System and method for security key transmission with strong pairing to destination client

• US 9,094,699 B2
• Filed: 06/18/2004
• Issued: 07/28/2015
• Est. Priority Date: 02/05/2004
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Chen, Iue-Shuenn, Patariu, Kevin
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US10/871,120
• Publication Number:
  US 20050177741A1
• Time in Patent Office: 4,057 Days
• Field of Search: 713/162, 713/189, 713/375, 726/26, 726/27, 380/22, 380277-279, 380/222
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Systems and methods for security key transmission with strong pairing to a destination client are disclosed. A security key may be generated by an on-chip key generator, an off-chip device, and/or software. A rule may then be paired with the security key and an address associated with the security key. The rule may define permissible usage by a destination module, which is defined by the associated address. The rule may comprise a command word, which may be implemented using a data structure associated with a permissible algorithm type, a security key size, and/or a security key source.

Claims

1. A method for security key transmission, the method comprising:

generating, by at least one processor in an integrated circuit, a security key sequence comprising a security key, a security command comprising an algorithm associated with the security key, and an address associated with a destination module;

sending, by the processor, the security key sequence to the destination module; and

receiving, by the processor, an error message from the destination module in response to the algorithm being different than an algorithm configuration of the destination module.

2. The method of claim 1, wherein the security command defines permissible usage by the destination module.

3. The method of claim 1, further comprising:

sending, by the processor, a command word to the destination module.

4. The method of claim 3, wherein the command word comprises instructions for the destination module to invalidate the security key.

5. The method of claim 1, wherein the security command further comprises a security key size and a security key source.

6. The method of claim 1, wherein the security command indicates whether the destination module is authorized to use the security key.

7. The method of claim 1, further comprising:

generating the security key by a key generator disposed in the integrated circuit, an external key generator, or software.

8. The method of claim 1, further comprising:

serially transmitting, by the processor, the security key sequence to the destination module.

9. The method of claim 1, further comprising:

comparing, by the destination module, the algorithm with the algorithm configuration of the destination module.

10. The method of claim 9, further comprising:

sending, by the destination module, the error message to the processor in response to the algorithm being different than the algorithm configuration of the destination module.

11. The method of claim 9, further comprising:

invalidating, by the destination module, the security key in response to the algorithm being different than the algorithm configuration of the destination module.

12. A non-transitory machine-readable storage having stored thereon, a computer program having at least one code section for security key transmission, the at least one code section being executable by a machine for causing the machine to perform steps comprising:

generating a security sequence comprising a security key, a security command comprising an algorithm associated with the security key, and an address associated with a destination module;

sending the security sequence to the destination module; and

receiving an error message from the destination module in response to the algorithm being different than an algorithm configuration of the destination module.

13. The non-transitory machine-readable storage of claim 12, wherein the security command defines permissible usage by the destination module.

14. The non-transitory machine-readable storage of claim 12, the steps further comprising:

sending a command word to the destination module.

15. The non-transitory machine-readable storage of claim 12, wherein the command word comprises instructions for the destination module to invalidate the security key.

16. The non-transitory machine-readable storage of claim 12, wherein the security command further comprises a security key size and a security key source.

17. The non-transitory machine-readable storage of claim 12, wherein the security command indicates whether the destination module is authorized to use the security key.

18. The non-transitory machine-readable storage of claim 12, the steps further comprising

generating the security key by a key generator disposed in the integrated circuit, an external key generator, or software.

19. The non-transitory machine-readable storage of claim 12, the steps further comprising:

serially transmitting the security key sequence to the destination module.

20. The non-transitory machine-readable storage of claim 12, the steps further comprising:

comparing the algorithm with the algorithm configuration of the destination module.

21. The non-transitory machine-readable storage of claim 20, the steps further comprising:

generating the error message to the processor in response to the algorithm being different than the algorithm configuration of the destination module.

22. The non-transitory machine-readable storage of claim 20, the steps further comprising:

invalidating the security key in response to the algorithm being different than the algorithm configuration of the destination module.

23. A system for security key transmission, the system comprising:

at least one processor in an integrated circuit that is configured to generate a security key sequence comprising a security key, a security command comprising an algorithm associated with the security key, and an address associated with a destination module, wherein the processor is further configured to;

send the security key sequence to the destination module, and

receive an error message from the destination module in response to the algorithm being different than an algorithm configuration of the destination module.

24. The system of claim 23, wherein the security command defines permissible usage by the destination module.

25. The system of claim 23, wherein the processor is further configured to send a command word to the destination module.

26. The system of claim 25, wherein the command word comprises instructions for the destination module to invalidate the security key.

27. The system of claim 23, wherein the security command further comprises a security key size and a security key source.

28. The system of claim 23, wherein the security command indicates whether the destination module is authorized to use the security key.

29. The system of claim 23, further comprising a generator for generating the security key.

30. The system of claim 29, wherein the generator comprises a key generator disposed in the integrated circuit, an external key generator, or software.

31. The system of claim 23, wherein the processor is further configured to serially transmit the security key sequence to the destination module.

32. The system of claim 23, further comprising a destination module processor configured to compare the algorithm with the algorithm configuration of the destination module.

33. The system of claim 32, wherein the destination module processor is further configured to send the error message to the processor in response to the algorithm being different than the algorithm configuration of the destination module.

34. The system of claim 32, wherein the destination module processor is further configured to invalidate the security key in response to the algorithm being different than the algorithm configuration of the destination module.