Novel method for efficiently protecting integrated cryptographic engine

Abstract

Various embodiments include a method implemented in a processor for managing cryptographic keys of an integrated cryptographic engine. An embodiment may include detecting a cryptographic key access control event; determining whether the cryptographic key access control event is used to disable cryptographic key access at a cryptographic key memory of the integrated cryptographic engine; in response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key memory, disable cryptographic key access at the cryptographic key memory; and maintaining, at the cryptographic key memory, one or more cryptographic keys for which cryptographic key access is disabled. Embodiments may also include, in response to determining that the cryptographic key access control event is not used to disable cryptographic key access at the cryptographic key memory, enabling cryptographic key access at the cryptographic key memory.

Description

[0001] Related applications

[0002] This application claims priority to U.S. non-provisional application No. 18 / 301,305, filed April 17, 2023, the entire contents of which are incorporated herein by reference. Background Technology

[0003] Storage data protection is integrated into hardware-bounded cryptographic keys using cryptographic components similar to an Integrated Cryptographic Engine (ICE). The cryptographic key is programmed into the ICE memory while the computing device is running. Encryption / decryption of all sensitive data operations is guided through the ICE using the programmed cryptographic key. Without protection, the cryptographic key is accessible for any read / write operation, regardless of the computing device state (such as locked / unlocked). Even when the computing device is locked, leaving the unprotected cryptographic key makes sensitive data vulnerable to data at rest attacks. Current protection measures for cryptographic keys include evicting the cryptographic key from the ICE memory for computing device states such as locked or data at rest, and regenerating the cryptographic key and reprogramming it into the ICE memory for another computing device state, such as unlocked. Summary of the Invention

[0004] The various aspects include apparatus and methods for managing cryptographic keys of an integrated cryptographic engine. These aspects may include: detecting a cryptographic key access control event; determining whether the cryptographic key access control event is used to disable cryptographic key access at a cryptographic key memory of the integrated cryptographic engine; disabling cryptographic key access at the cryptographic key memory in response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key memory; and maintaining one or more cryptographic keys at the cryptographic key memory for which cryptographic key access is disabled.

[0005] Some aspects may also include: after disabling access to the cryptographic key at the cryptographic key store, receiving a data request, attempting to retrieve the cryptographic key from the cryptographic key store, and sending an error response.

[0006] In some aspects, disabling access to the cryptographic key storage may include setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to a disabled value.

[0007] Some aspects may also include: enabling cryptographic key access at the cryptographic key storage in response to determining that the cryptographic key access control event is not used to disable cryptographic key access at the cryptographic key storage.

[0008] Some aspects may also include: enabling access to the cryptographic key at the cryptographic key storage to receive data requests, attempting to retrieve the cryptographic key from the cryptographic key storage, and sending the cryptographic key.

[0009] In some aspects, enabling cryptographic key access at the cryptographic key storage location may include setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to an enabled value.

[0010] A further aspect may include: receiving cryptographic key access control policy parameters for the one or more cryptographic keys configured to enable a cryptographic key access control policy; and enabling the cryptographic key access control policy for the one or more cryptographic keys in response to receiving the cryptographic key access control policy parameters.

[0011] In some aspects, enabling the cryptographic key access control policy for the one or more cryptographic keys may include associating the one or more cryptographic keys with one or more cryptographic key access indicators.

[0012] A further aspect includes a computing device comprising a processor configured to perform operations of any of the methods outlined above. A further aspect includes a computing device having units for performing any of the functions of the methods outlined above. A further aspect includes a non-transitory processor-readable storage medium having processor-executable instructions stored thereon configured to cause the processor of the computing device to perform the functions of the methods summarized above. Attached Figure Description

[0013] The accompanying drawings, which are incorporated herein and form part of this specification, illustrate exemplary embodiments of various examples and, together with the general description given above and the detailed description given below, serve to interpret the features of the claims.

[0014] Figure 1 This is a component block diagram illustrating an example computing device suitable for implementing various embodiments.

[0015] Figure 2A and 2B This is a block diagram illustrating components of an example cryptographic key access control system suitable for implementing various embodiments.

[0016] Figure 3 This is a component block signaling diagram illustrating examples of programming cryptographic keys in a cryptographic key access control system suitable for implementing various embodiments.

