Method, program, and cryptographic processing system for setting permissions for cryptographic keys

Abstract

According to a first aspect of the present disclosure, a method for setting a permission of a cryptographic key in a cryptographic processing system is conceived, comprising: generating at least one cryptographic key to be protected; assigning one or more configurable properties to the cryptographic key; wherein the configurable properties define at least one of a permission to perform a first set of predefined operations on the cryptographic key and a permission to perform a second set of predefined operations using the cryptographic key. According to a second aspect of the present disclosure, a corresponding computer program is provided. According to a third aspect of the present disclosure, a corresponding cryptographic processing system is provided.

Description

Technical Field

[0001] This disclosure relates to a method for setting permissions for cryptographic keys in a cryptographic processing system. Furthermore, this disclosure relates to a corresponding computer program and a corresponding cryptographic processing system. Background Technology

[0002] Secure data processing is crucial in many applications. Tamper-proof integrated circuits, such as secure elements, offer relatively high levels of security. It should be noted that a secure element (SE) can be a tamper-proof integrated circuit with an installed or pre-installed smart card-level application (e.g., a payment application) having specified functions and a specified security level. Furthermore, the secure element can implement security functions, such as cryptographic and authentication functions. Summary of the Invention

[0003] According to a first aspect of this disclosure, a method for setting permissions for a cryptographic key in a cryptographic processing system is envisioned, comprising: generating at least one cryptographic key to be protected; assigning one or more configurable features to the cryptographic key; wherein the configurable features define at least one of permissions to perform a first set of predefined operations on the cryptographic key and permissions to perform a second set of predefined operations using the cryptographic key.

[0004] In one or more embodiments, the first set of predefined operations includes at least one of the following operations: reading the cryptographic key by the processing unit; exporting the cryptographic key to an external device; packaging the cryptographic key; and unpacking the cryptographic key.

[0005] In one or more embodiments, the second set of predefined operations includes at least one of the following operations: using the cryptographic key to generate another cryptographic key; using the cryptographic key to wrap another cryptographic key; using the cryptographic key to perform a predefined cryptographic function, wherein the cryptographic function includes encrypting and / or decrypting data with the cryptographic key.

[0006] In one or more embodiments, when the cryptographic key is derived from the root key, the configurable feature is assigned to the cryptographic key, and the configurable feature is used to adjust the derivation data used to derive the cryptographic key from the root key.

[0007] In one or more embodiments, when the cryptographic key is derived from the root key, the cryptographic key is associated with at least one predefined state of the cryptographic processing system.

[0008] In one or more embodiments, if the current state of the cryptographic processing system does not correspond to the predefined state, one or more operations performed using the cryptographic key fail.

[0009] In one or more embodiments, the configurable feature can be accessed by the secure processing unit of the cryptographic system.

[0010] In one or more embodiments, the configurable features can only be read by the security processing unit.

[0011] In one or more embodiments, at least some of the configurable features are mutually exclusive.

[0012] In one or more embodiments, if one or more operations on or using the cryptographic key are not permitted according to the configurable characteristics assigned to the cryptographic key, the operation is suspended or terminated.

[0013] In one or more embodiments, if one or more operations are performed on or using the cryptographic key, and the operation is not permitted according to the configurable characteristics assigned to the cryptographic key, then the cryptographic key is cleared.

[0014] In one or more embodiments, the cryptographic key is packaged before it is transmitted to a non-secure component of the cryptographic processing system, specifically, to the non-volatile memory of the cryptographic processing system.

[0015] In one or more embodiments, when the cryptographic key is retrieved from the insecure component of the cryptographic processing system, the cryptographic key is unpacked.

[0016] According to a second aspect of this disclosure, a computer program is provided, including executable instructions that, when executed by a cryptographic processing system, perform methods of the described kind.

