Apparatus and method for binding system-on-chip and memory device with key

Abstract

Methods and apparatus relating to providing multi-key support within a die architecture, such as a system on a chip. In some examples, a die package includes a key activation fuse, a key revocation fuse, and a key fuse for a plurality of keys. The die package also includes a processor electrically coupled to the key activation fuse, the key revocation fuse, and the plurality of key fuses. Further, the processor may generate a first key value and write the first key value to the key fuse to generate a first key. The processor may also write to the key activation fuse to activate the first key. The processor may further supply the first key to the first memory device. When the first memory device is replaced with the second memory device, the processor may write to the key revocation fuse to revoke the first key and may supply the second key to the second memory device.

Description

Technical Field

[0001] This disclosure relates generally to die architecture, and more specifically to using keys to bind a system-on-a-chip (SoC) architecture to a memory device. Background Technology

[0002] In various applications, die architectures such as System-on-Chip (SoC) architectures use keys to bind to other devices, such as memory devices. Using keys to bind the SoC to other devices provides device security benefits. For example, when bound to a memory device by a key, the SoC can access secure data maintained within the memory device. However, other devices, such as other SoCs, cannot gain access to the secure data within the memory device without the key. Typically, the key is programmed into the memory device once. For example, the memory device can be an one-time programmable (OTP) memory, such as read-only memory (ROM) or a fuse. The SoC device can supply the key to the memory device, where both the SoC and the memory device store the key. Once the key is supplied to the memory device, the SoC and the memory device are bound together. Summary of the Invention

[0003] According to one aspect, a die package includes a first memory device and a processor electrically coupled to the first memory device. The processor is configured to write to a key revocation location of the first memory device, revoking a first key stored in a first key location of the first memory device. The processor is also configured to write a second key to a second key location of the first memory device. Furthermore, the processor is configured to write to a key activation location of the first memory device, activating the second key. The processor is further configured to generate supply data characterizing the second key. Additionally, the processor is configured to send the supply data to the second memory device, causing the second memory device to store the second key.

[0004] According to another aspect, a method executed by a processor includes writing to a key revocation location of a first memory device, thereby revoking a first key stored in a first key location of the first memory device. The method further includes writing a second key to a second key location of the first memory device. Additionally, the method includes writing to a key activation location of the first memory device, thereby activating the second key. The method also includes generating supply data characterizing the second key. Furthermore, the method includes sending the supply data to a second memory device, causing the second memory device to store the second key.

[0005] According to another aspect, a non-transitory machine-readable storage medium includes instructions that, when executed by at least one processor, cause at least one processor to perform operations. The operations include writing to a key revocation location of a first memory device, revoking a first key stored in a first key location of the first memory device. The operations also include writing a second key to a second key location of the first memory device. Furthermore, the operations include writing to a key activation location of the first memory device, activating the second key. The operations also include generating supply data characterizing the second key. Additionally, the operations include sending the supply data to a second memory device, causing the second memory device to store the second key.

[0006] According to another aspect, a die package includes a plurality of key activation fuses, each of which is configured to activate a corresponding key among a plurality of keys. The die package also includes a plurality of key deactivation fuses, each of which is configured to deactivate a corresponding key among a plurality of keys. Furthermore, the die package includes a key fuse associated with each of the plurality of keys, each key fuse being configured to store a corresponding key among a plurality of keys. The die package also includes a processor electrically coupled to the plurality of key activation fuses, the plurality of key deactivation fuses, and the key fuse associated with each of the plurality of keys. The processor is configured to generate a first key value. The processor is also configured to write the first key value to the key fuse associated with the first key among the plurality of keys. Additionally, the processor is configured to write to the first key activation fuse among the plurality of key activation fuses to activate the first key among the plurality of keys. The processor is also configured to write to the first key deactivation fuse among the plurality of key deactivation fuses to deactivate the first key among the plurality of keys. The processor is further configured to write a second key activation fuse into a plurality of key activation fuses to activate the second key among the plurality of keys. Attached Figure Description

[0007] Figure 1 It is a block diagram based on some specific implementations of bare die packages; Figure 2 This is a block diagram illustrating a portion of a specific implementation of a system-on-a-chip; Figure 3A and Figure 3B It is a block diagram of a die package that is bound to a memory device according to some specific implementation; Figure 4A Examples of memory device programming systems based on some specific implementations are shown; Figure 4B Examples are given based on some specific implementations. Figure 4A The operation of the on-chip system of the programmed memory device; Figure 5 These are flowcharts illustrating exemplary processes for binding an on-chip system to a memory device, based on some specific implementations; and Figure 6 It is a flowchart of an exemplary process for binding a system-on-a-chip to a memory device, based on some specific implementations. Detailed Implementation

[0008] While the features, methods, apparatus, and systems described herein may be embodied in various forms, some exemplary and non-limiting embodiments are shown in the accompanying drawings and described below. Some components described in this disclosure are optional, and some specific embodiments may include additional, different, or fewer components compared to those expressly described in this disclosure.

[0009] The implementation described herein relates to providing multi-key support within a die architecture such as a System-on-Chip (SoC). For example, the SoC may include multiple key locations, where only one of the key locations is active at any given time. For example, the multiple key locations may reside within the SoC's secure FLASH memory. The SoC may program a first key, such as a first private key (e.g., a first cryptographic key), into the first key location and may activate the first key location. Furthermore, the SoC may provision (e.g., securely program) the first key to a first memory device, such as a Universal Flash Storage (UFS) device, thereby binding the SoC to the first memory device based on the first key. For example, the SoC may perform operations to securely store the first key within a key location of the first memory device. For example, the first key may be stored within a Replay Protected Memory Block (RPMB) of the first memory device. The SoC can now securely access the first memory device (e.g., read data from the first memory device, write data to the first memory device) based on the first key. For example, when bound, the SoC can successfully access a memory location of the first memory device (or, in some examples, at least a portion of the memory location of the first memory device, such as a memory location requiring authenticated access) using read and write access authenticated with the first key. In contrast, the first memory device will not serve (e.g., allow) read or write access to its memory location (or, in some examples, a portion of its memory location) that is not authenticated with the first key.

[0010] However, in some situations, the first memory device may fail. For example, as the number of data reads and / or writes to the memory device increases, its memory cells may degrade, leading to memory failure. Thus, over time, the first memory device may begin to fail (e.g., after three years). However, the lifespan of the SoC may be much longer than that of the first memory device. For example, in automotive applications, an SoC may have a lifespan of fifteen years or more. If the first memory device fails, the SoC cannot reliably access it. However, the implementation allows the first memory device to be replaced with a second memory device without having to replace the SoC.

