Protecting cryptographic keys stored in non-volatile memory

Abstract

Systems and methods for protecting cryptographic keys stored in non-volatile memory. Example methods may include: storing a device root key in non-volatile memory; storing a volatile key in volatile memory; storing a masked cryptographic key in non-volatile memory, wherein the masked cryptographic key is generated by combining the cryptographic key and the device root key; storing the masked device root key in non-volatile memory, wherein the masked root key is generated by combining the device root key and the volatile key; and erasing the device root key from the non-volatile memory.

Description

Technical Field

[0001] The present disclosure relates generally to computer systems and, more particularly, to cryptographic data processing systems and methods. Background Art

[0002] Since the advent of computers, there have been evolving systems and methods for not only protecting cryptographic keys and / or other sensitive data, but also systems and methods for gaining unauthorized access to protected data, ranging from conceptually unsophisticated brute force password cracking to sophisticated external surveillance attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] The present disclosure is illustrated by way of example and not limitation and may be more fully understood by reference to the following detailed description when considered in conjunction with the accompanying drawings, in which:

[0004] Figure 1 schematically illustrates an initialization sequence of an example cryptographic data processing device implementing the disclosed method for protecting cryptographic keys utilized to perform cryptographic data processing operations;

[0005] Figure 2 schematically illustrates a key retrieval sequence of an example cryptographic data processing device;

[0006] Figure 3 schematically illustrates another example of a device initialization and key retrieval sequence of a cryptographic data processing device 100 implementing the disclosed method for protecting a cryptographic key utilized to perform a cryptographic data processing operation;

[0007] Figure 4 A flowchart depicting an example method for protecting a cryptographic key utilized to perform a cryptographic data processing operation in accordance with one or more aspects of the present disclosure;

[0008] Figure 5 A flowchart depicting another example method for protecting a cryptographic key utilized to perform a cryptographic data processing operation in accordance with one or more aspects of the present disclosure; and

[0009] Figure 6 A pictorial representation of an example computing system is illustrated within which a set of instructions for causing a computing device to perform the methods described herein may be executed. DETAILED DESCRIPTION

[0010] Systems and methods for protecting cryptographic keys utilized to perform cryptographic data processing operations are described herein.

[0011] "Cryptographic data processing operation" shall refer herein to a data processing operation involving secret parameters (e.g., an encryption / decryption operation using a cryptographic key). "Cryptographic data processing device" shall refer herein to a data processing device (e.g., a general-purpose or special-purpose processor, a system on a chip, a cryptographic hardware accelerator, etc.) configured or employed to perform cryptographic data processing operations.

[0012] A cryptographic data processing device may securely manage one or more cryptographic keys that may be utilized to perform cryptographic data processing operations. Upon detection of a tampering attempt with respect to the cryptographic data processing device, certain cryptographic applications and standards require that the cryptographic keys be securely destroyed (e.g., overwritten with a specified data pattern such as all zeros). However, if one or more cryptographic keys are stored in a non-volatile memory such as flash memory or one-time programmable (OTP) memory, it cannot be assumed that the cryptographic data processing device has sufficient time or power to securely destroy the cryptographic keys.

[0013] This problem can be solved by storing cryptographic keys or key segments (i.e., one or more values ​​of a cryptographic key can be derived from) in a volatile memory such as a static random access memory (SRAM). The volatile memory can be powered by a dedicated power source such as a battery. Erasing the volatile key or key segment will only require interrupting the power supply to the volatile memory in response to detecting a tampering attempt. All other cryptographic keys used by the cryptographic data processing device can be derived from the volatile key or volatile key segment.

[0014] However, this approach would not be suitable if one or more cryptographic keys need to be programmed into the cryptographic data processing device in the absence of a constant power supply necessary to maintain the volatile keys. In an illustrative example, a device root key (DRK) may be programmed into the cryptographic data processing device as part of a manufacturing workflow before a battery is connected to the volatile memory.

[0015] The systems and methods of the present disclosure address the above-mentioned and other deficiencies by providing a method of protecting cryptographic keys, which method involves storing a device root key in a masked form, such that the masking operation involves combining the device root key with a volatile key, which can be stored in a volatile memory and can therefore be securely destroyed by interrupting power to the volatile memory.

[0016] The device root key may be self-generated by the device or loaded from an external source. All other cryptographic keys utilized by the device may be derived from the device root key and may be stored in non-volatile memory in a masked form such that the masking operation involves combining the cryptographic key with the device root key (e.g., by a bitwise exclusive OR operation, also referred to as "exclusive OR" or "XOR").