[0017] According to a third aspect of this disclosure, a cryptographic processing system is provided, comprising: a key generation unit configured to generate at least one cryptographic key; the key generation unit further configured to assign one or more configurable features to the cryptographic key; wherein the configurable features define at least one of the following: permission to perform a first set of predefined operations on the cryptographic key and permission to perform a second set of predefined operations using the cryptographic key. Attached Figure Description

[0018] The embodiments will be described in more detail with reference to the accompanying drawings, in which:

[0019] Figure 1 An illustrative embodiment of a method for protecting cryptographic keys is shown;

[0020] Figure 2 An illustrative embodiment of a cryptographic processing system is shown;

[0021] Figure 3 An illustrative embodiment of the key derivation operation is shown;

[0022] Figure 4 An illustrative embodiment of derived key generation is shown;

[0023] Figure 5 An illustrative embodiment of the key wrapping operation is shown;

[0024] Figure 6 An illustrative embodiment of the key unpacking operation is shown;

[0025] Figure 7 An illustrative embodiment of key processing is shown. Detailed Implementation

[0026] Secure data processing is crucial in many applications. Tamper-proof integrated circuits, such as secure elements, offer relatively high levels of security. It should be noted that a secure element (SE) can be a tamper-proof integrated circuit with an installed or pre-installed smart card-level application (e.g., a payment application) having specified functions and a specified security level. Furthermore, the secure element can implement security functions, such as cryptographic and authentication functions.

[0027] The components of a secure element are generally trustworthy. Therefore, the cryptographic key can be handled, for example, by the central processing unit (CPU) of the secure element. However, for systems where the CPU and other system components cannot be fully trusted, it may be necessary to protect the cryptographic key. In other words, in such systems, direct access to the cryptographic key by the CPU or another component should be prevented, and the CPU or another component should be prevented from using these keys to perform cryptographic operations. If this protection can be achieved, only a limited set of components may need to be designed with high security, while other components can be insecure. This, in turn, reduces the cost and complexity of the type of cryptographic processing system described.

[0028] This paper presents a method for setting permissions for cryptographic keys in a cryptographic processing system, a computer program for implementing the method, and a corresponding cryptographic processing system. The method and the corresponding cryptographic processing system help reduce the cost and complexity of the cryptographic processing system while achieving advanced security.

[0029] Figure 1An illustrative embodiment of a method 100 for setting permissions for a cryptographic key is shown. Method 100 includes the following steps. In step 102, at least one cryptographic key that should be protected is generated. Furthermore, in step 104, one or more configurable characteristics are assigned to the cryptographic key, wherein the configurable characteristics define at least one of permissions to perform a first set of predefined operations on the cryptographic key and permissions to perform a second set of predefined operations using the cryptographic key. This helps to improve the level of security because when an operation is performed on the cryptographic key and / or when the cryptographic key is used to perform an operation, the permission for the operation can be verified according to the configurable characteristics assigned to the cryptographic key. In other words, the configurable characteristics ensure that a cryptographic key created for a particular purpose cannot be recreated for another purpose. Furthermore, because the characteristics are configurable, permissions can be defined in a flexible manner. Method 100 can be implemented at least in part as a computer program.

[0030] Figure 2 An illustrative embodiment of a cryptographic processing system 200 is shown, in which the methods of the described type can be applied. System 200 includes a key generation unit 202 and a processing unit 204. Key generation unit 202 is configured to generate at least one cryptographic key. Furthermore, key generation unit 202 is configured to assign one or more configurable features to the cryptographic key, wherein the configurable features define at least one of the permissions to perform a first set of predefined operations on the cryptographic key and the permissions to perform a second set of predefined operations using the cryptographic key. Processing unit 204 can then perform operations on the cryptographic key and / or use the cryptographic key to perform operations according to the permissions defined by the configurable features. As mentioned above, this helps to improve the level of security. Furthermore, permissions can be defined in a flexible manner.

