SECURE FEATURE AND KEY MANAGEMENT IN INTEGRATED CIRCUITS

• US 20160028722A1
• Filed: 09/30/2015
• Published: 01/28/2016
• Est. Priority Date: 08/10/2012
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Kocher, Paul Carl, Jun, Benjamin Che-Ming, Leiserson, Andrew John
• Granted Patent: US 10,084,771 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

A mechanism for providing secure feature and key management in integrated circuits is described. An example method includes receiving, by a root authority system, data identifying a command that affects operation of an integrated circuit, singing, by the root authority system, the command using a root authority key to create a root signed block (RSB), and providing the RSB to a security manager of the integrated circuit.

Claims

1. A method comprising:

receiving, by a root authority system, data identifying a command that affects operation of an integrated circuit;

singing, by the root authority system, the command using a root authority key to create a root signed block (RSB); and

providing the RSB to a security manager of the integrated circuit.

2. The method of claim 1 wherein the RSB is provided to the security manager via a tester interface of the integrated circuit.

3. The method of claim 1 wherein the command instructs the security manager to update to a feature of the integrated circuit, wherein an update to the feature is persistent or non-persistent.

4. The method of claim 1 wherein the command is to deliver one or more keys to components of the integrated circuit, wherein the keys pertain to at least one of:

encryption operations of the components, digital rights management operations of the components, password management operations of the components, or authentication operations of the components.

5. The method of claim 1 wherein the command is to store one or more hardware constants within the integrated circuit, the hardware constants comprising at least one of:

a product chip identifier, one or more security keys, one or more base keys, or error correction data.

6. A method comprising:

receiving, by a root authority system, input parameters indicating a command affecting operation of an integrated circuit;

creating, by the root authority system, a root signed block (RSB) comprising the command and delegate permissions associated with a delegate authority system, the RSB being signed by the root authority system; and

providing the RSB to a security manager of the integrated circuit.

7. The method of claim 6 wherein the delegate permissions define management capabilities of the delegate authority system over the security manager.

8. The method of claim 6 wherein the RSB further comprises a public key associated with the delegate authority system.

9. The method of claim 6 wherein the RSB further comprises a command template associated with the command.

10. The method of claim 6 wherein the RSB further comprises one or more requirements for a delegate authority signature.

11. The method of claim 6 further comprising delivering the RSB to the delegate authority system.

12. A method comprising:

receiving, by a delegate authority system, input parameters including a command affecting operation of an integrated circuit;

signing, by the delegate authority system, the delegate input parameters to create a delegate signed block (DSB); and

providing the DSB to a security manager of the integrated circuit.

13. The method of claim 12 wherein the input parameters are received as part of a root signed block (RSB) provided by a root authority system.

14. The method of claim 13 wherein the DSB is associated with the RSB, the RSB being provided to the security manager.

15. The method of claim 13 wherein the RSB comprises one or more of:

delegate permissions associated with the delegate authority system, a public key associated with the delegate authority system, a command template associated with the command, or requirements for a delegate authority signature.

16. The method of claim 15 wherein the delegate permissions define management capabilities of the delegate authority system over the security manager.