A method implemented in a processor for managing cryptographic keys of an integrated cryptographic mechanism, computing device, and processor-readable non-transient medium.

Description

1 / 52 "METHOD IMPLEMENTED IN A PROCESSOR FOR MANAGING CRYPTOGRAPHIC KEYS OF AN INTEGRATED CRYPTOGRAPHIC MECHANISM, COMPUTING DEVICE, AND PROCESSOR-READABLE NON-TRANSIENTIAL MEDIUM" REQUESTS FOR RELATED ITEMS

[0001] This application claims the benefit of priority of non-provisional US application No. 18 / 301,305, filed April 17, 2023, the content of which is incorporated herein by reference in its entirety. BACKGROUND

[0002] Data storage protection is linked to hardware-delimited cryptographic keys using cryptographic components, such as an integrated cryptographic engine (ICE). While a computing device is running, cryptographic keys are programmed into ICE memory. Encryption / decryption of all sensitive data operations is routed through the ICE using the pre-programmed cryptographic keys. Without protection measures, cryptographic keys are accessible for any read / write operations, regardless of the computing device's state, such as a locked / unlocked state. Leaving cryptographic keys unprotected makes sensitive data vulnerable to data-at-rest attacks, even when the computing device is in a locked state.Current protection measures for cryptographic keys include dumping cryptographic keys from ICE memory to a computing device state, such as a locked state or data state. Petition 870250090963, dated 06 / 10 / 2025, page 9 / 137 2 / 52 of the system is in rest mode, and it regenerates and reprograms the cryptographic keys into the ICE memory to another computing device state, such as an unlocked state. SUMMARY

[0003] Several aspects include devices and methods for implementing cryptographic key management of an integrated cryptographic engine. Several aspects may include detecting a cryptographic key access control event, determining whether the cryptographic key access control event is intended to disable cryptographic key access in a cryptographic key memory of the integrated cryptographic engine, disabling cryptographic key access in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable cryptographic key access in the cryptographic key memory, and maintaining one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled.

[0004] Some aspects may additionally include, after disabling access to the cryptographic key in the cryptographic key memory, receiving a data request, attempting to retrieve a cryptographic key from the cryptographic key memory, and sending an error response.

[0005] In some respects, disabling cryptographic key access in cryptographic key memory may involve setting one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value. Petition 870250090963, dated 06 / 10 / 2025, page 10 / 137 3 / 52

[0006] Some aspects may additionally include enabling access to the cryptographic key in cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable access to the cryptographic key in cryptographic key memory.

[0007] Some aspects may additionally include, after enabling access to the cryptographic key in the cryptographic key memory, receiving a data request, attempting to retrieve a cryptographic key from the cryptographic key memory, and sending the cryptographic key.

[0008] In some respects, enabling cryptographic key access in cryptographic key memory may include setting one or more cryptographic key access indicators associated with one or more cryptographic keys to an enable value.

[0009] Additional aspects may include further receiving a cryptographic key access control policy parameter for the one or more cryptographic keys configured to enable a cryptographic key access control policy and enabling the cryptographic key access control policy for the one or more cryptographic keys in response to receiving the cryptographic key access control policy parameter.

[0010] In some respects, enabling the cryptographic key access control guideline for one or more cryptographic keys may include associating one or more cryptographic keys with one or more Petition 870250090963, dated 06 / 10 / 2025, page 11 / 137 4 / 52 indicators of access to the cryptographic key.

[0011] Additional aspects include computing devices including a processor configured to perform operations of any of the methods summarized above. Additional aspects include computing devices having means to perform any of the functions of the methods summarized above. Additional aspects include a processor-readable non-transient storage medium having stored thereon processor-executable instructions configured to cause a processor of a computing device to perform the functions of the methods summarized above. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The attached drawings, which are incorporated in the present invention and form part of this descriptive report, illustrate examples of embodiments of various claims and, together with the general description given above and the detailed description given below, serve to explain the attributes of the claims.

[0013] Figure 1 is a component block diagram illustrating an example computing device suitable for use with various modes.

[0014] Figures 2A and 2B are component block diagrams illustrating an example encryption key access control system suitable for implementing various modalities.

[0015] Figure 3 is a component block signaling diagram illustrating an example of cryptographic key programming in the cryptographic key access control system suitable for implementing various Petition 870250090963, dated 06 / 10 / 2025, page 12 / 137 5 / 52 modalities.

[0016] Figures 4A and 4B are component block signaling diagrams illustrating examples of disabling and enabling cryptographic key access in the cryptographic key access control system suitable for implementing various modalities.

[0017] Figure 5 is a process flow diagram illustrating a cryptographic key management method for an integrated cryptographic mechanism according to some modalities.

[0018] Figure 6 is a process flow diagram illustrating a cryptographic key programming method for the integrated cryptographic mechanism according to some modalities.

[0019] Figure 7 is a component block diagram illustrating an example mobile computing device suitable for implementing various modalities.

[0020] Figure 8 is a component block diagram illustrating an example mobile computing device suitable for use with various modalities.

[0021] Figure 9 is a component block diagram illustrating a suitable example server to implement various modes. DETAILED DESCRIPTION

[0022] The various embodiments will be described in detail with reference to the attached drawings. Whenever possible, identical reference numbers will be used in all drawings to refer to identical or related parts. References made to particular examples and implementations are for illustrative purposes only and are not intended to replace the original design. Petition 870250090963, dated 06 / 10 / 2025, p. 13 / 137 6 / 52 limit the scope of the claims.

[0023] Various embodiments include methods and computing devices implementing such methods, for managing cryptographic keys for an integrated cryptographic engine. In some embodiments, managing cryptographic keys for the integrated cryptographic engine includes maintaining one or more cryptographic keys in a cryptographic key memory of the integrated cryptographic engine and controlling access to the cryptographic keys based on an event from a computing device. Controlling access to cryptographic keys may include disabling access to cryptographic keys in the cryptographic key memory based on one event, and enabling access to cryptographic keys in the cryptographic key memory based on another event. Cryptographic keys may be maintained in the cryptographic key memory while access to cryptographic keys in the cryptographic key memory is disabled.In some embodiments, cryptographic keys can be programmed into the integrated cryptographic mechanism by associating the cryptographic keys with the cryptographic key access control directive. In some embodiments, cryptographic keys can be programmed into the integrated cryptographic mechanism by associating the cryptographic keys with a cryptographic key access indicator configured to indicate to the integrated cryptographic mechanism whether cryptographic key access is disabled and / or enabled.

[0024] The terms computing device and mobile device are used interchangeably in Petition 870250090963, dated 06 / 10 / 2025, page 14 / 137 7 / 52 of the present invention to refer to any or all mobile phones, smartphones, personal or mobile multimedia players, personal data assistants (PDAs), laptop computers, tablet computers, convertible laptops / tablets (2-in-1 computers), smartbooks, ultrabooks, netbooks, palmtop computers, wireless email receivers, multimedia internet-enabled mobile phones, mobile game consoles, wireless game controllers, and similar personal electronic devices that include a programmable memory and processor. The term computing device may additionally refer to stationary computing devices, including personal computers, desktop computers, all-in-one computers, workstations, supercomputers, mainframe computers, embedded computers, servers, home theater computers, and game consoles.

[0025] Data storage protection is linked to hardware-delimited cryptographic keys using cryptographic components, such as an integrated cryptographic engine (ICE). While a computing device is running, cryptographic keys are programmed into the integrated cryptographic engine's memory. Encryption / decryption of all sensitive data operations is handled through the integrated cryptographic engine using the pre-programmed cryptographic keys. Without protection measures, the cryptographic keys are accessible for any read / write operations, regardless of the computing device's state, such as a locked / unlocked state. Leaving the keys Petition 870250090963, dated 06 / 10 / 2025, page 15 / 137 8 / 52 unprotected cryptographic security makes confidential data vulnerable to data-at-rest attacks, even when the computing device is in a locked state.

[0026] Current protection measures for cryptographic keys include evicting cryptographic keys from the embedded cryptographic engine memory to a computing device state where cryptographic keys cannot be used, such as a locked state or a data-at-rest state, and regenerating and reprogramming the cryptographic keys to the embedded cryptographic engine memory to a computing device state where cryptographic keys can be used, such as an unlocked state. This protective measure is inefficient, consuming computing device resources and causing performance degradation during each instance of reprogramming the cryptographic keys to the embedded cryptographic engine memory.Identical cryptographic keys must be regenerated, for example when implementing key derivation functions to generate cryptographic keys and / or unwrap encrypted cryptographic keys, and reprogrammed into the integrated cryptographic engine memory for each change in the state of the computing device where the cryptographic keys may be used. The cost of regenerating and reprogramming cryptographic keys into the integrated cryptographic engine memory increases based on the number of cryptographic keys.