[0031] In one or more embodiments, the first set of predefined operations includes at least one of the following operations: reading the cryptographic key by the processing unit, exporting the cryptographic key to an external device, packaging the cryptographic key, and unpacking the cryptographic key. It should be noted that packaging the cryptographic key refers to the process of encrypting the cryptographic key and its characteristics and adding an authentication code (i.e., an authenticity tag) to the encryption result. Similarly, unpacking the cryptographic key refers to the process of verifying the authentication code and decrypting the encrypted cryptographic key and its characteristics when or after the verification result is positive. Since these operations may be performed frequently on the cryptographic key, setting appropriate permissions for these operations can significantly improve the security level of the cryptographic processing system. Furthermore, in one or more embodiments, the second set of predefined operations includes at least one of the following operations: using the cryptographic key to generate another cryptographic key, using the cryptographic key to package another cryptographic key, and using the cryptographic key to perform a predefined cryptographic function, wherein the cryptographic function includes encrypting and / or decrypting data with the cryptographic key. Again, since these operations may be performed frequently, setting appropriate permissions for these operations can significantly improve the security level of the cryptographic processing system.

[0032] In one or more embodiments, when the cryptographic key is derived from the root key, configurable characteristics are assigned to the cryptographic key, and these configurable characteristics are used to adjust the derived data used to derive the cryptographic key from the root key. This results in practical implementations that ensure the derived cryptographic key is associated with its characteristics. That is, some bits of the derived data can be replaced by values ​​representing the configurable characteristics. For example, in the case of an 8-bit characteristic, the derived data at bits 7:0 can be replaced by these 8-bit values. This adjustment of the derived data can be referred to as fine-tuning.

[0033] In one or more embodiments, when the cryptographic key is derived from the root key, the cryptographic key is associated with at least one predefined state of the cryptographic processing system. This further contributes to improving the security level. Specifically, when performing derivation, the derived data can be fine-tuned according to the system state by setting an enable bit. Therefore, the derived cryptographic key can also optionally be associated with the system state. The derived key can then be obtained by applying a key derivation function that uses the root key and the fine-tuned derived data as input. To fine-tune the derived data, the pre-selected bits of the derived data can be replaced with the state of the indicator and the value of the enable bit. For example, if the system state is represented by a value including 8×8 bits, then 64+8 bits of derived data can be replaced. Specifically, the enable bit can be used for each byte. If the enable bit is set to 1, the corresponding byte is set to the value set by the system, and if the enable bit is set to 0, the corresponding byte is replaced with 0. For example, if the system state is 01234567..F and the enabled bits are 0, 1, 0, 1, then the fine-tuning value will be 0023006700AB00EF55. Furthermore, in one or more embodiments, if the current state of the cryptographic processing system does not correspond to the predefined state, one or more operations performed using the cryptographic key will fail. This restricts the use of the cryptographic key to specific scenarios. For example, if data is encrypted using a key generated based on state = 0xABCD, then if an attempt is made to derive the encryption key when the state is BCDE, the derived key will be completely different, and decryption operations using the derived key will fail to decrypt the data correctly.

[0034] Furthermore, in one or more embodiments, the configurable feature is accessible to the secure processing unit of the cryptographic system. Specifically, the configurable feature may be stored in the secure memory of the cryptographic system along with the associated cryptographic key, wherein the configurable feature is accessible to the secure processing unit. However, the configurable feature cannot be modified by the secure processing unit (i.e., the feature is read-only). This further contributes to improving the security level. Additionally, in one or more embodiments, the configurable feature can only be read by the secure processing unit. In other words, the configurable feature is configured such that only the secure processing unit and no other components of the system can read the configurable feature. This further contributes to improving the security level. In one or more embodiments, at least some of the configurable features are mutually exclusive. This further contributes to improving the security level.

[0035] In one or more embodiments, if one or more operations on or using the cryptographic key are not permitted according to the configurable characteristics assigned to the cryptographic key, the operation is suspended or aborted. This effectively prevents unauthorized use of the cryptographic key, further enhancing the security level. Furthermore, in one or more embodiments, if one or more operations are performed on or using the cryptographic key, and the operation is not permitted according to the configurable characteristics assigned to the cryptographic key, the cryptographic key is cleared. This facilitates the implementation of a stricter security policy, according to which a new cryptographic key should be generated after any unauthorized attempt to use the current cryptographic key.

