Granted Patent B2

US 12,724,905 · App. 17/518,013 · Granted Sep 1, 2026

Inventors: Sung Hyun Kim (Anyang-si, KR); Jun Ho Huh (Yongin-si, KR)

Assignee: Samsung Electronics Co., Ltd.

G06F21/602G06F7/588G06F15/7807G06F21/54G06F21/575G06F21/79G06F21/107

Abstract

Claims (83)

1 . An operating method of SoC (System on Chip) including a secure element, the method comprising:

generating a random number in response to power of the SoC being turned on;

transmitting a first setting code stored in a read only memory (ROM) of the SoC to a seed table manager and the seed table manager sets a seed table operation policy based on the first setting code;

transmitting a second setting code stored in the read only memory (ROM) of the SoC to a key seed table manager and the key seed table manager sets a key seed table operation policy based on the second setting code;

generating a seed table based on the random number, the generating the seed table on the basis of the seed table operation policy;

generating a key seed table based on the random number, the generating the key seed table on the basis of the key seed table operation policy;

masking a first data with a first data seed value corresponding to a target address value extracted from the seed table;

extracting a key seed value corresponding to the target address value from the key seed table to generate a first varied encryption key;

encrypting the masked first data with the first varied encryption key input from a key register; and

writing encrypted masked first data to a target address of an external memory corresponding to the target address value extracted from the seed table, and

wherein at least one of the first data seed value or the first varied encryption key changes dynamically.

2 . The operating method of SoC of claim 1 , wherein the generating the random number includes generating the random number aperiodically depending on a trigger condition.

3 . The operating method of SoC of claim 1 , wherein the seed table operation policy includes at least one of a variable range scheme, a variable scheme of position, or a change cycle of a table element included in the seed table.

4 . The operating method of SoC of claim 1 , further comprising:

decrypting a second data received from the external memory by using a second varied encryption key; and

unmasking the decrypted second data with a second data seed value corresponding to an address value of the second data.

5 . The operating method of SoC of claim 4 , wherein at least one of the second varied encryption key or the second data seed value is generated based on the random number and is different from both the first varied encryption key and the first data seed value.

6 . The operating method of SoC of claim 1 , wherein the first data is data which is read from a non-volatile memory device and is decrypted with a first saved encryption key.

7 . A SoC (System On Chip) connected to an external memory, the SoC comprising:

secure element circuitry which includes a CPU and processing circuitry configured to output a target address value and a write command,

wherein the processing circuitry is configured to,

generate a random number in response to power of the SoC being turned on;

transmit a first setting code stored in a read only memory (ROM) of the SoC to a seed table manager and the seed table manager sets a seed table operation policy based on the first setting code,

transmit a second setting code stored in the read only memory (ROM) of the SoC to a key seed table manager and the key seed table manager sets a key seed table operation policy based on the second setting code,

generate a data seed table based on the random number, the generating the data seed table on the basis of the seed table operation policy,

generate a key seed table based on the random number, the generating the key seed table on the basis of the key seed table operation policy,

mask a first data with a data seed value corresponding to the target address value of the data seed table,

extract a key seed value corresponding to the target address value from a the key seed table to generate a first varied encryption key,

encrypt the masked first data with the first varied encryption key, and

store the encrypted masked first data and an anti-replay counter (ARC) in the external memory,

wherein at least one of the data seed value or the first varied encryption key is configured to change dynamically based on the seed table operation policy, and

wherein the ARC increases in value each time the encrypted masked first data is transmitted.

8 . The SoC of claim 7 , wherein the external memory includes a volatile memory that includes a security area configured to store the encrypted masked first data, and a normal area configured to store unencrypted general data.

9 . The SoC of claim 7 , wherein the data seed table and the key seed table are generated in accordance with a dynamically changing random number, and

the secure element circuitry includes:

data block circuitry configured to extract the data seed value and to mask the first data;

key block circuitry configured to extract the key seed value corresponding to the target address value;

a key register configured to store the key seed value as the first varied encryption key; and

encryption engine circuitry configured to encrypt the masked first data with the stored first varied encryption key and to output the encrypted masked first data to the external memory.

