System on chip, security system, and method of performing authentication
Provided are a system on chip, a security system, and a method of performing authentication. The system-on-chip includes a non-volatile memory a key storage region and a key indicator region, and an authenticator configured to identify a storage location by using key indicator data in response to an authentication request received from an external device, obtain key data stored in the storage location from the non-volatile memory, and perform an encryption algorithm by using an input key received from the external device and an asymmetric key of the key data as inputs.
1. A security system comprising:
an external device configured to transmit an input key; and
a system on chip configured to authenticate the external device based on the input key,
wherein the system on chip comprises
a non-volatile memory comprising a key storage region in which at least one piece of key data is stored, and a key indicator region in which key indicator data, indicating a storage location in the key storage region, is stored;
a secure processor configured to control the non-volatile memory; and
an authenticator configured to identify the storage location by using the key indicator data, obtain the key data stored in the storage location from the non-volatile memory, and perform an encryption algorithm by using the input key and an asymmetric key of the key data as inputs,
wherein the key indicator region comprises at least one bit cell which is in a free state or is programmed, the at least one bit cell corresponds to the key indicator data, and
wherein, when the external device is authenticated, the secure processor is further configured to provide data for programming a bit cell in the free state, and address corresponding to the bit cell, and a write command to the non-volatile memory to update the key indicator data.
2. The security system of claim 1 , wherein
the key storage region comprises first to N-th slots (N is an integer greater than or equal to 2), and
the key indicator region comprises first to N-th bit cells respectively corresponding to first to N-th bit positions.
3. The security system of claim 2 , wherein, when first to k-th bit cells (k is a natural number less than or equal to N) respectively corresponding to the first to k-th bit positions among the first to N-th bit cells are programmed, the storage location is a k-th slot among the first to N-th slots.
4. The security system of claim 1 , wherein the authenticator is configured to,
when the external device is authenticated, receive a key change command and valid key data from the external device,
identify an empty storage location in the key storage region by using the key indicator data, and
provide slot data indicating the empty storage location and the valid key data to the secure processor, and
wherein the secure processor is further configured to
provide an address corresponding to the empty storage location, the valid key data, and a write command to the non-volatile memory, and
control the non-volatile memory to update the key indicator data.
5. A method of authenticating an external device, the method comprising:
obtaining key indicator data from a key indicator region of a one time programmable (OTP) memory, the key indicator region comprises at least one bit cell which is in a free state or is programmed, the at least one bit cell corresponds to the key indicator data;
identifying a slot in which key data is stored among a plurality of slots included in the OTP memory, by using the key indicator data;
obtaining an asymmetric key by reading the key data from the OTP memory;
performing an encryption algorithm to authenticate the external device by using an input key received from the external device and the asymmetric key as inputs; and
in response to the external device being authenticated, providing data for programming a bit cell in the free state, an address corresponding to the bit cell, and a write command to the OTP memory to update the key indicator data.
6. The method of claim 5 , further comprising:
receiving a key change command and new key data from the external device in response to the external device being authenticated.
7. The method of claim 6 , further comprising:
identifying an empty slot among the plurality of slots by using the key indicator data.
8. The method of claim 7 , further comprising:
storing the new key data in the empty slot.
9. The method of claim 8 , further comprising:
updating the key indicator data.
10. The method of claim 9 , further comprising:
obtaining the new key data in response to a new authentication request from an unauthorized device different from the external device.
11. The method of claim 10 , wherein the new key data is valid data.