Secure feature and key management in integrated circuits

• US 10,666,641 B2
• Filed: 09/21/2018
• Issued: 05/26/2020
• Est. Priority Date: 08/10/2012
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Kocher, Paul Carl, Jun, Benjamin Che-Ming, Leiserson, Andrew John
• Primary Examiner(s): Kim, Tae K
• Application Number:
  US16/138,105
• Publication Number:
  US 20190097999A1
• Time in Patent Office: 613 Days
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

A mechanism for providing secure feature and key management in integrated circuits is described. An example method includes receiving, by a root authority system, data identifying a command that affects operation of an integrated circuit, singing, by the root authority system, the command using a root authority key to create a root signed block (RSB), and providing the RSB to a security manager of the integrated circuit.

Claims

1. A method comprising:

obtaining, by a delegate authority system, a base key, the delegate authority system being configured to lock, unlock, modify, or any combination thereof one or more configurable hardware features of an integrated circuit using a delegated signed block (DSB) comprising one or more commands and a payload;

deriving, by the delegate authority system, a mixed key using the base key;

deriving, by the delegate authority system, a transport key using the mixed key;

obtaining, by the delegate authority system, a payload key;

encrypting the payload key using the transport key to obtain an encrypted payload key;

deriving, by the delegate authority system, a validator using the encrypted payload key and the mixed key, wherein the validator enables a security manager core of the integrated circuit to verify that the encrypted payload key is valid and unmodified;

receiving, by the delegate authority system, delegate input parameters, the delegate input parameters comprises an address of where the security manager core is to deliver the payload;

signing, by the delegate authority system, the delegate input parameters, the encrypted payload key, and the validator using a delegate private key to create the DSB, wherein the delegate private key is associated with the delegate authority system; and

providing the DSB to the security manager core of the integrated circuit, wherein the security manager core is to extract the payload in the DSB, the payload specifying at least one of a restriction, a binding, or a value intended for the one or more configurable hardware features of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.

2. The method of claim 1, wherein deriving the mixed key comprises deriving the mixed key using a series of one or more one-way functions on the base key.

3. The method of claim 1, wherein deriving the mixed key comprises deriving the mixed key using at least one of a key tree operation, a hash-based message authentication code (HMAC) computation, or a hash function.

4. The method of claim 1, wherein deriving the transport key comprises deriving the transport key from the mixed key using a series of one or more one-way functions.

5. The method of claim 1, wherein deriving the transport key comprises deriving the transport key from the mixed key using at least one of a symmetric cryptography function, an asymmetric cryptographic function, or a one-way cryptographic function.

6. The method of claim 1, wherein obtaining the payload key comprises deriving the payload key from a master key.

7. The method of claim 1, wherein obtaining the payload key comprises retrieving the payload key from a precomputed data table.

8. The method of claim 1, wherein obtaining the payload key comprises fetching the payload key over a network.

9. The method of claim 1, wherein obtaining the payload key comprises:

retrieving an encrypted payload key from memory; and

decrypting the encrypted payload key to obtain the payload key.

10. The method of claim 1, wherein deriving the validator comprises providing the encrypted payload key and the mixed key as inputs to a series of one or more one-way functions to derive the validator.

11. The method of claim 1, wherein the base key is at least one of a global base key or a device-specific base key programmed into the security manager core or derived from a product identifier, wherein the global base key is a root-authority system key provided to the security manager core as a hardware constant.

12. The method of claim 1, wherein obtaining the base key comprises receiving the base key from at least one of a manufacturer of the integrated circuit, a product vendor, or a security service.

13. The method of claim 1, wherein obtaining the base key comprises:

retrieving a value stored in the security manager core of the integrated circuit; and

processing or decrypting the value to determine the base key.

14. A method comprising:

obtaining, by a delegate authority system, a mixed key or a precursor to the mixed key, the delegate authority system being configured to lock, unlock, modify, or any combination thereof one or more configurable hardware features of an integrated circuit using a delegated signed block (DSB) comprising one or more commands and a payload;

deriving, by the delegate authority system, a transport key using the mixed key;

obtaining, by the delegate authority system, a payload key;

encrypting the payload key using the transport key to obtain an encrypted payload key;

receiving, by the delegate authority system, delegate input parameters, the delegate input parameters comprises an address of where a security manager core of the integrated circuit is to deliver the payload;

signing, by the delegate authority system, the delegate input parameters and the encrypted payload key using a delegate private key to create the DSB, wherein the delegate private key is associated with the delegate authority system; and

providing the DSB to the security manager core of the integrated circuit, wherein the security manager core to extract the payload in the DSB, the payload specifying at least one of a restriction, a binding, or a value intended for the one or more configurable hardware features of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.

15. The method of claim 14, wherein the integrated circuit comprise a device-specific device key, wherein the obtaining the mixed key comprises retrieving a cryptographic operation to use as the mixed key, wherein the cryptographic operation uses a delegate identifier and the device-specific device key to derive the mixed key, and wherein the security manager core is to compute the cryptographic operation for the delegate identifier to obtain the same mixed key.

16. The method of claim 14, wherein the obtaining the mixed key comprises:

receiving a delegated base key as part of a delegated key database, wherein the delegated base key is generated by a root authority system; and

deriving the mixed key using the delegated base key.

17. The method of claim 16, wherein driving the mixed key comprises deriving the mixed key using at least one of a key ladder, a hash-based message authentication code (HMAC) computation, or a hash function.

18. The method of claim 14, further comprising:

deriving, by the delegate authority system, a validator using the encrypted payload key and the mixed key, wherein the validator enables the security manager core of the integrated circuit to verify that the encrypted payload key is valid and unmodified,

wherein the signing further comprises signing the delegate input parameters, the encrypted payload key and the validator using the delegate private key to create the DSB.

19. A delegate authority system comprising:

a memory device; and

a processing device operatively coupled to the memory device, the processing device to;

obtain a mixed key or a precursor to the mixed key;

derive a transport key using the mixed key;

obtain a payload key;

encrypt the payload key using the transport key to obtain an encrypted payload key;

receive delegate input parameters, the delegate input parameters comprises an address of where a security manager core of an integrated circuit is to deliver a payload of a delegated signed block (DSB), wherein the delegate authority system is configured to lock, unlock, modify, or any combination thereof one or more configurable hardware features of the integrated circuit using the DSB;

sign the delegate input parameters and the encrypted payload key using a delegate private key to create the DSB, wherein the delegate private key is associated with the delegate authority system; and

provide the DSB to the security manager core of the integrated circuit, wherein the security manager core to extract the payload in the DSB, the payload specifying at least one of a restriction, a binding, or a value intended for the one or more configurable hardware features of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.

20. The delegate authority system of claim 19, wherein the processing device is further to:

derive a validator using the encrypted payload key and the mixed key, wherein the validator enables the security manager core of the integrated circuit to verify that the encrypted payload key is valid and unmodified; and

sign the delegate input parameters, the encrypted payload key and the validator using the delegate private key to create the DSB.