[0017] The result of a single-bit XOR is true (binary 1) if and only if one of the two operands is true; otherwise, the result is false (binary 0). Therefore, the result of applying the XOR operation to two equal operands is always false. Applying the XOR operation to any operand and binary 0 produces a result equal to that operand. Therefore, the cryptographic key K can be masked by the device root key using the XOR operation: K * =K⊕DRK; To remove the mask, perform an XOR operation on the masked key and the device root key:

[0018]

[0019] Therefore, the cryptographic key (K) stored in the volatile memory in masked form is * =K⊕DRK) can be unmasked using the device root key (K=K * ⊕DRK).

[0020] Since the device root key will be required to recover any cryptographic key, securely destroying the device root key will effectively destroy the cryptographic key if a tampering event is detected. To achieve secure device root key erasure, the device root key may be stored in non-volatile memory in a masked form such that the masking operation involves combining the device root key with a volatile key (e.g., via a bitwise XOR operation):

[0021] DRK * =DRK⊕VK,

[0022] DRK * is the masked device root key, and VK is the volatile key (or a volatile key segment, which is the value utilized to derive the volatile key).

[0023] The volatile key may be self-generated by the device or loaded from an external source, and may be stored in the volatile memory before the device begins operation, at which time it is assumed that the volatile memory has a constant power supply.

[0024] After storing the masked device root key, the original device root key is erased from the non-volatile memory. Recovering the cryptographic key derived from the device root key will therefore require using the volatile key to recover the device root key from the masked form through a demasking operation: DRK = DRK * ⊕VK. Therefore, erasing the volatile key from the volatile memory will effectively erase all cryptographic keys in the system. As noted above, erasing the volatile key from the volatile memory will only require interrupting the power supplied to the volatile memory.

[0025] Thus, the systems and methods described herein represent an improvement in the functionality of general purpose or special purpose computing devices by enabling secure processing of cryptographic keys by such devices.

[0026] The systems and methods described herein may be implemented by hardware (e.g., general and / or special purpose processing devices and / or other devices and associated circuits), software (e.g., instructions executable by a processing device), or a combination thereof. Various aspects of the methods and systems are described herein by way of example and not limitation.

[0027] Figure 1 Schematically illustrates an initialization sequence of an example cryptographic data processing device 100 implementing the disclosed method for protecting cryptographic keys utilized to perform cryptographic data processing operations. Figure 1 As shown in , the example device 100 may include non-volatile memory (e.g., flash memory) 110 and volatile memory 120 (e.g., SRAM). As part of the device manufacturing workflow, a device root key (DRK) 130 from which all other cryptographic keys will subsequently be derived may be stored in the non-volatile memory 110. Alternatively, the device root key may be stored in the non-volatile memory 110 as part of a device initialization sequence, which may involve generating the device root key or receiving the device root key from an external source.

[0028] The device initialization sequence may also involve generating one or more cryptographic keys or receiving one or more cryptographic keys from an external source that may be utilized by the device 100 to perform various cryptographic data processing operations. The cryptographic keys may be stored in the non-volatile memory 110 in a masked form 140 such that the masking operation involves combining the cryptographic keys with the device root key 130 (e.g., via a bitwise XOR operation).

[0029] The device initialization sequence may also involve generating the volatile key 150 (or one or more volatile key segments from which the volatile key may then be derived) or receiving the volatile key 150 (or one or more volatile key segments) from an external source. The volatile key 140 may be stored in the volatile memory 120 .

[0030] The device initialization sequence may also involve combining the volatile key 150 and the device root key 130 by a mask function 160, thereby generating a masked device root key 170. In an illustrative example, the mask function 160 may generate the masked device root key DRK by applying a bitwise XOR operation to its inputs. * :DRK *=DRK⊕VK. Alternatively, other masking functions may be used. After storing the masked device root key 170 in the non-volatile memory 110 , the original device root key 130 may be erased from the non-volatile memory 110 .

[0031] Therefore, recovering the cryptographic key derived from the device root key 130 will involve: using the volatile key 150 to recover the device root key 130 from the masked form 170 through an unmasking operation: DRK = DRK * ⊕VK, and then recover the cryptographic key from the masked form 140 using the recovered device root key 130 by applying a demasking operation: K=(K⊕DRK)⊕DRK. Thus, erasing the volatile key from the volatile memory will effectively erase all cryptographic keys in the system. In various illustrative examples, erasing the volatile key from the volatile memory 120 can be performed by interrupting power 180 to the volatile memory 120 or applying a reset signal 190 to the volatile memory 120.