[0027] The methods address and overcome the inefficiencies of regenerating and reprogramming cryptographic keys into cryptographic mechanism memory. Petition 870250090963, dated 06 / 10 / 2025, page 16 / 137 9 / 52 integrated for each change in the state of the computing device where cryptographic keys can be used. The modes include a cryptographic key access control scheme for a cryptographic key memory for the integrated cryptographic engine. Instead of repeatedly dumping, regenerating, and reprogramming cryptographic keys, the modes maintain the cryptographic keys in a cryptographic key memory for the integrated cryptographic engine and control access to the cryptographic keys in the cryptographic key memory based on the states of the computing device. The modes avoid the cost of regenerating and reprogramming cryptographic keys after the initial generation and programming of cryptographic keys in the cryptographic key memory.

[0028] The methods include programming cryptographic keys into the cryptographic key memory for the integrated cryptographic engine. A cryptographic key can be associated with a cryptographic key access control directive in the integrated cryptographic engine. The cryptographic key can be associated with a cryptographic key access indicator in the cryptographic key memory configured to indicate to the integrated cryptographic engine whether cryptographic key access is disabled and / or enabled.

[0029] A secure master can be configured to detect a cryptographic key access control event, such as a change in the computing device state. For example, the computing device state might include a locked state and an unlocked state. The secure master can be configured to Petition 870250090963, dated 06 / 10 / 2025, page 17 / 137 10 / 52 interpret the cryptographic key access control event as triggering the disabling and / or enabling of cryptographic key access in the cryptographic key memory for the integrated cryptographic engine. For example, the secure master might interpret a change in the computing device's lock state as triggering the disabling of cryptographic key access in the cryptographic key memory and a change in the unlock state as enabling cryptographic key access in the cryptographic key memory. The secure master can signal to the integrated cryptographic engine whether to disable and / or enable cryptographic key access in the cryptographic key memory based on the interpretation of the cryptographic key access control event.

[0030] The integrated cryptographic engine can be configured to disable and / or enable access to the cryptographic key in the cryptographic key memory for the integrated cryptographic engine based on the secure master signal. For example, a signal to disable access to the cryptographic key in the cryptographic key memory can trigger the integrated cryptographic engine to set a cryptographic key access indicator associated with the cryptographic key in the cryptographic key memory to indicate to the integrated cryptographic engine that access to the cryptographic key is disabled. A signal to enable access to the cryptographic key in the cryptographic key memory can trigger the integrated cryptographic engine to set the cryptographic key access indicator associated with the cryptographic key in the cryptographic key memory to indicate to the cryptographic engine. Petition 870250090963, dated 06 / 10 / 2025, page 18 / 137 11 / 52 integrated that access to the cryptographic key is enabled.

[0031] The integrated cryptographic mechanism can be configured to check the cryptographic key access indicator associated with the cryptographic key in the integrated cryptographic mechanism's cryptographic key memory in response to a data request by a non-secure master. The integrated cryptographic mechanism can be configured to determine whether the cryptographic key access indicator associated with the cryptographic key indicates that cryptographic key access for the cryptographic key is disabled and / or enabled. In response to the determination that cryptographic key access for the cryptographic key is disabled, the integrated cryptographic mechanism can be configured to deny cryptographic key access in the cryptographic key memory.In response to the determination that access to the cryptographic key is enabled, the integrated cryptographic mechanism can be configured to allow access to the cryptographic key in the cryptographic key memory.

[0032] Figure 1 illustrates a system that includes a computing device 10 suitable for use with various modes. The computing device 10 may include a system-on-chip (SoC) 12 with a processor 14, a memory 16, a memory interface 34, an integrated cryptographic module 38, a communication interface 18, a storage memory interface 20, a clock controller 30, and an interconnect 32. The computing device 10 may additionally include a communication component 22, such as a wired or wireless modem, a storage memory 24, and an antenna 26 for establishing Petition 870250090963, dated 06 / 10 / 2025, page 19 / 137 12 / 52 a wireless communication link, a power manager 28 and a memory 36. The processor 14 may include any one of a variety of processing devices, for example, multiple processor cores.

[0033] The term system-on-chip (SoC) is used in the present invention to refer to a set of interconnected electronic circuits, typically, but not exclusively, including a processing device, a memory, and a communication interface.A processing device may include a variety of different types of processors and processor cores, such as a general-purpose processor, a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), an accelerated processing unit (APU), a secure processing unit (SPU), a neural network processing unit (NPU), a subsystem processor for specific computing device components, such as an image processor for a camera subsystem or a display processor for a display, an auxiliary processor, a single-core processor, a multi-core processor, a controller, and a microcontroller.A processing device may additionally incorporate other hardware and hardware combinations, such as a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC). Petition 870250090963, dated 06 / 10 / 2025, page 20 / 137 13 / 52 specific integrated circuit), other programmable logic devices, discrete gate logic, transistor logic, performance monitoring hardware, surveillance hardware, and timing references. Integrated circuits can be configured so that the integrated circuit components reside on a single piece of semiconductor material, such as silicon.

[0034] A SoC 12 may include one or more processors 14. The computing device 10 may include more than one SoC 12, thus increasing the number of processors 14 and processor cores. The computing device 10 may also include processors 14 that are not associated with a SoC 12. The processors 14 may be configured for specific purposes that may be the same as or different from other processors 14 in the computing device 10. One or more of the processors 14 and processor cores of the same or different configurations may be grouped together. A group of processors 14 or processor cores may be called a multiprocessor grouping.

[0035] The computing device 10 may include any number and combination of memories, such as memory 16 integral to the SoC 12 and memory 36 separate from the SoC 12. Any of the memories 16, 36 may be volatile or non-volatile memory configured to store processor-executable data and code for access by the processor 14. The computing device 10 and / or SoC 12 may include one or more memories 16, 36 configured for various purposes. One or more memories 16, 36 may include volatile memories, such as random access memory (RAM) or main memory, including RAM Petition 870250090963, dated 06 / 10 / 2025, p. 21 / 137 14 / 52 static (SRAM) - static RAM, such as memory 16, dynamic RAM (DRAM - dynamic RAM), such as memory 36 or cache memory.

[0036] Memories 16, 36 can be configured to temporarily store a limited amount of data. For example, the data may be received from a sensor or data subsystem. As another example, the data may be processor-executable code instructions and / or data that are requested from non-volatile memory 16, 24, 36 and loaded into memories 16, 36 from non-volatile memory 16, 24, 36 in anticipation of future access based on a variety of factors. As another example, the data may be intermediate processing data and / or processor-executable code instructions produced by processor 14 and temporarily stored for future fast access without being stored in non-volatile memory 16, 24, 36.

[0037] Memory interface 34 can work in unison with memory 36 to enable computing device 10 to store and retrieve processor-executable data and code in and from memory 36. Memory interface 34 can control access to storage memory 36 and allow processor 14 to read data and write data to memory 36.

[0038] The storage memory interface 20 and the storage memory 24 can work in unison to allow the computing device 10 to store data and executable code by the processor in a non-volatile storage medium, such as a non-volatile memory device. The storage memory 24 can be configured very similarly to a memory embodiment 16 in which the storage memory 24 can store the data or code. Petition 870250090963, dated 06 / 10 / 2025, page 22 / 137 15 / 52 executable per processor for access by one or more of the processors 14. The storage memory 24, being non-volatile, can retain information after the power to the computing device 10 has been turned off. When power is restored and the computing device 10 is restarted, the information stored in the storage memory 24 can be available to the computing device 10. The storage interface 20 can control access to the storage memory 24 and allow the processor 14 to read data and write data to the storage memory 24.

