Dual key establishment between two measurement states

Abstract

Systems and techniques for key establishment are described. For example, a process may store a first trusted measurement of a first entity in a first storage location during a first encryption key derivation, store an expected measurement of a second entity in a second storage location, and generate a first instance of an encryption key using the first trusted measurement, the expected measurement, and a key derivation function (KDF). The process may obtain an expected measurement as a second trusted measurement for a second entity and store it in a second storage location during a second encryption key derivation, obtain a first trusted measurement as a second expected measurement and store it in the first storage location, and generating a second instance of the encryption key using the second expected measurement, the second trusted measurement, and the key derivation function.

Description

TECHNICAL FIELD

[0001] The present disclosure relates generally to key establishment used by entities of a device when performing cryptographic operations. For example, aspects of the present disclosure relate to obtaining and providing inputs to a key derivation function. BACKGROUND

[0002] Devices often use cryptographic keys to perform cryptographic operations (e.g., encryption and / or decryption) on data. In some cases, multiple entities (e.g., different software image versions, different components, different devices, etc.) can need access to such data (e.g., be able to decrypt encrypted data). However, in certain scenarios, a cryptographic key for performing a cryptographic operation can be derived based on one or more data items that differ between the multiple entities. Thus, the entities can not be able to derive a common cryptographic key for using the data. Accordingly, there is a need for systems and techniques that allow different entities to derive the same cryptographic key in order to allow the entities to access the data. SUMMARY

[0003] Systems and techniques are described herein for dual key establishment between two entities to allow a common cryptographic key to be derived using a key derivation function.

[0004] According to at least one example, a process for key establishment is provided. The process includes, during a first cryptographic key derivation: storing a first trusted measurement value associated with a first entity in a first secure storage location; storing an expected measurement value associated with a second entity in a second secure storage location; and generating a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after the first instance of the cryptographic key is generated during the first cryptographic key derivation, obtaining the expected measurement value as a second trusted measurement value associated with the second entity; storing the second trusted measurement value in the second secure storage location; obtaining the first trusted measurement value as a second expected measurement value; storing the second expected measurement value in the first secure storage location; and generating a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0005] In another illustrative example, an apparatus for key establishment is provided. The apparatus includes at least one memory and at least one processor coupled to the at least one memory and configured to: during a first cryptographic key derivation: cause a first trusted measurement value associated with a first entity to be stored in a first secure storage location; cause an expected measurement value associated with a second entity to be stored in a second secure storage location; and generate a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after the first instance of the cryptographic key is generated during the first cryptographic key derivation, obtain the expected measurement value as a second trusted measurement value associated with the second entity; cause the second trusted measurement value to be stored in the second secure storage location; obtain the first trusted measurement value as a second expected measurement value; cause the second expected measurement value to be stored in the first secure storage location; and generate a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0006] In another illustrative example, a non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to: during a first cryptographic key derivation: cause a first trusted measurement value associated with a first entity to be stored in a first secure storage location; cause an expected measurement value associated with a second entity to be stored in a second secure storage location; and generate a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after the first instance of the cryptographic key is generated during the first cryptographic key derivation, obtain the expected measurement value as a second trusted measurement value associated with the second entity; cause the second trusted measurement value to be stored in the second secure storage location; obtain the first trusted measurement value as a second expected measurement value; cause the second expected measurement value to be stored in the first secure storage location; and generate a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0007] In another illustrative example, an apparatus for key establishment is provided. The apparatus comprises, during a first cryptographic key derivation: means for storing a first trusted measurement value associated with a first entity in a first secure storage location; means for storing an expected measurement value associated with a second entity in a second secure storage location; and means for generating a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: means for obtaining the expected measurement value as a second trusted measurement value associated with the second entity after the first instance of the cryptographic key is generated during the first cryptographic key derivation; means for storing the second trusted measurement value in the second secure storage location; means for obtaining the first trusted measurement value as a second expected measurement value; means for storing the second expected measurement value in the first secure storage location; and means for generating a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0008] In some aspects, one or more apparatuses described herein are, are part of, and / or include a mobile or wireless communication device (e.g., a mobile phone or other mobile device), an extended reality (XR) device or system (e.g., a virtual reality (VR) device, an augmented reality (AR) device, or a mixed reality (MR) device), a wearable device (e.g., a networked watch or other wearable device), a vehicle or computing device or component of a vehicle, a camera, a personal computer, a laptop computer, a server computer or server device (e.g., an edge or cloud-based server, a personal computer acting as a server device, a mobile device such as a mobile phone acting as a server device, an XR device acting as a server device, a vehicle acting as a server device, a network router, or other device acting as a server device), a system on chip (SoC), any combination thereof, and / or other type of device. In some aspects, the apparatus includes a display for displaying one or more images, notifications, and / or other displayable data. In some aspects, the apparatus can include one or more sensors (e.g., one or more RF sensors), such as one or more gyroscopes, one or more gyro tests, one or more accelerometers, any combination thereof, and / or other sensors.

[0009] This Summary is neither intended nor should it be construed to

[0010] The foregoing and other features and examples will become more apparent upon referring to the following specification, claims, and accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0011] Illustrative examples of the present application are described in detail below with reference to the following drawings:

[0012] Figure 1 is a block diagram illustrating certain components of a computing device, in accordance with one or more examples described herein;

[0013] Figure 2A is a block diagram illustrating an environment for deriving an encryption key during a first measurement state, in accordance with one or more examples described herein;

[0014] Figure 2B is a block diagram illustrating an environment for deriving an encryption key during a second measurement state, in accordance with one or more examples described herein;

[0015] Figure 3 is a flow diagram illustrating an example of a process for dual key establishment between different measurement states, in accordance with one or more examples described herein;

[0016] Figure 4 is a schematic diagram illustrating an example of a computing system for implementing certain aspects described herein. DETAILED DESCRIPTION

[0017] Certain aspects and examples of the present disclosure are provided below. As will be apparent to those of ordinary skill in the art, some of the aspects and examples can be used independently and some of them in combination with others. In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of examples of the application. However, it will be apparent that various examples can be practiced without these specific details. The drawings and description are not intended to be limiting. Furthermore, certain details can be omitted for the sake of brevity so as to not obscure the description.

[0018] In the following description of the drawings, any component described with respect to one drawing can be identical to one or more similarly named components described with respect to any other drawing, in various examples described herein. For the sake of brevity, the description of these components can not be fully repeated with respect to each drawing. Thus, each and every example of a component of each figure is incorporated by reference and assumed to optionally exist in each other figure having one or more similarly named components. Additionally, any description of a component of a drawing will be interpreted as an optional example that can be implemented in addition to, in conjunction with, or in place of, examples described with respect to a corresponding similarly named component in any other drawing, in accordance with various examples described herein.

[0019] The subsequent description of illustrative examples is provided for the purpose of illustration only. The subsequent description does not purport to be exhaustive or to limit the scope, applicability, or configuration in any way. Rather, the subsequent description of illustrative examples will serve to provide a person of ordinary skill in the art with an enabling description for implementing an example. It should be understood that various changes can be made to the function and arrangement of elements without departing from the spirit and scope of the application as set forth in the appended claims.

[0020] As used herein, the phrase operatively connected or operable connection (or any variation thereof) means that there is a direct or indirect connection between elements / components / devices / etc. that allows the elements to interact in some manner with each other. For example, the phrase "operatively connected" can refer to any direct (e.g., a direct wire between two devices or components) or indirect (e.g., a wired and / or wireless connection between any number of devices or components that connect the operatively connected devices) connection. Thus, any path through which information can travel can be considered an operable connection. Additionally, operatively connected devices and / or components can exchange things and / or can inadvertently share things other than information, such as, for example, current, radio frequency signals, power supply interference, interference due to proximity, interference due to reuse of the same wires and / or physical media, interference due to reuse of the same registers and / or other logic media, etc.

[0021] Systems and techniques for common encryption key establishment for different entities are described herein. In other words, the systems and techniques described herein allow for a common encryption key to be generated by a key derivation function for at least two separate entities that require that an encryption key pair can perform encryption operations on data that can be used and / or shared by the entities. The key derivation function can be any algorithm (e.g., implemented at least partially in hardware) that performs a function to produce an output based on one or more inputs (e.g., a platform key, etc.). The output can include, at least in part, a derived encryption key.

[0022] In some examples, an aggregate software image can be launched on a device. As used herein, an aggregate software image can be a collection of any one or more software images that are loaded during the booting of a computing device. In some examples, when such an aggregate software image is launched on a computing device, the image can be used to obtain a trusted measurement value. In some examples, a measurement value is any value (which can also be referred to as a parameter) that is obtained during the booting process of a device. In some examples, when a measurement is obtained during the booting of a device and stored in a location that can not be overwritten during subsequent operation of the device (e.g., in a write-once memory, some form of immutable storage, read-only memory, etc.), such a measurement value can be referred to as a trusted value. As an example, a trusted measurement value can include a cryptographic hash of an aggregate software image obtained via execution of a hash function using the aggregate software image as input. In some examples, the hash can be combined with any other item of information (e.g., state information of the computing device, measured physical properties, etc.) to obtain a trusted measurement value. Such a trusted measurement value, along with a secure platform key, can be used with a key derivation function to obtain an encryption key to be used to perform encryption operations on data to be accessed and / or otherwise used by the aggregate software image. In some examples, as used herein, a platform key refers to any encryption key that is usable by at least two entities that is a protected secret known only to one or more devices that include the two entities, such that the platform key is usable as input to a key derivation function performed by and / or on behalf of the two entities. In some examples, the use of a platform key in conjunction with a measurement value that is specific to a software image can prevent a classical signature forgery (e.g., performed using a quantum computer) from granting access to a device secret to an unauthorized aggregate image. For example, if a previous aggregate image did not authorize a new or updated image, the new image would not have access to a secret tied to the state of the device. Authentication of the new or updated image can be performed by the previously measured image using quantum algorithmically secure cryptographic primitives. Thus, quantum protection can be provided by mutable components and does not require addition to immutable software of the device.