[0011] For example, a failed first memory device can be replaced by a second memory device. Furthermore, the SoC can deactivate the first key location and program a second key into it. The SoC can then activate the second key location. The SoC can also supply the same second key to a second memory device (which could be another UFS device), thereby binding the SoC to the second memory device based on the second key. The SoC can now securely access the second memory device based on the second key.

[0012] Among other advantages, the implementation allows die architectures such as SoCs to provide multi-key support, where only one of multiple keys is active at any given time. The SoC can supply the active key to the memory device, and the SoC and memory device can securely exchange data based on the active key. If a memory device fails, it can be replaced with another memory device, and the SoC can supply a new key to the other memory device. Therefore, the implementation allows memory devices to be replaced without replacing the SoC, providing cost savings and extending the SoC's lifespan. For example, if a memory device typically lasts six years, and the SoC supports three keys, the implementation allows the SoC to operate for up to eighteen years, and each of the three memory devices for six years. Therefore, instead of requiring three SoCs and three memory devices for a total of eighteen years of operation, the implementation allows the same total of eighteen years of operation, but with only one SoC and three memory devices. These and other benefits will be appreciated by those skilled in the art.

[0013] Figure 1This is a block diagram of an integrated circuit package 100, which includes a system-on-chip (SoC) 102 electrically coupled to a memory device 120 via a communication bus 153. The communication bus 153 may provide, for example, a serial interface or a parallel interface. Furthermore, as illustrated, the SoC 102 may include non-volatile memory 103 (e.g., read-only memory (ROM)) electrically coupled to one or more processors 106, 116. Each processor 106, 116 may be, for example, a processing core, a graphics processing unit (GPU), a central processing unit (CPU), a microcontroller, or any other suitable processing device. The non-volatile memory 103 may be, for example, a one-time programmable (OTP) memory device including one or more fuses (e.g., electrical fuses). As illustrated, the non-volatile memory 103 may include various storage locations, including a key revocation location 108, a key activation location 110, a key lock location 112, and a key storage device location 104, where the key storage device location 104 includes a first key location 104A, a second key location 104B, and an Nth key location 104C. In some examples, each of the key revocation location 108, key activation location 110, key lock location 112, and key storage device location 104 may include one or more fuses, as described herein. For example, the key revocation location 108 may include multiple bits (e.g., "N" bits), each bit representing a revocation fuse. Similarly, the key activation location 110 may include multiple bits, each bit representing an activation fuse. The trusted processor 106 may write to one or more fuses in each of the key revocation location 108, key activation location 110, key lock location 112, and key storage device location 104. For example, the trusted processor 106 can write the address of the corresponding fuse to the fuse address register and write the data to be written to the fuse to the fuse data register. Then, the trusted processor can write to the fuse write register, causing the data in the fuse data register to be written to the fuse located at the address in the fuse address register. For example, the fuse address register, fuse data register, and fuse write register may reside in non-volatile memory 103. In other cases, the trusted processor 106 may write data directly to the address corresponding to the fuse. The SoC 102 may also include working memory 107 electrically coupled to one or more trusted processors 106. Working memory 107 may be, for example, random access memory (RAM).

[0014] In some cases, non-volatile memory 103, working memory 107, and one or more trusted processors 106 can communicate via internal bus 111 and form all or part of a trusted zone 109 that provides secure processing. Trusted zone 109 provides a private and secure processing environment within SoC 102. For example, while trusted processor 106 can write to storage locations within key revocation location 108, key activation location 110, and key storage device 104, processor 116 (i.e., untrusted processor 116) cannot, because processor 116 is not within trusted zone 109. In some examples, trusted processor 106 can establish virtual processors, where each virtual processor is associated with a corresponding hardware asset. For example, a first virtual processor of trusted processor 106 can be configured to communicate outside trusted zone 109 via communication bus 153, while a second virtual processor of trusted processor 106 can be configured to communicate within trusted zone 109 via internal bus 111.

[0015] As described above, processor 116 is not within trusted zone 109 and therefore can access locations within key storage device 104, such as first key location 104A, second key location 104B, and Nth key location 104C, based on access controls defined in key revocation location 108 and key activation location 110. For example, key activation location 110 may include one or more fuses, each determining whether access to the corresponding location within key storage device 104 is active (e.g., enabled). Furthermore, key revocation location 108 may include one or more fuses, each determining whether access to the corresponding location within key storage device 104 has been revoked (e.g., disabled). For processor 116 to access a specific location within key storage device 104, the corresponding fuse in key activation location 110 must make the location active, and the corresponding fuse in key revocation location 108 must not make the location revoked. If the corresponding location is not active (e.g., as determined by key activation location 110), or the corresponding location has been revoked (e.g., as determined by key revocation location 108), then processor 116 cannot access the corresponding location within key storage device 104 (e.g., due to one or more corresponding "fuse-out" fuses). Furthermore, key lock location 112 may include one or more configuration settings that disable read access to key storage device 104. For example, trusted processor 106 may write to key lock location 112 to disable processor 116 from reading one or more locations within key storage device 104, such as reading first key location 104A.

[0016] Memory device 120 may be, for example, FLASH memory, such as a Universal Flash Storage (UFS) device. Memory device 120 may include a Replay Protected Memory Block (RPMB) 127 and one or more additional data partitions 140. RPMB 127 can only be accessed using authenticated reads and writes. In this example, RPMB 127 includes an authentication key location 138, a write counter 132, and a data area 139. Authentication key location 138 may store an authentication key, such as an authentication key supplied by SoC 102 as described herein. The value of write counter 132 indicates the number of writes to RPMB 127 (e.g., the number of 256-byte blocks written). Furthermore, data area 139 allows for the storage of secure data, such as data for storing trusted applications.

[0017] In some examples, memory device 120 stores executable instructions within one or more data partitions 140. Trusted processor 106 can receive instructions from memory device 120 and can store these instructions in working memory 107. For example, trusted processor 106 can perform one or more read operations with memory device 120 via communication bus 153 to receive instructions from data partitions 140 of memory device 120. Trusted processor 106 can also perform one or more write operations with working memory 107 to store instructions in working memory 107. Furthermore, trusted processor 106 can execute instructions stored in working memory 107 to perform one or more of the operations described herein.

[0018] SoC 102 provides multi-key support, where only one key is active and available for provisioning at any given time (e.g., controlled by key activation location 110), and the currently active key is revoked before another key is activated (e.g., controlled by key revocation location 118). For example, based on execution instructions (e.g., instructions stored in working memory 107), trusted processor 106 can generate key values ​​for keys such as authentication keys, private keys, cryptographic keys, or RSA keys. The key can be, for example, a 521-bit key, a 1024-bit key, a 2048-bit key, a 4096-bit key, or any other suitable key. In some examples, trusted processor 106 generates random numbers and determines the key value based on these random numbers. For example, trusted processor 106 can use random numbers as key values. In some examples, trusted processor 106 scales random numbers to a specific size (e.g., 1024 bits) to generate key values.