[0036] In one or more embodiments, the cryptographic key is packaged before being transmitted to a non-secure component of the cryptographic processing system. In this way, the cryptographic key remains undamaged even if it is exposed to a non-secure part of the cryptographic processing system. Furthermore, in one or more embodiments, the cryptographic key is unpacked when it is retrieved from the non-secure component of the cryptographic processing system. Therefore, the cryptographic key can be reused by a secure component after being exposed to a non-secure part of the cryptographic processing system. In one or more embodiments, the non-secure component is non-volatile memory (i.e., retention memory). Therefore, the cryptographic key can be retained in a non-secure part of the cryptographic processing system while still being protected.

[0037] According to this disclosure, configurable features are assigned to cryptographic keys. Configurable features can be considered as attributes that define which operations can be performed on and / or by means of the cryptographic keys. Furthermore, the cryptographic keys are stored in secure storage. These cryptographic keys can be used as root keys to derive unique keys usable by a specific system application. The unique keys can be used to perform various operations or cryptographic functions, such as encryption, decryption, wrapping, and unpacking. During the power-off state of the secure system, the uniquely derived keys can be stored in insecure external storage memory, such as static random access memory (SRAM). Such storage memory is susceptible to leakage, forgery, and various types of attacks. To protect the cryptographic keys stored in such storage memory—such as the aforementioned uniquely derived keys—the keys can be wrapped before being transferred to the storage memory. In this case, when the secure system is powered on, the unique keys can be retrieved from the external storage memory and extracted by means of an unpacking operation. Additionally, the root key can also be wrapped and stored in external storage memory. Generally, the method disclosed in this invention helps reduce the requirements for secure storage of a limited number of keys in a cryptographic processing system.

[0038] Furthermore, configurable features ensure that the cryptographic key is not freely accessible to the central processing unit (CPU). It should be noted that this CPU can also be a non-secure component of the cryptographic processing system. In a practical and secure implementation, secure cryptographic operations can be performed using a unique key derived from the root key. In this case, configurable features can be assigned to these unique keys. This can be conveniently accomplished during the derivation process of generating the unique key. Thus, configurable features can form part of a unique key created for a specific purpose. Configurable features can define the cryptographic capabilities (e.g., encryption, decryption, and wrapping) associated with the key and / or the usage permissions associated with the key (e.g., the key can be exported, read, and wrapped). Configurable features can, for example, be used to interrupt cryptographic operations if the cryptographic key is not used according to the permissions defined by its features. Furthermore, the cryptographic key can be cleared in this case. In addition, when a unique key is derived from the root key, besides configurable features, the unique key can also be associated with system states, such as test state, production state, firmware version state, and counter state. Key leakage during system power-down states can be avoided by wrapping the key before it is stored in external memory. Furthermore, configurable characteristics can limit whether a given cryptographic key can be used to derive another cryptographic key. This can be useful for constructing key hierarchies. Configurable characteristics can be assigned when creating a key, such as by means of derivation or by using transmission through an external interface, or when unpacking a key. Some characteristics can be mutually exclusive; for example, a derived key or a wrapping key may not have any permissions other than the permission to use the characteristic for derivation and wrapping, respectively.

