Cryptographic Transmission System

• US 20130219189A1
• Filed: 02/20/2013
• Published: 08/22/2013
• Est. Priority Date: 02/21/2012
• Status: Active Grant

• Current Assignee: Microchip Technology Incorporated
• Original Assignee: Microchip Technology Incorporated
• Inventors: Simmons, Michael
• Granted Patent: US 9,286,241 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

A microcontroller includes on-chip key storage slots stored in a non-volatile memory, wherein selecting which key is to be used is restricted to software, wherein a predetermined key storage slot stores a Key Encrypt Key (KEK), and a register flag is provided for determining whether the predetermined key storage slot stores a key for encrypting/decrypting data or the KEK for encrypting/decrypting a key

Claims

1. A microcontroller comprising on-chip key storage slots stored in a non-volatile memory, wherein selecting which key is to be used is restricted to software, wherein a predetermined key storage slot stores a Key Encrypt Key (KEK), and a register flag is provided for determining whether the predetermined key storage slot stores a key for encrypting/decrypting data or the KEK for encrypting/decrypting a key.

2. The microcontroller according to claim 1, wherein the non-volatile memory is a one-time programmable memory.

3. The microcontroller according to claim 1, wherein the non-volatile memory is a flash memory, wherein the keys are stored in an encrypted format and wherein the KEK can be used to decrypt the keys.

4. The microcontroller according to claim 1, wherein if said register flag is set and the predetermined key slot is used for an encryption or decryption operation, a key configuration error is generated.

5. The microcontroller according to claim 1, wherein the register flag and the keys share a level of security permission.

6. The microcontroller according to claim 1, further including hardware for selecting a destination for encrypted data based on whether the register flag for the KEK selection is set and which key of a plurality of keys has been selected.

7. A method for handling encryption keys in processor, comprising:

selecting at least one key encrypt key (KEK) from predetermined ones of a plurality of key storage slots in non-volatile memory;

determining if the at least one key encrypt key is to be used for encrypting/decrypting data or encrypting/decrypting a session key; and

if the at least one key encrypt key is to be used for encrypting/decrypting a session key, preventing the key encrypt key from encrypting/decrypting data.

8. The method according to claim 7, wherein the non-volatile memory is a one-time programmable memory.

9. The method according to claim 7, wherein the non-volatile memory is a flash memory, wherein the keys are stored in an encrypted format and wherein the KEK can be used to decrypt the keys.

10. The method according to claim 7, wherein if a register flag is set and the predetermined key slot is used for an encryption or decryption operation, a key configuration error is generated.

11. The method according to claim 7, wherein a register flag corresponding to an encryption/decryption status and the keys share a level of security permission.

12. The method according to claim 7, further including selecting a destination for encrypted data based on whether KEK selection has been set and which key of a plurality of keys has been selected for encrypting/decrypting data.

14. The method according to claim 7, wherein the non-volatile memory is a one-time programmable memory.

15. The method according to claim 7, wherein the non-volatile memory is a flash memory, wherein the plurality of keys are stored in an encrypted format and wherein the dual mode encryption key is used to decrypt the keys.

16. The method according to claim 7, wherein if a status bit is set and the dual mode encryption key slot is used for an encryption or decryption operation, a key configuration error is generated.

17. The method according to claim 16, wherein the status bit and the keys share a level of security permission.

18. The method according to claim 7, further including selecting a destination for encrypted data based on which mode is set and which key of a plurality of keys has been selected for encrypting/decrypting data.

13. A method for handling encryption keys in processor, comprising:

providing a dual mode encryption key among a plurality of keys in a predetermined one of a plurality of key storage slots in non-volatile memory; and

defining whether the dual mode encryption key is to be used to encrypt/decrypt data or encrypt/decrypt a session key;

wherein if dual mode encryption key is defined to be used to encrypt/decrypt a session key, the dual mode encryption key cannot be used to encrypt or decrypt data.