Washington D.C., USA – Philips Intrinsic-ID, a venture of
Royal Philips Electronics, will announce the commercial availability
at CHES 2008 of its Quiddikey product to provide secure generation
and storage of secret cryptographic keys based on the unique
intrinsic features of a device’s hardware. The keys can be used to
protect valuable digital data, from embedded software in ICs, used
in TVs and professional routers for example, to digital credentials,
as used in public transport payment cards and the like. Quiddikey
provides superior security as the secret cryptographic keys do not
need to be permanently stored and are generated only when needed.
Since no hardware modifications are required in the existing
devices, the solution can be easily implemented in existing designs
at low-cost. Quiddikey addresses the need in the embedded
electronics world for protection of data, which is increasingly
under threat from counterfeiting, theft and misuse.
Today’s embedded electronic systems carry much valuable digital data
that is vulnerable to being copied, stolen or tampered with. For
instance, embedded software (which constitutes intellectual
property, or IP) is an obvious target for illegal copying as it is
the source for products with a competitive edge in the market.
Smartcards, with such diverse applications as financial
transactions, pay television and access control, are another common
target for security hacking, including physically tampering with the
card to obtain, for example, its secret keys. Philips Intrinsic-ID
addresses these problems with a solution that builds on Philips’
broad experience in protecting optical media, digital TV and
smartcards as well as extensive work on Physical Unclonable
Functions (PUFs). The solution is based on the concepts of ‘hardware
fingerprints’ and ‘key extraction’.
The hardware in an electronic device has intrinsic physical
features, which, due to process variations, are non-reproducible,
not even by the original manufacturer. These features can be used to
derive a unique ID that is intrinsic to the device, similar to a
fingerprint that uniquely identifies an individual. From this
hardware fingerprint, Quiddikey can further derive, or ‘extract’, a
robust secret cryptographic key. Unlike existing approaches, in
which the key is permanently stored in the device, with Quiddikey
the key is not stored but can be extracted only as and when needed.
The outcome is a much more secure setting as the key is not present
when the device is powered down.
Philips Intrinsic-ID offers a product-service combination to
customers. Quiddikey is commercially available via a licensing
scheme and the complementary service is provided to customers
directly. For example, in the IP business there is a growing
outsourcing of device manufacturing which allows illegal
over-production (known as ‘overbuilding’) of physical devices that
contain IP. To prevent overbuilding, Quiddikey can be used to
identify and register each device on the production line, generating
a unique Quiddicode without which the IP will not run. Philips
Intrinsic-ID provides the complementary service of securely
activating only the legally produced devices, giving IP owners full
control over production.
Philips Intrinsic-ID is currently establishing targeted partnerships
to offer secure turnkey solutions and application-specific customer
engineering as well as to support global distribution.
Quiddikey will be demonstrated at stand 2 in the exhibit area of
CHES 2008. Furthermore, the related presentation “Efficient Helper
Data Key Extractor on FPGAs” – to be given on August 11
(15:30–16:45), during the session “Randomness for Cryptography” of
the CHES 2008 workshop – will be devoted to the new concepts behind
Quiddikey.
Quiddikey and Quiddicode are registered trademarks of Philips
Intrinsic-ID.