VaultIP is a hardware IP block to be integrated to SoC (System on Chip). It is designed to provide secure, energy efficient and accelerated security functions.
VaultIP is delivered as a synthesizable Verilog RTL source code. Hardware solution provides unmatched security combined with optimized power consumption and speed.
The concept is to create inside the SoC two physical domains, the “non secure” domain and the “secure” domain, each domain running independently from the other. The secure domain manages sensitive tasks (e.g. crypto functions, secure storage, etc.) and can only be accessed through a mailbox receiving commands and then sending back results.
The VaultIP security module includes a rich set of cryptographic services and functions that are executed independently from the general purpose computing resources. The VaultIP provides a rich set of cryptographic services.
Cost optimized solution
By integrating the security at the heart of the SoC design, the security cost overhead is just a matter of few kgates which is reflected in very small increase in die size.
This solution is much cheaper than implementing a companion chip (e.g. secure element) in the device design.
The hardware solution provides a complete and efficient isolated environment, a vault, where all crypto functions are executed and cannot be accessed by the SoC operating system.
Having the security vault inside the SoC itself definitively binds the crypto assets with the device. Such a binding cannot really be established with a secure element model.
INSIDE Secure’s VaultIP is delivered as a FIPS certified silicon IP security module that easily integrates into any chip. Previously, a platform vendor using this process would not have been able to claim certification on the final silicon. Working in collaboration with the CMVP and atsec, INSIDE was able to address this issue and obtain the first ever Level 2 FIPS 140-2 certificate (#2272) for an IP component.
|With this certification, INSIDE Secure’s customers may now be able to apply for incremental recertification of their chip against the existing FIPS certificate for VaultIP. While full FIPS-140-2 Level 2 certification typically takes over a year to achieve, recertification using the initial validation as a base allows for process efficiencies by both the laboratory and the CMVP and significantly reduces the time and cost.||
The VaultIP Secure Platform provides cryptographic building blocks, as well as ‘trust anchors’ in hardware, allowing designers to implement a comprehensive security architecture without getting bogged down in the complexities of low-level cryptographic operation and key management. The platform components provide a low cost, low power and small footprint IP solution for system and platform integrity, and cryptographic acceleration services to applications. The key attributes of the VaultIP Secure Platform are secure boot, secure storage, secure debug, hardware Root of Trust, secure communication, and secure asset store.
The most optimized solution to reduce power
Cryptography algorithms can be executed either by the main SoC CPU or by a dedicated hardware block.
For a given algorithm and key size, the energy required by a fully hardware solution is much smaller than the same function executed in “software”, the saving of energy can be a factor of 10 to 100 (depending on use cases).
Hence, for energy sensitive devices (e.g. battery operated, with long life time), energy saving is critical and hardware solution provide the best solution.
Get to Market faster with optimized security IP
Devices that communicate – all have data that must be protected from increasingly sophisticated security attacks. They need to encrypt and decrypt network access parameters, provide data security services to users and ensure their own operational integrity. Designers need to build the required security into these devices while keeping to the development schedule and budget.
INSIDE Secure has strong expertise in providing hardware IPs to its customer base.
IP are clean proven and well documented, this reduces the risk of iterations, and therefore reduces development cost and improves time to market.
Innovation at work : Three main components
The VaultIP Secure Platform has three main components:
The VaultIP Secure element module, hardware IP that delivers cryptographic acceleration and the ability to put a Root of Trust in hardware, as well as in a secured cryptographic environment for the Asset Store (below),
The Secure Asset Store, a combination of local secure key storage and firmware running inside the VaultIP module’s closed processing environment, ensuring protection of key material against both software and hardware based attacks
The SafeZone middleware software, to allow efficient use of the hardware and providing higher level services using, if needed, the trust anchors provided by the hardware and the Asset Store,
The VaultIP Embedded secure element module
The Platform’s central building block is the VaultIP hardware module. It provides a closed environment with a security boundary and multiple hardware crypto engines (MD5, SHA1, SHA2, AES, DES, 3DES, ARC4, TRNG, and optionally Camellia, C2, and MULTI2). VaultIP offers both performance advantages and security benefits when compared to a software only solution, including exclusive and privileged access to the Non-Volatile Memory (NVM) where only sensitive data (Root of Trust) is stored, as well as key generation using the FIPS approved embedded True Random Number Generator.
A few special cryptographic secrets like the Root Key or Hardware Unique Key (HUK) are typically programmed into a device’s NVM during manufacturing. For security reasons, the NVM is only readable by the crypto module. CRC is used to verify the integrity of the static assets. The exact data objects to be stored in NVM can be customized.
