Techniques to protect fuses against non-destructive attacks

Patent metadata

Field	Value
Publication number	US-2019278932-A1
Application number	US-201916424558-A
Country	US
Kind code	A1
Filing date	May 29, 2019
Priority date	Sep 30, 2016
Publication date	Sep 12, 2019
Grant date	—

Abstract

Embodiments may be generally directed to techniques to encrypt and decrypt data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array having the encryption key comprising a plurality of segments of bits, an inverse encryption key comprising a second plurality of segments of bits, each segment of the inverse encryption key to correspond with a particular segment of the encryption key, and a random pattern having equally distributed bit values, the random pattern to enable detection of voltage attacks on the second fuse block array.

First claim

What is claimed is:

1 . An apparatus, comprising:
a first fuse block array comprising:
an encryption key comprising a plurality of segments of bits;
an inverse encryption key comprising a second plurality of segments of bits, wherein at least one segment of the inverse encryption key corresponds with at least one segment of the encryption key; and
a pattern of bit values to enable detection of voltage attacks on the first fuse block array.

2 . The apparatus of claim 1 , the first fuse block array comprising a plurality of hash values to validate data stored in another fuse block array.

3 . The apparatus of claim 1 , the first fuse block array comprising an encryption protection enable segment and an integrity protection enable segment, the encryption protection enable segment to enable encryption for another fuse block array and the integrity protection enable segment to enable hash value validation.

4 . The apparatus of claim 1 , comprising:
a processor; and memory comprising instructions that when executed by the processor cause the processor to decrypt data in another fuse block array using the encryption key of the first fuse block array.

5 . The apparatus of claim 4 , the memory comprising instructions that when executed by the processor cause the processor to generate a hash value for decrypted data of the other fuse block array.

6 . The apparatus of claim 5 , the memory comprising instructions that when executed by the processor cause the processor to:
compare the hash value of the decrypted data with a second hash value stored in the first fuse block array; validate the decrypted data when the hash value and the second hash value match; and invalidate the decrypted data when the hash value and the second hash value fail to match.

7 . The apparatus of claim 1 , comprising:
a processor; and memory comprising instructions that when executed by the processor cause the processor to:
compare the pattern of bit values with a pattern value of a fuse controller,
determine a voltage attack is not occurring when the pattern of bit values and the pattern value match; and
determine the voltage attack is occurring when the pattern of bit values and the pattern value fail to match.

8 . The apparatus of claim 1 , the first fuse block array comprising a duplicate encryption key having duplicate bits of the encryption key, and a duplicate inverse encryption key having duplicate bits of the inverse encryption key.

9 . The apparatus of claim 1 , the first fuse block array and another fuse block array comprising programmable read-only memory (PROM).

10 . The apparatus of claim 1 , comprising a processor unit having the first fuse block array and another fuse block array.

11 . At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
decrypt data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array comprising:
the encryption key comprising a plurality of segments of bits;
an inverse encryption key comprising a second plurality of segments of bits, wherein at least one segment of the inverse encryption key corresponds with at least one segment of the encryption key; and
a pattern of bit values to enable detection of voltage attacks on the second fuse block array.

12 . The at least one non-transitory computer-readable medium of claim 11 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to generate a hash value for decrypted data of the first fuse block array.

13 . The at least one non-transitory computer-readable medium of claim 12 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
compare the hash value of the decrypted data with a second hash value stored in the second fuse block array; validate the decrypted data when the hash value and the second hash value match; and invalidate the decrypted data when the hash value and the second hash value fail to match.

14 . The at least one non-transitory computer-readable medium of claim 11 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
compare the pattern of bit values with a pattern value of a fuse controller, determine a voltage attack is not occurring when the pattern of bit values and the pattern value match; and determine the voltage attack is occurring when the pattern of bit values and the pattern value fail to match.

15 . The at least one non-transitory computer-readable medium of claim 11 , the second fuse block array comprising a plurality of hash values to validate data stored in the second fuse block array.

16 . The at least one non-transitory computer-readable medium of claim 11 , the second fuse block array comprising an encryption protection enable segment and an integrity protection enable segment, the encryption protection enable segment to enable encryption for the second fuse block array and the integrity protection enable segment to enable hash value validation.

17 . The at least one non-transitory computer-readable medium of claim 11 , comprising a plurality of instructions, that when executed, enable circuitry to sense the encryption key segment and the inverse encryption key segment to maintain a hamming weight.

18 . A computer-implemented method, comprising:
decrypting data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array comprising:
the encryption key comprising a plurality of segments of bits;
an inverse encryption key comprising a second plurality of segments of bits, wherein at least one segment of the inverse encryption key corresponds with at least one segment of the encryption key; and
a pattern of bit values to enable detection of voltage attacks on the second fuse block array.

19 . The computer-implemented method of claim 18 , comprising decrypting data in the second fuse block array using the encryption key of the first fuse block array.

20 . The computer-implemented method of claim 18 , comprising generating a hash value for decrypted data of the first fuse block array.

21 . The computer-implemented method of claim 20 , comprising:
comparing the hash value of the decrypted data with a second hash value stored in the second fuse block array; validating the decrypted data when the hash value and the second hash value match; and invalidating the decrypted data when the hash value and the second hash value fail to match.

22 . The computer-implemented method of claim 18 , comprising:
comparing the pattern of bit values with a pattern value of a fuse controller, determining a voltage attack is not occurring when the pattern of bit values and the pattern value match; and determining the voltage attack is occurring when the pattern of bit values and the pattern value fail to match.

23 . The computer-implemented method of claim 18 , the second fuse block array comprising a plurality of hash values to validate data stored in the second fuse block array.

24 . The computer-implemented method of claim 18 , the second fuse block array comprising an encryption protection enable segment and an integrity protection enable segment, the encryption protec

Assignees

• Intel Corp

Inventors

• Upasani Neeraj S
• Turley David P
• Ghetie Sergiu D
• Chen Zhangping
• Sandri Jason G

Classifications

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F2221/2107

  File encryption · CPC title

• G11C29/787

  using a fuse hierarchy · CPC title

• G11C7/24

  Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells · CPC title

• G11C7/1006

  Data managing, e.g. manipulating data before writing or reading out, data bus switches or control circuits therefor · CPC title