Methods circuits devices and systems for provisioning of cryptographic data to one or more electronic devices

• US 8,687,813 B2
• Filed: 12/09/2010
• Issued: 04/01/2014
• Est. Priority Date: 11/16/2009
• Status: Active Grant

• Current Assignee: Arm Limited (SoftBank Group Corp.)
• Original Assignee: Sansa Security, Inc. (SoftBank Group Corp.)
• Inventors: Bar-El, Hagai
• Primary Examiner(s): LESNIEWSKI, VICTOR D
• Application Number:
  US12/947,381
• Publication Number:
  US 20110116635A1
• Time in Patent Office: 1,209 Days
• Field of Search: 380/278, 380/279, 380/280, 380/44, 380/45
• US Class Current: 380/280
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

Disclosed are methods, circuit, devices and systems for provisioning cryptographic material to a target device. According to embodiments, a cryptographic material provisioning (CMP) module may be adapted to process a provisioning message with a first message portion which is encrypted with a native key of the target device and which includes first cryptographic material along with a first permissions data vector, wherein the CMP may be further adapted to process data bits of a second portion of the provisioning message using the first cryptographic material and in accordance with usage limitations defined in the first permissions data vector.

Claims

1. An electronic device comprising:

a cryptographic material provisioning (CMP) module to perform a method comprising;

(a) receiving a CMP message which comprises a preamble and a payload;

(b) decrypting the preamble of the CMP message by using a root key of the electronic device;

(c) extracting from the decrypted preamble of the CMP message a first cryptographic key;

(d) extracting from the decrypted preamble of the CMP message a primary permissions data vector indicating at least one of;

(A) a type of keys that are authorized to be provisioned to the electronic device by a user of the preamble, and (B) an indication of whether or not the user of the preamble is authorized to delegate key provisioning rights to other entities;

(e) decrypting at least a portion of the payload of the CMP message by using the first cryptographic key that was extracted from the preamble;

(f) extracting a functional cryptographic key from the decrypted payload of the CMP message, wherein the extracted functional cryptographic key comprises a cryptographic key associated with at least one of;

an application installed on the electronic device, and a process running on the electronic device;

(g) checking key metadata, of the extracted functional cryptographic key, against one or more usage permissions indicated by the primary permissions data vector, and determining whether or not the extracted functional cryptographic key is of a type permitted for provisioning;

(h) if it is determined that the extracted functional cryptographic key is of a type permitted for provisioning by the permissions data vector, then provisioning the extracted functional cryptographic key to said electronic device, wherein the provisioning comprises at least one of;

(x) storing the extracted functional cryptographic key in the electronic device, (y) using the extracted functional cryptographic key in the electronic device, (z) installing the extracted functional cryptographic key in the electronic device,

wherein the CMP message comprises a multi-level delegation hierarchy for provisioning one or more cryptographic keys for use by one or more applications of the electronic device;

wherein the root key of the electronic device is used to delegate at least partial key provisioning rights to one or more other parties;

wherein at least one of said other parties is authorized, based on a respective permissions data vector, to delegate at least part of the key provisioning rights to one or more other parties,

wherein the electronic device is implemented by utilizing at least a hardware component.

2. The electronic device according to claim 1, wherein some or all of the preamble is digitally signed using the root key of the electronic device.

3. The electronic device according to claim 1, wherein said extracted functional cryptographic key is utilized by the electronic device for a process selected from the group consisting of (1) decrypting data, (2) encrypting data, (3) digital rights management, (4) signature generation, (5) signature generation verification, and (6) payment application.

4. The electronic device according to claim 1, wherein said CMP module is to regulate usage of the extracted functional cryptographic key by an application of the electronic device in accordance with usage permissions indicated by key metadata and by the primary permissions data vector.

5. The electronic device according to claim 1, wherein the method comprises:

extracting from the decrypted payload of the CMP message a second cryptographic key usable for decrypting another portion of the CMP message.

6. The electronic device according to claim 5, wherein the decrypted payload of the CMP message further comprises a second permissions data vector, and wherein said CMP module is to regulate usage of said second cryptographic key in accordance with usage limitations of both the first and second permissions data vectors.

7. The electronic device according to claim 6, wherein said CMP module is to process a portion of the CMP message using the second cryptographic key.

8. The electronic device according to claim 7, wherein said CMP module is to regulate usage of the extracted functional cryptographic key, extracted from said CMP message, in accordance with all usage limitations of all permissions data vectors within the CMP message.

9. The electronic device according to claim 1, wherein the primary permissions data vector defines one or more types of functional cryptographic key which may be included in the CMP message.