[0023] In some examples, the trusted measurement value obtained at boot is stored in a secure storage location. In some examples, the secure storage location is any storage location that can be written to only during a secure boot process and can not be overwritten thereafter (e.g., a write-once storage location). A computing device can be configured with any number of secure storage locations without departing from the scope of the examples described herein. In some examples, a particular secure storage location to which a trusted measurement value is written is determined based at least in part on one or more parameters and / or information associated with the aggregated software image. As an example, a secure storage location can be selected based on a version number of the aggregated software image. As another example, the aggregated software image can include instructions indicating a particular secure storage location to which a trusted measurement value is to be written.

[0024] In some examples, the aggregated software image can need to be updated (e.g., to fix a security issue). Such an update can require an update to one or more portions of the aggregated software image. The update can change the contents of the aggregated software image such that the hash of the aggregated software image changes because the hash of the different information results in a different hash value. Thus, if the updated aggregated software image attempts to obtain an encryption key using the key derivation function (e.g., using the hash of the updated aggregated image instead of the hash of the original image), the encryption key can be different than the encryption key obtained by the aggregated software image prior to the update. Obtaining a different encryption key can make information protected by the original encryption key unavailable to the updated aggregated software image. Thus, a technique is needed to allow the aggregated software image and the updated aggregated software image to provide the same input to the key derivation function such that the encryption key generated is the same, thereby allowing the updated aggregated software image to access data previously protected by the un-updated aggregated software image.

[0025] As another example, a particular component can need to share data with another component, where such data is subject to encryption operations by the particular component. The components can be part of the same computing device, or can be part of separate computing devices (e.g., components of separate mobile computing devices). In this case, the two components can again need the ability to generate the same encryption key to access the same data. Thus, again, a technique is needed to allow the components to generate the same encryption key.

[0026] In some examples, the problem such as described above can be addressed at least in part via a technique of deriving an encryption key using at least two inputs to a key derivation function and a common platform key. The two inputs can be kept the same between two versions of an aggregated software image and / or between two components by manipulating the secure storage locations of the measurements. Specifically, during one boot process, a first secure storage location can be used to store a trusted measurement (e.g., of an initial aggregated software image or a first component), and a second secure storage location can be used to store an expected measurement (e.g., of an updated aggregated software image or a second component). In some examples, during a subsequent boot (e.g., of the same device, separate components, etc.), the expected measurement can be a second trusted measurement (e.g., a hash, a serial number, etc.) obtained during the boot process and stored in the second secure storage location, and the first trusted measurement can be obtained and stored in the first secure storage location. Thus, a key derivation function configured to use the common platform key and the values in the first and second secure storage locations can have the same inputs, and thus output the same derived encryption key. A system with the platform secret but in another state would not be able to derive the same group secret since the secure resources are limited and populated by the immutable trusted portion.

[0027] In some examples, a computing device is configured with at least a first secure storage location and a second secure storage location (e.g., two separate platform control registers). In some examples, the first secure storage location can be configured such that it can be written to only once during a boot of the computing device. Thus, the first secure storage location can be immutable during a runtime of the computing device. The first secure storage location can be written with a first trusted measurement obtained (e.g., measured) during a boot of the device, and during the boot, the first trusted measurement can be written only once by a component configured to obtain the measurement and write the measurement to the first secure storage location. In some examples, the first trusted measurement is a hash value of a first aggregated software image loaded during the boot process. In some examples, the first storage location can be written with a serial number of a component initialized during the boot process. In either case, the first trusted measurement can be a combination of an item of information (e.g., an image hash, a component serial number, etc.) with any other information of any type. As an example, an image hash or a component serial number can be combined with a value representing a state of the computing device to obtain the first trusted measurement. Examples of state information can include, but are not limited to, values of one or more read-only registers of the computing device, measurements related to operation of the computing device, etc. In some examples, the first trusted measurement can be referred to as a boot-time measurement.

[0028] In some examples, an expected measurement value is obtained. The expected measurement value can be any value selected by the first aggregate software image or by the first component to represent an expected measurement value of the updated aggregate software image or the second component, respectively. As an example, the second trusted measurement value can be obtained at least in part by obtaining a hash value associated with the updated aggregate software image. As another example, the second trusted measurement value can be obtained at least in part using a serial number associated with the second component. In some examples, the expected measurement value can be a value that becomes a trusted measurement value if measured during a subsequent boot of the device (or any component therein). As an example, a known hash of the updated software image or a known serial number (or other identifying information) of another component can be obtained as at least a portion of the expected measurement value, and can or can not be combined with some other information (e.g., a register state of the device) to generate the expected measurement value. In such examples, the obtained expected measurement value can become a trusted measurement value during a subsequent boot of the device (e.g., for a different software version), or during operation of the device (e.g., for a separate device component).

[0029] In some examples, the second trusted measurement value is stored in a second secure storage location (e.g., a second platform control register) that is writable after the first secure storage location has been rendered immutable (e.g., read-only). In some examples, the second trusted measurement value (e.g., the expected measurement value) is obtained using any suitable technique for obtaining information. As an example, an aggregate software image executing on a computing device can obtain an expected hash of an updated software image to be loaded (e.g., obtained over a network connection). As another example, a serial number of a separate component can be obtained directly or indirectly from another component. In some examples, the expected measurement value is stored in the second storage location based at least in part on information associated with the first entity (e.g., the aggregate software image, a device component, etc.) and / or the second entity (e.g., the updated software image, a second device component, etc.). For example, a version number of the updated software image can determine the second secure storage location. As another example, a key derivation process contemplated herein can determine the first secure storage location based on a version number of the aggregate software image, and the second secure storage location can be determined as being another secure storage location to be used in the key derivation process (e.g., when only two inputs plus a platform key are used to perform a key derivation function).

[0030] In some examples, the first trusted measurement value and the expected measurement value, along with a public platform key, are used as inputs to a key derivation function. In some examples, the public platform key is any encryption key that is available to both separate entities. As an example, the platform key can be stored in a particular storage location of a read-only hardware component (e.g., configured during a manufacturing process) and accessible by a software image executing on a device that includes the hardware component (e.g., indirectly accessible by the software, such as via a key derivation function or via immutable software in boot, after which the key is locked). As another example, the platform key can be stored on a read-only hardware component of a device and only accessible by certain other hardware components of the device. As another example, two separate devices manufactured by the same manufacturer can each include a read-only hardware component that includes a public platform key.

[0031] In some examples, the first trusted measurement value, the expected measurement value, and the platform key are used as inputs to a key derivation function to derive an encryption key to be used for performing encryption operations (e.g., encryption and / or decryption of data) by the first entity (e.g., the initial aggregated software image, the first component, etc.).

[0032] However, the same encryption key can be needed for other entities that access and / or otherwise use the same data. Thus, during subsequent encryption key derivation, using the same key derivation function, the same inputs must be used. To achieve the same inputs, the contents of the secure storage locations providing the input measurement values must be the same. To this end, in some examples, the secure storage locations of the expected measurement value and the first trusted measurement value can be flipped between subsequent boots of the computing device or during boot of a separate component.

[0033] In some examples, when the first trusted measurement value includes a hash of the initial aggregated software image, the first trusted measurement value is stored in the first secure storage location based on information associated with the initial aggregated software image (e.g., a version number of the image), as described above. An expected measurement value of an updated aggregated software image can then be stored in a second secure storage location, and the two measurement values, along with a public platform key, can be used to obtain a derived encryption key.

[0034] In some examples, when the updated aggregated software image is launched, the updated image has different associated information (e.g., a new version number) that indicates the second secure storage location is used to store the trusted measurement value during the boot process, where the first secure storage location is writable by the updated aggregated software image. The first storage location can be written with the trusted measurement value of the previous aggregated software image (e.g., the expected measurement value of the initial aggregated software image obtained by the updated aggregated software image). Thus, the first secure storage location still includes the trusted measurement value associated with the initial aggregated software image, the second secure storage location includes the trusted measurement value associated with the updated aggregated software image (which was previously the expected measurement value associated with the updated aggregated software image), and the platform key remains the same. Thus, in some examples, the inputs to the key derivation function (e.g., the platform key, the trusted measurement value associated with the initial aggregated software image, and the measurement value associated with the updated aggregated software image) remain the same, resulting in the same derived encryption key. Thus, the updated aggregated software image can access the same data as the initial aggregated software image (e.g., via encryption operations).

[0035] In some examples, when the first trusted measurement value includes a serial number of the first component, as described above, the first trusted measurement value is stored in the first secure storage location during the boot process of the computing device. The desired value in this scenario is information associated with the second component (e.g., another serial number) and is stored in the second secure storage location during or after the boot process. In some examples, the trusted measurement value of the first component and the expected measurement value of the second component are used with the platform key as inputs to a key derivation function to obtain a derived encryption key that is used to perform encryption operations (e.g., encrypt / decrypt) on data that is used by both components. In some examples, the second component can be configured to store its own trusted measurement value (e.g., its own serial number) in a secure storage location during the boot process, obtain the expected measurement value associated with the first component (e.g., the serial number of the first component), and store the expected measurement value in another secure storage location such that when used as inputs to a key derivation function along with the common platform key, the same encryption key is obtained as output, allowing both components to have the shared derived encryption key for performing encryption operations on data shared by both components.