[0032] In operation, one or more cryptographic keys stored in masked form 140 may be unmasked before being utilized to perform various cryptographic data processing operations. Figure 2 Schematically illustrates a key retrieval sequence of an example cryptographic data processing device 100. Figure 2 As shown in , the device root key 130 may be recovered from the masked form 170 of the device root key 130 by applying a masking function 160 to the volatile key 150 and the masked form 170 of the device root key: DRK=DRK * ⊕VK. The cryptographic key 210 can then be recovered from the masked form 140 of the cryptographic key 210 by applying the mask function 220 to the device root key 130 and the masked form 140 of the cryptographic key: K = (K ⊕ DRK) ⊕ DRK. In the illustrative example, the mask functions 160 and 220 can apply a bitwise XOR operation to their respective inputs. Alternatively, other mask functions can be used. As noted above, the unmasked cryptographic key 210 can be utilized to perform various cryptographic data processing operations.

[0033] Figure 3 Another example of a device initialization and key retrieval sequence of a cryptographic data processing device 300 implementing the method of the present disclosure for protecting a cryptographic key utilized to perform cryptographic data processing operations is schematically illustrated. Figure 3As shown in , as part of the device manufacturing workflow, a device root key (DRK) 130 from which all other cryptographic keys will subsequently be derived can be stored in non-volatile memory 110. Alternatively, the device root key can be stored in non-volatile memory 110 as part of a device initialization sequence, which may involve generating the device root key or receiving the device root key from an external source.

[0034] The device initialization sequence may also involve generating one or more cryptographic keys or receiving one or more cryptographic keys from an external source that may be utilized by the device 300 to perform various cryptographic data processing operations. The cryptographic keys may be stored in a masked form 140 in the non-volatile memory 110 such that the masking operation involves combining the cryptographic keys with the device root key 130 (e.g., via a bitwise XOR operation). The device initialization sequence may also involve copying the device root key to the volatile memory 120. After the device root key 130 is stored in the volatile memory 120, the original device root key 130 may be erased from the non-volatile memory 110.

[0035] Thus, using the device root key 130 by the demasking function 310, the cryptographic key derived from the device root key 130 can be recovered from the masked form 140 of the cryptographic key: K = (K⊕DRK)⊕DRK. In the illustrative example, the masking function 310 can apply a bitwise XOR operation to its respective input. Alternatively, other masking functions can be used. As noted above, the demasked cryptographic key 320 can be utilized to perform various cryptographic data processing operations.

[0036] Thus, erasing the device root key from the volatile memory will effectively erase all cryptographic keys in the system. In various illustrative examples, erasing the device root key from the volatile memory 120 may be performed by interrupting power 180 to the volatile memory 120 or applying a reset signal 190 to the volatile memory 120 .

[0037] Figure 4A flowchart of an example method 400 for protecting a cryptographic key utilized to perform cryptographic data processing operations in accordance with one or more aspects of the present disclosure is depicted. The method 400 and / or each of its individual functions, routines, subroutines, or operations may be performed by one or more general-purpose and / or special-purpose processing devices. Two or more functions, routines, subroutines, or operations of the method 400 may be performed in parallel or in an order that may be different from that described above. In certain implementations, the method 400 may be performed by a single processing thread. Alternatively, the method 400 may be performed by two or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing the method 400 may be synchronized (e.g., using semaphores, critical sections, and / or other thread synchronization mechanisms). Alternatively, the processing threads implementing the method 400 may be executed asynchronously relative to each other. In an illustrative example, the method 400 may be executed by a processor as described below with reference to FIG. Figure 6 The described computing system 1000 is implemented.

[0038] Reference Figure 4 At block 410, a cryptographic data processing device implementing the method may receive or generate a device root key from an external source, which may be provided by a bit sequence of arbitrary length. In an illustrative example, the device root key may be programmed into the cryptographic data processing device as part of a manufacturing workflow. Alternatively, the device root key may be generated by the cryptographic data processing device as part of a device initialization sequence, as described in more detail above.

[0039] At block 415, the cryptographic data processing device may store the device root key in a non-volatile memory. In an illustrative example, the non-volatile memory may be provided by flash memory, as described in more detail above.

