System and Method for Secure Device Key Storage

• US 20120011373A1
• Filed: 04/20/2011
• Published: 01/12/2012
• Est. Priority Date: 04/21/2010
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Hakkarainen, Harri, Haider, Amer, Parker, Trent, Hussain, Muhammad
• Granted Patent: US 8,661,266 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1011 to devices

Abstract

Disclosed are systems and methods for protecting secret device keys, such as High-bandwidth Digital Content Protection (HDCP) device keys. Instead of storing secret device keys in the plain, a security algorithm and one or more protection keys are stored on the device. The security algorithm is applied to the secret device keys and the one or more protection keys to produce encrypted secret device keys. The encrypted secret device keys are then stored either on chip or off-chip.

Claims

1. A method of protecting a secret device key comprising:

providing a security algorithm module configured to store a security algorithm;

providing a protection key module configured to store a protection key; and

providing an encrypted device key module configured to store an encrypted secret device key generated by applying the security algorithm to a secret device key and utilizing the protection key.

2. The method of claim 1, wherein providing a security algorithm module comprises providing a security algorithm hardwired in logic gates or in a programmable module in a device chip.

3. The method of claim 1, wherein the security algorithm utilizes one of RSA or AES encryption.

4. The method of claim 1, wherein providing a protection key module comprises implementing a bit sequence representing a protection key in one of an EFUSE, an EEPROM, or logic gates in a device chip.

5. The method of claim 1, wherein providing a protection key module comprises providing a programmable device.

6. The method of claim 1, further comprising:

storing a security algorithm in the security algorithm module.

7. The method of claim 1, further comprising:

storing a protection key in the protection key module.

8. The method of claim 1, further comprising:

receiving an unencrypted secret device key;

applying the security algorithm to the unencrypted secret device key utilizing the protection key to obtain an encrypted secret device key; and

storing the encrypted secret device key in the encrypted device key module.

9. The method of claim 1, further comprising:

storing a security algorithm in the security algorithm module;

storing a protection key in the protection key module;

receiving an unencrypted secret device key;

applying the security algorithm to the unencrypted secret device key utilizing the protection key to obtain an encrypted secret device key; and

storing the encrypted secret device key in the encrypted device key module.

10. A system comprising:

a security algorithm module configured to store a security algorithm;

a protection key module configured to store a protection key; and

an encrypted device key module configured to store an encrypted secret device key generated by applying the security algorithm to a secret device key and utilizing the protection key.

11. The system of claim 10, wherein the security algorithm is hardwired in logic gates or in a programmable module in a device chip.

12. The system of claim 10, wherein the security algorithm utilizes one of RSA or AES encryption.

13. The system of claim 10, wherein the protection key module comprises one of an EFUSE, an EEPROM, or logic gates in a device chip.

14. The system of claim 10, wherein the protection key module comprises a programmable device.

15. The system of claim 10, wherein the security algorithm module further comprises a device-specific key and the security algorithm module is configured to utilize the device-specific key to generate the encrypted secret device key.

16. The system of claim 15, wherein the device-specific key is a non-software-readable key.

17. A method of protecting a secret device key comprising:

providing a security algorithm module comprising a security algorithm and a non-software-readable device-specific key; and

providing a protection key module configured to store a protection key,

wherein the security algorithm module is configured to encrypt a secret device key by applying the security algorithm to the secret device key, the non-software-readable device specific key, and the protection key.

18. The method of claim 17, wherein the security algorithm is hardwired in logic gates or in a programmable module in a device chip.

19. The method of claim 17, wherein the security algorithm utilizes one of RSA or AES encryption.

20. The method of claim 17, wherein providing a protection key module comprises implementing a bit sequence representing a protection key in one of an EFUSE, an EEPROM, or logic gates in a device chip.

21. The method of claim 17, wherein providing a protection key module comprises providing a programmable device.

22. The method of claim 17 further comprising:

storing a protection key in the protection key module.

23. The method of claim 17, further comprising:

providing an encrypted device key module configured to store the encrypted secret device key.

24. The method of claim 17, further comprising:

receiving an unencrypted secret device key;

applying the security algorithm to the unencrypted secret device key utilizing the device-specific key and the protection key to obtain an encrypted secret device key; and

storing the encrypted secret device key in an encrypted device key module.

25. A system comprising:

a security algorithm module comprising a security algorithm and a non-software-readable device-specific key; and

a protection key module configured to store a protection key.

26. The system of claim 25 further comprising:

an encrypted device key module configured to store an encrypted secret device key generated by applying the security algorithm to an unencrypted secret device key and utilizing the device-specific key and the protection key.

27. The system of claim 25, wherein the security algorithm is hardwired in logic gates or in a programmable module in a device chip.

28. The system of claim 25, wherein the security algorithm utilizes one of RSA or AES encryption.

29. The system of claim 25, wherein the protection key module comprises one of an EFUSE, an EEPROM, or logic gates in a device chip.

30. The system of claim 25, wherein the protection key module comprises a programmable device.