[0036] Examples described herein can address the need to securely establish a dual encryption key that is typically derived between two entities when all or any portion of an entity or one or more devices comprising the entity can be in different states (e.g., a measurement state). In some examples, examples described herein provide consistent input to a key derivation function when an entity changes state (e.g., during and / or after a software update) and / or separate components require common cryptographic capabilities (e.g., components will operate on at least partially common data sets).

[0037] Various aspects of the technology described herein will be discussed below with respect to the drawings. Figure 1 is a block diagram illustrating an example of a computing device 100. As shown, the computing device 100 includes a processor 102, a universal flash storage (UFS) device 104, a memory device 108, an additional storage device 110, and a trusted environment 112. The trusted environment 112 can include any number of secure measurement storage locations (e.g., secure measurement storage location A 114, secure measurement storage location B 116), a platform key store 118, a key derivation component 120, and any number of secure components (e.g., secure component A 122, secure component B 124). Each of these components is described below.

[0038] Computing device 100 is any device, part of a device, or collection of devices capable of electronically processing instructions, and can include, but is not limited to, any of the following: one or more processors (e.g., components including integrated circuits, memory, input and output devices (not shown), non-volatile storage hardware, one or more physical interfaces (e.g., input / output (I / O) interfaces), any number of other hardware components (not shown), and / or any combination thereof). Examples of computing devices include, but are not limited to, mobile devices (e.g., laptop computers, smartphones, personal digital assistants, tablet computers, automotive computing systems, and / or any other mobile computing devices), Internet of Things (IoT) devices, servers (e.g., blade servers in a blade server chassis, rack servers in a rack, etc.), desktop computers, storage devices (e.g., disk drive arrays, Fibre Channel storage devices, Internet Small Computer System Interface (iSCSI) storage devices, tape storage devices, flash storage arrays, network-attached storage devices, etc.), network devices (e.g., switches, routers, multi-layer switches, etc.), wearable devices (e.g., networked watches or smart watches or other wearable devices), robotic devices, smart televisions, smart appliances, extended reality (XR) devices (e.g., augmented reality, virtual reality, etc.), any device including one or more SoCs, and / or any other type of computing device having the aforementioned requirements. In one or more examples, any or all of the aforementioned examples can be combined to create a system of such devices, which can be collectively referred to as a computing device. Other types of computing devices can be used without departing from the scope of the examples described herein.

[0039] In some examples, the processor 102 is any component including circuitry for executing instructions (e.g., of a computer program). As an example, such circuitry can be an integrated circuit implemented at least in part using transistors implementing components such as arithmetic logic units, control units, logic gates, registers, first-in-first-out (FIFO) buffers, data and control buffers, and the like. In some examples, the processor retrieves and decodes instructions, and then executes the instructions. Execution of the instructions can include operating on data, which can include reading and / or writing data. In some examples, instructions and data used by the processor are stored in a memory (e.g., memory device 108) of the computing device 100. The processor can perform various operations for executing software, such as an operating system, applications, and the like. The processor 102 can cause data to be written from the memory to storage of the computing device 100 and / or cause data to be read from the storage via the memory. Examples of processors include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), neural processing units, tensor processing units, display processing units, digital signal processors (DSPs), finite state machines, and the like. The processor 102 can be operatively connected to all or any portion of the memory device 108, any storage of the computing device 100 (e.g., UFS device 104, additional storage device 110), and / or the trusted environment 112. Although Figure 1 The computing device 100 is shown with a single processor 102, but the computing device can include any number of processors without departing from the scope of the examples described herein.

[0040] In some examples, the computing device 100 includes a universal flash storage (UFS) device 104. In some examples, the UFS device 104 is a flash storage device that is compliant with the UFS specification. The UFS device 104 can be used to store any type of data. Data can be written to and / or read from the UFS device 104. As an example, the UFS device can store an operating system image, a software image, application data, and the like. The UFS device 104 can store any other type of data without departing from the scope of the examples described herein. In some examples, the UFS device 104 includes NAND flash storage. The UFS device 104 can use any other type of storage technology without departing from the scope of the examples described herein. In some examples, the UFS device 104 can be capable of relatively faster data rates than other storage devices of the computing device 100 (e.g., additional storage device 110). The UFS device 104 can be operatively connected to all or any portion of the processor 102, the memory device 108, the additional storage device 110, and / or the trusted environment. Although Figure 1A computing device 100 with a single UFS device 104 is shown, but the computing device can include any number of UFS devices without departing from the scope of the examples described herein. Additionally, although Figure 1 A UFS device 104 is shown, but the computing device 100 can include any other type of flash storage device without departing from the scope of the examples described herein.

[0041] In some examples, the computing device 100 includes an additional storage device 110. In some examples, the additional storage device is any one or more non-volatile storage devices. The additional storage device 110 can be, for example, a persistent memory device. In some examples, the additional storage device 110 can be any type of computer storage. Examples of types of computer storage include, but are not limited to, hard disk drives, solid state drives, flash memory, tape drives, removable disk drives, universal serial bus (USB) storage devices, secure digital (SD) cards, optical storage devices, read-only memory devices, etc. Although Figure 1 The additional storage device 110 is shown as part of the computing device 100, but the additional storage device can be separate from and operatively connected to the computing device 100 (e.g., an external drive array, cloud storage, etc.). In some examples, the additional storage device 110 operates at a relatively slower data rate than the UFS device 104. In some examples, the additional storage device 110 is also a UFS storage device. In some examples, the additional storage device 110 is operatively connected to all or any portion of the processor 102, the UFS device 104, the memory device 108, and / or the trusted environment 112. Although Figure 1 A computing device 100 with a single additional storage device 110 is shown, but the computing device 100 can have any number of additional storage devices without departing from the scope of the examples described herein.

[0042] In some examples, the computing device 100 includes a memory device 108. The memory device can be any type of computer memory. In some examples, the memory device 108 is a volatile storage device. As an example, the memory device 108 can be a random access memory (RAM). In one or more examples, data stored in the memory device 108 is located at a memory address and is thus accessible by the processor 102 using the memory address. Similarly, the processor 102 can use the memory address to write data to and / or read data from the memory device 108. The memory device 108 can be used to store any type of data, such as, for example, computer programs, computation results, and the like. In some examples, the memory device 108 is operatively connected to all or any portion of the processor 102, the UFS device 104, the additional storage device 110, and / or the trusted environment 112. Although Figure 1 The computing device 100 is shown with a single memory device 108, but the computing device 100 can have any number of memory devices without departing from the scope of the examples described herein.

[0043] In some examples, the computing device 100 includes a trusted environment 112. The trusted environment 112 can be any hardware (e.g., circuitry), software, firmware, or any combination thereof configured to perform various services that can protect the computing device 100. Examples of such services can include, but are not limited to, performing various operations for performing various cryptographic service types, providing secure boot functionality, managing cryptographic keys, cryptographic key derivation, and the like. Examples of the trusted environment 112 include, but are not limited to, a secure execution environment, a trusted management environment, a trusted execution environment, a trusted area, a trusted platform module, a secure element, and the like. The trusted environment 112 can be operatively connected to the processor 102, the UFS device 104, the additional storage device 110, and / or the memory device 108. Although Figure 1 The computing device 100 is shown with a single trusted environment 112, but the computing device 100 can include any number of trusted environments without departing from the scope of the examples described herein. Additionally, although Figure 1 The various components (described below) are shown as being included in a single trusted environment 112, but all or any portion of the components shown within the trusted environment 112 can be in different secure execution environments (not shown) of the computing device 100, and / or not in a secure execution environment (e.g., as part of a rich execution environment).

[0044] In some examples, the trusted environment includes any number of secure measurement value storage locations (e.g., secure measurement value storage location A 114, secure measurement value storage location B 116). In some examples, a secure measurement value storage location is any hardware (e.g., circuitry), software, firmware, or any combination thereof configured to securely store any type of information. Such information can be or include a measurement value.

[0045] In some examples, a secure measurement value storage location is any location or medium for storing data that is restricted from being written in some manner. As an example, a secure measurement value storage location (e.g., 114, 116) can be a register (e.g., a platform control register) configured to be written only once (e.g., a write-once storage device) during a secure boot process, which is immutable after all or any portion of the time that the computing device 100 is continuously operated (e.g., remains powered on). A different register (e.g., a second platform control register) can be configured to be written by an entity associated with generating an input for a key derivation function during the secure boot process, and can include any information (e.g., an expected measurement value based on a hash of an obtained updated software image, a serial number of another component, etc.). Other examples of secure measurement value storage locations can be used without departing from the scope of the examples described herein (e.g., non-volatile memory devices, one-time programmable devices, fuse-based devices, registers, other volatile or non-volatile storage, etc.). Although Figure 1 The computing device 100 is shown as having two secure measurement value storage locations, but the computing device 100 can include any number of such storage locations without departing from the scope of the embodiments described herein.