[0019] Furthermore, based on execution instructions, the trusted processor 106 can write a key value to a first key location 104A of the key storage device 104 to establish a first key. As described herein, the first key location 104A may include one or more fuses of the key storage device 104 defining the first key value. Thus, once written, the first key location 104A cannot be written to again. Furthermore, based on execution instructions, the trusted processor 106 writes to a key activation location 110 to enable access to the first key location 104A, thereby "activating" the first key. Thus, the processor 116 can access the first key from the first key location 104A and can perform operations to supply the first key to the memory device 120, thereby binding the SoC 102 to the memory device 120. For example, the memory device 120 may be a UFS device, and the processor 116 may program (e.g., write) the first key to an authentication key location 138 within the RPMB 127 of the memory device 120. Once programmed, the first key is supplied to the memory device 120, and the authentication key location 138 within the RPMB 127 cannot be reprogrammed.

[0020] If, for example, memory device 120 begins to fail or malfunctions, the current memory device 120 can be replaced by another memory device (e.g., a memory device with the same storage components as memory device 120 but which has not yet been supplied with a key). For example, a service technician can remove memory device 120 from integrated circuit package 100 (e.g., from a socket) and place a new memory device into integrated circuit package 100. The new memory device may include executable instructions characterizing an application within one or more data partitions 140. To bind to the new memory device, trusted processor 106 can obtain executable instructions from the data partitions 140 of the new memory device, and the executable instructions cause trusted processor 106 to revoke a first key, activate a second key, and supply the second key to the new memory device.

[0021] For example, based on execution instructions, trusted processor 106 can write to key revocation location 108 to disable access to first key location 104A, thereby "revokeing" the first key. When writing to key revocation location 108 to disable access to first key location 104A, processor 116 will no longer have access to first key location 104A. Furthermore, based on execution instructions, trusted processor 106 can generate a second key, which may be a random number, and trusted processor 106 can store the second key in second key location 104B. As described herein, second key location 104B may include one or more fuses defining the second key. Trusted processor 106 can also write to key activation location 110 based on execution instructions to enable access to second key location 104B, thereby "activating" the second key. Thus, processor 116 can now access the second key from second key location 104B and can perform operations to supply the second key to second memory device 120, thereby binding SoC 102 to second memory device 120. For example, the second memory device 120 may be a UFS device, and the processor 116 may program (e.g., write) a second key into the authentication key location 138 within the RPMB 127 of the second memory device 120. Once programmed, the second key is supplied to the memory device 120, and the authentication key location 138 within the RPMB 127 cannot be reprogrammed. In some cases, the trusted processor 106 writes to the key lock location 112 of the key storage device 104 to lock read access to the key storage device 104. The key lock location 112 may be a read access fuse that prevents read access to each key in the key when written. For example, the key lock location 112 may include multiple bits, where each bit corresponds to a read access fuse for a key. If a bit is written with a specific value (e.g., 1), the corresponding key is prevented from being read.

[0022] Figure 2 Access to the key storage device 104 for trusted processor 106 and processor 116 is illustrated. For example, as illustrated, key revocation position 108 may include a first key revocation fuse 202, a second key revocation fuse 204, and a third key revocation fuse 206. In some examples, each of the first key revocation fuse 202, the second key revocation fuse 204, and the third key revocation fuse 206 is destroyed (e.g., access is not provided through the fuse) when programmed (e.g., written). Key activation position 110 may include a first key activation fuse 222, a second key activation fuse 224, and a third key activation fuse 226. In some examples, each of the first key revocation fuse 202, the second key revocation fuse 204, and the third key revocation fuse 206 is not destroyed (e.g., access is provided through the fuse) when programmed (e.g., written).

[0023] Key revocation position 108 and key activation position 110 control whether processor 116 can read key storage device 104. For example, for processor 116 to read first key position 104A, first key revocation fuse 202 and first key activation fuse 222 must each provide connectivity through them. For example, processor 116 can read first key 242 when first key revocation fuse 202 is not programmed and first key activation fuse 222 is programmed, thereby allowing access through each of the respective fuses. Similarly, processor 116 can read second key 244 when second key revocation fuse 204 is not programmed and second key activation fuse 224 is programmed, thereby allowing access through each of the respective fuses. Furthermore, processor 116 can read third key 246 when third key revocation fuse 206 is not programmed and third key activation fuse 226 is programmed, thereby allowing access through each of the respective fuses.

[0024] Trusted processor 106 can program any of the first key revocation fuse 202, the second key revocation fuse 204, and the third key revocation fuse 206 at key revocation position 108, and any of the first key activation fuse 222, the second key activation fuse 224, and the third key activation fuse 226 at key activation position 110. For example, to activate the first key 242 located in the first key position 104A of key storage device 104, trusted processor 106 can write to the first key activation fuse 222 to activate the first key 242. Because the first key activation fuse 222 is activated (e.g., thus allowing access), and the first key revocation fuse 202 is not programmed (e.g., thus also allowing access), processor 116 can read the first key 242 from the first key position 104A in key storage device 104. Furthermore, to deactivate the first key 242, trusted processor 106 can write to the first key revocation fuse 202. Because the first key revocation fuse 202 is now blown (e.g., thus preventing access through it), the processor 116 cannot read the first key 242 from the first key location 104A.

[0025] Similarly, to activate the second key 244, the trusted processor 106 can write to the second key activation fuse 224 to activate the second key 244. Because the second key activation fuse 224 is activated (e.g., thus allowing access), and the second key deactivation fuse 204 is not programmed (e.g., thus also allowing access), the processor 116 can read the second key 244 from the second key location 104B in the key storage device 104. Furthermore, to deactivate the second key 244, the trusted processor 106 can write to the second key deactivation fuse 204. Because the second key deactivation fuse 204 is now blown (e.g., thus disallowing access through it), the processor 116 is now prevented from reading the second key 244. Furthermore, to activate the third key 246, the trusted processor 106 can write to the third key activation fuse 226 to activate the third key 246. Because the third key activation fuse 226 is activated (e.g., thus allowing access), and the third key deactivation fuse 206 is not programmed (e.g., thus also allowing access), the processor 116 is able to read the third key 246 from the third key location 104C in the key storage device 104. Furthermore, to deactivate the third key 246, the trusted processor 106 can write to the third key deactivation fuse 206. Because the third key deactivation fuse 206 is now blown (e.g., thus disallowing access through it), the processor 116 is now prevented from reading the third key 246.

