skip to Main Content

BroadKey™

The accelerating expansion of the Internet of Things brings with it a comparably expanding threat model. The growing number of endpoints require strong identities as the foundation of trust to establish and scale robust security. BroadKey is a secure root key generation and management software solution for IoT security that allows device manufacturers to secure their products with an internally generated, unique identity without the need for adding a costly, security-dedicated silicon. Since BroadKey is a software implementation of SRAM PUF, it is the only hardware entropy source option for securing IoT products that does not need to be loaded at silicon fabrication. It can be installed later in the supply chain, and even remotely retrofitted on deployed devices. This enables a never-before-possible remote “brownfield” installment of a hardware root of trust and paves the way for scaling the IoT to billions of devices.

Unclonable Identities for the IoT

To solve security problems in IoT systems, such as authentication, product lifecycle management, reverse engineering and cloning, every device needs an unclonable identity. This consists of a secret key, a public key and a certificate. The biggest challenge is to get these credentials into the device. The figure below illustrates how this can be achieved by using BroadKey. BroadKey creates the secret key of the unclonable identity from within, derived using the intrinsic randomness in uninitialized SRAM. This secret key is not stored but is dynamically regenerated from the SRAM PUF. 

Completing the unclonable identity requires that a public key be generated from the secret key. And this public key can be turned into a certificate by signing it at a certificate authority. At that point the device is ready to prove its identity and set up a secure channel with another device, a server or a cloud.

SRAM PUF Software enabling PKI elements such as certificate signing requests

Security Based on SRAM PUF

At power-up, SRAM bits settle in the one or zero state in a non-deterministic way that not even the manufacturer can predict or duplicate. That’s what makes the SRAM PUF response a physical unclonable function, or PUF, which can be used as a unique “silicon fingerprint.”

By nature some of the SRAM bits are unstable making this fingerprint noisy. Turning a fingerprint into a high-quality and secure key vault requires further processing. This is done with the BroadKey software IP, which reliably reconstructs the same cryptographic key under all environmental circumstances.

Upon first use, called the enrollment, it generates an activation code (AC) which, in combination with the SRAM startup behavior, is used to reconstruct on demand, in real time, an intrinsic PUF key. This PUF key is never stored in flash or OTP but reconstructed when needed. Reconstruction can be done very quickly starting at 0.5M cycles for 128-bit keys.

BroadKey offers functions to wrap and manage user keys which then can be stored in unprotected memory. All of BroadKey’s features are accessed by the host software via the API.

BroadKey is available in different configurations and sizes such as:

BroadKey-ProDevice-unique key derivation, random number generation, key wrapping and management, elliptic curve-based public key crypto functions (ECDSA and ECDH) and public key infrastructure (PKI) elements such as certificate signing request (CSR)
BroadKey-PlusDevice-unique key derivation, random number generation, application key wrapping and management
BroadKey-SafeLow footprint, device-unique key derivation and random number generation

Low Cost, Flexible & Secure

This software-only product is easy to integrate and improves time to market. No need for additional or modified silicon. Wrapped keys can be stored securely in unprotected memory. BroadKey works on all MCUs, CPUs and allows for brownfield deployments of hardware-based security.

Operating Ranges

SRAM PUF responses have been qualified for use with BroadKey over a wide operating range:

  • Qualified top semiconductor fabs and technology nodes ranging from 350nm down to 7nm
  • Semiconductor processes include low power, high speed and high density
  • Temperature range from -55°C to 150°C  [-67°F to 300°F]
  • Voltage supply variation  +/- 20%
  • Lifetime > 25 years

BroadKey Software IP is delivered as a library compiled for a specific target chip, along with API specifications and user manual.

BroadKey Configurations

Safe

Plus

Pro

Security Strength (bits)

128/256

128/256

128/256

SRAM PUF (KB)

0.7/1

0.7/1

0.7/1

Code Size (KB)

7

8

19

Generate Device Keys and Random Values

Y

Y

Y

Wrap and Unwrap Application Keys

Y

Y

Public Key Crypto Functions and PKI Elements

Y

SRAM PUF Benefits

  • Use standard SRAM
  • Unclonable and immutable
  • Device-unique high-quality keys
  • No secrets when power is off
  • No root key programming
  • Flexible and scalable

Applications

  • Secure Key Storage
  • Authentication
  • Flexible Key Provisioning
  • Anti-Counterfeiting 
  • HW-SW Binding
  • Supply Chain Protection

Certifications

  • EMVCo, Visa, CC EAL6+
  • U.S. and EU Governments
  • Automotive SPICE Level 1
  • BroadKey-Safe compatible w/China’s OSCCA standard

Protecting the IoT with Invisible Keys | Get White Paper

Back To Top