[0017] Figure 4A and 4BThis is a component block signaling diagram illustrating examples of disabling and enabling cryptographic key access in a cryptographic key access control system suitable for implementing various embodiments.

[0018] Figure 5 This is a process flowchart illustrating a method for managing cryptographic keys for an integrated cryptographic engine according to some embodiments.

[0019] Figure 6 This is a flowchart illustrating a method for programming a cryptographic key used in an integrated cryptographic engine, according to some embodiments.

[0020] Figure 7 This is a component block diagram illustrating an example mobile computing device suitable for implementing various embodiments.

[0021] Figure 8 This is a component block diagram illustrating an example mobile computing device suitable for implementing various embodiments.

[0022] Figure 9 This is a component block diagram illustrating an example server suitable for implementing various embodiments. Detailed Implementation

[0023] Various embodiments are described in detail with reference to the accompanying drawings. Where possible, the same reference numerals will be used throughout the drawings to refer to the same or similar components. References to specific examples and implementations are for illustrative purposes and are not intended to limit the scope of the claims.

[0024] Various embodiments include methods for managing cryptographic keys used in an integrated cryptographic engine and computing devices implementing such methods. In some embodiments, management of cryptographic keys used in an integrated cryptographic engine includes: maintaining one or more cryptographic keys at a cryptographic key store of the integrated cryptographic engine; and controlling access to the cryptographic keys based on events of the computing device. Controlling access to the cryptographic keys may include disabling access to the cryptographic keys at the cryptographic key store based on one event and enabling the cryptographic keys at the cryptographic key store based on another event. Cryptographic keys can be maintained at the cryptographic key store while simultaneously disabling access to them. In some embodiments, the cryptographic keys may be programmed into the integrated cryptographic engine, which associates the cryptographic keys with a cryptographic key access control policy. In some embodiments, the cryptographic keys may be programmed into the integrated cryptographic engine, which associates the cryptographic keys with a cryptographic key access indicator configured to indicate to the integrated cryptographic engine whether cryptographic key access is disabled and / or enabled.

[0025] The terms “computing device” and “mobile device” are used interchangeably herein to refer to any or all of the following: cellular phones, smartphones, personal or mobile multimedia players, personal data assistants (PDAs), laptops, tablets, convertible laptops / tablets (2-in-1 computers), smartbooks, ultrabooks, netbooks, handheld computers, wireless email receivers, cellular phones with multimedia internet access, mobile game consoles, wireless game controllers, and similar personal electronic devices including memory and programmable processors. The term “computing device” may also refer to fixed computing devices, including personal computers, desktop computers, all-in-one computers, workstations, supercomputers, mainframe computers, embedded computers, servers, home theater computers, and game consoles.

[0026] Storage data protection is integrated into hardware-bounded cryptographic keys using cryptographic components similar to an Integrated Cryptographic Engine (ICE). The cryptographic key is programmed into the ICE's memory while the computing device is running. Encryption / decryption of all sensitive data operations is guided through the ICE using the programmed cryptographic key. Without protection, the cryptographic key is accessible for any read / write operation, regardless of the computing device's state (such as locked / unlocked). Even when the computing device is locked, leaving the unprotected cryptographic key makes sensitive data vulnerable to data-at-rest attacks.

[0027] Current protection measures for cryptographic keys include: evictting the cryptographic key from the integrated cryptographic engine memory for computing device states where the key cannot be used (such as a locked state or a data-at-rest state); and regenerating and reprogramming the cryptographic key into the integrated cryptographic engine memory for computing device states where the key can be used (such as an unlocked state). This protection is inefficient, consumes computing device resources, and causes performance degradation during each instance of key reprogramming into the integrated cryptographic engine memory. For example, by implementing key derivation functions to generate and / or decrypt cryptographic keys, the same cryptographic key must be regenerated and reprogrammed into the integrated cryptographic engine memory for each change in computing device state where the key can be used. The cost of regenerating and reprogramming the cryptographic key into the integrated cryptographic engine memory increases based on the number of cryptographic keys.