[0039] The integrated cryptographic module 38 can be configured to implement cryptographic functions, such as encryption and decryption, of data for transactions from the memory storage device 24. Data transmitted between memory 36 and storage memory 24 can be encrypted and decrypted by the integrated cryptographic module 38 to protect the data stored in the memory storage device 24 by encrypting the data, and to make the encrypted data retrieved from the memory storage device 24 usable by the SoC 12 by decrypting the data. The integrated cryptographic module 38 can be configured with multiple cryptographic cores (not shown) configured to implement the cryptographic functions.The integrated cryptographic module 38 can be configured with a cryptographic key memory (not shown) configured to store one or more cryptographic keys used to implement the cryptographic functions. In some implementations, the integrated cryptographic module 38 may be... Petition 870250090963, dated 06 / 10 / 2025, page 23 / 137 16 / 52 a standalone component of the SoC 12. In some implementations, the integrated cryptographic module 38 may be integral to another component of the SoC 12, such as the memory interface 34, the storage memory interface 20, the processor 14, the multi-data stream memory controller, etc.

[0040] Power Manager 28 can be configured to control power states of one or more power rails (not shown) for delivering power to the SoC 12 components. In some embodiments, Power Manager 28 can be configured to control amounts of power supplied to the SoC 12 components. For example, Power Manager 28 can be configured to control connections between SoC 12 components and the power rails. As another example, Power Manager 28 can be configured to control amounts of power on the power rails connected to the SoC 12 components. Power Manager 28 can be configured as a power management integrated circuit (PMIC).

[0041] A clock controller 30 can be configured to control clock signals transmitted to the SoC 12 components. For example, clock controller 30 can block a SoC 12 component by disconnecting the SoC 12 component from a clock signal and can unblock the SoC 12 component by connecting the SoC 12 component to the clock signal.

[0042] Interconnect 32 can be a communication mesh, such as a communication bus, configured to communicatively connect the components of the SoC 12. Interconnect 32 can transmit signals between the Petition 870250090963, dated 06 / 10 / 2025, page 24 / 137 17 / 52 components of the SoC 12. In some embodiments, the interconnect 32 can be configured to control signals between the components of the SoC 12 by controlling the timing and / or transmission paths of the signals.

[0043] Some or all of the components of the computing device 10 and / or the SoC 12 may be arranged differentially and / or combined, while simultaneously serving the functions of the various embodiments. The computing device 10 may not be limited to one of each of the components, and multiple instances of each component may be included in various configurations of the computing device 10.

[0044] Figures 2A and 2B illustrate an example of a cryptographic key access control system suitable for implementing various modalities. With reference to Figures 1 to 2B, the cryptographic key access control system 200 may include a SoC 201 (e.g., SoC 12 in Figure 1) and a secure non-volatile memory 210 (e.g., storage memory 24, memory 36 in Figure 1).

[0045] The SoC 201 may include a processor (not shown; for example, processor 14 in Figure 1) configured with processor-executable instructions to implement a non-secure master 202, such as one or more applications. Examples of one or more applications may include high-level operating systems, gaming applications, productivity applications, entertainment applications, web browser applications, communication applications, etc. In some examples, the non-secure master 202 may run on a

[0046] The SoC 201 may include one or more processors (not shown; for example, processor 14, Petition 870250090963, dated 06 / 10 / 2025, page 25 / 137 18 / 52 integrated cryptographic module 38 in Figure 1) configured with processor- and / or hardware executable instructions to implement a secure master 204, an integrated cryptographic mechanism 206, and a secure cryptographic key manager 208. In some examples, the secure cryptographic key manager 208 may be an integral component of the integrated cryptographic mechanism 206.

[0047] In some examples, one or more of the non-secure masters 202, the secure master 204, the integrated cryptographic engine 206, and / or the secure cryptographic key manager 208 may be implemented by the same processor. In some examples, the SoC 201 and / or the processors may include a normal execution environment and a secure execution environment (or trusted execution environment, for example, ARM TrustZone, AMD Secure Technology, IBM Secure Service Container, Intel Trusted Execution Technology, etc.). The non-secure master 202 may run in the normal execution environment of the SoC 201 and / or the processor. The secure master 204 may run in the secure execution environment of the SoC 201 and / or the processor. The integrated cryptographic engine 206 and / or the secure cryptographic key manager 208 may be implemented in the normal execution environment and / or the secure execution environment of the SoC 201 and / or the processor.

[0048] Secure nonvolatile memory 210 may be accessible by one or more components of the SoC 201. For example, secure nonvolatile memory 210 may be accessible by secure master 204. For another example, secure nonvolatile memory 210 may be accessible by components of the secure execution environment of the SoC 201 and / or the processor. Petition 870250090963, dated 06 / 10 / 2025, p. 26 / 137 19 / 52 The secure non-volatile memory 210 can be configured with stored data including one or more cryptographic keys used to implement cryptographic functions of the integrated cryptographic mechanism 206, as further described in the present invention.

[0049] Cryptographic keys stored in secure non-volatile memory 210 can be programmed for the integrated cryptographic engine 206. For example, the integrated cryptographic engine 206 may include a memory (not shown, for example, memory 16 in Figure 1) in which cryptographic keys can be stored. The secure master 204 can be configured to retrieve cryptographic keys from secure non-volatile memory 210 and store the cryptographic keys in the integrated cryptographic engine 206. The secure master 204 can also store associations of cryptographic keys with cryptographic key access control policy indicators. The cryptographic key access control policy indicators can be configured to indicate whether the cryptographic key access control policy is enabled for the cryptographic keys for the secure master 204.The secure cryptographic key manager 208 can store associations of cryptographic keys with cryptographic key access indicators. Cryptographic key access indicators can be configured to indicate whether cryptographic key access is disabled and / or enabled for cryptographic keys for the secure cryptographic key manager 208. Programming of cryptographic keys for the integrated cryptographic mechanism 206 can occur, for example, as part of and / or. Petition 870250090963, dated 06 / 10 / 2025, page 27 / 137 20 / 52 in response to SoC 201 initialization.

[0050] Secure master 204 can store the cryptographic key associations with the cryptographic key access control policy indicators in a file, a data structure, a database, etc. in a memory (not shown, for example, memory 16 in Figure 1), such as a memory of the processor running secure master 204, a memory of the secure master 204 hardware, and / or the memory of the integrated cryptographic engine 206. In some examples, secure master 204 can receive cryptographic key access control policy parameters for the cryptographic keys of non-secure master 202 indicating to secure master 204 whether to set the cryptographic key access control policy indicators to enabled.The secure master 204 can set the cryptographic key access control policy indicators to enabled for cryptographic keys in response to cryptographic key access control policy parameters indicating to set the cryptographic key access control policy indicators to enabled.

[0051] The secure cryptographic key manager 208 can store the associations of cryptographic keys with cryptographic key access indicators in a file, a data structure, a database, etc. in memory (not shown, for example, memory 16 in Figure 1), such as memory of the processor running the secure cryptographic key manager 208, in the hardware memory of the secure cryptographic key manager 208, and / or in the memory of the integrated cryptographic engine 206. The Petition 870250090963, dated 06 / 10 / 2025, page 28 / 137 Secure cryptographic key manager 208 can receive signals from the secure master 204 configured to indicate to the secure cryptographic key manager 208 whether to disable and / or enable cryptographic key access for the cryptographic keys, as further described in the present invention. Secure cryptographic key manager 208 can set the cryptographic key access indicators as disabled and / or enabled for the cryptographic keys in response to signals from the secure master 204 indicating to disable and / or enable cryptographic key access.

[0052] Secure master 204 can be configured to detect a cryptographic key access control event, such as a change in the computing device state of a computing device (e.g., computing device 10 in Figure 1). For example, the cryptographic key access control event might include switching between a locked state and an unlocked state, etc. Secure master 204 can be configured to interpret different cryptographic key access control events to trigger the disabling and / or enabling of cryptographic key access. In response to the detection of the cryptographic key access control event, secure master 204 can be configured to determine whether the cryptographic keys stored in the integrated cryptographic engine 206 have the cryptographic key access control directive enabled.Secure master 204 can determine if cryptographic keys have the cryptographic key access control directive enabled based on the cryptographic key associations. Petition 870250090963, dated 06 / 10 / 2025, page 29 / 137 22 / 52 with the cryptographic key access control guideline indicators. Secure master 204 can be configured to signal to disable and / or enable cryptographic key access for cryptographic keys having the cryptographic key access control guideline enabled for secure cryptographic key manager 208.