[0040] At block 420 , the cryptographic data processing device may receive or generate a volatile key from an external source, which may be provided by a bit sequence of arbitrary length.

[0041] At block 425, the cryptographic data processing device may store the volatile key in a volatile memory. In an illustrative example, the volatile memory may be provided by SRAM, as described in more detail above.

[0042] At block 430 , the cryptographic data processing device may receive or generate a cryptographic key from an external source, which may be provided by a bit sequence of arbitrary length, to be utilized to perform various cryptographic data processing operations.

[0043] At block 435, the cryptographic data processing device may generate a masked cryptographic key by combining the cryptographic key and the device root key. In an illustrative example, the masking operation may involve applying an XOR operation to the cryptographic key and the device root key: K * =K⊕DRK, as described in more detail above.

[0044] At block 440 , the cryptographic data processing device may store the masked cryptographic key in a non-volatile memory.

[0045] At block 445, the cryptographic data processing device may generate a masked device root key by combining the device root key and the volatile key. In an illustrative example, the masking operation may involve applying an XOR operation to the device root key and the volatile key: DRK * =DRK⊕VK, as described in more detail above.

[0046] At block 450 , the cryptographic data processing device may store the masked device root key in a non-volatile memory.

[0047] At block 455 , the cryptographic data processing device may erase the device root key from the non-volatile memory.

[0048] In response to detecting a tampering event at block 460 , the cryptographic data processing device may erase the volatile key from the volatile memory at block 465 , and the method may terminate, for example, by throwing an exception at block 470 .

[0049] Otherwise, at block 475, the cryptographic data processing device may, in response to receiving the request to perform a cryptographic data processing operation, recover the device root key by combining the masked device root key and the volatile key. In an illustrative example, the demasking operation may involve applying an XOR operation to the masked device root key and the volatile key: DRK = DRK * ⊕VK, as described in more detail above.

[0050] At block 480, the cryptographic data processing device may recover the cryptographic key by combining the masked cryptographic key and the recovered device root key. In an illustrative example, the demasking operation may involve applying an XOR operation to the masked cryptographic key and the recovered device root key: K = K * ⊕DRK, as described in more detail above.

[0051] At block 485 , the cryptographic data processing device may utilize the cryptographic key to perform a cryptographic data processing operation, and the method may terminate at block 490 .

[0052] Figure 5A flowchart of an example method 500 for protecting a cryptographic key utilized to perform cryptographic data processing operations in accordance with one or more aspects of the present disclosure is depicted. The method 500 and / or each of its individual functions, routines, subroutines, or operations may be performed by one or more general-purpose and / or special-purpose processing devices. Two or more functions, routines, subroutines, or operations of the method 500 may be performed in parallel or in an order that may be different from that described above. In certain implementations, the method 500 may be performed by a single processing thread. Alternatively, the method 500 may be performed by two or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing the method 500 may be synchronized (e.g., using semaphores, critical sections, and / or other thread synchronization mechanisms). Alternatively, the processing threads implementing the method 500 may be executed asynchronously relative to each other. In an illustrative example, the method 500 may be executed by a processor as described below with reference to the accompanying drawings. Figure 6 The described computing system 1000 is implemented.

[0053] Reference Figure 5 At block 510, a cryptographic data processing device implementing the method may receive or generate a device root key from an external source, which may be provided by a bit sequence of arbitrary length. In an illustrative example, the device root key may be programmed into the cryptographic data processing device as part of a manufacturing workflow. Alternatively, the device root key may be generated by the cryptographic data processing device as part of a device initialization sequence, as described in more detail above.

[0054] At block 515, the cryptographic data processing device may store the device root key in a non-volatile memory. In an illustrative example, the non-volatile memory may be provided by flash memory, as described in more detail above.

[0055] At block 520 , the cryptographic data processing device may receive or generate a cryptographic key from an external source, which may be provided by a bit sequence of arbitrary length, to be utilized to perform various cryptographic data processing operations.

[0056] At block 525, the cryptographic data processing device may generate a masked cryptographic key by combining the cryptographic key and the device root key. In an illustrative example, the masking operation may involve applying an XOR operation to the cryptographic key and the device root key: K * =K⊕DRK, as described in more detail above.

[0057] At block 530 , the cryptographic data processing device may store the masked cryptographic key in a non-volatile memory.

[0058] At block 535 , the cryptographic data processing device may store the device root key in volatile memory.