[0026] As described herein, in some examples, the trusted processor 106 may perform multiple write operations to write to any of the fuses described herein. For example, the non-volatile memory 108 may include a fuse address register, a fuse data register, and a fuse write register. To write data to a fuse, the trusted processor 106 may write the address of the corresponding fuse to the fuse address register and write the data to be written to the fuse to the fuse data register. The trusted processor 106 may then write to the fuse write register, causing the data in the fuse data register to be written to the fuse located at the address in the fuse address register. In other cases, the trusted processor 106 may write data directly to the address corresponding to the fuse, or may write to the fuse in any other suitable manner.

[0027] Figure 3A and Figure 3BExamples illustrate supplying keys to a memory device to bind SoC 102 to the memory device. In these examples, the key revocation fuses at key revocation positions 108 allow access when they are not programmed (e.g., not corrupted), and disallow access when they are programmed (e.g., by writing a "1"). Similarly, the key activation fuses at key activation positions 110 allow access when they are programmed (e.g., by writing a "1"). However, they disallow access when they are not programmed.

[0028] refer to Figure 3A Each of the first key revocation fuse 202, the second key revocation fuse 204, and the third key revocation fuse 206 at key revocation position 108 is unprogrammed (e.g., exemplified by the corresponding zero), thereby allowing access through their respective locations. Furthermore, as illustrated, the first key activation fuse 222 at key activation position 110 is programmed (e.g., exemplified by the figure), while the second key activation fuse 224 and the third key activation fuse 226 are unprogrammed (e.g., exemplified by the corresponding zero).

[0029] Thus, in this example, processor 116 can read the first key location 104A, but cannot read the second key location 104B, and cannot read the Nth key location 104C. Furthermore, processor 116 can perform operations to supply the first key 242 located in the first key location 104A to the first memory device 302. For example, processor 116 can generate supply data 301 (e.g., a supply command) characterizing the supply of the first key 242 to the first memory device 302, and can send the supply data 301 to the first memory device 302. For example, the supply data 301 may include the value of the first key 242 and the address of a memory location within an RPMB block of the first memory device 302. Upon receiving the supply data 301, the first memory device 302 may store the value of the first key 242 in an authentication key location (e.g., authentication key location 138 within RPMB 127), which cannot be rewritten. Thus, the first memory device 302 will only successfully service access to at least a portion of its memory locations authenticated using the first key 242. In some examples, the trusted processor 106 may generate supply data 301 and may send the supply data 301 to the first memory device 302 to supply the first key 242.

[0030] refer to Figure 3BThe first memory device 302 is replaced by the second memory device 352. The trusted processor 106 can read executable instructions from the data partition of the second memory device 352, and execute these instructions to update the key revocation position 108, the key activation position 110, and the key storage device 104 to allow the supply of the second key 244 to the second memory device 352. For example, based on the execution of the received instructions, the trusted processor 106 can generate a random number as the second key. Furthermore, the trusted processor 106 can execute instructions to write to the first key revocation fuse 202 at the key revocation position 108 to disable access to the first key location 104A storing the first key. The trusted processor 106 can also write the second key to the second key location 104B of the key storage device 104 based on the executed instructions. Additionally, the trusted processor 106 can execute instructions to write to the second key activation fuse 224 to activate the second key.

[0031] Thus, in this example, processor 116 can read the second key location 104B, but cannot read the first key location 104A, and still cannot read the Nth key location 104C. Processor 116 can execute instructions to supply the second key 244 to the second memory device 352. For example, processor 116 can generate supply data 351 (e.g., a supply command) characterizing the supply of the second key 244 to the second memory device 352, and can send the supply data 351 to the second memory device 352. For example, the supply data 351 may include the value of the second key 244 and the address of a memory location within the RPMB block of the second memory device 352. Upon receiving the supply data 351, the second memory device 352 can store the value of the second key 244 in an authentication key location that cannot be written to again. Thus, the second memory device 352 will only successfully service access to at least a portion of its memory locations authenticated using the second key 244.

[0032] Figure 4AAn example is illustrated of a memory programming device 402 electrically coupled to memory device 120 via a communication bus 404. Memory programming device 402 may be located in a service center such as service center 401 and may be any suitable device capable of programming memory device 120. For example, memory programming device 402 may include a FLASH programmer (e.g., a UFS device programmer) and a display showing a user interface for the FLASH programmer. Memory programming device 402 may store data such as executable instructions (e.g., which may be executed by one or more of trusted processors 106 and processor 116), configuration data, and any other suitable data. For example, memory programming device 402 may store a key update engine 410 and a provisioning engine 420 within one or more data partitions 140 of memory device 120.

[0033] The key update engine 410 can be executed by the trusted processor 106, and when executed, the trusted processor 106 can generate keys and write them to locations within the key revocation location 108, the key activation location 110, and the key storage device 104. For example, the key update engine 410 may include instructions characterizing the provision of trusted applications and trusted zone services. For example, the key update engine 410 may be provided by the original equipment manufacturer to service stations to allow them to initiate the provisioning process.

[0034] Furthermore, the key update engine 410 may include instructions that, when executed, cause the trusted processor 106 to activate a key, such as a first key 242. In some examples, another version of the key update engine 410 may include instructions that, when executed by the trusted processor 106, cause the trusted processor 106 to revoke the first key 242 and activate a second key 244, as described herein. In some examples, yet another version of the key update engine 410 may include instructions that, when executed, cause the trusted processor 106 to revoke the second key 244 and activate a third key 246, as described herein. The memory programming device 402 is operable to program any of these versions of the key update engine 410 into the memory device 120.

[0035] Furthermore, when executed by the trusted processor 106, the provisioning engine 420 can enable the trusted processor 106 to provision an active key (e.g., a first key 242) to the memory device 120. For example, the provisioning engine 420 may include instructions characterizing the service center application and providing the application programming interface (API).

[0036] For example, memory programming device 402 can program memory device 120 using versions of key update engine 410 and supply engine 420. The memory device 120 without a supplied key is then placed in integrated circuit package 100, and integrated circuit package 100 is powered on. Trusted processor 106 can obtain key update engine 410 from the corresponding data partition 140 of memory device 120 and can execute key update engine 410 to activate a key. For example, to activate a third key 246, trusted processor 106 can execute key update engine 410 to generate a third key 246, revoke a second key 244 by writing a second key revocation fuse 204 to key revocation position 108, write the third key 246 to the Nth key position 104C, and activate the third key 246 by writing a third key activation fuse 226 to key activation position 110.