[0053] Secure cryptographic key manager 208 can be configured to interpret the secure master signal 204 to disable and / or enable cryptographic key access and respond by updating the cryptographic key access indicators associated with the cryptographic keys. Updating the cryptographic key access indicators may include setting the cryptographic key access indicators to a disable value and / or an enable value.

[0054] In some examples, the secure master 204 can be configured to determine whether one or different groups of cryptographic keys that have the cryptographic key access control policy enabled are subject to the same and / or different cryptographic key access control events. The secure master 204 can be configured to signal to disable and / or enable cryptographic key access for the group, or different groups, of cryptographic keys having the cryptographic key access control policy enabled for the secure key manager 208. The secure key manager 208 can be configured to interpret the signal from the secure master 204 to disable and / or enable cryptographic key access and respond by updating the cryptographic key access indicators. Petition 870250090963, dated 06 / 10 / 2025, page 30 / 137 23 / 52 associated with the group, or different groups, of cryptographic keys. In some examples, a group of cryptographic keys may include at least one cryptographic key.

[0055] The secure cryptographic key manager 208 can be configured to interpret a cryptographic key request from the integrated cryptographic engine 206 and respond based on whether cryptographic key access is disabled and / or enabled for one or more cryptographic keys in the cryptographic key request. The secure cryptographic key manager 208 can determine whether cryptographic keys have cryptographic key access disabled and / or enabled from the associations of the cryptographic keys with cryptographic key access indicators. For a cryptographic key having cryptographic key access disabled, the secure cryptographic key manager 208 can send an error message to the integrated cryptographic engine 206.For a cryptographic key with cryptographic key access enabled, the secure cryptographic key manager 208 can send the cryptographic key to the integrated cryptographic engine 206.

[0056] Figure 2A illustrates an example of the cryptographic key access control system 200 implementing disabled cryptographic key access. Secure master 204 can receive a cryptographic key access control event signal 220 from the non-secure master 202 configured to indicate to secure master 204 a cryptographic key access control event to disable cryptographic key access. Secure master 204 can Petition 870250090963, dated 06 / 10 / 2025, page 31 / 137 24 / 52 respond to the cryptographic key access control event signal 220 by determining that one or more cryptographic keys have the cryptographic key access control directive enabled and send a disable cryptographic key access signal 222 to the secure cryptographic key manager 208. The secure cryptographic key manager 208 can receive the disable cryptographic key access signal 222 and respond by setting the cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

[0057] The integrated cryptographic mechanism 206 can receive a data request signal 224 from the non-secure master 202 and respond by sending a cryptographic key request signal 226 for one or more cryptographic keys to implement the data request to the secure cryptographic key manager 208. The secure cryptographic key manager 208 can determine that cryptographic key access is disabled for one or more cryptographic keys and return an error signal 228 to the integrated cryptographic mechanism 206. The integrated cryptographic mechanism 206 can return an error signal 230 to the non-secure master 202.

[0058] Figure 2B illustrates an example of the cryptographic key access control system 200 implementing enabled cryptographic key access. Secure master 204 can receive a cryptographic key access control event signal 240 from the non-secure master 202 configured to indicate to secure master 204 a cryptographic key access control event to enable cryptographic key access. Secure master 204 can Petition 870250090963, dated 06 / 10 / 2025, page 32 / 137 25 / 52 respond to the cryptographic key access control event signal 240 by determining that one or more cryptographic keys have the cryptographic key access control directive enabled and send an enable cryptographic key access signal 242 to the secure cryptographic key manager 208. The secure cryptographic key manager 208 can receive the enabled cryptographic key access signal 242 and respond by setting the cryptographic key access indicators associated with one or more cryptographic keys to an enabled value.

[0059] The integrated cryptographic mechanism 206 can receive a data request signal 244 from the non-secure master 202 and respond by sending a cryptographic key request signal 246 for the one or more cryptographic keys to implement the data request to the secure cryptographic key manager 208. The secure cryptographic key manager 208 can determine that cryptographic key access is enabled for the one or more cryptographic keys and return a cryptographic key signal 248 to the integrated cryptographic mechanism 206. The cryptographic key signal 248 can include the one or more cryptographic keys and / or means to access the one or more cryptographic keys, such as a memory address. The integrated cryptographic mechanism 206 can implement the data request using the one or more cryptographic keys and return a result signal 250 to the non-secure master 202.

[0060] Figure 3 illustrates an example of cryptographic key programming in the cryptographic key access control system suitable for implementing Petition 870250090963, dated 06 / 10 / 2025, page 33 / 137 26 / 52 various modalities. With reference to Figures 1 to 3, a high-level operating system 302 (e.g., non-secure master 202 in Figures 2A and 2B), the secure master 204 and a cryptographic key management service 304 (executed by and / or as part of one or a combination of processors 14, integrated cryptographic module 38 in Figure 1, secure master 204, integrated cryptographic mechanism 206, secure cryptographic key manager 208 in Figures 2A and 2B) can program cryptographic keys 300 in the cryptographic key access system (e.g., cryptographic key access control system 200 in Figures 2A and 2B).

[0061] The high-level operating system 302 may request the programming of one or more cryptographic keys in the cryptographic key access system (step 310) for the secure master 204. In some examples, the call to program one or more cryptographic keys may be configured to identify the one or more cryptographic keys and / or include a cryptographic key directive parameter. In some examples, the cryptographic key directive parameter may be configured to indicate to the secure master 204 the cryptographic key directive and / or to enable the cryptographic key directive. In some examples, the cryptographic key directive may be the cryptographic key access control directive.

[0062] Secure master 204 can respond to the call (step 310) by calling to store the association of one or more cryptographic keys and the cryptographic key access control directive (step 312) to the cryptographic key management service 304. In Petition 870250090963, dated 06 / 10 / 2025, page 34 / 137 27 / 52 some examples, the call to store the association of one or more cryptographic keys and the cryptographic key access control directive can be configured to identify one or more cryptographic keys and / or include the cryptographic key directive parameter.

[0063] The cryptographic key management service 304 can respond to the call (step 312) by determining that the cryptographic key directive parameter identifies the cryptographic key access control directive and storing the association of one or more cryptographic keys and the cryptographic key access control directive (step 314). The cryptographic key management service 304 can store the association of one or more cryptographic keys and the cryptographic key access control directive to the integrated cryptographic engine (e.g., integrated cryptographic engine 206 in Figures 2A and 2B). For example, the integrated cryptographic engine may include a memory (not shown, e.g., memory 16 in Figure 1) in which the association of one or more cryptographic keys and the cryptographic key access control directive can be stored.The 304 cryptographic key management service can store the association of one or more cryptographic keys and the cryptographic key access control directive in a file, data structure, database, etc., within the integrated cryptographic engine.

[0064] Cryptographic key management service 304 can return a cryptographic key reference to secure manager 204 (step 316) and secure manager 204 can return the key reference. Petition 870250090963, dated 06 / 10 / 2025, page 35 / 137 28 / 52 cryptographic key for the high-level operating system 302 (step 318). The cryptographic key reference can be used to identify one or more cryptographic keys for a data request to the cryptographic key access system.

[0065] Figures 4A and 4B illustrate examples of disabling and enabling cryptographic key access in the cryptographic key access control system suitable for implementing various modalities. With reference to Figures 1 to 4B, a cryptographic key access control event 402a, 402b can trigger the disabling of cryptographic key access 400 and the enabling of cryptographic key access 420 in the cryptographic key access control system (e.g., cryptographic key access control system 200 in Figures 2A and 2B).

[0066] In the example illustrated in Figure 4A, cryptographic key access control event 402a can trigger the disabling of cryptographic key access 400 in the key access control system. Cryptographic key access control event 402a can trigger an insecure master (e.g., insecure master 202 in Figure 2A) to send a cryptographic key access control event signal (e.g., a cryptographic key access control event signal 220 in Figure 2A) (step 410) to a secure master 204.

[0067] Secure master 204 can respond to the signal (step 410) by sending a call to disable access to the cryptographic key (step 412) to the cryptographic key management service 304. In some examples, the call (step 412) may include a reference Petition 870250090963, dated 06 / 10 / 2025, page 36 / 137 29 / 52 of cryptographic key for the one or more cryptographic keys for which to disable cryptographic key access. In some examples, the cryptographic key reference can be used to identify one or more cryptographic keys. The secure master 204 can retrieve the cryptographic key reference for the one or more cryptographic keys associated with the cryptographic key access control directive stored in the integrated cryptographic engine (e.g., integrated cryptographic engine 206 in Figures 2A and 2B). For example, the integrated cryptographic engine may include a memory (not shown, e.g., memory 16 in Figure 1) in which the association of the one or more cryptographic keys, which can be represented by a cryptographic key reference, and the cryptographic key access control directive can be stored.