[0059] At block 540 , the cryptographic data processing device may erase the device root key from the non-volatile memory.

[0060] In response to detecting a tampering event at block 545 , the cryptographic data processing device may erase the device root key from the volatile memory at block 550 , and the method may terminate, for example, by throwing an exception at block 555 .

[0061] Otherwise, at block 560, the cryptographic data processing device may, in response to receiving the request to perform a cryptographic data processing operation, recover the cryptographic key by combining the masked cryptographic root key and the device root key. In an illustrative example, the demasking operation may involve applying an XOR operation to the masked cryptographic root key and the device root key: K = K * ⊕DRK, as described in more detail above.

[0062] At block 565 , the cryptographic data processing device may utilize the cryptographic key to perform a cryptographic data processing operation, and the method may terminate at block 570 .

[0063] Figure 6 The diagrammatic representation of computing system 1000 is illustrated, and this computing system 1000 can be incorporated into the processing device described herein, and can perform a group of instructions for making computing device perform method described herein therein.Computing system 1000 can be connected to other computing devices in LAN, intranet, extranet and / or the Internet.Computing device can operate with the ability of server machine in client-server network environment.Computing device can be provided by any machine that can (sequentially or otherwise) perform a group of instructions, and this group of instructions specifies the action to be taken by this machine.In addition, although only a single computing device is illustrated, the term "computing device" should also be considered to include any set of computing devices that perform a group (or multiple groups) of instructions to perform method described herein individually or collectively.

[0064] The example computing system 1000 may include a processing device 1002, which in various illustrative examples may be a general or special purpose processor including one or more processing cores. The example computing system 1000 may also include a volatile memory 1004 (e.g., SRAM), a non-volatile memory 1006 (e.g., flash memory), and a data storage device 1018, which may communicate with each other via a bus 1030.

[0065] The processing device 1002 may be configured to perform the methods 400 , 500 for protecting cryptographic keys utilized to perform cryptographic data processing operations in accordance with one or more aspects of the present disclosure for performing the operations and steps described herein.

[0066] The example computing system 1000 may also include a network interface device 1008 that may communicate with a network 1020. The example computing system 1000 may also include a video display unit 1010 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT), an alphanumeric input device 1012 (e.g., a keyboard), a cursor control device 1014 (e.g., a mouse), and an acoustic signal generating device 1016 (e.g., a speaker). In one embodiment, the video display unit 1010, the alphanumeric input device 1012, and the cursor control device 1014 may be combined into a single component or device (e.g., an LCD touch screen).

[0067] The data storage device 1018 may include a computer-readable storage medium 1028 on which one or more sets of instructions (e.g., instructions of the methods 400, 500) may be stored that implement any one or more of the methods or functions described herein. The instructions that implement the methods 400, 500 may also reside, in whole or at least in part, within the main memory 1004 and / or within the processing device 1002 during their execution by the example computing system 1000, and thus the main memory 1004 and the processing device 1002 may also constitute or include computer-readable media. The instructions may also be transmitted or received over the network 1020 via the network interface device 1008.

[0068] Although the computer-readable storage medium 1028 is shown as a single medium in the illustrative example, the term "computer-readable storage medium" should be considered to include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) that store one or more sets of instructions. The term "computer-readable storage medium" should also be considered to include any medium that is capable of storing, encoding, or carrying a set of instructions to be executed by a machine and causing the machine to perform the methods described herein. Thus, the term "computer-readable storage medium" should be considered to include, but is not limited to, solid-state memories, optical media, and magnetic media.

[0069] Unless expressly stated otherwise, terms such as "update," "identify," "determine," "send," "assign," and the like refer to actions and processes performed or implemented by a computing device that manipulates data represented as physical (electronic) quantities in registers and memories of the computing device and transforms it into other data similarly represented as physical quantities within the memory or registers of the computing device or other such information storage, transmission, or display device. Moreover, as used herein, the terms "first," "second," "third," "fourth," and the like are intended to be labels used to distinguish between different elements and do not necessarily have ordinal meanings according to their numerical names.

[0070] The examples described herein also relate to an apparatus for performing the methods described herein. The apparatus may be specially constructed for the desired purpose, or may include a general-purpose computing device selectively programmed by a computer program stored in a computing device. Such a computer program may be stored in a computer-readable non-transient storage medium.