[0046] In some examples, the platform key storage 118 is any suitable location and / or medium for storing any type of data. As an example, the platform key storage 118 can be any type of storage discussed above with respect to the secure measurement storage locations (114, 116). As another example, the platform key storage 118 can be a hardware component configured to include certain immutable secret data during a manufacturing process. In some examples, such data can be referred to as a platform key. As used herein, the term platform key can refer to any cryptographic key that can be embedded in some manner to one or more devices (which can be the same or similar devices) such as the computing device 100, such that the platform key can be obtained by an entity (e.g., a hardware component, a software component, etc.) of a given device, but not by other devices (e.g., the platform key is not a shared secret). Although Figure 1The computing device 100 is shown as having one platform key storage 118, but the computing device 100 can include any number of such storage locations for storing any number of platform keys without departing from the scope of the embodiments described herein.

[0047] In some examples, the secure measurement value storage locations (e.g., 114, 116) and the platform key storage 118 are each operatively connected to a key derivation component 120. In some examples, the key derivation component 120 is any hardware, software, firmware, or any combination thereof configured to execute a key derivation function for generating any number of derived cryptographic keys. In some examples, the key derivation function is any algorithm that can be implemented at least partially in hardware that takes one or more inputs, performs a function to produce an output based on the one or more inputs, where the output is at least partially a derived cryptographic key. The inputs can include, but are not limited to, platform keys (e.g., stored in the platform key storage 118) and any number of other inputs (e.g., contents of the secure measurement value storage locations).

[0048] As used herein, a measurement value can be, include, or otherwise correspond to any item of information based on, associated with, derived from, or otherwise corresponding to any other one or more items of information. The measurement value can be, include, or otherwise correspond to any item of information related to the computing device 100. Examples include, but are not limited to, a hash value associated with an aggregated software image, a serial number or other item of identification information associated with a device component, a physical value measured during operation of the computing device, state information of the computing device at a given time (e.g., contents of one or more registers), and the like. In some examples, the measurement value is a combination of any one or more of the foregoing examples and / or any other type of measurement value. As an example, the measurement value can be a hash of a software image loaded during a secure boot process combined with a measured state value of registers of the computing device at some point during the boot process.

[0049] A measurement value can be referred to as a trusted measurement value or an expected measurement value. In some examples, a trusted measurement value is a measurement value obtained during a secure boot process. As an example, during a secure boot process, the trusted environment 112 can be configured to verify one or more software images to be loaded by obtaining a hash of the one or more software images (e.g., an aggregated software image) and obtaining a particular value from a particular register and combining the two items of information to form a trusted measurement value. An expected measurement value can be any type of data item obtained in any manner. As an example, an expected measurement value can be, based on, or otherwise include a hash value of an updated aggregated software image obtained by the trusted environment 112 during a secure boot process from a repository of such information available to the trusted environment (e.g., over a network). An expected measurement value can be a combination of such an obtained value and another measurement value (e.g., a state information item) of the computing device 100.

[0050] Accordingly, in some examples, a trusted measurement value is trusted when one or more items of information are measured during a secure boot of a device for the trusted measurement value. In some examples, an expected measurement value is based at least in part on an item of information obtained rather than measured (e.g., a hash of a software image update that has not yet been applied, a serial number of another component, etc.). In some examples, this difference in measurement values can be used to generate cryptographic keys for different entities in various scenarios that are secure between different measurement states of a computing device (e.g., 100).

[0051] As an example, a trusted measurement value can be used as one input to a key derivation function (discussed above), an expected measurement value can be used as a second input to the key derivation function, and a platform key (discussed above) can be used as a third input to the key derivation function. The key derivation function can then be executed (e.g., by the key derivation component 120) to produce a derived cryptographic key as an output. If the cryptographic key is to be used by two separate entities (e.g., a latest version of an aggregated software image and an updated version between two components of a device, etc.), the same cryptographic key should be generated for each entity. In some examples, derivation of the same key can be achieved by providing the same inputs to the key derivation function. Assuming the platform key remains common, inputting the same measurement values can require one or more elements of the trusted environment 112 and / or any components therein to be configured such that the values of secure measurement value storage locations (e.g., 114, 116) remain the same between different measurement states of the computing device and / or components therein.

[0052] As an example, the trusted environment can be configured to determine one secure measurement location (e.g., 114) as a location to store a trusted measurement value during a secure boot process. This determination can be made, for example, based on any item of information associated with the aggregated software image to be loaded (e.g., a software version number). The trusted environment 112 can also be configured to obtain an expected measurement value (as described above) and store the expected measurement value in a second secure measurement value storage location (e.g., 116). When the aggregated software image is executing (e.g., during a secure boot process prior to a reboot following a software update), both secure measurement value storage location values and the platform key can be provided to a key derivation function (discussed below) to derive one or more encryption keys for use by the software of the aggregated software image to perform any number of encryption operations (e.g., encrypting and / or decrypting data). Following the execution of the software update, data that can need to be encrypted (e.g., decrypted) during operation of the computing device 100 can be performed.

[0053] As an example, during a boot process, a first aggregated software image can be loaded and a trusted measurement value obtained and stored in a configured one-time write secure storage location. The aggregated software image can be configured to check for a software update, and then a software update can be obtained. The trusted environment 112 can be configured to obtain a hash value as at least a portion of an expected measurement value for a planned updated version of the aggregated software image. The expected measurement value can be stored in a second secure measurement value storage location (which can also be pre-configured or determined based on any information) and used as part of a key derivation process. At a reboot, a secure boot process continues to execute the updated aggregated software image. During this boot, based on the updated aggregated software image having a different version number than the previous aggregated software image, the updated aggregated software image is used to obtain a trusted measurement value stored in the second secure measurement storage location during the current boot. The trusted environment 112 can be configured to obtain information associated with the previous aggregated software image, generate an expected measurement value for the previous aggregated software image, and store the value in the first secure measurement value storage location as configured.

[0054] This configuration allows the values ​​in the two secure measurement storage locations to remain identical between subsequent boots (because the locations of the trusted and expected values ​​are switched, but remain identical based on the information used to obtain the identical values). Therefore, when a trusted measurement generated during the first boot and obtained as the expected measurement during the second boot matches, and vice versa for the updated aggregate software image, and with the storage locations of each aggregate software image as described above, the input to the key derivation function remains the same. Therefore, since the input to the key derivation function can remain identical, one or more common encryption keys matching one or more encryption keys previously derived for the previous aggregate software image during the previous boot can be derived for the updated aggregate software image. Thus, the updated aggregate software image may be able to access or otherwise use data previously used by the previous aggregate software image, which may have been protected by encryption keys derived during the previous boot. In other words, based on the matching between trusted and expected measurements between different measurement states of the computing device (e.g., different boots during a secure boot process), the aggregate software image and the updated aggregate software image may be able to have a derived common encryption key for performing encryption operations on common data.

[0055] As another example, the two components of computing device 100 ( Figure 1 (Not shown) may need access to public data (e.g., input / output components and display generation components). In some examples, such data may be encrypted. Therefore, similar to the examples above, each component can generate a trusted measurement value at least in part based on information associated with itself (e.g., a serial number) and obtain an expected measurement value (e.g., a serial number) associated with other components. The first component can be configured such that the two measurements are stored in a secure measurement value storage location in a specific order, which is provided as input to a key derivation function instance. The second component can be configured to perform the same but reversed operation, providing the same input to the same key derivation function instance or to a separate instance of the key derivation function. Therefore, when the trusted measurement value and expected measurement value associated with the first component value are equally valid for the second component, and a shared secret (e.g., a platform key) is generally available for both components, the same encryption key can be derived for both components across different measurement states (e.g., due to execution by different components, at different points in time, etc.). Such a component can be separate from or included in any one or more trusted environments (e.g., 112) of the computing device 100.

[0056] In some examples, as described above, the determination of which secure measurement value storage location (e.g., 114, 116) is configured to store trusted measurement values or expected measurement values can be performed using any technique for determining where data is stored. As an example, the trusted environment (e.g., 112) can be configured to determine the location of trusted measurement values based on an item of information (e.g., a version number, component identification information, etc.) and configured to use a separate location for expected measurement values. In some examples, after a state change (e.g., after a software update followed by a reboot, during boot of a separate component, etc.), the trusted environment can be configured to reverse the location of stored measurement values at least with respect to the configuration of inputs to the key derivation function. Such a reversal causes the inputs to remain the same between measurement states, allowing for the common encryption key derivation described above.

[0057] In some examples, the computing device 100 includes any number of secure components (e.g., secure component 122, secure component 124). The secure components 122 and 124 can be any component capable of performing various cryptographic services and thus can be any hardware (e.g., circuitry), software, firmware, or any combination thereof. In some examples, the secure components are sub-chip hardware components of a system on a chip (SoC) that can include Figure 1 The other components shown, such as, for example, the processor 102, can also be included as part of the SoC without departing from the scope of the examples described herein. In some examples, the secure components exist in data paths between the storage devices (e.g., UFS storage device 104, additional storage device 110) and the memory device 108, and / or between the processor 102 and the memory device 108 or any of the storage devices (e.g., 104, 110). In some examples, all or any portion of the secure components can be considered an “inline” cryptographic engine. In some examples, the secure components (e.g., 122, 124) are configured to perform any number of cryptographic service types on data read from or written to the storage devices (e.g., UFS device 104, additional storage device 110) and / or the memory device 108 of the computing device 100. In some examples, all or any portion of data passed from memory to storage, from storage to memory, or to or from the processor 102 of the computing device 100 passes through the secure components (e.g., 122, 124). In some examples, the secure components (122, 124) are configured to perform any number of encryption operations (e.g., encryption, decryption, authentication, verification, etc.) using encryption keys derived by the key derivation function as described herein. Although Figure 1The trusted environment is shown as having two secure components (122, 124), although the trusted environment 112 and / or the computing device 100 can include any number of secure components without departing from the scope of the examples described herein.

