System and method for secure deconstruction sensor in a heterogeneous integration circuitry

Patent metadata

Field	Value
Publication number	US-12093394-B2
Application number	US-202318111808-A
Country	US
Kind code	B2
Filing date	Feb 20, 2023
Priority date	Feb 20, 2023
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

Some examples described herein provide for securely booting a heterogeneous integration circuitry apparatus. In an example, an apparatus (e.g., heterogeneous integration circuitry) includes a first portion and a second portion of one or more entropy sources on a first component and a second component, respectively. The apparatus also includes a key generation circuit communicatively coupled with the first portion and the second portion to generate a key encrypted key based on a first set of bits output by the first portion and a second set of bits output by the second portion. The apparatus also includes a key security circuit to generate, based on the key encrypted key and an encrypted public key stored at the apparatus, a plaintext public key to be used by a boot loader during a secure booting operation for the apparatus.

First claim

What is claimed is:

1. An apparatus, comprising:
a first portion of one or more entropy sources on a first component of a heterogeneous integration circuitry;
a second portion of the one or more entropy sources on a second component of the heterogeneous integration circuitry;
a key generation circuit communicatively coupled with the first portion of the one or more entropy sources on the first component and the second portion of the one or more entropy sources on the second component to generate a key encrypted key based at least in part on a first set of bits output by the first portion of the one or more entropy sources and a second set of bits output by the second portion of the one or more entropy sources; and
a key security circuit to generate, based at least in part on the key encrypted key and an encrypted public key stored at the apparatus, a plaintext public key to be used by a boot loader during a secure booting operation for the apparatus.

2. The apparatus of claim 1 , wherein:
the one or more entropy sources comprise a first entropy source that is divided between the first component and the second component, the first portion of the first entropy source is on the first component and communicatively coupled with the second portion of the first entropy source on the second component.

3. The apparatus of claim 1 , wherein:
the one or more entropy sources comprise at least a first entropy source on the first component and a second entropy source on the second component;
the first portion of the one or more entropy sources comprises the first entropy source; and
the second portion of the one or more entropy sources comprises the second entropy source.

4. The apparatus of claim 1 , further comprising:
a public key interface to receive the plaintext public key; and
a memory device to store the encrypted public key,
wherein the key security circuit is communicatively coupled with the memory device to generate the encrypted public key as a function of the plaintext public key and the key encrypted key during an enrollment operation.

5. The apparatus of claim 1 , wherein:
the one or more entropy sources comprise a plurality of ring oscillators;
the first portion of the plurality of ring oscillators comprises a first set of ring oscillator banks, each ring oscillator bank of the first set of ring oscillator banks comprising a plurality of ring oscillators to output a set of bit values corresponding to the ring oscillator bank; and
the second portion of the plurality of ring oscillators comprises a second set of ring oscillator banks, each ring oscillator bank of the second set of ring oscillator banks comprising a plurality of ring oscillators to output a set of bit values corresponding to the ring oscillator bank.

6. The apparatus of claim 1 , further comprising:
a selection circuit to select the first portion and the second portion from the one or more entropy sources for the key generation circuit to use to generate the key encrypted key.

7. The apparatus of claim 6 , further comprising:
a third portion of the one or more entropy sources on a third component of the heterogeneous integration circuitry, the third portion of the one or more entropy sources communicatively coupled with the key generation circuit, wherein:
the first component is a top component of the heterogeneous integration circuitry;
the second component is a base component of the heterogeneous integration circuitry;
the third component is a middle component of one or more middle components of the heterogeneous integration circuitry; and
the selection circuit determines not to select the third portion based at least in part on the third component being the middle component of the heterogeneous integration circuitry.

8. The apparatus of claim 6 , further comprising:
a third portion of the one or more entropy sources on a third component of the heterogeneous integration circuitry, the third portion of the one or more entropy sources communicatively coupled with the key generation circuit; and
a wiring substrate of the heterogeneous integration circuitry, wherein the first component is attached to the wiring substrate, the second component is attached to the wiring substrate, the third component is attached to the wiring substrate, and the first component, second component, and third component are communicatively coupled via the wiring substrate, and
wherein the selection circuit determines to select the first portion, the second portion, and the third portion based at least in part on the first component, the second component, and the third component behind attached to the wiring substrate.

9. The apparatus of claim 1 , further comprising:
a first component key generation circuit communicatively coupled with the first portion of the one or more entropy sources to generate a first key based at least in part on the first set of bits; and
a second component key generation circuit communicatively coupled with the second portion of the one or more entropy sources to generate a second key based at least in part on the second set of bits,
wherein the key generation circuit generates the key encrypted key as a function of the first key and the second key.

10. The apparatus of claim 9 , wherein:
the first component key generation circuit performs a first hash operation on the first set of bits to generate the first key; and
the second component key generation circuit performs a second hash operation on the second set of bits to generate the second key.

11. The apparatus of claim 1 , wherein the heterogeneous integration circuitry comprises the first component attached to the second component using a plurality of thru-silicon vias.

12. The apparatus of claim 1 , wherein the heterogeneous integration circuitry comprises the first component attached to a wiring substrate and the second component attached to the wiring substrate, the first component communicatively coupled with the second component through the wiring substrate.

13. A method of securely booting a heterogeneous integration circuitry apparatus, comprising:
generating a key encrypted key based at least in part on a first set of bits and a second set of bits, where the first set of bits is output by a first portion of one or more entropy sources on a first component of a heterogeneous integration circuitry, and the second set of bits is output by a second portion of the one or more entropy sources on a second component of the heterogeneous integration circuitry;
obtaining an encrypted public key from a memory device of the heterogeneous integration circuitry;
decrypting the encrypted public key using the key encrypted key to generate a plaintext public key; and
performing a secure booting operation for the apparatus using the plaintext public key.

14. The method of claim 13 , further comprising:
obtaining the plaintext public key via a public key interface;
generating, during an enrollment operation, the encrypted public key as a function of the plaintext public key and the key encrypted key; and
storing the encrypted public key in a memory device of the heterogeneous integration circuitry.

15. The method of claim 13 , further comprising:
selecting the first portion from the one or more entropy sources to use to generate the key encrypted key based at least in part on the first component being a top component of the heterogeneous integration circuitry; and
selecting the second portion from the one or more entropy sources to use to generate the key encrypted key based at least in part on the second component being a base component of the heterogen

Assignees

• Xilinx Inc

Inventors

• Gupta Aman
• Wesselkamper James D
• Anderson James
• Sharifi Nader
• Ansari Ahmad R
• Ahmad Sagheer
• Gaide Brian C

Classifications

• H04L9/0618

  Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation · CPC title

• H04L9/14 Primary

  using a plurality of keys or algorithms · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title