Key management system providing secure management of cryptographic keys, and methods of operating the same

A key management system based on a physically unclonable function (PUF), the key management system comprising:

• a plurality of key management components (KMCs), each KMC comprising:
• a PUF unit;
• a key derivation function (KDF) logic coupled to the PUF unit;
• a key wrap (KWP) logic coupled to the PUF unit;
• and
• a memory coupled to the KDF logic and the KWP logic;
• a load balancer coupled to the plurality of key management components and configured to dispatch a key generation request including a parameter from an external device according to workload of each KMC;
• and
• a backup channel coupled to the plurality of key management components;
• wherein a KMC having minimum workload among the plurality of KMCs is designated as the key-generation KMC and the key generation request is dispatched thereto, and remaining KMCs of the plurality of KMCs are designated as backup KMCs;
• wherein upon receiving the key generation request, a PUF unit of the key-generation KMC is configured to generate a first PUF sequence, a KDF logic of the key-generation KMC is configured to generate a key according to the parameter and the first PUF sequence, the key-generation KMC is configured to transmit a key storage request including the key and a first identifier associated therewith to the backup KMCs through the backup channel and transmit the first identifier to the external device, a KWP logic of the key-generation KMC is disabled, and a memory of the key-generation KMC is configured to store the first identifier and the parameter associated therewith;
• wherein once the backup KMCs receive the key storage request, each PUF unit of each backup KMC is configured to generate a second PUF sequence, each KDF logic of the each backup KMC is disabled, each KWP logic of the each backup KMC is configured to generate a wrapped key according to the key and the second PUF sequence, and a memory of the backup KMC is configured to store the first identifier and the wrapped key associated therewith.