[0058] Although Figure 1 A particular number of components in a particular configuration is shown, but one of ordinary skill in the art will understand that the computing device 100 can include more or fewer components, and / or the components arranged in any number of alternative configurations, without departing from the scope of the examples described herein. Additionally, some or all of the illustrated components can be part of a single component, and any single component can be implemented as any number of discrete components. As an example, although Figure 1 The various components included in the computing device 100 are shown, although all or any portion of these components can be separate from the computing device 100 and operably connected to the computing device 100 without departing from the scope of the examples described herein. Additionally, although Figure 2A not shown in FIG. 1, one of ordinary skill in the art will understand that the computing device 100 can execute any number or type of software or firmware (e.g., a boot loader, an operating system, a hypervisor, a virtual machine, a computer application, a mobile device application, etc.). Thus, the examples disclosed herein should not be limited to Figure 2B the configuration of the components shown.

[0059] Figure 1 and Figure 2A is a diagram illustrating an environment 200 in accordance with one or more examples described herein. In one illustrative example, the environment 200 is an example of the trusted environment 112 of Figure 1 FIG. 1. Certain aspects of the examples described herein are set forth below with respect to Figure 2A and 2B The following examples are for illustrative purposes only and are not intended to limit the scope of the examples described herein. Additionally, while the examples illustrate certain aspects of the examples described herein, all possible aspects of such examples can not be described in this particular example. In certain aspects, details that are apparent to one of ordinary skill in the art are omitted in order to provide a clear and concise description of certain aspects of the examples described herein Figure 2B described above in the description of

[0060] Figure 2A and Figure 2B is a block diagram illustrating an example environment 200 in accordance with one or more examples described herein. As Figure 1 and Figure 2A shown, the environment 200 includes a first secure storage location 202 and a second secure storage location 204, which can be the same as or similar to the trusted environment 112 and the secure storage locations 122, 124 described above in Figure 2BThe secure measurement value storage locations 114 and 116 discussed in the description of Figure 1 and Figure 1 As shown, the environment 200 also includes a platform key 206, which can be the same as or similar to the platform key discussed above in the description of Figure 2A and stored in a platform key storage (e.g., the platform key storage 118 of Figure 2B ).

[0061] Figure 1 and Figure 2A The environment 200 is also shown as including a key derivation function 208. As an example, the key derivation function 208 can be performed at least in part using the key derivation component 120 discussed above in the description of Figure 2B Although not shown in Figure 1 or Figure 2A All or any portion of the components of the environment 200 can be included in or otherwise operatively connected to one or more trusted environments (e.g., the trusted environment 112 of Figure 2B ).

[0062] In some examples, the first secure storage location 202, the second secure storage location 204, and the platform key 206 can each be configured as an input to the key derivation function 208. In some examples, the key derivation function 208 processes the values provided as input to obtain a derived encryption key 210 as output. In some examples, the derived encryption key 210 can remain the same, given that the inputs remain the same.

[0063] As Figure 2BThe illustrated environment 200 is in a first measurement state, as a booting environment during a secure boot process after a start of an initial aggregated software image. The initial aggregated software image is used to compute (e.g., measure) a hash value, and the hash value is combined with another measurement (a register value) to produce a trusted measurement value of 0xabba. This trusted measurement value is stored in a one-write platform control register configured to store trusted measurement values, and is then not overwritten (at least until a subsequent boot). The determination to store the trusted measurement value is based at least in part on a version number associated with the initial aggregated software image. In this case, the secure boot process includes an update of the initial aggregated software image and a reboot to execute the updated aggregated software image. Accordingly, a trusted environment (not shown) of the environment 200 obtains an expected measurement value corresponding to the updated aggregated software image, which includes a hash value associated with the updated aggregated software image. The expected value of 0xdbac is configured to be stored in the second secure storage location 204. The trusted measurement value, the expected measurement value, and the platform key 206 are used as inputs to a key derivation function 208 to derive a derived encryption key 210, which is used to perform encryption operations on data during operation of the initial aggregated software image.

[0064] However, the updated aggregated software image will need to use data that can have had encryption operations performed on it. Accordingly, after the reboot, when the updated aggregated software image is executing, the updated aggregated software image needs the same encryption key that was previously used by the initial aggregated software image on the data. To achieve this commonly derived encryption key, a similar process is performed to obtain the trusted and expected measurement values as described above, resulting in the Figure 3 illustrated environment 200.

[0065] In Figure 1 , the values stored in the secure storage locations remain the same, but are derived in a manner opposite to the above-described manner during the previous boot. Specifically, in some examples, the trusted measurement value computed for the updated aggregated software image during the boot again uses a hash of the updated aggregated software image, and thus is computed to be the same as the expected measurement value in the previous boot. Due to the different version number associated with the updated aggregated software image, the trusted measurement value is now stored in the second secure storage location 204. The expected measurement value associated with the initial aggregated software image is obtained, and is configured to be stored in the first secure storage location 202 during this subsequent boot.

[0066] Accordingly, the inputs to the key derivation function 208 remain the same between the subsequent boot (e.g., two different measurement states), allowing the same derived encryption key 210 to be obtained for use by both the initial aggregated software image and the updated aggregated software image.

[0067] While the foregoing examples contemplate deriving a common encryption key for a separate software image during a secure boot process by reversing the order in which trusted measurements and expected measurements are stored in a secure storage location, one of ordinary skill in the art will appreciate and the benefit of the detailed description is that this technique can be applied to any other scenario in which two entities need to use a key derivation function to derive a common encryption key.

[0068] As a simple example, 0xabba can be a serial number of a first component of a computing device, and 0xdbac can be a serial number of a second component of the computing device. The components can need the ability to operate on the same data collectively, some of which can undergo an encryption operation (e.g., encryption, later requiring decryption). When the components boot, a trusted measurement for the first component can be obtained that includes the serial number 0xabba, and an expected measurement for the second component that includes the serial number 0xdbac. The computing device can be configured such that when an encryption key for the first component is derived, the trusted measurement is provided as a first input to a key derivation function, and the expected measurement can be provided as a second input. These inputs can be combined with a platform key input to generate the derived encryption key.

[0069] Separately, a trusted measurement for the second component can be obtained that includes the serial number 0xdbac, and an expected measurement for the first component that includes the serial number 0xabba. The computing device can be configured such that when an encryption key for the second component is derived, the expected measurement is provided as a first input to a key derivation function, and the trusted measurement can be provided as a second input. These inputs can be combined with a platform key input to generate the derived encryption key. Thus, in each case, the inputs to the key derivation, and thus the output encryption key, remain the same. Thus, each of the two components can have a commonly derived encryption key for performing encryption operations.

[0070] Figure 2A is a flow diagram illustrating an example of a process 300 for key establishment (e.g., dual key establishment between measurement states) in accordance with one or more examples described herein. The process 300 can be performed, at least in part, e.g., by a computing device or a component of a computing device (e.g., a chipset, etc.). In one illustrative example, the process 300 can be performed, at least in part, by the computing device 100 (or any one or more components or elements therein) shown in Figure 2A and described above.

[0071] At box 302, the computing device (or a component thereof) may store a first trusted measurement associated with a first entity (e.g., a first software image, a first component, etc.) in a first secure storage location (e.g., secure measurement storage location A 114) during the first (or initial) cryptographic key derivation. Reference Figure 1 As an illustrative example, the first trusted measurement value could be a trusted measurement value 0xabba stored in a first secure storage location 202. In one illustrative example, the first trusted measurement value includes a hash (e.g., a cryptographic hash) of the first software image.

[0072] At box 304, the computing device (or a component thereof) may store the expected measurement associated with the second entity (e.g., the second software image, the second component, etc.) in a second secure storage location (e.g., secure measurement storage location B 116) during the first encryption key derivation. Reference Figure 2A As an illustrative example, the expected measurement value could be 0xdbac, stored in a second secure storage location 204. In one illustrative example, the expected measurement value includes a hash of the second software image (e.g., a password hash).

[0073] In some aspects, when the first entity is the first component and the second entity is the second component, the first trusted measurement may include a first identification information item (e.g., a first serial number) associated with the first component, and the expected measurement may include a second identification information item (e.g., a second serial number) associated with the second component.

[0074] At box 306, the computing device (or a component thereof) may use a first trusted measurement, an expected measurement, and a key derivation function (e.g., during the first cryptographic key derivation) Figure 2B Key derivation component 120 Figure 2A and / or Figure 2B The first instance of the encryption key is generated by the key derivation function 208 and / or other key derivation functions (e.g., ...). Figure 2A The exported encryption key 206).

[0075] At box 308, the computing device (or a component thereof) may, during the second encryption key derivation, after generating a first instance of the encryption key during the first encryption key derivation, obtain a desired measurement value as a second trusted measurement value associated with the second entity. At box 310, the computing device (or a component thereof) may store the second trusted measurement value in a second secure storage location during the second encryption key derivation. (Reference) Figure 2B As an illustrative example, from Figure 2B The expected measurement value 0xdbac is stored as the second reliable measurement value. Figure 2A In the second secure storage location 204.

[0076] At block 312, the computing device (or a component thereof) can obtain, during the second cryptographic key derivation, the first trusted measurement value as a second expected measurement value. At block 314, the computing device (or a component thereof) can store, during the second cryptographic key derivation, the second expected measurement value in the first secure storage location. See Figure 2B As an illustrative example, the trusted measurement value 0xabba from Figure 2B is stored in the first secure storage location 202 in Figure 1 as the second expected measurement value.