[0037] Furthermore, the trusted processor 106 may obtain the provisioning engine 420 from the corresponding data partition 140 of the memory device 120 and may execute the provisioning engine 420 to provision an active key (e.g., a third key 246) to the memory device 120. For example, as described herein, the trusted processor 106 may generate provisioning data such as provisioning data 301, 351 and may send the provisioning data to the memory device 120 to provision an active key, which may be stored in the authentication key location 138 of the RPMB 127 of the memory device 120.

[0038] For example, Figure 4BVarious operations of the trusted processor 106 using key binding to the memory device 120 are illustrated. As illustrated, the trusted processor 106 (e.g., upon power-up) can obtain data 409 from the memory device 120. Data 409 may include data within any of the data partitions 140 of the memory device 120. For example, as illustrated, one or more data partitions 140 of the memory device 120 store one or more of a key update engine 410, a provisioning engine 420, a certificate 430, and a license 440. The trusted processor 106 may receive the key update engine 410 as part of the received data 409 and may execute the key update engine 410 to (e.g., within the trusted zone 109) establish a provisioning trusted application 450 and a provisioning trusted zone service 452. In some examples, the executed provisioning trusted application 450 may verify the certificate 430. If the certificate 430 is invalid, the executed provisioning trusted application 450 prevents further provisioning operations. Additionally or alternatively, the performed Supply Trust Zone Service 452 may perform operations to determine the validity of License 440 (e.g., License 440 is valid and still in effect). If the performed Supply Trust Zone Service 452 determines that License 440 is invalid, the performed Supply Trust Zone Service 452 prevents further supply operations.

[0039] Furthermore, the trusted processor 106 can execute the key update engine 410 to generate a random number 454. The trusted processor 106 can also update the key revocation setting 456 based on executed instructions. For example, the trusted processor 106 can write to the key revocation location 108 to revoke a key, such as the first key 242. Additionally, the trusted processor 106 can execute the key update engine 410 to fuse a random number into a new key 458. For example, the trusted processor 106 can write the generated random number to the second key location 104B within the key storage device 104 to generate a second key 244. The trusted processor 106 can also update the key activation setting 460 based on executed instructions. For example, the trusted processor 106 can write to the key activation location 110 to activate a new key, such as the second key 244.

[0040] Additionally, once the new key is activated, the trusted processor 106 can send a provisioning command 462 to the memory device 120 based on execution instructions (e.g., provisioning trusted application 450 and provisioning trusted zone service 452). For example, the trusted processor 106 can generate provisioning data 351 characterizing the provisioning of the new key to the memory device 120 and can send the provisioning data to the memory device 120. Based on the provisioning data, the memory device 120 can store the new key in an authentication key location (e.g., authentication key location 138 of RPMB 127), and the SoC 102 can be bound to the memory device 120 based on the new key.

[0041] In some examples, trusted processor 106 may execute instructions to write to a key storage location to restrict key access 464 to a new key. For example, trusted processor 106 may write to key lock location 112 to prevent untrusted reading of the corresponding key location in key storage device 104. Key lock location 112 may be a read access fuse that, when written, prevents read access to each key in the key set from outside the trusted area.

[0042] Figure 5 This is a flowchart of an exemplary process 500 for binding an on-chip system to a memory device according to some exemplary embodiments. For example, one or more die packages such as SoC 102 may perform one or more operations of the exemplary process 500. Reference Figure 5 At box 502, a first key value is generated. For example, SoC 102 may generate a random number and determine the first key value (e.g., first key 242) based on the random number. For example, the first key value may represent an RSA key value. At box 504, the first key value is written to a first key memory location. As an example, SoC 102 may write the first key value to a first key location 104A of key storage device 104. As described herein, the first key location 104A may include one or more fuses defining the first key value.

[0043] Proceeding to block 506, in order to activate the first key value, a key activation memory location is written. For example, SoC 102 may write the first key activation fuse 222 to key activation location 110 to activate the first key 242. At block 508, supply data is sent to supply the first key value to the first memory device. For example, SoC 102 may generate supply data 301 characterizing the supply of the first key 242 to the first memory device 302, and may send the supply data 301 to the first memory device 302.

[0044] In some cases, the first memory device may begin to fail. For example, the first memory device may fail to respond to read or write operations, may fail to successfully store data in response to write transactions, or may fail to provide accurate data in response to read transactions. In these cases, the first memory device can be replaced by a second memory device. The second memory device may store executable instructions, such as the key update engine 410 described herein.

[0045] In such cases, at box 510, a second key value is generated. For example, SoC 102 may generate a second random number and determine the second key value (e.g., second key 244) based on the second random number. Furthermore, at box 512, a key revocation memory location is written to in order to revoke the first key value. For example, SoC 102 may write a first key revocation fuse 202 to key revocation location 108 to revoke (e.g., disable) the first key 242 stored in first key location 104A.

[0046] Proceeding to block 514, the second key value is written to the second key memory location. As an example, SoC 102 may write the second key value to the second key location 104B of the key storage device 104. At block 516, to activate the second key value, a key activation memory location is written. For example, SoC 102 may write the second key activation fuse 224 to key activation location 110 to activate the second key 244. Furthermore, at block 518, second supply data is sent to supply the second key value to the second memory device. For example, SoC 102 may generate supply data 351 characterizing the supply of the second key 244 to the second memory device 352, and may send the supply data 351 to the second memory device 352.

[0047] Figure 6 This is a flowchart of an exemplary process 600 for binding a System-on-a-Chip (SoC) to a UFS device, according to some exemplary embodiments. For example, one or more die packages, such as SoC 102, may perform one or more operations of the exemplary process 600. Reference Figure 6 At box 602, data is received from the UFS device. The data may include executable instructions, certificates (e.g., certificate 430), and licenses (e.g., license 440). The executable instructions may characterize, for example, the provision of trusted applications, trusted zone services, and key update engine 410. If valid, the certificate may establish certification for third parties such as original equipment manufacturers (OEMs). Furthermore, the license may indicate whether the provision of the SoC is permitted.

[0048] At box 604, the certificate is authenticated based on the execution of a trusted application provisioning. For example, SoC 102 can execute a trusted application provisioning to determine the authenticity of the third party based on certificate 430. If SoC 102 fails to authenticate the third party, the key provisioning to the UFS device is not permitted, and the method ends. Otherwise, if SoC 102 successfully authenticates the third party, the method proceeds to box 606. At box 606, the license is verified based on the execution of a trusted zone service provisioning. For example, SoC 102 can execute a trusted application provisioning to determine if license 440 is valid. If the license is invalid, the key provisioning to the UFS device is not permitted, and the method ends. Otherwise, if the license is valid, the method proceeds to box 608.