Inside VaultIP, key material and other cryptographic secrets can be protected against disclosure, modification and unintended use, while this material can be used by VaultIP’s hardware crypto engines. VaultIP has an embedded processor that runs its security policy firmware stored in ROM.
The VaultIP module can provide cryptographic services to multiple applications simultaneously, with all applications running on one host or on a variety of hosts like CPUs and DSPs. The SafeZone Middleware Software modules are designed to run on these hosts.
The embedded Public Key Accelerator IP module provides powerful modular mathematical operations required for Public Key algorithms like RSA and ECDSA, Modular Exponentiation and Elliptic Curve Cryptography (ECC). The Public Key Accelerator is controlled by embedded firmware stored in VaultIP’s ROM.
INSIDE Secure maintains its position as the leader in embedded security by applying decades of security innovation and expertise to solve market challenges and help customers meet evolving security requirements. As the first commercially available FIPS 140-2 silicon hardware IP security module certified for CMVP (Cryptographic Module Validation Program) Level 2, meeting the new National Institute of Standards and Technology (NIST) guidelines for IP sub-module pre-certification, VaultIP is a key example of this innovation at work. VaultIP-FIPS is a Silicon IP security module that provides HW protected platform security capabilities such as: Root of Trust, secure boot and secure debug, key vault & Asset Store (Secure Asset Management such as key generation, derivation, usage) and Secure Encryption Services to applications on (Mobile) Application Processors and IoT SoCs.
VaultIP Product Family
VaultIP is a complete product family comprising of VaultIP-100, VaultIP-120 and VaultIP-130, each one of them targeting specific applications or use cases.
VaultIP-100 is the smallest member of the product family. It is primarily dedicated for secure device identification and authentication based on ECDSA standards. Thanks to its very low gate count, it is a perfect match for tiny battery powered autonomous devices, requiring ultra-low power consumption. VaultIP-100 can also perform code signature verification (for secure booting and firmware upgrade), key generation, key exchange (DH), and of course store security “root of trust” and crypto keys.
The vaultIP-120 features all functions of the VaultIP-100 and also embeds an AES hardware block with DMA access to allow encryption/decryption of bulk data. This provides an optimized solution for power consumption and speed when it is used in combination with INSIDE secure communication software like SSL, TLS or DTLS.
The VaultIP-130 includes additional crypto functions and is designed to be integrated in SoC featuring TEE (trusted Execution environment) as an ideal complement to securely handle all crypto functions.
VaultIP Secure Asset Store
Internal storage and management for protection and handling of sensitive keys and assets are achieved through the Secure Asset Store feature in INSIDE Secure’s Secure Platform. The functions of the Secure Asset Store include protecting the key material from disclosure and modification, allowing key material to be generated in a secure key hierarchy by the cipher and hash cores inside the crypto module, and allowing keys to be securely wrapped (AES SIV, RFC5297) before transferred to off-chip flash for permanent storage. These functions ensure that sensitive assets are never exposed outside of the trusted boundary as plain text.
SafeZone Secure Boot
INSIDE Secure’s Secure Platform solution also provides complete secure boot functionality for the external (to VaultIP) host CPU(s). Secure boot is needed to make sure that only the software images from an authorized source are booted and that corrupted software images are not booted. Secure Boot also provides confidentiality of booted images by decrypting them; it prevents from downgrading software images to a version with possibly known security holes and prevents from software reverse engineering by encrypting software images. The secure boot process can use VaultIP to speed up the integrity and confidentiality operations of the boot sequence.
SafeZone Secure Debug
The Secure Debug capability enables secure debugging at the host system level. Bits can be enabled/disabled under control of Public Key Cryptography based authentication so that access to debug ports cannot be used to compromise device security. For highest security and protection against attacks by hardware debuggers, the Secure Debug functionality is implemented in firmware on VaultIP’s embedded controller.
SafeZone Middleware — Complete Security Solution
To address the difficulties of security integration across hardware, software and application layers, INSIDE Secure provides a unique middleware solution as part of the VaultIP Secure Platform - SafeZone software. This integrated security middleware enables application developers to transparently utilize and easily integrate hardware-based security services. It provides the certificate and cryptographic protocols and algorithms essential to applications while ensuring API compatibility and seamless upgradeability to future generations of processors and mobile devices.
With SafeZone software, software developers can take full advantage of sophisticated security mechanisms and develop robust and future-proof mobile applications that are optimized for the resource-constrained wireless environment. SafeZone software allows applications to be quickly integrated into an established ecosystem of security solutions, ensuring quick adoption of mobile applications in the marketplace. The software has been designed for resource-constrained environments like mobile phones and to support industry standards like the Open Mobile Alliance DRM, OMTP TR1 Secure Storage and Secure Boot and the PKCS#11 Cryptographic Token Interface Standard.