[0077] At block 314, the computing device (or a component thereof) can generate, during the second cryptographic key derivation, a second instance of the cryptographic key (e.g., the derived cryptographic key 206 of Figure 4 ) using the second expected measurement value, the second trusted measurement value, and a key derivation function. In some cases, the computing device (or a component thereof) can generate the first instance of the cryptographic key and the second instance of the cryptographic key using the key derivation function and using a platform key that is common to the first entity and the second entity. As described herein, the platform key can be an encryption key that is available to at least two entities (e.g., the first entity and the second entity) that is a protected secret known only to one or more devices that include the two entities. The platform key can be made available as an input to a key derivation function performed by and / or on behalf of the two entities.

[0078] In some aspects, the computing device (or a component thereof) can select the first secure storage location to store the first trusted measurement value during the first key derivation based on a parameter associated with the first entity (e.g., based on a version number of the first entity (e.g., included in a software image, etc.)), an instruction included in the first entity (e.g., a software image, etc.) that indicates a particular secure storage location to which a trusted measurement value is to be written, any combination thereof, and / or other parameter or information. In some cases, the computing device (or a component thereof) can select the second secure storage location to store the second trusted measurement value during the second key derivation based on a parameter associated with the second entity (e.g., based on a version number of the second entity (e.g., a software image, etc.)), an instruction included in the second entity (e.g., included in a software image, etc.) that indicates a particular secure storage location to which a trusted measurement value is to be written, any combination thereof, and / or other parameter or information.

[0079] As described above, the process 300 and / or any other process described herein can be performed by a computing device or apparatus (e.g., the computing device 100 of Figure 1 , the computing device 200 of Figure 4and / or one or more components to which the computing device is operatively connected, to perform. The computing device can be, include, or be a component of any suitable device, such as a vehicle or computing device of a vehicle (e.g., a driver monitoring system (DMS) of a vehicle), a mobile device (e.g., a mobile phone), a desktop computing device, a tablet computing device, a wearable device (e.g., a VR headset, an AR headset, AR glasses, a networked watch or smartwatch, or other wearable device), a server computer, a robotic device, a television, a smart speaker, a voice assistant device, a SoC, and / or any other device having the resource capabilities to perform the processes described herein, including process 500 and / or other processes described herein. In some cases, a computing device or apparatus (e.g., that includes a hardware identity emulator) can include various components, such as one or more input devices, one or more output devices, one or more processors, one or more microprocessors, one or more microcomputers, one or more cameras, one or more sensors, and / or other component(s) configured to perform the operations of the processes described herein. In some examples, a computing device can include a display, a network interface configured to transmit and / or receive data, an RF sensing component, any combination thereof, and / or other component(s). The network interface can be configured to transmit and / or receive Internet Protocol (IP) based data or other types of data.

[0080] components of a computing device (e.g., Figure 3 a computing device 100 of a vehicle, Figure 4 a computing system 400 of a vehicle Components of a computing device (e.g., a computing device 100 of a vehicle, a computing system 400 of a vehicle) can be implemented at least in part in circuitry. For example, a component can include or be implemented using electronic circuitry or other electronic hardware, which can include one or more programmable electronic circuits (e.g., microprocessors, graphics processing units (GPUs), digital signal processors (DSPs), central processing units (CPUs), finite state machines, and / or other suitable electronic circuits), and / or a component can include or be implemented at least in part using computer software, firmware, or a combination thereof for performing various operations described herein.

[0081] Figure 4The illustrated process 300 is shown as a logic flow diagram, the operations of which represent a sequence of operations that can be implemented in hardware, computer instructions, or a combination thereof. In the context of computer instructions, the operations represent computer-executable instructions stored, for example, on one or more computer-readable storage media that, when executed by one or more processors, perform the recited operations. Generally, computer-executable instructions include routines, programs, objects, components, data structures, and the like that perform particular functions or implement particular data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations can be combined in any order and / or in parallel to implement the processes.

[0082] Additionally, the process 300 and / or other processes described herein can be performed under the control of one or more computer systems configured with executable instructions and can be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware, or combinations thereof. As noted above, the code can be stored on a computer-readable or machine-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. The computer-readable or machine-readable storage medium can be non-transitory.

[0083] ​ FIG. 1 is a schematic diagram illustrating an example of a system for implementing certain aspects of the present technology. Specifically, ​ An example of a computing system 400 is shown, which can be, for example, any computing device making up an internal computing system, a remote computing system, a camera, or any component thereof, where the components of the system communicate with each other using a connection 405. The connection 405 can be a physical connection using a bus, or a direct connection into a processor 410 (such as in a chipset architecture). The connection 405 can also be a virtual connection, a networking connection, or a logical connection.

[0084] In some examples, the computing system 400 is a distributed system, where the functions described in this disclosure can be distributed among data centers, multiple data centers, peer-to-peer networks, and the like. In some examples, one or more of the described system components represent many such components, each performing some or all of the functions described for that component. In some examples, the components can be physical devices or virtual devices.

[0085] Example system 400 includes at least one processing unit (CPU or processor) 410 and a connection 405 that couples various system components, including system memory 415 (such as read-only memory (ROM) 420 and random access memory (RAM) 425), to processor 410. Computing system 400 may include a cache 412 of high-speed memory that is directly connected to, adjacent to, or integrated into processor 410.

[0086] Processor 410 may include any general-purpose processor and hardware or software services configured to control processor 410 (such as services 432, 434, and 436 stored in storage device 430), as well as dedicated processors in which software instructions are incorporated into the actual processor design. Processor 410 may essentially be a fully self-contained computing system, containing multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0087] To enable user interaction, the computing system 400 includes an input device 445, which can represent any number of input mechanisms or sensors, such as a microphone for voice (e.g., the user speaking), a touch-sensitive screen for gesture or graphical input (e.g., the user performing sign language symbols, the user shaking a phone, etc.), a keyboard (e.g., the user pressing keys), a mouse, motion input, determining the user's location as indicated by a positioning system or modem subsystem, etc., which can be used to activate the counters described in the previous section and enable / disable the asset transfer chain at any stage described previously. The computing system 400 may also include an output device 435, which can be one or more of a variety of output mechanisms. In some instances, a multi-mode system allows the user to provide multiple types of input / output to communicate with the computing system 400. The computing system 400 may include a communication interface 440, which typically manages and controls user input and system output. The communication interface can perform or facilitate the reception and / or transmission of wired or wireless communications using wired and / or wireless transceivers, including using audio jacks / plugs, microphone jacks / plugs, Universal Serial Bus (USB) ports / plugs, etc. Ports / plugs, Ethernet ports / plugs, fiber optic ports / plugs, proprietary wired ports / plugs Wireless signal transmission Low-power (BLE) wireless signal transmission wireless transceivers of wireless signal transmissions, radio frequency identification (RFID) wireless signal transmissions, near field communication (NFC) wireless signal transmissions, dedicated short range communication (DSRC) wireless signal transmissions, 802.11 Wi-Fi wireless signal transmissions, wireless local area network (WLAN) signal transmissions, visible light communication (VLC), worldwide interoperability for microwave access (WiMAX), infrared (IR) communication wireless signal transmissions, public switched telephone network (PSTN) signal transmissions, integrated services digital network (ISDN) signal transmissions, 3G / 4G / 5G / LTE cellular data network wireless signal transmissions, ad-hoc network signal transmissions, radio wave signal transmissions, microwave signal transmissions, infrared signal transmissions, visible light signal transmissions, ultraviolet light signal transmissions, wireless signal transmissions along the electromagnetic spectrum, or some combination thereof. The communication interface 440 can also include one or more global navigation satellite system (GNSS) receivers or transceivers for determining a location of the computing system 400 based on one or more signals received from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to: the United States-based Global Positioning System (GPS), the Russian-based Global Navigation Satellite System (GLONASS), the Chinese-based BeiDou Navigation Satellite System (BDS), and the European-based Galileo GNSS. There is no limitation as to the operation of any particular hardware arrangement, so the basic features here can be readily replaced with improved hardware or firmware arrangements as they are developed.

[0088] The storage device 430 can be a non-volatile and / or non-transitory and / or computer-readable storage device, and can be a hard disk or other type of computer readable media such as a box tape, a flash card, a solid-state storage device, a digital versatile disc (DVD), a tape, a floppy drive, a flexible disk drive, a hard disk drive, a magnetic tape, a magnetic strip / ribbon, any other magnetic storage medium, a flash memory storage, a memristor memory, any other solid-state memory, a compact disc read-only memory (CD-ROM) optical disc, a compact disc (CD) re-writable optical disc, a digital video disc (DVD) optical disc, a Blu-ray disc (BDD) optical disc, a holographic optical disc, another optical medium, a secure digital (SD) card, a micro secure digital (microSD) card, A card, a smart card chip, an EMV chip, a Subscriber Identity Module (SIM) card, a mini / micro / nano / pico SIM card, another integrated circuit (IC) chip / card, a random access memory (RAM), a static RAM (SRAM), a dynamic RAM (DRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash EPROM (FLASH EPROM), a cache memory (L1 / L2 / L3 / L4 / L5 / L#), a resistive random access memory (RRAM / ReRAM), a phase change memory (PCM), a spin transfer torque RAM (STT-RAM), another memory chip or a cassette tape, and / or a combination thereof. The storage device 430 can include software instructions or code that can be executed by the processor 410 to cause the system 400 to perform functions.

