using a digital signature.
11. The apparatus of claim 1 , wherein the device identifier circuit is further configured to perform the secure proof using a direct anonymous authentication protocol.
12. The apparatus of claim 1 , wherein the device identifier circuit is further configured to perform the secure proof by performing a secure multiparty computation using a first set of inputs from the at least a secret generator module and a second set of inputs from at least an exterior input.
13. The apparatus of claim 1 further comprising:
a key extractor communicatively connected to the secret generator module and the device identifier circuit, wherein the key extractor is configured to extract a private key from the device specific secret module.
14. The apparatus of claim 13 , wherein the private key is never stored in memory.
15. The apparatus of claim 1 further comprising:
a verification information circuit communicatively connected to the secret generator module, wherein the verification information circuit configured to generate verification information to evaluate the secure proof.
16. The apparatus of claim 15 , wherein:
the secure proof is a digital signature protocol using a private key derived from the module-specific secret; and
the verification information circuit is further configured to generate a public key associated with a private key.
17. The apparatus of claim 1 , further comprising a memory communicatively coupled to the device identifier circuit.
18. The apparatus of claim 16 , wherein the device identifier circuit is further configured to encrypt data written to the memory using a private key.
19. The apparatus of claim 16 , wherein the memory includes at least a portion connected only to the secure computing hardware apparatus.
20. The apparatus of claim 16 , wherein the secure computing hardware apparatus is further configured to permit a memory access operation to an address in the memory by a requesting processor only after an access privilege operation indicates that the requesting processor has access rights to the address.
21. The apparatus of claim 1 further comprising a processor communicatively connected to the proof-generation circuit.
22. The apparatus of claim 1 , wherein the processor includes at least a processor cache, and wherein the processor is further configured to clear the at least a processor cache after each operation by the secure computing hardware apparatus.