System with secure cryptographic capabilities using a hardware specific digital secret

• US 7,681,046 B1
• Filed: 09/26/2003
• Issued: 03/16/2010
• Est. Priority Date: 09/26/2003
• Status: Active Grant

• Current Assignee: Intellectual Ventures Funding LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures Funding LLC (Intellectual Ventures LLC)
• Inventors: Morgan, Andrew, Anvin, H. Peter
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US10/672,796
• Time in Patent Office: 2,363 Days
• Field of Search: 713192-194
• US Class Current: 713/193
• CPC Class Codes: G06F 21/72 in cryptographic circuits

Abstract

A system with secure cryptographic capabilities using a hardware specific digital secret.

Claims

1. A processor, comprising:

a digital secret including a secret key used in a key-based cryptographic process, wherein the digital secret is stored within the processor, wherein the processor is configured to use the digital secret for both encryption and decryption, wherein the digital secret is calculated using an HMAC algorithm implemented on testing data, and wherein the testing data is associated with fabrication of the processor;

a cryptography engine configured to perform the key-based cryptographic process internally within the processor using the digital secret; and

internal memory configured to store data associated with the key-based cryptographic process, wherein the data includes at least one result of a calculation performed by the key-based cryptographic process.

2. The processor of claim 1 further comprising an internal bus configured to facilitate secure communication between the cryptography engine, the digital secret, and the internal memory within said processor.

3. The processor of claim 1, wherein the digital secret is securely confined within the processor.

4. The processor of claim 1, wherein the internal memory includes microcode for implementing the key-based cryptographic process on the data within the processor, and wherein the internal memory is configured to perform state tracking associated with the key-based cryptographic process.

5. The processor of claim 1, wherein the data includes intermediate data generated by the key-based cryptographic process.

6. The processor of claim 1 further comprising:

a cryptography unit including a functional unit within the processor for securely executing the key-based cryptographic process internally within the processor, wherein the cryptography unit includes;

the digital secret;

the cryptography engine; and

the internal memory.

7. The processor of claim 1, wherein the key-based cryptographic process includes:

a key-based encryption process; and

a key-based decryption process.

8. The processor of claim 1, wherein the processor includes:

a secure hardware environment configured to provide core processing functionality; and

a secure software environment coupled to the secure hardware environment, wherein the secure software environment is configured to generate executable instructions that are sent to the secure hardware environment for processing, wherein the secure hardware environment in combination with the secure software environment is configured to provide processor capability, and wherein the secure hardware environment is accessible through the secure software environment.

9. The processor of claim 1, wherein the digital secret is unique to the processor and is permanently and physically manifested within the processor.

10. A processor, comprising:

a secure cryptography unit, wherein the secure cryptography unit is configured to internally provide secure cryptographic capabilities as a functional unit within the processor, the secure cryptography unit including;

a cryptography engine configured to perform a key-based cryptographic process;

a digital secret accessible to the cryptography engine, wherein the digital secret includes a secret key used in the key-based cryptographic process, wherein the processor is configured to use the secret key for both encryption and decryption, wherein the digital secret is calculated using an HMAC algorithm implemented on testing data, and wherein the testing data is associated with fabrication of the processor; and

internal memory configured to store data associated with the key-based cryptographic process, wherein the data includes at least one result of a calculation performed by the key-based cryptographic process.

11. The processor of claim 10, wherein the key-based cryptographic process includes:

a key-based encryption process; and

a key-based decryption process.

12. The processor of claim 10, wherein the processor is a very long instruction word (VLIW) processor.

13. The processor of claim 10, wherein the processor includes:

a secure hardware environment providing core processing functionality; and

a secure software environment coupled to the secure hardware environment, wherein the secure software environment is configured to generate executable instructions that are sent to the secure hardware environment for processing, wherein the secure hardware environment in combination with the secure software environment is configured to provide processor capability, and wherein the secure hardware environment is accessible through the secure software environment.

14. The processor of claim 10, wherein the digital secret is unique to the processor and is permanently and physically manifested within the processor.

15. The processor of claim 10, wherein the digital secret includes:

a plurality of fusible links configured to manifest the digital secret by permanently setting a binary state in each of the plurality of fusible links.

16. The processor of claim 10, wherein the testing data includes:

wafer test data; and

die test data.

17. The processor of claim 10, wherein the secure cryptography unit is a fully integrated circuit within the processor.

18. The processor claim 10, wherein the digital secret and the internal memory are fully integrated with the cryptography engine to facilitate communication without use of a bus.

19. The processor of claim 10, wherein the key-based cryptography process includes a Triple Data Encryption Algorithm (TDEA or Triple DES) cryptography process.

20. A processor, comprising:

a secure hardware environment configured to provide core processing functionality, wherein the secure hardware environment includes;

a secure cryptography unit configured to provide secure cryptographic capabilities as a functional unit within the secure hardware environment, wherein the secure cryptography unit is configured to facilitate performance of a key-based cryptographic process performed by the processor, wherein the key-based cryptographic process includes encryption using a digital secret and decryption using the digital secret, wherein the digital secret is calculated using an HMAC algorithm implemented on testing data, wherein the testing data is associated with fabrication of the processor, wherein the key-based cryptographic process further includes generating data, wherein the data includes at least one result of a calculation performed by the key-based cryptographic process.

21. The processor of claim 20 further comprising:

a secure software environment configured to access the secure hardware environment, wherein the secure software environment is configured to generate executable instructions that are sent to the secure hardware environment for processing, wherein the secure hardware environment in combination with the secure software environment is configured to provide processor capability.

22. The processor of claim 20, wherein the secure cryptography unit includes:

a cryptography engine configured to perform the key-based cryptographic process;

the digital secret accessible to the cryptography engine, wherein the digital secret includes a secret key used in the key-based cryptographic process; and

internal memory coupled to the cryptography engine, wherein the internal memory is configured to support the key-based cryptographic process and further configured to perform state tracking associated with the key-based cryptographic process.

23. The processor of claim 22, wherein the internal memory is configured to securely store the data, and wherein the data includes intermediate data generated by the key-based cryptographic process.

24. The processor of claim 22, wherein the secure cryptography unit is a fully integrated circuit within the processor, and wherein the secure cryptography unit is configured to facilitate communication between the cryptography engine, the digital secret and the internal memory without use of a bus.

25. The processor of claim 20, wherein the secure cryptography unit is a fully integrated circuit within the processor.