[0071] The methods and illustrative examples described herein are not inherently related to any particular computer or other device. Various general purpose systems may be used in accordance with the teachings described herein, or it may prove convenient to construct more specialized devices to perform the required method steps. The required structures for various of these systems will appear as set forth in the description above.

[0072] The above description is intended to be illustrative rather than restrictive. Although the present disclosure has been described with reference to specific illustrative examples, it will be appreciated that the present disclosure is not limited to the described examples. The scope of the present disclosure should be determined with reference to the attached claims and the full range of equivalents given by the claims.

Claims

1. A method comprising: storing the device root key in non-volatile memory; storing a volatile key in a volatile memory; storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is generated by combining a cryptographic key and the device root key; storing a masked device root key in the non-volatile memory, wherein the masked device root key is generated by combining the device root key and the volatile key; as well as The device root key is erased from the non-volatile memory.

2. The method according to claim 1, further comprising: In response to detecting a tampering event, the volatile key is erased from the volatile memory.

3. The method of claim 2, wherein erasing the volatile key from the volatile memory further comprises at least one of: A reset signal is sent to the volatile memory or power supply to the volatile memory is interrupted.

4. The method according to claim 1, further comprising: recovering the device root key by combining the masked device root key and the volatile key; recovering the cryptographic key by combining the masked cryptographic key and the device root key; as well as A cryptographic data processing operation is performed using the cryptographic key.

5. The method of claim 1 , wherein combining the cryptographic key and the device root key further comprises: An XOR operation is performed on the cryptographic key and the device root key.

6. The method of claim 1 , wherein combining the device root key and the volatile key further comprises: An XOR operation of the device root key and the volatile key is performed.

7. The method according to claim 1, further comprising: At least one of the following is received from an external source: the device root key, the volatile key, or the cryptographic key.

8. The method according to claim 1, further comprising: At least one of the following is generated: the device root key, the volatile key, or the cryptographic key.

9. A system comprising: Non-volatile memory; Volatile memory; a voltage control circuit configured to interrupt power to the volatile memory in response to receiving a signal indicative of a tampering event; as well as A processor, the processor being configured to: storing a device root key in the non-volatile memory; storing a volatile key in the volatile memory; storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is generated by combining a cryptographic key and the device root key; storing a masked device root key in the non-volatile memory, wherein the masked device root key is generated by combining the device root key and the volatile key; as well as The device root key is erased from the non-volatile memory.

10. The system of claim 9, wherein the processor is further configured to: recovering the device root key by combining the masked device root key and the volatile key; recovering the cryptographic key by combining the masked cryptographic key and the device root key; and A cryptographic data processing operation is performed using the cryptographic key.

11. The system of claim 9, wherein combining the cryptographic key and the device root key further comprises: An XOR operation is performed on the cryptographic key and the device root key.

12. A method comprising: storing the device root key in non-volatile memory; storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is generated by combining a cryptographic key and the device root key; storing the device root key in a volatile memory; erasing the device root key from the non-volatile memory; as well as In response to detecting a tampering event, the device root key is erased from the volatile memory.

13. The method of claim 12, wherein erasing the device root key from the volatile memory further comprises: A reset signal is sent to the volatile memory or power supply to the volatile memory is interrupted.

14. The method according to claim 12, further comprising: recovering the cryptographic key by combining the masked cryptographic key and the device root key; as well as A cryptographic data processing operation is performed using the cryptographic key.

15. The method of claim 12, wherein combining the cryptographic key and the device root key further comprises: An XOR operation is performed on the cryptographic key and the device root key.

16. The method according to claim 12, further comprising: At least one of the following is received from an external source: the device root key or the cryptographic key.

17. The method according to claim 12, further comprising: At least one of the following is generated: the device root key or the cryptographic key.

18. A system comprising: Non-volatile memory; Volatile memory; a voltage control circuit configured to interrupt power to the volatile memory in response to receiving a signal indicative of a tampering event; as well as A processor, the processor being configured to: storing a device root key in the non-volatile memory; storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is generated by combining a cryptographic key and the device root key; storing the device root key in the volatile memory; as well as The device root key is erased from the non-volatile memory.

19. The system of claim 18, wherein the processor is further configured to: recovering the cryptographic key by combining the masked cryptographic key and the device root key; and A cryptographic data processing operation is performed using the cryptographic key.

20. The system of claim 18, wherein combining the cryptographic key and the device root key further comprises: An XOR operation is performed on the cryptographic key and the device root key.

Images