[0028] The embodiments address and overcome the inefficiency of regenerating and reprogramming cryptographic keys into the integrated cryptographic engine memory for every change in the state of the computing device that can use the cryptographic keys. The embodiments include a cryptographic key access control scheme for the cryptographic key memory of the integrated cryptographic engine. Instead of repeatedly evicting, regenerating, and reprogramming cryptographic keys, the embodiments maintain cryptographic keys for the integrated cryptographic engine at the cryptographic key memory and control access to the cryptographic keys at the cryptographic key memory based on the state of the computing device. The embodiments avoid the cost of regenerating and reprogramming cryptographic keys after their initial generation and programming at the cryptographic key memory.

[0029] The embodiment includes programming a cryptographic key into a cryptographic key store for use in an integrated cryptographic engine. The cryptographic key may be associated with a cryptographic key access control policy at the integrated cryptographic engine. The cryptographic key may be associated with a cryptographic key access indicator at the cryptographic key store, which is configured to indicate to the integrated cryptographic engine whether cryptographic key access is disabled and / or enabled.

[0030] The security host can be configured to detect cryptographic key access control events, such as changes in the state of a computing device. For example, the computing device state may include a locked state and an unlocked state. The security host can be configured to interpret cryptographic key access control events to trigger the disabling and / or enabling of cryptographic key access at the cryptographic key store used by the integrated cryptographic engine. For example, the security host can interpret a change in the locked state of the computing device as triggering the disabling of cryptographic key access at the cryptographic key store and a change in the unlocked state as enabling cryptographic key access at the cryptographic key store. The security host can signal the integrated cryptographic engine to disable and / or enable cryptographic key access at the cryptographic key store based on the interpretation of the cryptographic key access control events.

[0031] The integrated cryptographic engine can be configured to disable and / or enable cryptographic key access at the cryptographic key store used by the integrated cryptographic engine based on signals from the secure host. For example, a signal to disable cryptographic key access at the cryptographic key store can trigger the integrated cryptographic engine to set a cryptographic key access indicator associated with the cryptographic key at the cryptographic key store to indicate that cryptographic key access is disabled. A signal to enable cryptographic key access at the cryptographic key store can trigger the integrated cryptographic engine to set a cryptographic key access indicator associated with the cryptographic key at the cryptographic key store to indicate that cryptographic key access is enabled.

[0032] The integrated cryptographic engine can be configured to check the cryptographic key access indicator associated with the cryptographic key at its cryptographic key store in response to a data request from an insecure host. The integrated cryptographic engine can be configured to determine whether the cryptographic key access indicator associated with the cryptographic key indicates that cryptographic key access to the cryptographic key is disabled and / or enabled. In response to determining that cryptographic key access to the cryptographic key is disabled, the integrated cryptographic engine can be configured to deny access to the cryptographic key at its cryptographic key store. In response to determining that cryptographic key access to the cryptographic key is enabled, the integrated cryptographic engine can be configured to allow access to the cryptographic key at its cryptographic key store.

[0033] Figure 1 A system including a computing device 10 suitable for use with various embodiments is illustrated. The computing device 10 may include a system-on-a-chip (SoC) 12 having a processor 14, memory 16, memory interface 34, integrated cryptographic module 38, communication interface 18, storage memory interface 20, clock controller 30, and interconnect 32. The computing device 10 may also include communication components 22, such as a wired or wireless modem, storage memory 24, an antenna 26 for establishing wireless communication links, a power manager 28, and memory 36. The processor 14 may include any of a variety of processing devices, such as several processor cores.

[0034] The term "System-on-a-Chip" (SoC) is used herein to refer to a set of interconnected electronic circuits, typically but not exclusively including processing devices, memory, and communication interfaces. Processing devices can include various types of processors¹⁴ and processor cores, such as general-purpose processors, central processing units (CPUs), digital signal processors (DSPs), graphics processing units (GPUs), accelerated processing units (APUs), security processing units (SPUs), neural network processing units (NPUs), subsystem processors for specific components of a computing device, such as image processors for camera subsystems or display processors for displays, auxiliary processors, single-core processors, multi-core processors, controllers, and microcontrollers. Processing devices can further embody other hardware and hardware combinations, such as field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), other programmable logic devices, discrete gate logic, transistor logic, performance monitoring hardware, watchdog hardware, and time bases. Integrated circuits can be configured such that the components of the integrated circuit reside on a monolithic semiconductor material such as silicon.

