Silicon IP

Hardware Security Module

Status:

Available

Hardware security module IP core with function to support crypto key storage, boot authentication, supervision, and offloading of cryptographic functions.

Overview

GRHSM is an isolated system-on-chip (SoC) that can be used as a subsystem in a larger SoC design to implement a hardware security module or otherwise provide security functions to the larger system. Use cases include crypto key storage, boot authentication,supervision, and offloading of cryptographic functions.

GRHSM depends on platform-specific capabilities to implement its features, utilizing non-volatile on-chip memory in ASSPs and unique bitstreams in FPGAs

‍

Architecture

Key Tech Spec

Target technology support

Evaluation boards

Ordering information

Development Kit

Licensing

Software

Tools

Block diagram

Supported Hardware

Configuration

Reference Design

Other resources

Detailed features

Root of Trust
- Provides a hardware-based Root of Trust with a unique, immutable device ID
- Supports cryptographic verification of device identity and integrity
- Generate Public Key Infrastructure (PKI) keypairs that it can use to sign messages, including random number based challenges
Authentication and secure communication
- Ability to perform authentication, integrity verification and assets encryption/decryption using symmetric or asymmetric keys (PKI). Supports also Post-Quantum Cryptography (PQC) algorithms for future-proof security
- Supports session establishment and encrypted data exchange via standard protocols, including PQC algorithms
Key Management
- Secure generation, derivation and operation of symmetric and asymmetric keys
- Key secure storage and erasure
- Predefined or static keys may be stored in on-chip memory or in an external flash only accessible by GRISoC
- Generated keys are stored in an external flash memory only accessible by GRISoC
Secure Random Number Generation
- Based on NIST SP 800-90A/B structure
Hardware accelerated cryptographic functions (NIST FIPS 180-4, 197, 198-1, 202)
- SHA-256, SHA-3, AES 128, AES 256, HMAC, HKDF
Self-Protection and Isolation
- Hardware-based isolation ensures separation from external SoC and system resources
- Minimal external communication, based on mailbox interface, limits attack vectors
Operations
- Users can customize the platform and manage secret keys using their proprietary software libraries
- The software running on the Isolated SoC determines how to manage keys, facilitates secure key operations, boot authentication, and communication setup
Debug
- The isolated SoC has a dedicated interface for debugging and customization
- The debug interface can be permanently disabled after deployment
- Debug and customization activities are facilitated via the GRMON debug tool.

‍