[0089] As used herein, the term "computer-readable medium" includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other mediums capable of storing, containing, or carrying instruction and / or data. Computer-readable medium can include a non-transitory medium in which data can be stored and that does not include carrier waves and / or transitory electronic signals propagating wirelessly or over wired connections. Examples of a non-transitory medium can include, but are not limited to, a magnetic disk or tape, optical disk storage, flash memory, memory or memory devices, and / or storage devices. Computer-readable medium can store code and / or machine-executable instructions that represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment can be coupled to another code segment or a hardware circuit by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. can be passed, forwarded, or transmitted using any suitable means including memory sharing, message passing, token passing, network transmission, etc.

[0090] In some examples, computer-readable storage devices, media and memories can include cables or wireless signals containing bit streams and the like. However, when referred to, non-transitory computer-readable storage media expressly excludes media such as energy, carrier signals, electromagnetic waves, and signals per se.

[0091] In the above description, specific details are provided to provide a thorough understanding of the examples and examples provided herein. However, a person of ordinary skill in the art will understand that the examples can be practiced without these specific details. In some instances, techniques can be presented as individual functional blocks, which can comprise devices, device components, operations in methods embodied in software, steps or routines in a program of instructions, hardware, or combinations thereof. Additional components can be used in addition to or instead of those shown in the figures and / or described herein. For example, circuits, systems, networks, processes, and other components can be shown as components in block diagram form in order not to obscure the examples in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques can be shown without unnecessary detail in order to avoid obscuring the examples.

[0092] The above description can have described various examples as a process or method that can be depicted as a flowchart, flow diagram, data flow diagram, structure diagram, or block diagram. Although a flowchart can describe operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations can be re-arranged. A process is terminated when its operations are completed, but could be terminated before, caused by the result of earlier operations. A process can correspond to a method, function, procedure, subroutine, subprogram, etc. When a process corresponds to a function, its termination can correspond to a return of the function to the calling function or the main function.

[0093] The processes and methods described above according to the examples can be implemented using computer-executable instructions, which are stored in or otherwise accessible to a computer-readable medium. For example, such instructions can include instructions and data which cause a general purpose computer, special purpose computer, or processing device to perform a certain function or group of functions. Portions of computer resources used can be accessible via a network. The computer-executable instructions can be, for example, in binary, intermediate format, human-readable, or machine- readable. Examples of computer-readable media that can be used to store instructions, used information, and / or information created during methods according to the described examples include magnetic or optical disks, flash memory, USB devices provided with non-volatile memory, network storage devices, etc.

[0094] Devices implementing processes and methods according to these disclosures can include hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof, and can take any of a variety of form factors. When implemented in software, firmware, middleware, or microcode, the program code or code segments to perform the necessary tasks (e.g., a computer-program product) can be stored in a computer-readable or machine-readable medium. A processor(s) can perform the necessary tasks. Typical examples of form factors include laptops, smartphones, mobile phones, tablet devices or other small form factor personal computers, personal digital assistants, rackmount devices, standalone devices, and so on. Functionality described herein also can be embodied in peripherals or add-on

[0095] Instructions, media for conveying such instructions, computing resources for executing them, and other structures for supporting such computing resources, are example means for providing the functionality described in this disclosure.

[0096] In the foregoing description, various aspects of the present application have been described with reference to specific examples of the application, but it will be appreciated that a person of ordinary skill in the art to which the application pertains will be able to devise further implementations of the application without departing from the scope of the application. Therefore, although illustrative examples of the application have been described in detail herein, it is the intent of the applicant that no limitation be placed on the scope of the application by this detailed description, but rather that substitutions and alterations can be made by one having ordinary skill in the art without departing from the scope of the application. Various features and aspects of the above-described application can be used individually or jointly. Further, the application can be utilized in any number of environments and applications beyond the type described herein without departing from the broader spirit and scope of the present specification. Thus, the disclosure should not be limited by the illustrative examples set forth herein. Rather, the scope of the disclosure is limited solely by the claims set forth below.

[0097] One of ordinary skill in the art will appreciate that the less than (“<”) and greater than (“>”) symbols or terms used herein can be replaced by the less than or equal to (“≤”) and greater than or equal to (“≥”) symbols, respectively, without departing from the scope of the present specification.

[0098] Where a component is described as being configured to perform certain operations, such configuration can, for example, be accomplished by designing the component to perform the operation, by programming the component to perform the operation, or any combination thereof. For example, a component can include one or more processors, one or more memory modules, one or more logic devices, or any combination thereof.

[0099] The phrase "coupled to" means any connection or other association between components, and / or any connection or association between components that is not direct or indirect, through a wired or wireless connection, and / or other appropriate connection interface.

[0100] The recitation of "at least one of," and / or "one or more of," a set of items indicates that there is at least one member of the set of items, and / or that there are one or more members of the set of items (with any combination of members being allowed). For example, the recitation "at least one of A and B" or "at least one of A or B" means A, B, or A and B. In another example, the recitation "at least one of A, B, and C" or "at least one of A, B, or C" means A, B, C, A and B, A and C, B and C, or A and B and C. The language of the set "at least one of" and / or the set "one or more of" does not limit the collection of items to a single item, regardless of whether the article "a," "an," or "the" is used in reference to the collection of items. For example, the recitation "a or B" or "an or B" can mean A, B, or A and B. The language of the set "at least one of" and / or the set "one or more of" is not limited to items recited in the specific order listed.

[0101] The various illustrative logical blocks, modules, circuits, and algorithm operations described in connection with the examples disclosed herein can be implemented as electronic hardware, computer software, firmware, or combinations thereof. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and operations have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans can implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

[0102] The techniques described herein can also be implemented in electronic hardware, computer software, firmware, or any combination thereof. Such techniques can be implemented in any of various devices such as a general purpose computer, a wireless communication device handsets, or an integrated circuit device having many uses including application in wireless communication device handsets and other devices. Any features described as modules or components can be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques can be realized at least in part by a computer-readable data storage medium comprising program code including instructions that, when executed, performs one or more of the methods described above. The computer-readable data storage medium can form part of a computer program product, which can include packaging material. The computer-readable medium can comprise memory or data storage media, such as random access memory (RAM) such as synchronous dynamic random access memory (SDRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic or optical data storage media, and the like. Additionally or in the alternative, the techniques described can be realized at least in part by a computer-readable communication medium that carries or communicates program code in the form of instructions or data structures and that can be accessed, read, and / or executed by a computer.

[0103] The program code can be executed by a processor, which can include one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application-specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuitry. Such a processor can be configured to perform any of the techniques described in this disclosure. A general purpose processor can be a microprocessor; microcontrollers; an ASIC; a FPGA; or any other equivalent integrated or discrete logic circuitry. The processor can also be configured to perform a software or firmware program associated with the method of this application. In this regard, the general purpose processor can include a

[0104] Illustrative aspects of the disclosure include:

[0105] Aspect 1. A method for key establishment, the method comprising: during a first cryptographic key derivation: storing a first trusted measurement value associated with a first entity in a first secure storage location; storing an expected measurement value associated with a second entity in a second secure storage location; and generating a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after the first instance of the cryptographic key is generated during the first cryptographic key derivation, obtaining the expected measurement value as a second trusted measurement value associated with the second entity; storing the second trusted measurement value in the second secure storage location; obtaining the first trusted measurement value as a second expected measurement value; storing the second expected measurement value in the first secure storage location; and generating a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0106] Aspect 2. The method of aspect 1, wherein the first entity is a first software image and the second entity is a second software image.

[0107] Aspect 3. The method of aspect 2, wherein the first trusted measurement value comprises a hash of the first software image and the expected measurement value comprises a hash of the second software image.

[0108] Aspect 4. The method of any one of aspects 1-3, wherein the first entity is a first component and the second entity is a second component.

[0109] Aspect 5. The method of aspect 4, wherein the first trusted measurement value comprises a first item of identification information associated with the first component and the expected measurement value comprises a second item of identification information associated with the second component.

[0110] Aspect 6. The method of any one of aspects 1-5, wherein the first secure storage location is selected during the first cryptographic key derivation for storing the first trusted measurement value based on a parameter associated with the first entity.

[0111] Aspect 7. The method of any one of aspects 1-6, wherein the second secure storage location is selected during the second cryptographic key derivation for storing the second trusted measurement value based on a parameter associated with the second entity.

[0112] Aspect 8. The method of any one of aspects 1 through 7, wherein generating the first instance of the encryption key and the second instance of the encryption key comprises using the key derivation function and using a platform key that is common to the first entity and the second entity.

[0113] Aspect 9. An apparatus for key establishment, the apparatus comprising: at least one memory; and at least one processor coupled to the at least one memory and configured to: during a first encryption key derivation: cause a first trusted measurement value associated with a first entity to be stored in a first secure storage location; cause an expected measurement value associated with a second entity to be stored in a second secure storage location; and generate a first instance of an encryption key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second encryption key derivation: after the first instance of the encryption key is generated during the first encryption key derivation, obtain the expected measurement value as a second trusted measurement value associated with the second entity; cause the second trusted measurement value to be stored in the second secure storage location; obtain the first trusted measurement value as a second expected measurement value; cause the second expected measurement value to be stored in the first secure storage location; and generate a second instance of the encryption key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0114] Aspect 10. The apparatus of aspect 9, wherein the first entity is a first software image and the second entity is a second software image.

[0115] Aspect 11. The apparatus of aspect 10, wherein the first trusted measurement value comprises a hash of the first software image and the expected measurement value comprises a hash of the second software image.

