Strengthening Silicon-Level Security with the Synopsys Secure Storage Solution for OTP IP

Modern SoCs face increasing exposure to sophisticated invasive and side-channel attacks. Purely software-based security is no longer enough because vulnerabilities at the silicon level can be exploited before software ever loads. Attackers equipped with tools such as voltage manipulation or FIB (Focused Ion Beam) probing can bypass traditional fuse-based protections, putting stored keys and configuration data at risk.

To close this gap, chipmakers are shifting toward hardware-anchored trust, where device-unique keys, secure identities, and sensitive code are protected by the physical properties of the chip itself.

Antifuse OTP has become a popular method for securely storing keys, boot code, and sensitive configuration information. However, as threats evolve, implementations that rely solely on strong secrets in antifuse OTP without additional safeguards are proving insufficient. Attackers with physical access—even when the chip is powered off—can still extract or reverse-engineer stored content.

What’s needed is a next-generation OTP approach—one that ensures data remains protected even if physical access is gained.

Synopsys’ Secure Storage Solution for OTP IP introduces a multi-layer security architecture that pairs antifuse OTP technology with SRAM PUF-derived cryptographic keys and an encryption/decryption engine to address vulnerabilities in static-key implementations (Figure 1). This layered approach delivers hardware-rooted protection that includes:

SRAM PUF: Generates a unique, device specific cryptographic root key derived from the silicon’s physical characteristics, which is never stored in memory.

Encryption: Uses the SRAM PUF key to encrypt OTP contents, ensuring that even if the OTP data is physically accessed in a powered-off state, it remains unusable without the decryption key.

This layered defense ensures OTP contents are protected even if attackers gain physical access. The main advantage is that the root key used to derive the keys needed for encryption is never stored—it is dynamically regenerated from the silicon itself using SRAM PUF technology.

Addressing the need for secure storage in embedded NVM, Synopsys Secure Storage Solution for OTP integrates advanced SRAM PUF technology, a robust crypto engine, and antifuse OTP. Each time the device powers up, the SRAM PUF reconstructs the same chip-unique root key from the physical characteristics of the chip. This key is never stored on the device; instead, it is regenerated upon every power cycle, making it resistant to cloning attempts and intrusive attacks such as those using Focused Ion Beam (FIB) techniques. This root key is then used to derive on-chip keys, which the integrated crypto engine uses to encrypt and protect information stored in the OTP.

The crypto engine supports AES encryption and decryption with 256-bit keys for data stored in the OTP and is designed to be quantum-safe. The solution also incorporates a secure controller that manages communication between the OTP, PUF, crypto engine, and the rest of the chip (Figure 2).

The Secure Storage Solution for OTP IP enables SoC teams to strengthen silicon-level protection across various architectures while reducing integration effort.

Key advantages include:

• Strong protection for OTP contents through AES-256 encryption using SRAM PUF-derived keys
• Hardware-rooted identity and key management using dynamically generated device-unique keys
• Configurable secure OTP regions to match per-application risk levels
• Straightforward integration through a standard APB interface
• Simple software API needing only basic read/write operations
• Accelerated time-to-market with a fully integrated subsystem

Designers can license the underlying OTP IP and then add the Secure Storage Solution in two flexible configurations: one focused on protecting OTP contents in the current release, and another extending protection across the entire chip, including optional system-level security features such as chip-wide ID and advanced key hierarchies in the next release.

The Secure Storage Solution for OTP IP is designed for applications where confidentiality, authenticity, and integrity are paramount, including:

• AI accelerators & HPC – secure key storage and anti-rollback of firmware
• Automotive – protection of calibration data, configuration, and boot code
• Aerospace & Defense – safeguarding mission-critical algorithms and identities
• IoT & Connectivity – secure protocol keys and ROM patching
• Mobile & Consumer – DRM protection and secure content pathways

By anchoring security in the physical characteristics of each chip, designers can strengthen system resilience against cloning, reverse engineering, and tampering.

With decades of investment in security IP, embedded memories including NVM, interface IP, and subsystems, Synopsys continues to help customers reduce integration risk and accelerate design cycles. The Secure Storage Solution for OTP IP extends this portfolio by giving SoC teams a practical, scalable way to adopt hardware-rooted security without architectural disruption.

To learn more visit: Synopsys Secure Storage Solution for OTP