Cryptographic ASIC with onboard permanent context storage and exchange
A cryptographic application-specific integrated circuit (ASIC) and method for autonomously storing context data into a one-time programmable memory in isolation are presented. The stored data describes product environmental history following manufacture, which may assist in assessing of a request for a refund or replacement of a defective product, such as an ASIC. The data may be cryptographically protected for retrieval and validation only by a manufacturer or authorized vendor. In another embodiment, communications between individual integrated circuits in a product may be secured by storing encryption keys as the context data, and exchanging the context data. The context data may be stored during manufacture, or thereafter. Such integrated circuits may be secured against replay attacks that capitalize on loss of context data that occurs when volatile memory is reset through power cycling, and enable inter-chip communications to be managed as are communications between unknown parties in an untrusted network.
1. An integrated circuit for autonomously storing context data relating to cryptographic security, comprising:
a one-time programmable memory circuit block configured to be programmed by internal programming circuitry to store the context data without external access, wherein the context data comprises an indication of a hacking attempt that occurs after integrated circuit manufacture;
a processor configured to selectively perform operations for preventing a loss of the cryptographic security, based on the context data; and
a secure communications circuit block configured to control an internal retrieval of the context data for use by the processor.
2. The integrated circuit of claim 1 , wherein the hacking attempt comprises a reset replay attack.
3. The integrated circuit of claim 1 , wherein the context data further comprises at least one random number generated internally within the integrated circuit based on electronic noise.
4. The integrated circuit of claim 3 , wherein the operations selectively enable cryptographically secure processing of an information stream based on context data that denotes a type of hacking attempt that would otherwise not be denoted when power is cycled, and responsively trigger defensive countermeasures.
5. The integrated circuit of claim 4 , wherein the information stream relates to a blockchain.
6. The integrated circuit of claim 3 , wherein the integrated circuit transmits the context data to a second integrated circuit having a second one-time programmable memory circuit block and a second secure communications circuit block.
7. The integrated circuit of claim 6 , wherein the at least one random number is a symmetric cryptographic key configured to secure a subsequent data exchange between the integrated circuit and the second integrated circuit.
8. The integrated circuit of claim 6 , wherein a set of the random numbers comprise a set of public-private cryptographic keys configured to secure a subsequent data exchange between the integrated circuit and the second integrated circuit.
9. The integrated circuit of claim 6 , wherein the at least one random number is a nonce that is transmitted to the second integrated circuit, and wherein the second integrated circuit responds with the nonce, a hash of the nonce generated by a transform-enabled hashing circuit block, and a second nonce, and receives a transform-enabled hash of the second nonce from the integrated circuit to establish a secure communications session for a subsequent data exchange between the integrated circuit and the second integrated circuit.
10. The integrated circuit of claim 6 , wherein at least one of the integrated circuit and the second integrated circuit perform a secure data exchange with an associated non-volatile memory.
11. A cryptographic method for autonomously storing context data relating to cryptographic security in an integrated circuit, the method comprising:
storing the context data without external access in a one-time programmable memory circuit block configured to be programmed by internal programming circuitry, wherein the context data comprises an indication of a hacking attempt that occurs after integrated circuit manufacture;
selectively performing operations, with a processor, to prevent a loss of the cryptographic security, based on the retrieved context data; and
controlling an internal retrieval of the context data for use by the processor, with a secure communications circuit block.
12. The method of claim 11 , wherein the hacking attempt further comprises a reset replay attack.
13. The method of claim 11 , wherein the context data further comprises at least one random number generated internally within the integrated circuit based on electronic noise.
14. The method of claim 13 , wherein the operations selectively enable cryptographically secure processing of an information stream based on context data that denotes a type of hacking attempt that would otherwise not be denoted when power is cycled, and responsively trigger defensive countermeasures, and wherein the information stream relates to a blockchain.
15. The method of claim 13 , further comprising transmitting the context data by the integrated circuit to a second integrated circuit having a second one-time programmable memory circuit block and a second secure communications circuit block.
16. The method of claim 15 , wherein the at least one random number is a symmetric cryptographic key configured to secure a subsequent data exchange between the integrated circuit and the second integrated circuit.
17. The method of claim 15 , wherein a set of the random numbers comprise a set of public-private cryptographic keys configured to secure a subsequent data exchange between the integrated circuit and a second integrated circuit.
18. The method of claim 15 , further comprising establishing a secure communications session for a subsequent data exchange between the integrated circuit and a second integrated circuit by:
transmitting the at least one random number as a nonce to the second integrated circuit;
responding, with the second integrated circuit, with the nonce, a hash of the nonce generated by a transform-enabled hashing circuit block, and a second nonce; and
receiving a transform-enabled hash of the second nonce from the integrated circuit.
19. The method of claim 15 , further comprising performing a secure data exchange with an associated non-volatile memory, with at least one of the integrated circuit and a second integrated circuit.
20. A system for autonomously storing context data relating to cryptographic security, the system comprising:
means for storing the context data without external access, wherein the context data comprises an indication of a type of hacking attempt that occurs after system manufacture;
means for selectively performing operations to prevent a loss of the cryptographic security, based on the retrieved context data; and
means for controlling an internal retrieval of the context data.