[0068] The cryptographic key management service 304 can respond to the call (step 412) by updating the cryptographic key access indicators associated with the cryptographic keys identified using the cryptographic key reference to a disable value (step 414). A cryptographic key memory 404 (e.g., memory 16 in Figure 1), which may be part of the integrated cryptographic engine, can store the updated cryptographic key access indicators associated with the cryptographic keys (step 416). The cryptographic key memory 404 can store the association of the updated cryptographic key access indicators associated with the cryptographic keys in a file, a data structure, a database, etc. Petition 870250090963, dated 06 / 10 / 2025, page 37 / 137 30 / 52 integrated cryptographic mechanism.

[0069] In the example illustrated in Figure 4B, cryptographic key access control event 402b can trigger the enabling of cryptographic key access 420 in the key access control system. Cryptographic key access control event 402b can trigger a non-secure master (e.g., non-secure master 202 in Figure 2A) to send a cryptographic key access control event signal (e.g., a cryptographic key access control event signal 220 in Figure 2A) (step 430) to a secure master 204.

[0070] Secure master 204 can respond to the signal (step 430) by sending a call to enable cryptographic key access (step 432) to the cryptographic key management service 304. In some instances, the call (step 432) may include a cryptographic key reference for the one or more cryptographic keys for which to enable cryptographic key access. In some instances, the cryptographic key reference may be used to identify one or more cryptographic keys. Secure master 204 can retrieve the cryptographic key reference for the one or more cryptographic keys associated with the cryptographic key access control directive stored in the integrated cryptographic engine (e.g., integrated cryptographic engine 206 in Figures 2A and 2B).For example, the integrated cryptographic mechanism may include a memory (not shown, for example, memory 16 in Figure 1) in which the association of one or more cryptographic keys is stored, which may be represented by a cryptographic key reference. Petition 870250090963, dated 06 / 10 / 2025, p. 38 / 137 31 / 52 and the cryptographic key access control guideline can be stored.

[0071] The cryptographic key management service 304 can respond to the call (step 432) by updating the cryptographic key access indicators associated with the cryptographic keys identified using the cryptographic key reference to an enable value (step 434). A cryptographic key memory 404 (e.g., memory 16 in Figure 1), which may be part of the integrated cryptographic engine, can store the updated cryptographic key access indicators associated with the cryptographic keys (step 436). The cryptographic key memory 404 can store the association of the updated cryptographic key access indicators associated with the cryptographic keys in a file, a data structure, a database, etc., in the integrated cryptographic engine.

[0072] Figure 5 illustrates a cryptographic key management method for an integrated cryptographic mechanism according to some embodiments. With reference to Figures 1 to 5, method 500 can be implemented on a computing device (e.g., computing device 10 in Figure 1), in software running on a processor (e.g., processor 14, integrated cryptographic module 38 in Figure 1, integrated cryptographic mechanism 206 in Figures 2A and 2B), in general-purpose hardware, in dedicated hardware (e.g., integrated cryptographic module 38 in Figure 1, secure master 204, integrated cryptographic mechanism 206, secure cryptographic key manager 208 in Figures 2A and 2B), or in a combination of a processor Petition 870250090963, dated 06 / 10 / 2025, page 39 / 137 32 / 52 configured by dedicated software and hardware, such as a software-executing processor within a cryptographic key access control system (e.g., cryptographic key access control system 200 in Figures 2A and 2B) that includes other individual components and various memory / cache controllers. In order to encompass the alternative configurations enabled in various embodiments, the hardware implementing method 500 is referred to in the present invention as an integrated cryptographic device.

[0073] In block 502, the integrated cryptographic device can program cryptographic keys. Program cryptographic keys are further described in the present invention for method 600 with reference to Figure 6. In some embodiments, the cryptographic keys for programming the integrated cryptographic device in block 502 may include a processor (e.g., processor 14, integrated cryptographic module 38 in Figure 1, integrated cryptographic mechanism 206 in Figures 2A and 2B), an integrated cryptographic module (e.g., integrated cryptographic module 38 in Figure 1), a secure master (e.g., secure master 204 in Figures 2A and 2B), an integrated cryptographic mechanism (e.g., integrated cryptographic mechanism 206 in Figures 2A and 2B), and / or a secure cryptographic key manager (e.g., secure cryptographic key manager 208 in Figures 2A and 2B).

[0074] In block 504, the integrated cryptographic device can detect a cryptographic key access control event. The cryptographic key access control event can be an event that triggers the integrated cryptographic device to implement a Petition 870250090963, dated 06 / 10 / 2025, page 40 / 137 33 / 52 cryptographic key access control guideline, such as disabling and / or enabling cryptographic key access. The cryptographic key access control event may include a change in the computing device state of a computing device (e.g., computing device 10 in Figure 1). For example, the cryptographic key access control event may include switching between a locked state and an unlocked state, etc. The embedded cryptographic device may receive an indication of the embedded cryptographic key access control event from a component of the computing device, such as a non-secure master (e.g., non-secure master 202 in Figures 2A and 2B). In some embodiments, the embedded cryptographic device that detects the cryptographic key access control event in block 504 may include the processor, the embedded cryptographic module, and / or the secure master.

[0075] In determination block 506, the integrated cryptographic device can determine whether the cryptographic key access control event is intended to disable or enable cryptographic key access. The integrated cryptographic device can be configured to interpret different cryptographic key access control events to trigger disabling and / or enabling cryptographic key access. For example, the integrated cryptographic device can be configured to interpret the cryptographic key access control event of the computing device being in a locked state as intended to Petition 870250090963, dated 06 / 10 / 2025, page 41 / 137 34 / 52 disable access to the cryptographic key. Similarly, the integrated cryptographic device can be configured to interpret the cryptographic key access control event from the computing device being in an unlocked state as intended to enable access to the cryptographic key. In some embodiments, the integrated cryptographic device determining whether the cryptographic key access control event is intended to disable or enable access to the cryptographic key in determination block 506 may include the processor, the integrated cryptographic module, and / or the secure master.

[0076] In response to the determination that the cryptographic key access control event is intended to enable cryptographic key access (i.e., determination block 506 = enable), the embedded cryptographic device may enable cryptographic key access in block 508. The embedded cryptographic device may identify cryptographic keys for which the cryptographic key access control directive is enabled. For example, the embedded cryptographic device may retrieve information related to cryptographic keys stored in a memory (e.g., memory 16 in Figure 1) in a manner associated with an indication that the cryptographic key access control directive is enabled.The integrated cryptographic device can use the information related to the cryptographic keys for which the cryptographic key access control directive is enabled to update the associated cryptographic key access indicators to an enabling value. For example, the device... Petition 870250090963, dated 06 / 10 / 2025, page 42 / 137 Integrated cryptographic devices (35 / 52) can identify the cryptographic keys for which to update the cryptographic key access indicators, the information related to the cryptographic keys for which the cryptographic key access control directive is stored in a memory (e.g., memory 16 in Figure 1, cryptographic key memory 404 in Figures 4A and 4B), and set the cryptographic key access indicators to an enable value. In some embodiments, the integrated cryptographic device that enables cryptographic key access in block 508 may include the processor, the integrated cryptographic module, the secure master, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0077] In block 510, the integrated cryptographic device may receive a data request from the insecure master. The data request may be a read and / or write request for which the integrated cryptographic device may decrypt and / or encrypt data using a cryptographic key implementation. In some embodiments, the integrated cryptographic device that receives the data request from the insecure master in block 510 may include the processor, the integrated cryptographic module, and / or the integrated cryptographic mechanism.

