Abstract: A method of secure key generation includes writing a predetermined write pattern to a particular address of volatile memory, wherein the volatile memory includes bit lines; reading data from the particular address while applying a first set of operating variables to the volatile memory, subsequent to the writing; sensing a first plurality of timing mismatches during the reading, wherein sense amplifiers are coupled to the bit lines, each latch of a plurality of latches is coupled between a respective pair of sense amplifiers, and each latch is configured to output a data value that indicates a respective timing mismatch between outputs of the respective pair of sense amplifiers; and determining an entropy ratio for the particular address, wherein the entropy ratio is equivalent to a ratio of a first number of latches that output a first data value to a second number of latches that output a second data value.

Abstract: An integrated circuit includes a one-time programmable (OTP) memory having a plurality of pages and address translation circuitry. A first line of each page is configured to store error policy bits. When a first bit of the first line has a first value, the page is configured to store data with error correction code (ECC) bits, and when the first bit has a second value, at least a portion of the page is configured to store data with redundancy. The address translation circuitry is configured to, in response to receiving an access address, use the first line of an accessed page of the plurality of pages accessed by the access address to determine a physical address in the accessed page which corresponds to the access address.

Abstract: An active tamper detection circuit with bypass detection is provided. A bypass detection circuit is coupled to an active mesh loop. The bypass detector includes a voltage comparator with a variable hysteresis control circuit and a calibration engine. The bypass detector detects a change in impedance in the mesh when an attacker attempts to bypass the active loop using a wire. As part of a boot-up sequence, the calibration engine runs a hysteresis sweep on the voltage comparator and stores a hysteresis sweep boot-up signature. When bypass protection is enabled, the bypass detector runs a hysteresis sweep of the voltage comparator periodically at a predetermined interval. Each sweep generates a generated signature that is compared to the stored boot-up signature. Any signature mismatch will be signaled as an impedance mismatch, or tamper. The hysteresis step size is also programmable. The calibration engine can make small changes to the boot-up signature to allow for small voltage variations.

Abstract: An apparatus for cooling a liquid being dispensed through a dispensing tower includes a replaceable cooling shank that sealingly engages a delivery nipple with one or more internally mounted annular seals. The replaceable cooling shank facilitates quick and cost efficient maintenance of the dispensing tower when the annular seals become worn.

Abstract: Methods and systems are disclosed for key management for on-the-fly hardware decryption within an integrated circuit. Encrypted information is received from an external memory and stored in an input buffer within the integrated circuit. The encrypted information includes one or more encrypted key blobs. The encrypted key blobs include one or more secret keys for encrypted code associated with one or more encrypted software images stored within the external memory. A key-encryption key (KEK) code for the encrypted key blobs is received from an internal data storage medium within the integrated circuit, and the KEK code is used to generate one or more key-encryption keys (KEKs). A decryption system then decrypts the encrypted key blobs using the KEKs to obtain the secret keys, and the decryption system decrypts the encrypted code using the secret keys. The resulting decrypted software code is then available for further processing.

Abstract: A method of secure key generation includes writing a predetermined write pattern to a particular address of volatile memory, wherein the volatile memory includes bit lines; reading data from the particular address while applying a first set of operating variables to the volatile memory, subsequent to the writing; sensing a first plurality of timing mismatches during the reading, wherein sense amplifiers are coupled to the bit lines, each latch of a plurality of latches is coupled between a respective pair of sense amplifiers, and each latch is configured to output a data value that indicates a respective timing mismatch between outputs of the respective pair of sense amplifiers; and determining an entropy ratio for the particular address, wherein the entropy ratio is equivalent to a ratio of a first number of latches that output a first data value to a second number of latches that output a second data value.

Abstract: A processing system includes a processor and a temperature security module coupled to provide a temperature tamper signal to the processor. The temperature security module includes a shelf mode trim value, an operating mode trim value, and a programmable temperature trim value. One of the programmable temperature trim value, the shelf mode trim value, and the operating mode trim value, is used based on a deployment mode of the processing system to set a temperature monitor trim value.

Abstract: A processing system includes a processor and a temperature security module coupled to provide a temperature tamper signal to the processor. The temperature security module includes a shelf mode trim value, an operating mode trim value, and a programmable temperature trim value. One of the programmable temperature trim value, the shelf mode trim value, and the operating mode trim value, is used based on a deployment mode of the processing system to set a temperature monitor trim value.

Abstract: A system for generating a tamper detection signal indicating tampering with one or more circuits of an integrated circuit (IC) includes both a static wire mesh and an active wire mesh. The wire meshes can be formed in the same layer over the circuits to be protected or in different layers. The wire meshes also may cover the entire chip area or only predetermined areas, such as over secure memory and register areas. The wire meshes are connected to a tamper detection module, which monitors the meshes and any signals transmitted via the meshes to detect attempts to access the protected circuits via micro-probing.

Abstract: Methods and systems are disclosed for on-the-fly decryption within an integrated circuit that adds zero additional cycles of latency within the overall decryption system performance. A decryption system within a processing system integrated circuit generates an encrypted counter value using an address while encrypted code associated with an encrypted software image is being obtained from an external memory using the address. The decryption system then uses the encrypted counter value to decrypt the encrypted code and to output decrypted code that can be further processed. A secret key and an encryption engine can be used to generate the encrypted counter value, and an exclusive-OR logic block can process the encrypted counter value and the encrypted code to generate the decrypted code. By pre-generating the encrypted counter value, additional cycle latency is avoided. Other similar data independent encryption/decryption techniques can also be used such as output feedback encryption/decryption modes.