[0039] Figure 3An illustrative embodiment of key derivation operation 300 is shown. Key derivation operation 300 includes a derivation step 304 that takes a root key 302 as input. Derivation step 304 may include, for example, a shift function and a conditional XOR function to generate a derived key. The output of derivation step 304, i.e., the derived key, may undergo a fine-tuning step 306. Fine-tuning step 306, which improves the level of security, may include an XOR operation on the generated subkey and a 128-bit CPU-programmed value. Furthermore, key configuration data 308 may be encrypted using Advanced Encryption Standard (AES) operation 310 to produce encrypted key configuration data 312. It should be noted that key configuration data represents configurable characteristics of the described type. In addition to the configurable characteristics of the key to be derived, key configuration data may also include test status, generation status, firmware version status, and / or counter status. After derivation has been performed, the configurable characteristics included in key configuration data 308 may be assigned to a key configuration register corresponding to the derived key. In the XOR operation, the output of fine-tuning step 306 is combined with encryption key configuration data 312. The output of the XOR operation is then encrypted again using AES, producing a unique key 316. In other words, the configurable nature of the cryptographic key and the predefined state of the system can be XORed with the derived data. Fine-tuning can form part of a commonly known key derivation function, such as CMAC. It should be noted that key derivation functions other than CMAC can also be applied. The entire operation is thus equivalent to deriving a unique cryptographic key using derived data set by the CPU, which is fine-tuned in hardware to reflect the key configuration and the state of the system. Furthermore, the key configuration register can be enabled only for certain operations, such as encryption operations using the unique cryptographic key. In this case, other operations that are not encrypted using the unique cryptographic key will not succeed. When the system is in use, the secure CPU can access the key configuration data 308 associated with the derived unique key 316, enabling the secure CPU to perform operations. Any illegal operation may result in abort.

[0040] More specifically, the process of deriving a unique key from the root key can involve two steps: derived key generation and encryption key configuration. Derived key generation can be based on a lock-based cryptographic MAC algorithm (CMAC) as described in NIST Special Publication 800-38B, “Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication,” available at https: / / doi.org / 10.6028 / NIST.SP.800-38B. A portion of the derived data can be provided by the user, while another portion can be associated with the state of the cryptographic processing system (e.g., test state, generation state, firmware version state, counter state, etc., controlled by a single-programmable register or hardware event). Key characteristics used to derive the unique key can also be provided by the user. These can be encrypted using the root key to provide encryption key configuration data.

[0041] Figure 4 An illustrative embodiment of derived key generation 400 is shown. The derived key generated using CMAC can be XORed with an encryption key configuration and encrypted using a root key to derive a unique key. This derived unique key can be used for specific system applications, such as for encryption and decryption of plaintext and ciphertext, for packaging and unpacking unique encryption keys, and for deriving other unique keys based on a specified key configuration. Key characteristics can be maintained in register 402 set by firmware, while, for example, a predefined state to be associated with the key can be maintained in a one-time programmable register 406. Alternatively or additionally, registers set at firmware download 404 can be used. Key characteristics can be used to derive configuration keys (i.e., derived keys of the illustrated type).

[0042] Figure 5 An illustrative embodiment of key wrapping operation 500 is shown. Specifically, the process of wrapping a cryptographic key using wrapping keys 508 and 514 is shown. As mentioned above, the cryptographic key can be wrapped before being transferred to external storage memory when the cryptographic processing system enters a power-off mode or power-off state. This protects the integrity and confidentiality of the cryptographic key and its configuration. One or more keys 504 to be wrapped are wrapped using an AES encryption operation 510, which takes an initialization vector 502 XORed with the one or more keys 504 and the wrapping key 508 as input. The AES encryption operation 510 outputs the wrapped key 518. The initialization vector 502 is also stored 516 for subsequent unpacking operations, such as... Figure 6As shown in the diagram. The output of AES encryption operation 510 is also fed to an XOR unit along with key configuration data 506. The output of the XOR operation serves as input to another AES encryption operation 512, by means of which the configurable characteristics (i.e., key configuration data) assigned to one or more keys 504 to be packaged are encrypted. AES encryption operation 512 also uses the package key 514 as input and outputs the packaged key configuration 520. Finally, a CMAC operation 522 is performed on the stored initialization vector 516, the packaged key 518, and the packaged key configuration 520. The initialization vector (IV) can be generated by a pseudo-random number generator (PRNG). The key and its characteristics can be encrypted using a cryptographic block chaining (CBC) method. The CMAC is generated based on the IV, the encryption key, and the encryption key characteristics. Therefore, the generated CMAC can be used as a reference for performing the corresponding unpacking operation. The IV, the packaged key, the packaged key configuration, and the CMAC can be stored in external retention memory (e.g., SRAM) before the system enters a power-down mode.