10 . The SoC of claim 7 , wherein the data seed table is generated in accordance with a dynamically changing random number, and the key seed table is a predetermined table, and

the secure element circuitry includes:

data block circuitry configured to mask the first data with the data seed value;

key block circuitry configured to extract the key seed value corresponding to the target address value;

a key register configured to store the key seed value as the first varied encryption key; and

encryption engine circuitry configured to encrypt the masked first data with the stored first varied encryption key and to output the encrypted masked first data to the external memory.

11 . The SoC of claim 7 , wherein the data seed table includes a first table, and the key seed table is generated in accordance with a dynamically changing random number, and

the secure element circuitry includes:

data block circuitry configured to extract the data seed value corresponding to the target address value and masks the first data with the data seed value;

key block circuitry configured to extract the key seed value;

a key register that stores the key seed value as the first varied encryption key; and

encryption engine circuitry configured to encrypt the masked first data with the stored first varied encryption key and to output the encrypted masked first data to the external memory.

12 . The SoC of claim 7 , wherein the seed table operation policy includes at least one of a variable range scheme, a variable scheme of position, or a change cycle of a table element included in the data seed table.

13 . The SoC of claim 7 , wherein the SoC is configured to apply the seed table operation policy to at least one of the data seed table or the key seed table.

14 . The SoC of claim 7 , wherein the SoC is connected to each of a dedicated memory and a non-volatile memory, the non-volatile memory configured to store at least one first saved encryption key,

the processing circuitry is further configured to,

encrypt second data with a first saved encryption key received from the dedicated memory, and

write the encrypted second data to the non-volatile memory.

15 . The SoC of claim 14 , wherein the SoC is configured to encrypt the second data stored in an internal memory of the secure element circuitry or the external memory and write the encrypted second data to the non-volatile memory, in response to power of the SoC being turned off.

16 . An operating method of a secure element circuitry, the method comprising:

generating a random number in a time-dependent manner in response to power of the secure element circuitry being turned on;

transmitting a first setting code stored in a read only memory (ROM) of the secure element circuitry to a data seed table manager and the data seed table manager sets a data seed table operation policy based on the first setting code stored in a read only memory (ROM);

transmitting a second setting code stored in the read only memory (ROM) of the secure element circuitry to a key seed table manager and the key seed table manager sets a key seed table operation policy based on the second setting code stored in the read only memory (ROM);

setting a data seed table corresponding to the random number in accordance with the data seed table operation policy;

setting a key seed table corresponding to the random number in accordance with the key seed table operation policy;

reading first data from a non-volatile memory device;

masking the first data with a data seed value corresponding to a target address of an external memory; and

writing the masked first data to the target address of the external memory,

wherein the first data read from the non-volatile memory device is encrypted.

17 . The operating method of the secure element circuitry of claim 16 , wherein the data seed table operation policy includes at least one of a variable range scheme, a variable scheme of position, or a change cycle of a table element included in the data seed table.

18 . The operating method of the secure element circuitry of claim 16 , wherein the masking the first data includes:

decrypting the read first data, using a first varied encryption key for the non-volatile memory device;

extracting the data seed value corresponding to a target address value from the set data seed table;

masking the decrypted first data, using the data seed value; and

encrypting the masked first data, using a stored encryption key,

wherein the target address value from the set data seed table matches the target address of the external memory.

19 . The operating method of the secure element circuitry of claim 18 , further comprising:

reading a second data stored in the external memory;

decrypting the second data, using a first saved encryption key; and

unmasking the decrypted second data with the data seed value.

20 . The operating method of the secure element circuitry of claim 18 , wherein when the power of the secure element circuitry is turned on, the method further includes

setting the key seed table operation policy, in response to the power being turned on;

setting the key seed table corresponding to the random number in accordance with the key seed table operation policy; and

extracting a first saved encryption key from the key seed table, the first saved encryption key corresponding to the target address value.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (19)