10. The electronic device according to claim 9, wherein said CMP module is not to process cryptographic material in the CMP message associated with functional keys of a type that is different from types defined in the primary permissions data vector.

11. The electronic device of claim 1, wherein extracting the functional cryptographic key from the decrypted payload of the CMP message comprises:

(A) determining that the decrypted payload comprises a secondary permissions data vector and a second cryptographic key;

(B) extracting from the decrypted payload said secondary permissions data vector and said second cryptographic key;

(C) regulating usage of the extracted functional cryptographic key in accordance with usage limitations of both the primary permissions data vector and the secondary permissions data vector.

12. The electronic device of claim 1, wherein the CMP message comprises a two-part preamble and a payload portion;

wherein the two-part preamble comprises;

(A) a first preamble portion which stores (i) a first cryptographic key, encrypted by using the root key of the electronic device; and

(ii) a first permissions vector associated with the first cryptographic key, wherein the first permissions vector defines provisioning limitations associated with the first cryptographic key; and

(B) a second preamble portion which stores (iii) a second cryptographic key, encrypted by using the first cryptographic key; and

(iv) a second permissions vector associated with the second cryptographic key, wherein the second permissions vector defines provisioning limitations associated with the second cryptographic key;

wherein the payload portion comprises;

(v) said functional cryptographic key, encrypted by using the second cryptographic key;

wherein provisioning of the functional cryptographic key is regulated by provisioning limitations which correspond to an aggregation of the provisioning limitations of the first and second permission vectors.

13. The electronic device of claim 1, wherein the multi-level delegation hierarchy has a non-predefined length.

14. The electronic device of claim 1, wherein the CMP message comprises data for partial delegation functionality based on key types;

wherein a member in a provisioning rights delegation hierarchy is authorized, by a respective permissions vector, to define which delegated key provisioning rights its delegates receive by delegation.

15. The electronic device of claim 14, wherein the CMP message comprises data indicating that delegated key provisioning rights do not exceed key provisioning rights of a member higher in the a multi-level delegation hierarchy.

16. The electronic device of claim 1, wherein the preamble of the CMP message is generated for a specific target device and is provided to a party intending to utilize the functional cryptographic key on said target device.

17. The electronic device of claim 1, wherein the preamble of the CMP message

(A) is generated for a specific group of multiple target devices, and

(B) is provided to a party intending to utilize the functional cryptographic key on said target device.

18. The electronic device of claim 17, wherein the specific group of multiple target devices comprises at least one of:

a group of multiple electronic devices that have a common maker;

a group of multiple electronic devices that have a common model.

19. A method of cryptographic material provisioning (CMP), the method being implementable on an electronic device which comprises at least a hardware component, the method comprising:

(a) receiving a CMP message which comprises a preamble and a payload;

(b) decrypting the preamble of the CMP message by using a root key of the electronic device;

(c) extracting from the decrypted preamble of the CMP message a first cryptographic key;

(d) extracting from the decrypted preamble of the CMP message a primary permissions data vector indicating at least one of;

(A) a type of keys that are authorized to be provisioned to the electronic device by a user of the preamble, and (B) an indication of whether or not the user of the preamble is authorized to delegate key provisioning rights to other entities;

(e) decrypting at least a portion of the payload of the CMP message by using the first cryptographic key that was extracted from the preamble;

(f) extracting a functional cryptographic key from the decrypted payload of the CMP message, wherein the extracted functional cryptographic key comprises a cryptographic key associated with at least one of;

an application installed on the electronic device, and a process running on the electronic device;

(g) checking the extracted functional cryptographic key against one or more usage permissions indicated by the primary permissions data vector, and determining whether or not the extracted functional cryptographic key is of a type permitted for provisioning;

(h) if it is determined that the extracted functional cryptographic key is of a type permitted for provisioning by the permissions data vector, then provisioning the extracted functional cryptographic key to said electronic device, wherein the provisioning comprises at least one of;

(x) storing the extracted functional cryptographic key in the electronic device, (y) using the extracted functional cryptographic key in the electronic device, (z) installing the extracted functional cryptographic key in the electronic device;

wherein the method is implemented by an electronic device comprising at least a hardware component,

wherein the CMP message comprises a multi-level delegation hierarchy for provisioning one or more cryptographic keys for use by one or more applications of the electronic device;

wherein the root key of the electronic device is used to delegate at least partial key provisioning rights to one or more other parties;

wherein at least one of said other parties is authorized, based on a respective permissions data vector, to delegate at least part of the key provisioning rights to one or more other parties.