[0116] Aspect 12. The apparatus of any one of aspects 9 through 11, wherein the first entity is a first component and the second entity is a second component.

[0117] Aspect 13. The apparatus of aspect 12, wherein the first trusted measurement value comprises a first item of identification information associated with the first component and the expected measurement value comprises a second item of identification information associated with the second component.

[0118] Aspect 14. The apparatus of any one of aspects 9 through 13, wherein the at least one processor is configured to select the first secure storage location for storing the first trusted measurement value during the first encryption key derivation based on a parameter associated with the first entity.

[0119] Aspect 15. The apparatus of any of aspects 9 through 14, wherein the at least one processor is configured to select the second secure storage location for storing the second trusted measurement value during the second cryptographic key derivation based on a parameter associated with the second entity.

[0120] Aspect 16. The apparatus of any of aspects 9 through 15, wherein the at least one processor is configured to generate the first instance of the cryptographic key and the second instance of the cryptographic key using the key derivation function and a platform key that is common to the first entity and the second entity.

[0121] Aspect 17. The apparatus of any of aspects 9 through 16, wherein the at least one memory includes the first secure storage location and the second secure storage location.

[0122] Aspect 18. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to: during a first cryptographic key derivation: cause a first trusted measurement value associated with a first entity to be stored in a first secure storage location; cause an expected measurement value associated with a second entity to be stored in a second secure storage location; and generate a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after the first instance of the cryptographic key is generated during the first cryptographic key derivation, obtain the expected measurement value as a second trusted measurement value associated with the second entity; cause the second trusted measurement value to be stored in the second secure storage location; obtain the first trusted measurement value as a second expected measurement value; cause the second expected measurement value to be stored in the first secure storage location; and generate a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.

[0123] Aspect 19. The non-transitory computer-readable medium of aspect 18, wherein the first entity is a first software image and the second entity is a second software image.

[0124] Aspect 20. The non-transitory computer-readable medium of aspect 19, wherein the first trusted measurement value comprises a hash of the first software image and the expected measurement value comprises a hash of the second software image.

[0125] Aspect 21. The non-transitory computer-readable medium of any of aspects 18 through 20, wherein the first entity is a first component and the second entity is a second component.

[0126] Aspect 22. The non-transitory computer-readable medium of aspect 21, wherein the first trusted measurement value comprises a first item of identification information associated with the first component and the expected measurement value comprises a second item of identification information associated with the second component.

[0127] Aspect 23. The non-transitory computer-readable medium of any of aspects 18-22, wherein the instructions, when executed by the at least one processor, cause the at least one processor to select, based on a parameter associated with the first entity, the first secure storage location for storing the first trusted measurement value during the first cryptographic key derivation.

[0128] Aspect 24. The non-transitory computer-readable medium of any of aspects 18-23, wherein the instructions, when executed by the at least one processor, cause the at least one processor to select, based on a parameter associated with the second entity, the second secure storage location for storing the second trusted measurement value during the second cryptographic key derivation.

[0129] Aspect 25. The non-transitory computer-readable medium of any of aspects 18-24, wherein the instructions, when executed by the at least one processor, cause the at least one processor to generate the first instance of the cryptographic key and the second instance of the cryptographic key using the key derivation function and a platform key that is common to the first entity and the second entity.

[0130] An apparatus for key establishment, the apparatus comprising one or more means for performing the operations of any of aspects 1-8.

Claims

1. A method for key establishment, the method comprising: during a first cryptographic key derivation: storing a first trusted measurement value associated with a first entity in a first secure storage location; storing an expected measurement value associated with a second entity in a second secure storage location; and generating a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after generating the first instance of the cryptographic key during the first cryptographic key derivation, obtaining the expected measurement value as a second trusted measurement value associated with the second entity; storing the second trusted measurement value in the second secure storage location; obtaining the first trusted measurement value as a second expected measurement value; storing the second expected measurement value in the first secure storage location; and generating a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function. The first entity is a first software image, and the second entity is a second software image. The first trusted measurement value comprises a hash of the first software image, and the expected measurement value comprises a hash of the second software image. The first entity is a first component, and the second entity is a second component.

2. The method of claim 1, wherein, The first trusted measurement value comprises a first item of identification information associated with the first component, and the expected measurement value comprises a second item of identification information associated with the second component.

3. The method of claim 2, wherein, The first secure storage location is selected for storing the first trusted measurement value based on parameters associated with the first entity during the first cryptographic key derivation.

4. The method of claim 1, wherein, The second secure storage location is selected for storing the second trusted measurement value based on parameters associated with the second entity during the second cryptographic key derivation.

5. The method of claim 4, wherein, Generating the first instance of the cryptographic key and the second instance of the cryptographic key comprises using the key derivation function and using a platform key that is common to the first entity and the second entity.

6. The method of claim 1, wherein, 9. An apparatus for key establishment, the apparatus comprising:

7. The method of claim 1, wherein, at least one memory; and 8. The method of claim 1, wherein, at least one processor coupled to the at least one memory and configured to: during a first cryptographic key derivation: cause a first trusted measurement value associated with a first entity to be stored in a first secure storage location; cause an expected measurement value associated with a second entity to be stored in a second secure storage location; and generate a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function; and during a second cryptographic key derivation: after generating the first instance of the cryptographic key during the first cryptographic key derivation, obtain the expected measurement value as a second trusted measurement value associated with the second entity; cause the second trusted measurement value to be stored in the second secure storage location; obtain the first trusted measurement value as a second expected measurement value; cause the second expected measurement value to be stored in the first secure storage location; and generate a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function. The first entity is a first software image, and the second entity is a second software image. The first trusted measurement value comprises a hash of the first software image, and the expected measurement value comprises a hash of the second software image. The first entity is a first component, and the second entity is a second component. The first trusted measurement value comprises a first item of identification information associated with the first component, and the expected measurement value comprises a second item of identification information associated with the second component. The first secure storage location is selected for storing the first trusted measurement value based on parameters associated with the first entity during the first cryptographic key derivation. The second secure storage location is selected for storing the second trusted measurement value based on parameters associated with the second entity during the second cryptographic key derivation. Generating the first instance of the cryptographic key and the second instance of the cryptographic key comprises using the key derivation function and using a platform key that is common to the first entity and the second entity. generating a second instance of the encryption key using the second expected measurement, the second trusted measurement, and the key derivation function.

10. The apparatus of claim 9, wherein, the first entity is a first software image and the second entity is a second software image.

11. The apparatus of claim 10, wherein, the first trusted measurement comprises a hash of the first software image and the expected measurement comprises a hash of the second software image.

12. The apparatus of claim 9, wherein, the first entity is a first component and the second entity is a second component.

13. The apparatus of claim 12, wherein, the first trusted measurement comprises a first item of identification information associated with the first component and the expected measurement comprises a second item of identification information associated with the second component.

14. The apparatus of claim 9, wherein, the at least one processor is configured to select the first secure storage location for storing the first trusted measurement during the first encryption key derivation based on a parameter associated with the first entity.

15. The apparatus of claim 9, wherein, the at least one processor is configured to select the second secure storage location for storing the second trusted measurement during the second encryption key derivation based on a parameter associated with the second entity.

16. The apparatus of claim 9, wherein, the at least one processor is configured to generate the first instance of the encryption key and the second instance of the encryption key using the key derivation function and a platform key that is common to the first entity and the second entity.

17. The apparatus of claim 9, wherein, the at least one memory comprises the first secure storage location and the second secure storage location.

18. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to: during a first encryption key derivation: cause a first trusted measurement associated with a first entity to be stored in a first secure storage location; causing an expected measurement value associated with the second entity to be stored in the second secure storage location; and generate a first instance of an encryption key using the first trusted measurement, an expected measurement, and a key derivation function; and during a second encryption key derivation: after generating the first instance of the encryption key during the first encryption key derivation, obtain the expected measurement as a second trusted measurement associated with a second entity; cause the second trusted measurement to be stored in a second secure storage location; obtain the first trusted measurement as a second expected measurement; cause the second expected measurement to be stored in the first secure storage location; and generate a second instance of the encryption key using the second expected measurement, the second trusted measurement, and the key derivation function.

19. The non-transitory computer-readable medium of claim 18, wherein, the first entity is a first software image and the second entity is a second software image.

20. The non-transitory computer-readable medium of claim 19, wherein, the first trusted measurement comprises a hash of the first software image and the expected measurement comprises a hash of the second software image.

21. The non-transitory computer-readable medium of claim 18, wherein, the first entity is a first component and the second entity is a second component.

22. The non-transitory computer-readable medium of claim 21, wherein, the first trusted measurement comprises a first item of identification information associated with the first component and the expected measurement comprises a second item of identification information associated with the second component.

23. The non-transitory computer-readable medium of claim 18, wherein, The instructions, when executed by the at least one processor, cause the at least one processor to select the first secure storage location for storing the first trusted measurement value during the first cryptographic key derivation based on parameters associated with the first entity.

24. The non-transitory computer-readable medium of claim 18, wherein, The instructions, when executed by the at least one processor, cause the at least one processor to select the second secure storage location for storing the second trusted measurement value during the second cryptographic key derivation based on parameters associated with the second entity.

25. The non-transitory computer-readable medium of claim 18, wherein, The instructions, when executed by the at least one processor, cause the at least one processor to generate the first instance of the cryptographic key and the second instance of the cryptographic key using the key derivation function and a platform key that is common to the first entity and the second entity.

Images