Dynamic key and rule storage protection

• US 9,501,429 B2
• Filed: 02/05/2015
• Issued: 11/22/2016
• Est. Priority Date: 09/05/2008
• Status: Expired due to Fees

• Current Assignee: VIXS Systems Incorporated (Pixelworks Incorporated)
• Original Assignee: VIXS Systems Incorporated (Pixelworks Incorporated)
• Inventors: Zheng, Heyun, Stewart, Norman, Zhang, Jing
• Primary Examiner(s): TURCHEN, JAMES R
• Application Number:
  US14/614,806
• Publication Number:
  US 20160315765A1
• Time in Patent Office: 656 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4183 providing its own processing capabilities, e.g. external module for video decoding
• CPC Class Codes: H04N 21/42623 involving specific decryption arrangements
• CPC Class Codes: H04N 21/42692 for reading from or writing on a volatile storage medium, e.g. Random Access Memory [RAM]
• CPC Class Codes: H04N 21/4431 characterized by the use of Application Program Interface [API] libraries
• CPC Class Codes: H04N 21/4435 : Memory management allocation of memory to service a request G06F9/5016; addressing or allocating within memory systems or architectures G06F12/02
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A media processing device includes a key store memory to store a plurality of cryptographic keys and a rule set memory to store a plurality of rules for the plurality of cryptographic keys. The media processing device further includes an integrity module to determine a first cyclical redundancy check (CRC) value from the plurality of rules stored in the rule set memory and compare the first CRC with a second CRC value associated with the plurality of rules. The media processing device further includes an arbitration module to prevent further access to the plurality of rules in the rule set memory responsive to the integrity verification module signaling a mismatch between the first CRC and the second CRC.

Claims

1. In a media processing device, a method comprising:

determining a first cyclical redundancy check (CRC) value from a plurality of rules stored in a rule set memory of the media processing device, each rule of the plurality of rules corresponding to a corresponding cryptographic key stored at the media processing device;

comparing the first CRC value with a second CRC value corresponding to the plurality of rules; and

preventing further access to the plurality of rules in the rule set memory in response to determining a mismatch between the first CRC value and the second CRC value.

2. The method of claim 1, further comprising:

copying the plurality of rules from a one time programmable (OTP) memory to the rule set memory; and

accessing the second CRC value from the OTP memory.

3. The method of claim 2, further comprising:

programming the OTP memory with the first CRC value during a provisioning of the media processing device.

4. The method of claim 1, further comprising:

determining the second CRC value based on the plurality of rules stored in the rule set memory during a boot process of the media processing device; and

wherein determining the first CRC value comprises determining the first CRC value after the boot process has finished.

5. The method of claim 1, further comprising:

determining the second CRC value based on the plurality of rules stored in the rule set memory in response to an access to the rule set memory.

6. The method of claim 1, wherein comparing the first CRC value with the second CRC value comprises comparing the first CRC value with the second CRC value in response to a lapse of a timer or a read access request to the rule set memory.

7. The method of claim 1, wherein preventing further access to the plurality of rules in the rule set memory comprises wiping the plurality of rules from the rule set memory.

8. A media processing device comprising:

a key store memory to store a plurality of cryptographic keys;

a rule set memory to store a plurality of rules for the plurality of cryptographic keys; and

an integrity module coupled to the key store memory and the rule set memory, the integrity module to determine a first cyclical redundancy check (CRC) value from the plurality of rules stored in the rule set memory and compare the first CRC value with a second CRC value corresponding to the plurality of rules; and

an arbitration module coupled to the integrity module, the arbitration module to prevent further access to the plurality of rules in the rule set memory responsive to the integrity verification module signaling a mismatch between the first CRC and the second CRC.

9. The media processing device of claim 8, further comprising:

a loader module to copy the plurality of rules from a one time programmable (OTP) memory to the rule set memory; and

the integrity module is to access the second CRC value from the OTP memory.

10. The media processing device of claim 8, wherein the OTP memory is programmed with the first CRC value during a provisioning of the media processing device.

11. The media processing device of claim 8, wherein:

the integrity module is to determine the second CRC value based on the plurality of rules stored in the rule set memory during a boot process of the media processing device; and

the integrity module is to determine the first CRC value after the boot process has finished.

12. The media processing device of claim 8, wherein:

the integrity module is to determine the second CRC value based on the plurality of rules stored in the key store memory in response to an access to the rule set memory.

13. The media processing device of claim 8, wherein:

the integrity module is to compare the first CRC value with a second CRC value in response to a lapse of a timer or a read access request for the rule set memory.

14. The media processing device of claim 8, wherein:

the arbitration module is to prevent further access to the plurality of rules in the rule set memory by wiping the plurality of rules from the rule set memory.

15. The media processing device of claim 8, wherein:

the key store memory and the rule set memory comprise at least one random access memory.

16. The media processing device of claim 15, wherein:

the at least one random access memory comprises a static random access memory (SRAM).