[0035] SoC 12 may include one or more processors 14. Computing device 10 may include more than one SoC 12, thereby increasing the number of processors 14 and processor cores. Computing device 10 may also include processors 14 not associated with SoC 12. Processors 14 may each be configured for a specific purpose that may be the same as or different from other processors 14 of computing device 10. One or more of processors 14 and processor cores with the same or different configurations may be grouped together. A group of processors 14 or processor cores may be referred to as a multiprocessor cluster.

[0036] Computing device 10 may include any number and combination of memories, such as memory 16 integrated into SoC 12 and memory 36 separate from SoC 12. Either memory 16, 36 may be volatile or non-volatile memory configured to store data and processor-executable code for access by processor 14. Computing device 10 and / or SoC 12 may include one or more memories 16, 36 configured for various purposes. One or more memories 16, 36 may include volatile memory such as random access memory (RAM) or main memory, including static RAM (SRAM) such as memory 16, dynamic RAM (DRAM) such as memory 36, or cache memory.

[0037] Memory 16, 36 can be configured to temporarily store a limited amount of data. For example, data can be received from a data sensor or subsystem. As another example, the data can be data requested from non-volatile memory 16, 24, 36 and / or processor-executable code instructions, which are loaded from non-volatile memory 16, 24, 36 based on various factors anticipating future access. As another example, the data can be intermediate processing data and / or processor-executable code instructions generated by processor 14 and temporarily stored for rapid future access, without being stored in non-volatile memory 16, 24, 36.

[0038] The memory interface 34 can work in harmony with the memory 36 to enable the computing device 10 to store and retrieve data and processor-executable code from the memory 36. The memory interface 34 can control access to the memory 36 and allow the processor 14 to read data from and write data to the memory 36.

[0039] Storage interface 20 and storage memory 24 can operate in concert to allow computing device 10 to store data and processor-executable code on a non-volatile storage medium, such as a non-volatile memory device. Storage memory 24 can be configured very similarly to an embodiment of memory 16, wherein storage memory 24 can store data or processor-executable code for access by one or more processors 14. Non-volatile storage memory 24 can retain information after the computing device 10 has been powered off. When power is restored and the computing device 10 restarts, the information stored on storage memory 24 becomes available to the computing device 10. Storage interface 20 can control access to storage memory 24 and allow processors 14 to read data from and write data to storage memory 24.

[0040] The integrated cryptographic module 38 can be configured to implement cryptographic functions, such as encryption and decryption, for transactions involving the memory storage device 24. Data transferred between the memory 36 and the memory storage device 24 can be encrypted and decrypted by the integrated cryptographic module 38 to protect the data stored at the memory storage device 24 by encrypting the data and to make the encrypted data retrieved from the memory storage device 24 usable by the SoC by decrypting the data. The integrated cryptographic module 38 can be configured with multiple cryptographic cores (not shown) configured to implement cryptographic functions. The integrated cryptographic module 38 can be configured with a cryptographic key memory (not shown) configured to store one or more cryptographic keys used to implement the cryptographic functions. In some implementations, the integrated cryptographic module 38 can be a standalone component of the SoC 12. In some implementations, the integrated cryptographic module 38 can be integrated into another component of the SoC 12, such as the memory interface 34, the memory interface 20, the processor 14, the multi-data stream memory controller, etc.

[0041] Power manager 28 can be configured to control the power state of one or more power rails (not shown) for power delivery to components of SoC 12. In some embodiments, power manager 28 can be configured to control the amount of power supplied to components of SoC 12. For example, power manager 28 can be configured to control the connection between components of SoC 12 and power rails. As another example, power manager 28 can be configured to control the amount of power on power rails connected to components of SoC 12. Power manager 28 can be configured as a power management integrated circuit (power management IC or PMIC).

[0042] Clock controller 30 can be configured to control clock signals transmitted to components of SoC 12. For example, clock controller 30 can gate components of SoC 12 by disconnecting them from clock signals, and can degated components of SoC 12 by connecting them to clock signals.

[0043] Interconnect 32 may be a communication structure, such as a communication bus, configured to communicatively connect components of SoC 12. Interconnect 32 may transmit signals between components of SoC 12. In some embodiments, interconnect 32 may be configured to control signals between components of SoC 12 by controlling the timing and / or transmission paths of signals.

[0044] Some or all of the components of computing device 10 and / or SoC 12 may be arranged and / or combined differently while still serving the functions of the various embodiments. Computing device 10 may not be limited to one component of each component, and multiple instances of each component may be included in various configurations of computing device 10.