[0078] In block 512, the integrated cryptographic device may attempt to retrieve the cryptographic key. The integrated cryptographic device may determine that the cryptographic key access indicator for the cryptographic key is set to an enable value. In some instances, the integrated cryptographic device may Petition 870250090963, dated 06 / 10 / 2025, page 43 / 137 36 / 52 retrieve the cryptographic key from the memory that stores the cryptographic key. In some instances, the integrated cryptographic device may retrieve a location for the cryptographic key in the memory that stores the cryptographic key. In some embodiments, the integrated cryptographic device that attempts to retrieve the cryptographic key in block 512 may include the processor, the integrated cryptographic module, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0079] In block 514, the integrated cryptographic device may send the cryptographic key. For example, the integrated cryptographic device may send the cryptographic key internally from one component of the integrated cryptographic device to another component of the integrated cryptographic device. In some examples, the integrated cryptographic device may send the cryptographic key retrieved from memory. In some examples, the integrated cryptographic device may send the location for the cryptographic key in memory. In some embodiments, the integrated cryptographic device that sends the cryptographic key in block 514 may include the processor, the integrated cryptographic module, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0080] In block 516, the integrated cryptographic device may receive the cryptographic key. For example, the integrated cryptographic device may receive the cryptographic key internally in one component of the integrated cryptographic device from another component of the integrated cryptographic device. In some examples, the integrated cryptographic device may receive the key Petition 870250090963, dated 06 / 10 / 2025, page 44 / 137 37 / 52 cryptographic key retrieved from memory. In some examples, the integrated cryptographic device may receive the location for the cryptographic key in memory. In some embodiments, the integrated cryptographic device that receives the cryptographic key in block 516 may include the processor, the integrated cryptographic module, and / or the integrated cryptographic mechanism.

[0081] In response to the determination that the cryptographic key access control event is intended to disable cryptographic key access (i.e., determination block 506 = disable), the integrated cryptographic device may disable cryptographic key access at block 518. The integrated cryptographic device may disable cryptographic key access in a manner similar to enabling cryptographic key access at block 508, by setting the cryptographic key access indicators to a disable value instead of an enable value. In some embodiments, the integrated cryptographic device that disables cryptographic key access at block 518 may include the processor, the integrated cryptographic module, the secure master, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0082] In block 520, the integrated cryptographic device may receive a data request from the insecure master. The data request may be a read and / or write request for which the integrated cryptographic device may decrypt and / or encrypt data using a cryptographic key implementation. In some embodiments, the device Petition 870250090963, dated 06 / 10 / 2025, page 45 / 137 Integrated cryptographic module 38 / 52 that receives the data request from the insecure master in block 520 may include the processor, the integrated cryptographic module and / or the integrated cryptographic mechanism.

[0083] In block 522, the integrated cryptographic device may attempt to retrieve the cryptographic key. The integrated cryptographic device may determine that the cryptographic key access indicator for the cryptographic key is set to a disable value. The integrated cryptographic device may fail to retrieve the cryptographic key. In some embodiments, the integrated cryptographic device attempting to retrieve the cryptographic key in block 522 may include the processor, the integrated cryptographic module, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0084] In block 524, the integrated cryptographic device may send an error response. The integrated cryptographic device that fails to retrieve the cryptographic key may generate and send an error response for the failure. For example, the integrated cryptographic device may send the error response internally from one component of the integrated cryptographic device to another component of the integrated cryptographic device. In some embodiments, the integrated cryptographic device that sends the error response in block 524 may include the processor, the integrated cryptographic module, the integrated cryptographic engine, and / or the secure cryptographic key manager.

[0085] In block 526, the integrated cryptographic device may receive an error response. For example, the Petition 870250090963, dated 06 / 10 / 2025, page 46 / 137 39 / 52 The integrated cryptographic device may receive the error response internally in one component of the integrated cryptographic device from another component of the integrated cryptographic device. In some embodiments, the integrated cryptographic device that receives the error response in block 526 may include the processor, the integrated cryptographic module, and / or the integrated cryptographic mechanism.

[0086] Figure 6 illustrates a method for programming cryptographic keys for the integrated cryptographic mechanism according to some modalities.With reference to Figures 1 to 6, method 600 can be implemented on a computing device (e.g., computing device 10 in Figure 1), in software running on a processor (e.g., processor 14, integrated cryptographic module 38 in Figure 1, integrated cryptographic mechanism 206 in Figures 2A and 2B), in general-purpose hardware, in dedicated hardware (e.g., integrated cryptographic module 38 in Figure 1, secure master 204, integrated cryptographic mechanism 206, secure cryptographic key manager 208 in Figures 2A and 2B), or in a combination of a software-configured processor and dedicated hardware, such as a software-running processor within a cryptographic key access control system (e.g., cryptographic key access control system 200 in Figures 2A and 2B) that includes other individual components and various memory / cache controllers.In order to encompass the alternative configurations enabled in various modes, the hardware that implements method 600 is referred to in the present invention as an integrated cryptographic device.

[0087] In block 602, the device Petition 870250090963, dated 06 / 10 / 2025, page 47 / 137 The integrated cryptographic device 40 / 52 can receive a cryptographic key. The integrated cryptographic device can receive a cryptographic key from a memory (e.g., memory 24 in Figure 1, secure non-volatile memory 210 in Figures 2A and 2B). In some embodiments, the integrated cryptographic device that receives the cryptographic key in block 602 may include a processor (e.g., processor 14, integrated cryptographic module 38 in Figure 1, integrated cryptographic mechanism 206 in Figures 2A and 2B), an integrated cryptographic module (e.g., integrated cryptographic module 38 in Figure 1), and / or a secure master (e.g., secure master 204 in Figures 2A and 2B).

[0088] In block 604, the embedded cryptographic device may receive a cryptographic key access control directive parameter to enable a cryptographic key access control directive. In some instances, the received cryptographic key and the received cryptographic key access control directive parameter may be part of a call to program the cryptographic key and / or enable cryptographic key access control for the cryptographic key. In some embodiments, the embedded cryptographic device that receives the cryptographic key access control directive parameter to enable the cryptographic key access control directive in block 604 may include the processor, the embedded cryptographic module, and / or the secure master.

[0089] In block 606, the integrated cryptographic device can enable the cryptographic key access control policy for the cryptographic key. Enabling the access control policy Petition 870250090963, dated 06 / 10 / 2025, page 48 / 137 41 / 52 Cryptographic key access may include the integrated cryptographic device storing an association of the cryptographic key with a cryptographic key access control directive indicator in a file, a data structure, a database, etc. in a memory (not shown, for example, memory 16 in Figure 1). In some embodiments, the integrated cryptographic device that enables the cryptographic key access control directive for the cryptographic key in block 606 may include the processor, the integrated cryptographic module, and / or the secure master.

[0090] In block 608, the integrated cryptographic device may enable cryptographic key access to the cryptographic key. Enabling cryptographic key access may include the integrated cryptographic device storing an association of the cryptographic key with a cryptographic key access indicator in a file, a data structure, a database, etc. in a memory (not shown, for example, memory 16 in Figure 1). In some embodiments, the integrated cryptographic device that enables cryptographic key access to the cryptographic key in block 608 may include the processor, the integrated cryptographic module, an integrated cryptographic engine (e.g., integrated cryptographic engine 206 in Figures 2A and 2B), and / or a secure cryptographic key manager (e.g., secure cryptographic key manager 208 in Figures 2A and 2B).

[0091] Various modalities (including, but not limited to, modalities described above with reference to Figures 1 to 6) can be implemented in a wide variety Petition 870250090963, dated 06 / 10 / 2025, p. 49 / 137 42 / 52 of computing systems, including mobile computing devices, an example of which suitable for use with the various modalities is illustrated in Figure 7. The mobile computing device 700 may include a processor 702 coupled to a touch-screen controller 704 and internal memory 706. The processor 702 may be one or more multi-core integrated circuits designed for general or specific processing tasks. The internal memory 706 may be volatile or non-volatile memory and may also be secure and / or encrypted memory, or insecure and / or unencrypted memory, or any combination thereof. Examples of memory types that may be leveraged include, but are not limited to, DDR, LPDDR, GDDR, WIDEIO, RAM, SRAM, DRAM, P-RAM, R-RAM, M-RAM, STT-RAM, embedded DRAM, non-volatile flash memory, UFS, SDCC, etc.The touchscreen controller 704 and processor 702 can also be coupled to a touchscreen panel 712, such as a resistive touchscreen, capacitive touchscreen, infrared touchscreen, etc. Additionally, the mobile computing device display 700 does not need to have touchscreen capability.