[0049] At box 608, a random number is generated. For example, SoC 102 may execute a random number generator to generate a random number. Furthermore, at box 610, a write-off fuse is used to revoke (e.g., disable) a first key stored in a first key fuse. For example, SoC 102 may write to the first key revocation fuse 202 at key revocation location 108 to revoke the first key 242 stored in the first key location 104A. Proceeding to box 612, a random number is written to a second key fuse to provide a second key. For example, SoC 102 may write a random number to the second key location 104B to establish a second key 244.

[0050] At box 614, an activation fuse is written to enable the second key fuse. For example, SoC 102 can write the second key activation fuse 224 to key activation location 110 to activate the second key 244. Additionally, at box 616, provisioning data is sent to the UFS device to provision the second key to the UFS device. The SoC and UFS device are now bound based on the second key.

[0051] Specific implementation examples are further described in the following numbered clauses.

[0052] 1. A die package, the die package comprising: First memory device; and A processor, electrically coupled to the first memory device, is configured to execute instructions to: Write to the key revocation location of the first memory device, and write to the key revocation location revokes the first key stored in the first key location of the first memory device; Write the second key into the second key location of the first memory device; Write to the key activation location of the first memory device, and the writing to the key activation location activates the second key; Generate supply data characterizing the second key; and The supply data is sent to a second memory device, which then stores the second key.

[0053] 2. The die package according to Clause 1, wherein the processor is configured to execute the instructions to: Write the first key to the first key location of the first memory device; and The key is written to the key activation location of the first memory device, and the writing to the key activation location activates the first key.

[0054] 3. The die package according to Clause 2, wherein the processor is configured to execute the instructions to send additional supply data to a third memory device, the additional supply data causing the third memory device to store the first key.

[0055] 4. A die package according to any one of clauses 1 to 3, wherein the processor is configured to execute the instructions to randomly generate the second key.

[0056] 5. A die package according to any one of clauses 1 to 4, wherein the processor is configured to execute the instructions to write to a key lock location of the first memory device, the writing to the key lock location disabling read access to the second key location.

[0057] 6. The die package according to any one of Clauses 1 to 5, wherein the second memory device is a general-purpose flash memory device.

[0058] 7. The die package according to any one of clauses 1 to 6, wherein the supply data causes the second memory device to store the second key within a replay protected memory block.

[0059] 8. A die package according to any one of clauses 1 to 7, wherein the processor is configured to receive at least a portion of the instructions from the second memory device.

[0060] 9. A die package according to any one of clauses 1 to 8, wherein the processor is configured to execute the instructions to: Receive a certificate from the second memory device; Authenticating a third party based on the certificate; and In response to the authentication, the key revocation location is written to the first memory device.

[0061] 10. A die package according to any one of clauses 1 to 9, wherein the processor is configured to execute the instructions to: Receive the license from the second memory device; Determine that the license is valid; and In response to the determination, the key revocation location is written to the first memory device.

[0062] 11. A bare die package according to any one of clauses 1 to 10, the bare die package comprising a system-on-a-chip, wherein the processor and the first memory device are disposed within a trusted region of the system-on-a-chip.

[0063] 12. A die package, the die package comprising: Multiple key activation fuses, each of which is configured to activate a corresponding key among the multiple keys; Multiple key revocation fuses, each of which is configured to revoke a corresponding key among the multiple keys; A key fuse associated with each of the plurality of keys, each key fuse being configured to store a corresponding key from the plurality of keys; and A processor electrically coupled to the plurality of key activation fuses, the plurality of key deactivation fuses, and the key fuse associated with each of the plurality of keys, the processor being configured to: Generate the first key value; Write the first key value to the key fuse associated with the first key among the plurality of keys; A first key activation fuse is written into the plurality of key activation fuses to activate the first key among the plurality of keys; A first key revocation fuse is written into the plurality of key revocation fuses to revoke the first key among the plurality of keys; Generate a second key value; and The second key value is written to the key fuse associated with the second key among the plurality of keys.

[0064] 13. The die package according to Clause 12, wherein the processor is configured to write to a second key activation fuse among the plurality of key activation fuses to activate the second key among the plurality of keys.

[0065] 14. The die package according to any one of clauses 12 to 13, wherein the processor is configured to: Generate a third key value; A second key revocation fuse is written into the plurality of key revocation fuses to revoke the second key among the plurality of keys; Write the third key value to the key fuse associated with the third key among the plurality of keys; and A third key activation fuse is written into the plurality of key activation fuses to activate the third key among the plurality of keys.

[0066] 15. A die package according to any one of clauses 12 to 14, wherein the processor is configured to: Generate supply data characterizing the second key among the plurality of keys; and The supply data is sent to a memory device, which causes the memory device to store the second key, one of the plurality of keys, in a replay protected memory block.

[0067] 16. The die package as described in Clause 15, wherein the memory device is a general-purpose flash memory device.

[0068] 17. A bare die package according to any one of Clauses 12 to 16, the bare die package comprising a system-on-a-chip, wherein the plurality of key activation fuses, the plurality of key deactivation fuses, the key fuses associated with each of the plurality of keys, and the processor are disposed within a trusted region of the system-on-a-chip.

[0069] 18. A die package according to any one of clauses 12 to 17, wherein the processor is configured to randomly generate the first key value.

[0070] 19. A method executed by at least one processor, the method comprising: Write to the key revocation position of the first memory device, and write to the key revocation position to revoke the first key; Write the second key into the second key location of the first memory device; Write to the key activation location of the first memory device, and the writing to the key activation location activates the second key; Generate supply data characterizing the second key; and The supply data is sent to a second memory device, which then stores the second key.

[0071] 20. The method described pursuant to Clause 19 further comprises: Write the first key to the first key location of the first memory device; and The key is written to the key activation location of the first memory device, and the writing to the key activation location activates the first key.

[0072] 21. The method according to Clause 20 further includes sending additional supply data to a third memory device, the additional supply data causing the third memory device to store the first key.

[0073] 22. The method according to any one of clauses 19 to 21 further includes randomly generating the second key.

[0074] 23. The method according to any one of clauses 19 to 22 further includes writing to a key lock location of the first memory device, the writing to the key lock location disabling read access to the second key location.

[0075] 24. The method according to any one of Clauses 19 to 23, wherein the second memory device is a general-purpose flash memory device.

[0076] 25. The method according to any one of Clauses 19 to 24, wherein the supply data causes the second memory device to store the second key in a replay protected memory block.

[0077] 26. The method according to any one of clauses 19 to 25 further includes receiving at least a portion of the instructions from the second memory device.

[0078] 27. The method according to any one of clauses 19 to 26 further comprises: Receive a certificate from the second memory device; Authenticating a third party based on the certificate; and In response to the authentication, the key revocation location is written to the first memory device.

[0079] 28. The method according to any one of clauses 19 to 27 further comprises: Receive the license from the second memory device; Determine that the license is valid; and In response to the determination, the key revocation location is written to the first memory device.