[0043] Figure 6An illustrative embodiment of key unpacking operation 600 is shown. Key unpacking operation 600 includes a CMAC operation 608, which takes an initialization vector 602, a packaged key 604, and a packaged key configuration 606 as inputs. CMAC operation 608 is used to verify the integrity of the content of a received message, which includes the packaged key and its configuration. If the content integrity verification step 610 fails, an error is marked at 614 and the cryptographic key is cleared at 612. Then, in step 628, key unpacking operation 600 ends. If the content integrity verification step 610 succeeds, AES decryption operations 618 and 620 are used to unpack both the packaged key 604 and its packaged configuration data 606, using the aforementioned packaged keys 616 and 622 as corresponding inputs. AES decryption 618 and 620 respectively generate a unique unpacked key 624 and unpacked key configuration data 626. The unique unpacking key 624 can then be used by a secure component (e.g., a CPU) that has retrieved the packaged key and its packaged configuration to perform operations. In other words, key unpacking may involve the following steps: Retrieving the packaged key, IV, and packaged key configuration data from external insecure memory. Then, calculating the CMAC based on the imported packaged information (i.e., the retrieved information). If the calculated CMAC matches a reference CMAC, CBC decryption is used to unpack the packaged key and packaged configuration data. If the calculated CMAC does not match a reference CMAC, all imported data is cleared, and an error message indicating that the key is corrupt is generated. Note that a key clearing operation can be used to clear individual or multiple key groups. A key clearing operation can write pseudo-random data to individual or all selected key groups. A key clearing operation on a selected key group can also reset the corresponding key configuration characteristics.

[0044] Figure 7 An illustrative embodiment of key processing 700 is shown. Specifically, Figure 7This illustrates how to derive several keys using a root key 702 transferred from flash memory or one-time programmable (OTP) memory. The key derivation function 712 takes two items as input: the root key and derivation data set by the CPU, a portion of which is replaced by the aforementioned fine-tuning, which is based on configurable key characteristics and a predefined system state. It should be noted that the use of the predefined system state in the fine-tuning is optional, such that the fine-tuning may also include fine-tuning the derivation data in a manner that reflects whether the fine-tuning is also based on a predefined system state in addition to configurable key characteristics. Some derived keys 714 and 716 are encryption and decryption keys, respectively, meaning that these keys can be used as inputs to encryption and decryption operations, respectively. Another derived cryptographic key 718 can be used for various purposes; this cryptographic key 718 can be packaged 724 and exported (i.e., transferred 726) to storage memory. For this purpose, a package key 720 is also derived. After the cryptographic processing system has been in low power mode 728 and has returned to normal power mode, the packaged key can be imported back into processing unit 730. Then, processing unit 732 performs unpacking operation 732, as described in reference... Figure 6 Detailed explanation. It should be noted that, in addition to the protection provided by the derived cryptographic key, messages exchanged between the processing unit and the holding memory—including the wrapped key—can be protected by encryption. Another derived key 722 can be a derivative key, meaning it can be exported to, for example, flash memory or one-time programmable (OTP) memory. This key 722 can be used as a root key for other cryptographic operations. It should be noted that the derivative key 722 can be masked using specific input values ​​received from external units.

[0045] The systems and methods described herein may be embodied, at least in part, by one or more computer programs, which may exist in various forms, in both active and inactive states, either within a single computer system or across multiple computer systems. For example, the computer program may exist as a software program consisting of program instructions in the form of source code, object code, executable code, or other formats for performing certain steps. Any of these formats may be implemented in compressed or uncompressed form on a computer-readable medium, which may include storage devices and signals.

[0046] As used herein, the term "computer" refers to any electronic device that includes a processor, such as a general-purpose central processing unit (CPU), a dedicated processor, or a microcontroller. A computer is capable of receiving data (input), performing a series of predetermined operations on the data, and thereby producing results (output) in the form of information or signals. Depending on the context, the term "computer" will refer (specifically) to a processor or (more generally) to a processor associated with a combination of related elements housed within a single chassis or housing.