[0045] Figure 2A and 2B An example of a cryptographic key access control system suitable for implementing various embodiments is shown. References Figures 1-2B The cryptographic key access control system 200 may include SoC 201 (e.g., Figure 1 SoC 12) and secure non-volatile memory 210 (e.g., Figure 1 (Storage memory 24, memory 36 in the middle).

[0046] SoC 201 may include a processor (not shown; for example, Figure 1 The processor 14 in the system is configured with processor-executable instructions for implementing a non-secure host 202 (such as one or more applications). Examples of one or more applications may include an advanced operating system, a game application, a productivity application, an entertainment application, a web browser application, a communication application, etc. In some examples, the non-secure host 202 can execute...

[0047] SoC 201 may include one or more processors (not shown; for example, Figure 1 The processor 14 and integrated cryptographic module 38 are configured with processor-executable instructions and / or hardware for implementing the secure host 204, the integrated cryptographic engine 206, and the secure cryptographic key manager 208. In some examples, the secure cryptographic key manager 208 may be an integrated component of the integrated cryptographic engine 206.

[0048] In some examples, one or more of the insecure host 202, secure host 204, integrated cryptographic engine 206, and / or secure cryptographic key manager 208 may be implemented by the same processor. In some examples, SoC 201 and / or the processor may include a normal execution environment and a secure execution environment (or a trusted execution environment; for example, ARM TrustZone, AMD Security Technology, IBM Security Services Container, Intel Trusted Execution Technology, etc.). The insecure host 202 may execute in the normal execution environment of SoC 201 and / or the processor. The secure host 204 may execute in the secure execution environment of SoC 201 and / or the processor. The integrated cryptographic engine 206 and / or secure cryptographic key manager 208 may be implemented in both the normal execution environment and / or the secure execution environment of SoC 201 and / or the processor.

[0049] The secure non-volatile memory 210 can be accessed by one or more components of the SoC 201. For example, the secure non-volatile memory 210 can be accessed by the secure host 204. As another example, the secure non-volatile memory 210 can be accessed by components of the secure execution environment of the SoC 201 and / or the processor. The secure non-volatile memory 210 can be configured to store data, including one or more cryptographic keys for implementing the cryptographic functions of the integrated cryptographic engine 206, as further described herein.

[0050] The cryptographic key stored in secure non-volatile memory 210 can be programmed into the integrated cryptographic engine 206. For example, the integrated cryptographic engine 206 may include a memory (not shown) where the cryptographic key can be stored. Figure 1 The secure host 204 can be configured to retrieve cryptographic keys from the secure non-volatile memory 210 and store them at the integrated cryptographic engine 206. The secure host 204 can also store associations between cryptographic keys and cryptographic key access control policy indicators. The cryptographic key access control policy indicators can be configured to indicate whether a cryptographic key access control policy is enabled for the cryptographic keys used by the secure host 204. The secure cryptographic key manager 208 can store associations between cryptographic keys and cryptographic key access indicators. The cryptographic key access indicators can be configured to indicate whether cryptographic key access is disabled and / or enabled for the cryptographic keys of the secure cryptographic key manager 208. Programming cryptographic keys to the integrated cryptographic engine 206 can occur, for example, as part of the startup of the SoC 201 and / or in response to the startup of the SoC 201.

[0051] The secure host 204 may store the association between the cryptographic key and the cryptographic key access control policy indicator in memory (not shown; for example, Figure 1The memory (16) may contain files, data structures, databases, etc., such as the memory of the processor executing the secure host 204, the memory of the secure host 204 hardware, and / or the memory of the integrated cryptographic engine 206. In some examples, the secure host 204 may receive cryptographic key access control policy parameters for a cryptographic key from the non-secure host 202, which instruct the secure host 204 whether to enable the cryptographic key access control policy indicator. The secure host 204 may, in response to the cryptographic key access control policy parameter instructing it to enable the cryptographic key access control policy indicator, enable the cryptographic key access control policy indicator for the cryptographic key.