[0080] 29. The method according to any one of Clauses 19 to 28, wherein the processor and the first memory device are disposed within a trusted region of the system on chip.

[0081] 30. A non-transitory machine-readable storage medium comprising instructions that, when executed by at least one processor, cause the at least one processor to: Write to the key revocation position of the first memory device, and write to the key revocation position to revoke the first key; Write the second key into the second key location of the first memory device; Write to the key activation location of the first memory device, and the writing to the key activation location activates the second key; Generate supply data characterizing the second key; and The supply data is sent to a second memory device, which then stores the second key.

[0082] 31. The non-transitory machine-readable storage medium according to Clause 30, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: Write the first key to the first key location of the first memory device; and The key is written to the key activation location of the first memory device, and the writing to the key activation location activates the first key.

[0083] 32. The non-transitory machine-readable storage medium according to Clause 31, wherein the instructions, when executed by the at least one processor, cause the at least one processor to send additional supply data to a third memory device, the additional supply data causing the third memory device to store the first key.

[0084] 33. A non-transitory machine-readable storage medium according to any one of clauses 31 to 32, wherein the instructions, when executed by the at least one processor, cause the at least one processor to randomly generate the second key.

[0085] 34. A non-transitory machine-readable storage medium according to any one of clauses 31 to 33, wherein the instructions, when executed by the at least one processor, cause the at least one processor to write to a key lock location of the first memory device, the writing to the key lock location disabling read access to the second key location.

[0086] 35. The non-transitory machine-readable storage medium according to any one of clauses 31 to 34, wherein the second memory device is a general-purpose flash memory device.

[0087] 36. A non-transitory machine-readable storage medium according to any one of clauses 31 to 35, wherein the supply data causes the second memory device to store the second key within a replay-protected memory block.

[0088] 37. A non-transitory machine-readable storage medium according to any one of clauses 31 to 36, wherein the instructions, when executed by the at least one processor, cause the at least one processor to receive at least a portion of the instructions from the second memory device.

[0089] 38. A non-transitory machine-readable storage medium according to any one of clauses 31 to 37, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: Receive a certificate from the second memory device; Authenticating a third party based on the certificate; and In response to the authentication, the key revocation location is written to the first memory device.

[0090] 39. A non-transitory machine-readable storage medium according to any one of clauses 31 to 38, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: Receive the license from the second memory device; Determine that the license is valid; and In response to the determination, the key revocation location is written to the first memory device.

[0091] 40. The non-transitory machine-readable storage medium according to any one of clauses 31 to 39, wherein the processor and the first memory device are disposed within a trusted region of the system on chip.

[0092] 41. A method executed by at least one processor, the method comprising: Generate the first key value; Write the first key value to the first key fuse associated with the first key among a plurality of keys; A first key activation fuse is written into a plurality of key activation fuses to activate the first key among the plurality of keys; A first key revocation fuse is written into a plurality of key revocation fuses to revoke the first key among the plurality of keys; Generate a second key value; and The second key value is written to the second key fuse associated with the second key among the plurality of keys.

[0093] 42. The method according to Clause 41 further includes a second key activation fuse written into the plurality of key activation fuses to activate the second key among the plurality of keys.

[0094] 43. The method according to any one of clauses 41 to 42 further comprises: Generate a third key value; A second key revocation fuse is written into the plurality of key revocation fuses to revoke the second key among the plurality of keys; Write the third key value to the third key fuse associated with the third key among the plurality of keys; and A third key activation fuse is written into the plurality of key activation fuses to activate the third key among the plurality of keys.

[0095] 44. The method according to any one of clauses 41 to 43 further comprises: Generate supply data characterizing the second key among the plurality of keys; and The supply data is sent to a memory device, which causes the memory device to store the second key, one of the plurality of keys, in a replay protected memory block.

[0096] 45. The method according to Clause 44, wherein the memory device is a general-purpose flash memory device.

[0097] 46. ​​The method according to any one of clauses 41 to 45, the method comprising a system-on-a-chip, wherein the plurality of key activation fuses, the plurality of key deactivation fuses, the key fuses associated with each of the plurality of keys, and the processor are disposed within a trusted region of the system-on-a-chip.

[0098] 47. The method according to any one of clauses 41 to 46 further includes randomly generating the first key value.

[0099] 48. A non-transitory machine-readable storage medium comprising instructions that, when executed by at least one processor, cause the at least one processor to: Generate the first key value; Write the first key value to the first key fuse associated with the first key among a plurality of keys; A first key activation fuse is written into a plurality of key activation fuses to activate the first key among the plurality of keys; A first key revocation fuse is written into a plurality of key revocation fuses to revoke the first key among the plurality of keys; Generate a second key value; and The second key value is written to the second key fuse associated with the second key among the plurality of keys.

[0100] 49. A non-transitory machine-readable storage medium according to any one of Clauses 48, wherein the instructions, when executed by the at least one processor, cause the at least one processor to write to a second key activation fuse among the plurality of key activation fuses to activate the second key among the plurality of keys.

[0101] 50. A non-transitory machine-readable storage medium according to any one of clauses 48 to 49, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: Generate a third key value; A second key revocation fuse is written into the plurality of key revocation fuses to revoke the second key among the plurality of keys; Write the third key value to the third key fuse associated with the third key among the plurality of keys; and A third key activation fuse is written into the plurality of key activation fuses to activate the third key among the plurality of keys.

[0102] 51. A non-transitory machine-readable storage medium according to any one of clauses 48 to 50, wherein the instructions, when executed by the at least one processor, cause the at least one processor to: Generate supply data characterizing the second key among the plurality of keys; and The supply data is sent to a memory device, which causes the memory device to store the second key, one of the plurality of keys, in a replay protected memory block.

[0103] 52. The non-transitory machine-readable storage medium as described in Clause 51, wherein the memory device is a general-purpose flash memory storage device.

[0104] 53. A nontransitory machine-readable storage medium according to any one of clauses 48-52, the nontransitory machine-readable storage medium comprising a system-on-a-chip, wherein the plurality of key activation fuses, the plurality of key deactivation fuses, the key fuses associated with each of the plurality of keys, and the processor are disposed within a trusted region of the system-on-a-chip.

[0105] 54. A non-transitory machine-readable storage medium according to any one of clauses 48 to 53, wherein the instructions, when executed by the at least one processor, cause the at least one processor to randomly generate the first key value.

[0106] Although the method described above refers to the illustrated flowchart, many other ways can be used to perform the actions associated with this method. For example, the order of some operations can be changed, and some implementations can omit one or more of the described operations and / or include additional operations.