[0047] The term "processor" or "processing unit" refers to a data processing circuit, which can be a microprocessor, coprocessor, microcontroller, microcomputer, central processing unit, field-programmable gate array (FPGA), programmable logic circuit, state machine, and / or any circuit that manipulates signals (analog or digital) based on operation instructions stored in memory. The term "memory" refers to one or more storage circuits, such as read-only memory, random access memory, volatile memory, non-volatile memory, static memory, dynamic memory, flash memory, cache memory, and / or any circuit that stores digital information.

[0048] As used herein, "computer-readable medium" or "storage medium" can be any component capable of containing, storing, conveying, propagating, or transmitting a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable medium can be, for example (but not limited to), an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, apparatus, or propagation medium. More specific examples of computer-readable media (a non-exhaustive list) may include: an electrical connection having one or more wires, a portable computer disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compressed optical disc read-only memory (CDROM), digital versatile optical disc (DVD), Blu-ray disc (BD), and memory cards.

[0049] It should be noted that the above embodiments have been described with reference to different subjects. Specifically, some embodiments may have been described with reference to claims of the method class, while others may have been described with reference to claims of the device class. However, those skilled in the art will understand from the foregoing that, unless otherwise specified, any combination of features relating to different subjects, specifically combinations of features of the method class claims and features of the device class claims, are also considered to be disclosed with this document, except for any combination of features belonging to one type of subject matter.

[0050] Additionally, it should be noted that the drawings are schematic. Similar or identical elements are represented by the same reference numerals in different drawings. Furthermore, it should be noted that, in order to provide a concise description of illustrative embodiments, implementation details that are customary to those skilled in the art may not be described. It should be understood that in the development of any such implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developer's specific objectives, such as complying with system-related and business-related constraints, which may differ in different implementations. Furthermore, it should be understood that such development work can be complex and time-consuming, but is merely a routine task for those skilled in the art in designing, manufacturing, and producing.

[0051] Finally, it should be noted that those skilled in the art will be able to devise numerous alternative embodiments without departing from the scope of the appended claims. Any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprise / comprising" does not exclude the presence of elements or steps other than those listed in the claims. The indefinite article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The measures recited in the claims can be implemented by means of hardware comprising several different elements and / or by means of a suitably programmed processor. In a device claim listing several components, several of these components can be embodied by the same object in the hardware. The mere fact that certain measures are recited in different appendix claims does not indicate that combinations of these measures cannot be advantageously used.

[0052] List of reference numerals

[0053] 100 Methods for protecting cryptographic keys

[0054] 102 Generate at least one cryptographic key to be protected.

[0055] 104 Assign one or more configurable features to the cryptographic key, wherein the configurable features define at least one of the permissions to perform a first set of predefined operations on the cryptographic key and the permissions to perform a second set of predefined operations using the cryptographic key.

[0056] 200 Cryptographic Processing System

[0057] 202 Key Generation Unit

[0058] 204 Processing Unit

[0059] 300 Key Derivation Operation

[0060] 302 root key

[0061] 304 derived

[0062] 306 Fine-tuning

[0063] 308 Key Configuration

[0064] 310 AES

[0065] 312 Encryption Key Configuration

[0066] 314 AES

[0067] 316 Unique Key

[0068] 400 Derivative Key Generation

[0069] 402 Register set by firmware

[0070] 404 Register set during firmware download

[0071] 406 One-Time Programmable Register

[0072] 500 Key Packaging Operation

[0073] 502 Initialization Vector

[0074] 504 Keys to be packaged (multiple)

[0075] 506 Key Configuration

[0076] 508 Packaging Key

[0077] 510 AES encryption

[0078] 512 AES encryption

[0079] 514 Packaging Key

[0080] 516 stores for unpacking

[0081] 518 Packet Key

[0082] 520-packet key configuration

[0083] 522 CMAC

[0084] 600 Key Unpacking Operation

[0085] 602 Initialization Vector

[0086] 604 Packaging Key

[0087] Key configuration for 606 package

[0088] 608 CMAC

[0089] 610 Content integrity matching?