[0092] The mobile computing device 700 may have one or more radio signal transceivers 708 (e.g., Peanut, Bluetooth, ZigBee, Wi-Fi, RF radio) and antennas 710, for sending and receiving communications, coupled to each other and / or to the processor 702. The transceivers 708 and antennas 710 may be used with the circuit set mentioned above to implement the various wireless transmission protocol stacks and interfaces. The Petition 870250090963, dated 06 / 10 / 2025, page 50 / 137 43 / 52 mobile computing device 700 may include a cellular network wireless modem chip 716 that enables communication via a cellular network and coupled to the processor 702.

[0093] The mobile computing device 700 may include a peripheral device connection interface 718 coupled to the processor 702. The peripheral device connection interface 718 may be configured singularly to accept one type of connection or may be configured to accept multiple types of common or proprietary physical and communication connections, such as Universal Serial Bus (USB), FireWire, Thunderbolt, or PCIe. The peripheral device connection interface 718 may also be coupled to a similarly configured peripheral device connection port (not shown).

[0094] The mobile computing device 700 may also include speakers 714 to provide audio output. The mobile computing device 700 may also include a housing 720, constructed of plastic, metal, or a combination of materials, to contain all or some of the components described in the present invention. The mobile computing device 700 may include a power source 722 coupled to the processor 702, such as a disposable or rechargeable battery. The rechargeable battery may also be coupled to the connection port of the peripheral device to receive a charging current from a source external to the mobile computing device 700. The mobile computing device 700 may also include a physical button 724 to receive user input. The mobile computing device 700 may also include an on / off button 726 to turn the mobile computing device 700 on and off. Petition 870250090963, dated 06 / 10 / 2025, page 51 / 137 44 / 52

[0095] The various embodiments (including, but not limited to, embodiments described above with reference to Figures 1 to 6) can be implemented in a wide variety of computing systems, including a laptop-type computer 800, an example of which is illustrated in Figure 8. Many laptop-type computers include a touchpad-sensitive surface 817 that serves as the computer's pointing device and can thus receive drag, scroll, and move gestures similar to those implemented in computing devices equipped with a touch-screen display and described above. A laptop-type computer 800 will typically include a processor 802 coupled with volatile memory 812 and high-capacity non-volatile memory, such as a Flash memory disk drive 813.Additionally, the computer 800 may have one or more antennas 808 for sending and receiving electromagnetic radiation that may be connected to a wireless data link and / or mobile phone transceiver 816 coupled to the processor 802. The computer 800 may also include a floppy disk drive 814 and a compact disc drive (CD) 815 coupled to the processor 802. In a notebook computer configuration, the computer housing includes the touchpad 817, the keyboard 818, and the display 819, all coupled to the processor 802. Other computing device configurations may include a computer mouse or trackball coupled to the processor 802 (e.g., via a USB input), as are well known, which may also be used in conjunction with various modes.

[0096] The various modalities (including, but not limited to, modalities described above with reference Petition 870250090963, dated 06 / 10 / 2025, page 52 / 13745 / 52 to Figures 1 to 6) can also be implemented in fixed computing systems, such as any of a variety of commercially available servers. An example server 900 is illustrated in Figure 9. Such a server 900 typically includes one or more multi-core processor sets 901 coupled to volatile memory 902 and high-capacity non-volatile memory, such as a disk drive 904. As illustrated in Figure 9, the multi-core processor sets 901 can be added to the server 900 by inserting them into the set's shelves. The server 900 may also include a floppy disk drive, compact disc (CD) drive, or digital versatile disc (DVD) drive 906 coupled to the processor 901.Server 900 may also include network access ports 903 coupled to multi-core processor assemblies 901 to establish network interface connections with a network 905, such as a local area network coupled to other computers and broadcast system servers, the internet, the public switched telephone network and / or a cellular data network (e.g., CDMA, TDMA, GSM, PCS, 3G, 4G, 5G, LTE or any other type of cellular data network).

[0097] Computer program code or program code for execution on a programmable processor to perform operations of various types may be written in a high-level programming language such as C, C++, C#, Smalltalk, Java, JavaScript, Visual Basic, a structured query language (e.g., TransactSQL), Perl, or in various other programming languages. Program code or programs stored on a computer-readable storage medium, as used in this Petition 870250090963, dated 06 / 10 / 2025, page 53 / 137 46 / 52 request, may refer to machine language code (such as object code) whose format is understandable by a processor.

[0098] Implementation examples are described in the following paragraphs. Although some of the following implementation examples are described in terms of example systems, devices, or methods, additional example implementations may include: the example systems or devices discussed in the following paragraphs implemented as a method that performs operations of the example systems or devices; the example systems, devices, or methods discussed in the following paragraphs implemented by an online cryptographic device configured to perform operations of the example systems, devices, or methods; the example systems, devices, or methods discussed in the following paragraphs implemented by a computing device comprising a processing device configured with instructions executable by the processing device to perform operations of the example systems, devices, or methods;a computing device including means for performing the functions of the example systems, devices, or methods; and the example systems, devices, or methods discussed in the following paragraphs implemented as a processor-readable, non-transient storage medium that has stored therein processor-executable instructions configured to cause a processor of a computing device to perform the operations of the example systems, devices, or methods.

[0099] Example 1. A method implemented in a Petition 870250090963, dated 06 / 10 / 2025, page 54 / 137 47 / 52 processor for cryptographic key management of an integrated cryptographic engine including: detecting a cryptographic key access control event; determining whether the cryptographic key access control event is intended to disable cryptographic key access in a cryptographic key memory of the integrated cryptographic engine; disabling cryptographic key access in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable cryptographic key access in the cryptographic key memory; and maintaining one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled.

[00100] Example 2. The method from example 1, including additionally, after disabling access to the cryptographic key in the cryptographic key memory: receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending an error response.

[00101] Example 3. The method of either Example 1 or 2, wherein disabling cryptographic key access in cryptographic key memory includes setting one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

[00102] Example 4. The method of any of examples 1 to 3, including additionally enabling access to the cryptographic key in cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable Petition 870250090963, dated 06 / 10 / 2025, p. 55 / 137 48 / 52 access to the cryptographic key in the cryptographic key memory.

[00103] Example 5. The method from example 4, including additionally, after enabling access to the cryptographic key in the cryptographic key memory: receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending the cryptographic key.

[00104] Example 6. The method of either of examples 4 or 5, in which enabling access to the cryptographic key in the cryptographic key memory includes setting one or more cryptographic key access indicators associated with one or more cryptographic keys to an enable value.

[00105] Example 7. The method of any of examples 1 through 6, including additionally: receiving a cryptographic key access control policy parameter for the one or more cryptographic keys configured to enable a cryptographic key access control policy; and enabling the cryptographic key access control policy for the one or more cryptographic keys in response to receiving the cryptographic key access control policy parameter.

[00106] Example 8. The method of example 7, in which enabling the cryptographic key access control directive for one or more cryptographic keys includes associating one or more cryptographic keys with one or more cryptographic key access indicators.

[00107] The descriptions of the previous methods and the process flow diagrams are provided merely as Petition 870250090963, dated 06 / 10 / 2025, page 56 / 137 49 / 52 illustrative examples and are not intended to require or imply that the operations of the various embodiments must be performed in the order presented. The order of operations in the preceding embodiments may be performed in any order. Words such as after this, then, afterward, etc. are not intended to limit the order of operations; these words are used simply to guide the reader through the description of the methods. Furthermore, any reference to claim elements in the singular, for example, using the articles a, an, or the, should not be interpreted as limiting the element to the singular.

[00108] The various illustrative logic blocks, modules, circuits, and algorithmic operations described in connection with the various embodiments can be implemented in the form of electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and operations have been described above in terms of their functionality. The possibility of such functionality being implemented as hardware or software depends on the particular application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in various ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the claims.

[00109] The hardware used to implement the various logics, logic blocks, modules and illustrative circuits described in connection with the embodiments disclosed in the present invention may be implemented or Petition 870250090963, dated 06 / 10 / 2025, page 57 / 137 50 / 52 implemented with a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described in the present invention. A general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other similar configuration.Alternatively, some operations or methods can be performed by a set of circuits that is specific to a given function.