[0052] The secure password key manager 208 can store the association between password keys and password key access indicators in memory (not shown; for example, Figure 1 The memory (16) may contain files, data structures, databases, etc., such as the memory of the processor executing the secure key manager 208, the memory of the secure key manager 208 hardware, and / or the memory of the integrated cryptographic engine 206. The secure key manager 208 may receive signals from the secure host 204 configured to indicate whether to disable and / or enable key access for a key, as further described herein. The secure key manager 208 may set a key access indicator to disable and / or enable for a key in response to a signal from the secure host 204 indicating to disable and / or enable key access.

[0053] Security host 204 can be configured to detect cryptographic key access control events, such as those from computing devices (e.g., Figure 1 The computing device 10) undergoes a change in its state. For example, a password key access control event may include switching between a locked and unlocked state. The security host 204 can be configured to interpret different password key access control events to trigger the disabling and / or enabling of password key access. In response to detecting a password key access control event, the security host 204 can be configured to determine whether a password key stored at the integrated cryptographic engine 206 has an enabled password key access control policy. The security host 204 can determine whether a password key has an enabled password key access control policy based on the association between the password key and a password key access control policy indicator. The security host 204 can be configured to signal to disable and / or enable password key access for password keys with password key access control policies enabled for the secure password key manager 208.

[0054] The secure password key manager 208 can be configured to interpret signals from the secure host 204 to disable and / or enable password key access, and respond by updating the password key access indicator associated with the password key. Updating the password key access indicator may include setting the password key access indicator to a disabled and / or enabled value.

[0055] In some examples, the security host 204 master controller can be configured to determine whether one or more cryptographic key groups with cryptographic key access control policies are enabled for the same and / or different cryptographic key access control events. The security host 204 can be configured to signal to disable and / or enable cryptographic key access for one or more cryptographic key groups with cryptographic key access control policies enabled for the security cryptographic key manager 208. The security cryptographic key manager 208 can be configured to interpret the signaling from the security host 204 to disable and / or enable cryptographic key access and respond by updating cryptographic key access indicators associated with one or more different cryptographic key groups. In some examples, a cryptographic key group may include at least one cryptographic key.

[0056] The secure key manager 208 can be configured to interpret key requests from the integrated cryptographic engine 206 and respond based on whether key access is disabled and / or whether one or more keys for the requested key are enabled. The secure key manager 208 can determine whether a key disables and / or enables key access based on the association between the key and a key access indicator. For keys with disabled key access, the secure key manager 208 can send an error message to the integrated cryptographic engine 206. For keys with enabled key access, the secure key manager 208 can send the key to the integrated cryptographic engine 206.

[0057] Figure 2A An example of a password key access control system 200 that implements disabled password key access is illustrated. A secure host 204 can receive a password key access control event signal 220 from a non-secure host 202, configured to indicate a password key access control event for disabling password key access. The secure host 204 can respond to the password key access control event signal 220 by determining that one or more password keys have an enabled password key access control policy and sending a disabled password key access signal 222 to a secure password key manager 208. The secure password key manager 208 can receive the disabled password key access signal 222 and respond by setting the password key access indicator associated with one or more password keys to a disabled value.

[0058] The integrated cryptographic engine 206 can receive a data request signal 224 from the insecure host 202 and respond by sending a cryptographic key request signal 226 to the secure cryptographic key manager 208 for one or more cryptographic keys to fulfill the data request. The secure cryptographic key manager 208 can determine that cryptographic key access is disabled for one or more cryptographic keys and return an error signal 228 to the integrated cryptographic engine 206. The integrated cryptographic engine 206 can return an error signal 230 to the insecure host 202.

[0059] Figure 2B An example of a password key access control system 200 implementing enabled password key access is shown. A secure host 204 can receive a password key access control event signal 240 from a non-secure host 202, configured to indicate a password key access control event for enabling password key access. The secure host 204 can respond to the password key access control event signal 240 by determining that one or more password keys have an enabled password key access control policy and sending an enabled password key access signal 242 to a secure password key manager 208. The secure password key manager 208 can receive the enabled password key access signal 242 and respond by setting the password key access indicator associated with one or more password keys to an enabled value.

[0060] The integrated cryptographic engine 206 can receive a data request signal 244 from the insecure host 202 and respond by sending a cryptographic key request signal 246 to the secure cryptographic key manager 208 for one or more cryptographic keys to fulfill the data request. The secure cryptographic key manager 208 can determine that cryptographic key access is enabled for one or more cryptographic keys and return a cryptographic key signal 248 to the integrated cryptographic engine 206. The cryptographic key signal 248 may include one or more cryptographic keys and / or units for accessing one or more cryptographic keys (such as memory addresses). The integrated cryptographic engine 206 can use one or more cryptographic keys to fulfill the data request and return a result signal 250 to the insecure host 202.

