Method for secure distribution and configuration of asymmetric keying material into semiconductor devices

• US 6,882,730 B1
• Filed: 06/29/2000
• Issued: 04/19/2005
• Est. Priority Date: 06/29/2000
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Herbert, Howard C., Davis, Derek L.
• Primary Examiner(s): MOISE, EMMANUEL LIONEL
• Application Number:
  US09/607,412
• Time in Patent Office: 1,755 Days
• Field of Search: 380/283, 380/278, 713/156, 713/163, 713/200, 713/201
• US Class Current: 380/283
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

In one embodiment, a method is described to secure transfer data from one location to another for storage in an electronic component. The transfer occurs with part of the data routed to a first destination and the remaining data routed to a second destination. The data routed to the first destination is for securely loading a current sort encrypted key (SEK) and a next SEK into memory of the electronic component. The data routed to the second destination includes a private key which is recovered using the current SEK and the next SEK.

Claims

1. A method comprising:

transferring at least a first bundle to a first destination via a first link; and

transferring at least a second bundle to the first destination via a first out-of-band information carrying mechanism;

transferring a plurality of bundles to a second destination, each of the plurality of bundles including a key, a key identifier and an integrity check value and the plurality of bundles includes a third bundle arid a fourth bundle, the third bundle is a plurality of second part bundle encryption key (BEK_p2) bundles, each of the BEK_p2 bundles includes a second part of a bundle encryption key and a combined integrity check value associated with a first encryption key and a second encryption key;

storing a current sort encryption key (SEK) at the first destination in an internal memory;

storing a next SEK at the first destination in the internal memory;

providing the electronic component to the second destination; and

recovering a private key at the second destination from a key bundle based on the current SEK, the next SEK and the plurality of bundles received at the second destination.

2. The method of claim 1, wherein the first bundle includes a plurality of configuration window (CWIN) bundles.

3. The method of claim 2, wherein each of the CWIN bundles includes a configuration window material, the configuration window material includes (i) a first key identifier associated with the current SEK, (ii) the current SEK, (iii) a second key identifier associated with the next SEK, (iv) the next SEK and (v) a group integrity check value for a first encryption key and a second encryption key.

4. The method of claim 3, wherein the configuration window material is encrypted with the first encryption key and the second encryption key.

5. The method of claim 4, wherein each CWIN bundle further includes a group identifier associated with the first encryption key and the second encryption key.

6. The method of claim 2, wherein the second bundle includes a plurality of sort encryption key (SEK) bundles.

7. The method of claim 6, wherein each of the SEK bundles includes (i) a sort encryption key, (ii) a key identifier associated with the sort encryption key and (iii) an integrity check value associated with the sort encryption key.

8. The method of claim 1, wherein the third bundle is transferred to the second destination via a second link.

9. The method of claim 1, wherein the fourth bundle is transferred to the second destination via a second out-of-band information carrying medium.

10. The method of claim 1, wherein the second part of the bundle encryption key and the combined integrity check value are encrypted with the first encryption key and the second encryption key.

11. The method of claim 1, wherein each BEK_P2 bundle further includes a group identifier associated with the first encryption key and the second encryption key.

12. The method of claim 1, wherein the fourth bundle includes a plurality of configuration encryption key (CEK) bundles.

13. The method of claim 12, wherein each of the CEK bundles includes (i) a configuration encryption key, (ii) a key identifier associated with the configuration encryption key and (iii) an integrity check value associated with the configuration encryption key.

14. The method of claim 1, wherein the current SEK represents a current period of validity for configuration of the electronic component.

15. The method of claim 14, wherein the next SEK represents a next period of validity for configuration of the electronic component.

16. The method of claim 1, wherein the second bundles includes a plurality of first part bundle encryption key (BEK_P1) bundles and a plurality of second part bundle encryption key (BEK_P2) bundles.