[0107] Furthermore, the methods and systems described herein can be embodied, at least in part, in the form of computer-implemented processes and apparatus for performing those processes. The disclosed methods can also be embodied, at least in part, in the form of a tangible, non-transitory machine-readable storage medium encoded with computer program code, which, when executed, causes a machine to manufacture at least one integrated circuit performing one or more of the operations described herein. For example, the method can be embodied in hardware, executable instructions (e.g., software) executed by a processor, or a combination of both. The medium may include, for example, RAM, ROM, CD-ROM, DVD-ROM, BD-ROM, hard disk drive, flash memory, or any other non-transitory machine-readable storage medium. When the computer program code is loaded into and executed by a computer, the computer becomes an apparatus for causing a machine to manufacture an integrated circuit. The method can also be embodied, at least in part, in the form of a computer, with the computer program code loaded into or executed in the computer, making the computer a dedicated computer for causing a machine to manufacture an integrated circuit. For example, when implemented on a general-purpose processor, computer program code segments configure the processor to create specific logic circuits. The method can also alternatively be embodied, at least in part, in an application-specific integrated circuit (ASIC) or any other integrated circuit for performing the method.

[0108] Furthermore, terms such as "circuit" and "logic" may individually or in combination include analog circuits, digital circuits, hardwired circuits, programmable circuits, processing circuits, hardware logic circuits, state machine circuits, and any other suitable type of physical hardware component. Additionally, the embodiments described herein can be employed in a wide variety of devices, such as networking devices, telecommunications devices, smartphones, gaming devices, enterprise devices, storage devices (e.g., cloud storage devices), automotive systems (e.g., collision avoidance systems, object detection systems, navigation systems, etc.), and computing devices (e.g., cloud computing devices), as well as other types of devices.

[0109] The subject matter has been described with reference to exemplary embodiments. Because these are merely examples, the claimed invention is not limited to these embodiments. Changes and modifications may be made without departing from the spirit of the claimed subject matter. The claims are intended to cover such changes and modifications.

Claims

1. A die package comprising: a first memory device; and a processor electrically coupled to the first memory device, the processor configured to execute instructions to: write to a key revocation location of the first memory device, the write to the key revocation location revoking a first key stored in a first key location of the first memory device; write a second key to a second key location of the first memory device; write to a key activation location of the first memory device, the write to the key activation location activating the second key; generate provisioning data characterizing the second key; and send the provisioning data to a second memory device, the provisioning data causing the second memory device to store the second key.

2. The die package of claim 1, wherein the processor is configured to execute the instructions to: write the first key to the first key location of the first memory device; and write to the key activation location of the first memory device, the write to the key activation location activating the first key.

3. The die package of claim 2, wherein the processor is configured to execute the instructions to send additional provisioning data to a third memory device, the additional provisioning data causing the third memory device to store the first key.

4. The die package of claim 1, wherein the processor is configured to execute the instructions to randomly generate the second key.

5. The die package of claim 1, wherein the processor is configured to execute the instructions to write to a key lock location of the first memory device, the write to the key lock location disabling read access to the second key location.

6. The die package of claim 1, wherein the second memory device is a general purpose flash memory device.

7. The die package of claim 1, wherein the provisioning data causes the second memory device to store the second key within a replay-protected memory block.

8. The die package of claim 1, wherein the processor is configured to receive at least a portion of the instructions from the second memory device.

9. The die package of claim 1, wherein the processor is configured to execute the instructions to: receive a certificate from the second memory device; authenticate a third party based on the certificate; and in response to the authentication, write to the key revocation location of the first memory device.

10. The die package of claim 1, wherein the processor is configured to execute the instructions to: receive a license from the second memory device; determine that the license is valid; and in response to the determination, write to the key revocation location of the first memory device.

11. The die package of claim 1, the die package comprising a system-on-a-chip, wherein the processor and the first memory device are disposed within a trusted region of the system-on-a-chip. ​ ​ 12. A die package comprising: a plurality of key activation fuses, each key activation fuse of the plurality of key activation fuses configured to activate a corresponding one of a plurality of keys; a plurality of key revocation fuses, each key revocation fuse of the plurality of key revocation fuses configured to revoke a corresponding one of the plurality of keys; a key fuse associated with each key of the plurality of keys, each key fuse configured to store a corresponding one of the plurality of keys; and a processor electrically coupled to the plurality of key activation fuses, the plurality of key revocation fuses, and the key fuse associated with each key of the plurality of keys, the processor configured to: generate a first key value; write the first key value to the key fuse associated with a first key of the plurality of keys; write to a first key activation fuse of the plurality of key activation fuses to activate the first key of the plurality of keys; write to a first key revocation fuse of the plurality of key revocation fuses to revoke the first key of the plurality of keys; generate a second key value; and write the second key value to the key fuse associated with a second key of the plurality of keys.

13. The die package of claim 12, wherein the processor is configured to write to a second key activation fuse of the plurality of key activation fuses to activate the second key of the plurality of keys.

14. The die package of claim 12, wherein the processor is configured to: generate a third key value; write to a second key revocation fuse of the plurality of key revocation fuses to revoke the second key of the plurality of keys; write the third key value to the key fuse associated with a third key of the plurality of keys; and write to a third key activation fuse of the plurality of key activation fuses to activate the third key of the plurality of keys.

15. The die package of claim 12, wherein the processor is configured to: generate provisioning data characterizing the second key of the plurality of keys; and send the provisioning data to a memory device, the provisioning data causing the memory device to store the second key of the plurality of keys within a replay-protected memory block.

16. The die package of claim 15, wherein the memory device is a universal flash storage device.

17. The die package of claim 12, comprising a system-on-a-chip, wherein the plurality of key activation fuses, the plurality of key revocation fuses, the key fuse associated with each key of the plurality of keys, and the processor are disposed within a trusted region of the system-on-a-chip.

18. The die package of claim 12, wherein the processor is configured to randomly generate the first key value.

19. A method performed by at least one processor, the method comprising: ​ ​ writing a key revocation location to the first memory device, the writing to the key revocation location revoking a first key; writing a second key to a second key location of the first memory device; writing a key activation location to the first memory device, the writing to the key activation location activating the second key; generating provisioning data characterizing the second key; and sending the provisioning data to a second memory device, the provisioning data causing the second memory device to store the second key.

20. A non-transitory machine-readable storage medium comprising instructions that, when executed by at least one processor, cause the at least one processor to: write a key revocation location to the first memory device, the writing to the key revocation location revoking a first key; write a second key to a second key location of the first memory device; write a key activation location to the first memory device, the writing to the key activation location activating the second key; generate provisioning data characterizing the second key; and send the provisioning data to a second memory device, the provisioning data causing the second memory device to store the second key.

Images