Abstract: Methods and systems are disclosed for key management for on-the-fly hardware decryption within an integrated circuit. Encrypted information is received from an external memory and stored in an input buffer within the integrated circuit. The encrypted information includes one or more encrypted key blobs. The encrypted key blobs include one or more secret keys for encrypted code associated with one or more encrypted software images stored within the external memory. A key-encryption key (KEK) code for the encrypted key blobs is received from an internal data storage medium within the integrated circuit, and the KEK code is used to generate one or more key-encryption keys (KEKs). A decryption system then decrypts the encrypted key blobs using the KEKs to obtain the secret keys, and the decryption system decrypts the encrypted code using the secret keys. The resulting decrypted software code is then available for further processing.

Abstract: Methods and systems are disclosed for on-the-fly decryption within an integrated circuit that adds zero additional cycles of latency within the overall decryption system performance. A decryption system within a processing system integrated circuit generates an encrypted counter value using an address while encrypted code associated with an encrypted software image is being obtained from an external memory using the address. The decryption system then uses the encrypted counter value to decrypt the encrypted code and to output decrypted code that can be further processed. A secret key and an encryption engine can be used to generate the encrypted counter value, and an exclusive-OR logic block can process the encrypted counter value and the encrypted code to generate the decrypted code. By pre-generating the encrypted counter value, additional cycle latency is avoided. Other similar data independent encryption/decryption techniques can also be used such as output feedback encryption/decryption modes.

Abstract: A microcontroller includes a clock generator having an internal reference clock, a system mode controller establishing an operating mode, a flash memory having an internal clock and a non-volatile option register, and a boot mode selection logic circuit coupled to the system mode controller and the flash memory. The logic circuit outputs a boot mode selection signal instructing the microcontroller to boot in a very low power run (VLPR) mode or a RUN mode. The system mode controller enters the VLPR or RUN mode in response. The flash memory bypasses and disables its internal clock prior to calibration of the flash memory in the VLPR mode and prior to initialization of the flash memory in the RUN mode. The flash memory subsequently uses an external clock signal based on the output of the internal reference clock.

Abstract: A system for securing a real-time clock (RTC) of an electronic device includes a RTC counter that counts clock pulses of a RTC signal generated by a crystal oscillator, and a reference-time register that periodically stores a reference time value generated by a network-clock generator. A hash-value generator uses a predefined hash algorithm to generate first and second hash values based on the reference time value and the count of the RTC counter, respectively, at predetermined time intervals. A comparator compares the first and second hash values and generates a trigger signal when there is a mismatch.

Abstract: A decryption key management system includes a memory, a memory controller, a decryption engine, and an on-chip crypto-accelerator. A key blob and an encrypted code are stored in the memory. The memory controller fetches the key blob and stores it in a memory buffer. The decryption engine fetches the key blob and decrypts it using an OTP key to generate a decryption key. The decryption key is used to decrypt the encrypted code and generate a decrypted code.

Abstract: A decryption key management system includes a memory, a memory controller, a decryption engine, and an on-chip crypto-accelerator. A key blob and an encrypted code are stored in the memory. The memory controller fetches the key blob and stores it in a memory buffer. The decryption engine fetches the key blob and decrypts it using an OTP key to generate a decryption key. The decryption key is used to decrypt the encrypted code and generate a decrypted code.

Abstract: A system for generating a tamper detection signal indicating tampering with one or more circuits of an integrated circuit (IC) includes a tamper detection module, and wire-pairs connected to the tamper detection module and arranged in a winding configuration to form a wire-mesh. The wire-mesh is placed a predefined distance from the circuits. The tamper detection module generates and provides serial bit-streams to the wire-pairs for detecting a breach in the wire-mesh by an external probe.

Abstract: A microcontroller includes a clock generator having an internal reference clock, a system mode controller establishing an operating mode, a flash memory having an internal clock and a non-volatile option register, and a boot mode selection logic circuit coupled to the system mode controller and the flash memory. The logic circuit outputs a boot mode selection signal instructing the microcontroller to boot in a very low power run (VLPR) mode or a RUN mode. The system mode controller enters the VLPR or RUN mode in response. The flash memory bypasses and disables its internal clock prior to calibration of the flash memory in the VLPR mode and prior to initialization of the flash memory in the RUN mode. The flash memory subsequently uses an external clock signal based on the output of the internal reference clock.

Abstract: A system for generating a tamper detection signal indicating tampering with one or more circuits of an integrated circuit (IC) includes a tamper detection module, and wire-pairs connected to the tamper detection module and arranged in a winding configuration to form a wire-mesh. The wire-mesh is placed a predefined distance from the circuits. The tamper detection module generates and provides serial bit-streams to the wire-pairs for detecting a breach in the wire-mesh by an external probe.

Abstract: A tamper detector has input and output pins for connection to ends of a tamper detection circuit, and a corresponding set of linear feedback shift registers (LFSRs) timed by clock signals for generating pseudo-random coded detection signals as a function of seed values and of a generator polynomial defined by feedback taps. A comparator compares signals received from the detection circuit with the coded detection signals. A multiplexer provides the coded detection signal selectively from the LFSRs to the output pin and the comparator. A controller varies the seed values for different cycles of values of the pseudo-random coded detection signals. The controller also controls the generator polynomial and a frequency of the clock signals for different cycles of values of the pseudo-random coded detection signals.