[0090] 612 Key clearing

[0091] 614 Marking error

[0092] 616 Packaging Key

[0093] 618 AES Decryption

[0094] 620 AES Decryption

[0095] 622 Packaging Key

[0096] 624 Unique unpacking key

[0097] 626 Key Configuration

[0098] Completed on June 28th.

[0099] 700 Key Processing

[0100] 702 Transfer root key from flash / OTP memory

[0101] 704 Single Programmable Register

[0102] 706 Registers set during firmware download

[0103] 708 Registers set by firmware

[0104] 712 Key Derivation

[0105] 714 Derived key used for encryption

[0106] 716 Derived key used for decryption

[0107] 718 Derived wrappable keys for wrapping

[0108] 720 Derived key used for packaging

[0109] 722 Derived key used for key derivation to external secure storage

[0110] 724 Perform key wrapping

[0111] 726 Transfer the packaged key to the storage memory.

[0112] 728 Switch to Low Power Mode

[0113] 730 Transfer the packaged key from the storage memory

[0114] 732 Perform unpacking.

Claims

1. A method for setting permissions for cryptographic keys in a cryptographic processing system, characterized in that, include: Generate at least one cryptographic key to be protected; Assign one or more configurable features to the cryptographic key; The configurable feature specifies at least one of the following: the permission to perform a first set of predefined operations on the cryptographic key and the permission to perform a second set of predefined operations using the cryptographic key. Specifically, when the cryptographic key is derived from the root key, the configurable feature is assigned to the cryptographic key. Furthermore, the configurable feature is encrypted and used to adjust the derived data used to derive the cryptographic key from the root key.

2. The method according to claim 1, characterized in that, The first group of predefined operations includes at least one of the following operations: The processing unit reads the cryptographic key; Export the cryptographic key to an external device; Package the cryptographic key; Unpack the aforementioned cryptographic key.

3. The method according to claim 1 or 2, characterized in that, The second group of predefined operations includes at least one of the following operations: Use the aforementioned cryptographic key to generate another cryptographic key; Use the aforementioned cryptographic key to wrap another cryptographic key; The cryptographic key is used to perform predefined cryptographic functions, wherein the cryptographic functions include encrypting and / or decrypting data with the cryptographic key.

4. The method according to claim 1, characterized in that, When the cryptographic key is derived from the root key, the cryptographic key is associated with at least one predefined state of the cryptographic processing system.

5. The method according to claim 1, characterized in that, If one or more operations are not permitted to be performed on or using the cryptographic key according to the configurable characteristics assigned to the cryptographic key, then the operation is suspended or terminated.

6. The method according to claim 1, characterized in that, If one or more operations are performed on or using the cryptographic key, and the operation is not permitted according to the configurable characteristics assigned to the cryptographic key, then the cryptographic key is cleared.

7. The method according to claim 1, characterized in that, The cryptographic key is packaged before it is transmitted to a non-secure component of the cryptographic processing system, specifically, to the non-volatile memory of the cryptographic processing system.

8. A computer program, characterized in that, Includes executable instructions that, when executed by a cryptographic processing system, perform the method according to any one of the preceding claims.

9. A cryptographic processing system, characterized in that, include: A key generation unit, configured to generate at least one cryptographic key; The key generation unit is further configured to assign one or more configurable features to the cryptographic key; The configurable feature specifies at least one of the following: the permission to perform a first set of predefined operations on the cryptographic key and the permission to perform a second set of predefined operations using the cryptographic key. Specifically, when the cryptographic key is derived from the root key, the configurable feature is assigned to the cryptographic key. Furthermore, the configurable feature is encrypted and used to adjust the derived data used to derive the cryptographic key from the root key.

Images