[00110] In one or more embodiments, the described functions can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored as one or more instructions or code in a non-transient computer-readable medium or a non-transient processor-readable medium. The operations of a method or algorithm disclosed in the present invention can be incorporated into a processor-executable software module, which can reside in a non-transient computer-readable or processor-readable storage medium. The storage media do not Petition 870250090963, dated 06 / 10 / 2025, page 58 / 137 51 / 52 Computer-readable or processor-readable transients may be any storage media that can be accessed by a computer or a processor. By way of example, but not limitation, such non-transient computer-readable or processor-readable media may include RAM, ROM, EEPROM, FLASH memory, CDROM or other optical disk storage, magnetic disk storage or other magnetic storage devices or any other media that can be used to store the desired program code in the form of instructions or data structures and that can be accessed by a computer. Disks (disk and disc), as used in the present invention, include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks typically reproduce data magnetically, while discs reproduce data optically by means of lasers.Combinations of the foregoing are also included within the scope of non-transient, machine-readable, and processor-readable media. Additionally, the operations of a method or algorithm may reside as one or any combination or set of codes and / or instructions in a non-transient, machine-readable, and / or computer-readable medium, which may be incorporated into a computer program product.

[00111] The foregoing description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the claims. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles Petition 870250090963, dated 06 / 10 / 2025, page 59 / 137 The principles defined in this invention can be applied to other embodiments and implementations without departing from the scope of the claims. Therefore, this disclosure is not intended to be limited to the embodiments described in the present invention, but should be consistent with the broader scope consistent with the following claims and the innovative principles and attributes disclosed in the present invention. Petition 870250090963, dated 06 / 10 / 2025, p. 60 / 137

Claims

1 / 9 CLAIMS 1. A method implemented in a processor for managing cryptographic keys of an integrated cryptographic mechanism, characterized by comprising: detecting a cryptographic key access control event; determining whether the cryptographic key access control event is intended to disable cryptographic key access in a cryptographic key memory of the integrated cryptographic mechanism; disabling cryptographic key access in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable cryptographic key access in the cryptographic key memory; and maintaining one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled.

2. A method according to claim 1, characterized by further comprising, after disabling access to the cryptographic key in the cryptographic key memory: receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending an error response.

3. Method, according to claim 1, characterized by disabling access to the cryptographic key in the cryptographic key memory comprising setting one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

4. A method according to claim 1, characterized by further comprising enabling access to the cryptographic key in the cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable access to the cryptographic key in the cryptographic key memory.

5. A method according to claim 4, characterized by further comprising, after enabling access to the cryptographic key in the cryptographic key memory: receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending the cryptographic key.

6. A method according to claim 4, characterized in that enabling access to the cryptographic key in the cryptographic key memory comprises setting one or more cryptographic key access indicators associated with one or more cryptographic keys to an enable value.

7. Method according to claim 1, characterized by further comprising: receiving a cryptographic key access control guideline parameter for one or more cryptographic keys configured to enable a cryptographic key access control guideline; and enabling the cryptographic key access control guideline for one or more cryptographic keys in response to receiving the cryptographic key access control guideline parameter.

8. A method according to claim 7, characterized by enabling the cryptographic key access control guideline for one or more cryptographic keys, comprising associating one or more cryptographic keys with one or more cryptographic key access indicators.

9. Computing device characterized by comprising a processor configured to: detect a cryptographic key access control event; determine whether the cryptographic key access control event is intended to disable cryptographic key access in a cryptographic key memory of an integrated cryptographic mechanism; disable cryptographic key access in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable cryptographic key access in the cryptographic key memory; and maintain one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled.

10. Computing device, according to claim 9, characterized in that the processor is additionally configured to: receive a data request; attempt to retrieve a cryptographic key from cryptographic key memory for which cryptographic key access is disabled; and send an error response.

11. Computing device, according to claim 9, characterized in that the processor is further configured to set one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

12. Computing device according to claim 9, characterized in that the processor is additionally configured to enable access to the cryptographic key in the cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable access to the cryptographic key in the cryptographic key memory.

13. Computing device according to claim 12, characterized in that the processor is additionally configured to: receive a data request; attempt to retrieve a cryptographic key from the cryptographic key memory for which cryptographic key access is enabled; and send the cryptographic key.

14. Computing device, according to claim 12, characterized in that it is further configured to set one or more cryptographic key access indicators associated with one or more cryptographic keys to an enable value.

15. Computing device according to claim 9, characterized in that it is additionally configured to: receive a cryptographic key access control policy parameter for one or more cryptographic keys configured to enable a cryptographic key access control policy; and enable the cryptographic key access control policy for one or more cryptographic keys in response to receiving the cryptographic key access control policy parameter.

16. Computing device, according to claim 9, characterized by being further configured to associate one or more cryptographic keys with one or more cryptographic key access indicators.

17. Computing device characterized by comprising: means for detecting a cryptographic key access control event; means for determining whether the cryptographic key access control event is intended to disable access to the cryptographic key in a cryptographic key memory of an integrated cryptographic mechanism; means for disabling access to the cryptographic key in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable access to the cryptographic key in the cryptographic key memory; and means for maintaining one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled. Petition 870250090963, dated 10 / 06 / 2025, pp. 118 / 137 6 / 9 18. Computing device according to claim 17, characterized by further comprising: means for receiving a data request; means for attempting to retrieve a cryptographic key from the cryptographic key memory for which cryptographic key access is disabled; and means for sending an error response.

19. Computing device according to claim 17, characterized in that the means for disabling access to the cryptographic key in the cryptographic key memory comprise means for setting one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

20. Computing device according to claim 17, characterized by further comprising means for enabling access to the cryptographic key in the cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable access to the cryptographic key in the cryptographic key memory.

21. Computing device according to claim 20, characterized by further comprising: means for receiving a data request; means for attempting to retrieve a cryptographic key from the cryptographic key memory for which cryptographic key access is enabled; and means for sending the cryptographic key.

22. Computing device, according to Petition 870250090963, dated 10 / 06 / 2025, pp. 119 / 137 7 / 9, claim 20, characterized in that the means for enabling access to the cryptographic key in the cryptographic key memory comprise means for setting one or more cryptographic key access indicators associated with one or more cryptographic keys to an enabling value.

23. Computing device according to claim 17, characterized by further comprising: means for receiving a cryptographic key access control directive parameter for one or more cryptographic keys configured to enable a cryptographic key access control directive; and means for enabling the cryptographic key access control directive for one or more cryptographic keys in response to receiving the cryptographic key access control directive parameter.

24. Computing device, according to claim 23, characterized by means for enabling the cryptographic key access control directive for one or more cryptographic keys comprising means for associating one or more cryptographic keys with one or more cryptographic key access indicators.

25. A processor-readable non-transient medium characterized by having stored therein processor-executable instructions configured to cause a processor of a computing device to perform operations comprising: detecting a cryptographic key access control event; determining whether the cryptographic key access control event is intended to disable access to the cryptographic key in a cryptographic key memory of an integrated cryptographic mechanism; disabling access to the cryptographic key in the cryptographic key memory in response to the determination that the cryptographic key access control event is intended to disable access to the cryptographic key in the cryptographic key memory; and maintaining one or more cryptographic keys in the cryptographic key memory for which cryptographic key access is disabled.

26. Processor-readable non-transient medium according to claim 25, characterized in that the stored processor-executable instructions are configured to cause the processor to perform additional operations comprising, after disabling access to the cryptographic key in the cryptographic key memory: receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending an error response.

27. Processor-readable non-transient medium according to claim 25, characterized in that the stored processor-executable instructions are configured to cause the processor to perform operations such that disabling access to the cryptographic key in the cryptographic key memory comprises setting one or more cryptographic key access indicators associated with one or more cryptographic keys to a disable value.

28. Processor-readable non-transient medium according to claim 25, characterized in that the stored processor-executable instructions are configured to cause the processor to perform operations that additionally comprise enabling access to the cryptographic key in cryptographic key memory in response to the determination that the cryptographic key access control event is not intended to disable access to the cryptographic key in cryptographic key memory.

29. Processor-readable non-transient medium according to claim 28, characterized in that the stored processor-executable instructions are configured to cause the processor to perform operations that additionally comprise enabling access to the cryptographic key in the cryptographic key memory; receiving a data request; attempting to retrieve a cryptographic key from the cryptographic key memory; and sending the cryptographic key.

30. Processor-readable non-transient medium according to claim 28, characterized in that the stored processor-executable instructions are configured to cause the processor to perform operations such that enabling access to the cryptographic key in the cryptographic key memory comprises setting one or more cryptographic key access indicators associated with one or more cryptographic keys to an enable value. Petition 870250090963, dated 06 / 10 / 2025, pp. 122 / 137

Images