GENERATING AND DISTRIBUTING PRE-COMPUTED DATA (PCD) ASSETS TO A TARGET DEVICE

• US 20150326540A1
• Filed: 11/06/2014
• Published: 11/12/2015
• Est. Priority Date: 05/07/2014
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Jun, Benjamin Che-Ming, Kocher, Paul C., O'Loughlin, Daniel, Pochuev, Denis Alexandrovich, Hamburg, Michael
• Granted Patent: US 9,923,890 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

The embodiments described herein describe technologies for pre-computed data (PCD) asset generation and secure deployment of the PCD asset to a target device in an operation phase of a manufacturing lifecycle of the target device in a cryptographic manager (CM) environment. One implementation includes a Root Authority (RA) device that receives a first command to generate a unique PCD asset for a target device. In response, the RA device generates the PCD asset and packages the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device. The RA device deploys the packaged PCD asset in a CM system for identification and tracking of the target device.

Claims

1. A method comprising:

receiving, by a cryptographic manager (CM) device, a first command to package a pre-computed data (PCD) asset for a target device, wherein the PCD asset is unique for the target device;

in response to the first command, packaging, by the CM device, the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device; and

deploying the packaged PCD asset in a cryptographic manager (CM) system for identification and tracking of the target device.

2. The method of claim 1, wherein the CM device is a Root Authority (RA) device, wherein, in response to the first command, generating, by the RA device the PCD asset and packaging the generated PCD asset for secure deployment, wherein deploying the PCD asset comprises storing, by the RA device, the PCD asset in a removable storage device to transfer the PCD asset to a Service device of the CM system, wherein the Service device is configured to distribute the PCD asset over a network to an Appliance device of the CM system.

3. The method of claim 2, wherein the Appliance device is to securely provision the PCD asset to a CM Core of the target device using a Module, the Module is an application that, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the PCD asset to the target device in an operation phase of a manufacturing lifecycle of the target device, and wherein the PCD asset is an input to the Module.

4. The method of claim 2, wherein generating the PCD asset comprises generating the PCD asset in response to a command line interface (CLI) command to generate PCD assets in bulk based on a PCD Template, wherein the PCD Template is a description of how the PCD assets are formatted as an input for a particular type of Module.

5. The method of claim 4, wherein the PCD Template corresponds to a PCD type, the PCD type is a set of PCD assets having a particular property of at least one of a uniqueness or serialization, and wherein the set of PCD assets of the PCD type are indexed.

6. The method of claim 1, wherein the CM device is a Service device, wherein, in response to the first command, generating, by the Service device, the PCD asset and packaging the generated PCD asset for secure deployment.

7. The method of claim 1, wherein the CM device is a Service device, wherein the PCD asset is generated external to the CM device, wherein, in response to the first command, importing, by the Service device, the PCD asset and packaging the imported PCD asset for secure deployment, and wherein deploying the PCD asset comprises distributing the PCD asset over a network to an Appliance device of the CM system.

8. The method of claim 7, wherein the Appliance device is to securely provision the PCD asset to a CM Core of the target device using a Module, the Module is an application that, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the PCD asset to the target device in an operation phase of a manufacturing lifecycle of the target device, and wherein the PCD asset is an input to the Module.

9. The method of claim 7, wherein the imported PCD asset is a High-bandwidth Digital Content Protection (HDCP) key.

10. The method of claim 7, wherein the imported PCD asset is signed by a root authorization private key, and wherein the method further comprises verifying the imported PCD asset using a root authorization public key.

11. The method of claim 1, further comprising storing the PCD asset in a stand-alone record.

12. The method of claim 1, further comprising storing the PCD asset as a PCD record in a PCD file containing at least one additional PCD record.

13. The method of claim 12, wherein the PCD file is a sequential PCD file, the sequential PCD file comprising:

an inner header containing information that is shared by the PCD record and the at least one additional PCD record;

an outer header containing information relevant to an instance of the sequential PCD file before any splitting of the sequential PCD file; and

the PCD record and the at least one additional PCD record.

14. The method of claim 13, further comprising:

splitting the sequential PCD file into a first sequential PCD file and a second sequential PCD file;

generating a first outer header containing information relevant to the first sequential PCD file, wherein the first sequential PCD file comprises the inner header, the first outer header containing information relevant to the first sequential PCD file and the PCD record; and

generating a second outer header containing information relevant to the second sequential PCD file, wherein the second sequential PCD file comprises the inner header, the second outer header containing information relevant to the second sequential PCD file and the at least one additional PCD record.

15. The method of claim 12, wherein the PCD file is a non-sequential PCD file, the non-sequential PCD file comprising:

an inner header containing information that is shared by the PCD record and the at least one additional PCD record;

an outer header containing information relevant to an instance of the non-sequential PCD file after a merge of a first non-sequential PCD file and a second non-sequential PCD file; and

the PCD record and the at least one additional PCD record.

16. The method of claim 15, further comprising:

merging the first non-sequential PCD file and the second non-sequential PCD file into the non-sequential PCD file;

sorting the PCD record and the at least one additional PCD record; and

generating the outer header, wherein the first non-sequential PCD file comprises the inner header, a first outer header containing information relevant to the first non-sequential PCD file and the PCD record, and wherein the second non-sequential PCD file comprises the inner header, a second outer header containing information relevant to the second sequential PCD file and the at least one additional PCD record.

17. A Root Authority (RA) device comprising:

a processor; and

a removable storage device interface configured to connect to a removable storage device, wherein the removable storage device interface is coupled to the processor, wherein the processor is operable to;

receive a first command to generate a pre-computed data (PCD) asset for a target device, wherein the PCD asset is unique for the target device;

in response to the first command, generate the PCD asset and package the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device; and

deploy the packaged PCD asset in a cryptographic manager (CM) system for identification and tracking of the target device.

18. The RA device of claim 17, wherein, in response to the first command, the processor is further operable to:

receive a command line interface (CLI) command to generate a set of PCD assets in bulk based on a PCD Template, and wherein the PCD Template is a description of how the PCD assets are formatted as an input for a particular type of Module;

generate the PCD asset as part of the generation of the set of PCD assets in bulk;

package the generated PCD asset for secure deployment; and

distribute the packaged PCD asset over a network to an Appliance device of the CM system, wherein the Appliance device is to securely provision the PCD asset to a CM Core of the target device using a Module of the particular type of Module, the Module is an application that, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the PCD asset to the target device in an operation phase of a manufacturing lifecycle of the target device, and wherein the PCD asset is an input to the Module.

19. A Service device comprising:

a processor; and

a removable storage device interface configured to connect to a removable storage device, wherein the removable storage device interface is coupled to the processor, wherein the processor is operable to;

receive a first command to package a pre-computed data (PCD) asset for a target device, wherein the PCD asset is unique for the target device;

in response to the first command, package the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device; and

deploy the packaged PCD asset in a cryptographic manager (CM) system for identification and tracking of the target device.

20. The Service device of claim 19, wherein the PCD asset is generated external to the Service device, wherein, in response to the first command, the processor is further operable to:

import the PCD asset;

package the imported PCD asset for secure deployment; and

distribute the packaged PCD asset over a network to an Appliance device of the CM system, wherein the Appliance device is to securely provision the PCD asset to a CM Core of the target device using a Module, the Module is an application that, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the PCD asset to the target device in an operation phase of a manufacturing lifecycle of the target device, and wherein the PCD asset is an input to the Module.