[0061] Figure 3 Examples of cryptographic keys suitable for implementing various embodiments of a cryptographic key access control system are shown. References Figure 1-3 Advanced operating system 302 (e.g., Figure 2A and 2B The non-secure host 202), secure host 204, and cryptographic key management service 304 (by...) Figure 1 The processor 14 and the integrated cryptographic module 38 are located in the middle. Figure 2A and 2BThe secure host 204, the integrated cryptographic engine 206, and the secure cryptographic key manager 208, or one or a combination thereof, can be executed and / or as part of them, to access the cryptographic key system (e.g., Figure 2A and 2B The password key 300 in the password key access control system 200 is programmed.

[0062] The advanced operating system 302 can invoke a call to program one or more cryptographic keys in the cryptographic key access system to the secure host 204 (step 310). In some examples, the call to program one or more cryptographic keys can be configured to identify one or more cryptographic keys and / or include cryptographic key policy parameters. In some examples, the cryptographic key policy parameters can be configured to instruct the secure host 204 on a cryptographic key policy and / or enable a cryptographic key policy. In some examples, the cryptographic key policy can be a cryptographic key access control policy.

[0063] The security host 204 can respond to the call (step 310) by invoking the storage of the association between one or more cryptographic keys and cryptographic key access control policies (step 312) to the cryptographic key management service 304. In some examples, the call to store the association between one or more cryptographic keys and cryptographic key access control policies can be configured to identify one or more cryptographic keys and / or include cryptographic key policy parameters.

[0064] The cryptographic key management service 304 can respond to the call (step 312) by identifying a cryptographic key access control policy by determining cryptographic key policy parameters and storing the association between one or more cryptographic keys and cryptographic key access control policies (step 314). The cryptographic key management service 304 can store the association between one or more cryptographic keys and cryptographic key access control policies in an integrated cryptographic engine (e.g., ...). Figure 2A and 2B The integrated cryptographic engine 206 in the example. For example, the integrated cryptographic engine may include a memory (not shown) that can store the association of one or more cryptographic keys and cryptographic key access control policies therein. Figure 1 (Memory 16 in the integrated cryptographic engine). The cryptographic key management service 304 can store the association of one or more cryptographic keys and cryptographic key access control policies in files, data structures, databases, etc. at the integrated cryptographic engine.

[0065] The password key management service 304 can return a password key reference to the security manager 204 (step 316), and the security manager 204 can return the password key reference to the advanced operating system 302 (step 318). The password key reference can be used to identify one or more password keys that are requesting data access to the password key system.

[0066] Figure 4A and 4B Examples of disabling and enabling cryptographic key access in a cryptographic key access control system suitable for implementing various embodiments are shown. References Figure 1-4B Password key access control events 402a and 402b can trigger the disabling of the password key access control system (e.g., Figure 2A and 2B The password key access control system 200 in the system enables password key access 400 and enables password key access 420.

[0067] exist Figure 4A In the example shown, password key access control event 402a can trigger the disabling of password key access 400 in the key access control system. Password key access control event 402a can also trigger a non-secure host (e.g., non-secure host 202 in Figure 2) to send a password key access control event signal (e.g., ...) to secure host 204. Figure 2A Password key access control event signal 220)(step 410).

[0068] The secure host 204 can respond to the signal (step 410) by sending a call to the cryptographic key management service 304 to disable cryptographic key access (step 412). In some examples, the call (step 412) may include a cryptographic key reference for disabling cryptographic key access for one or more cryptographic keys. In some examples, the cryptographic key reference may be used to identify one or more cryptographic keys. The secure host 204 can retrieve information for use with the cryptographic keys stored in the integrated cryptographic engine (e.g., Figure 2A and 2B The integrated cryptographic engine (206) may include cryptographic key references to one or more cryptographic keys associated with a cryptographic key access control policy. For example, the integrated cryptographic engine may include a memory (not shown) where the association between one or more cryptographic keys (which may be represented by cryptographic key references) and a cryptographic key access control policy can be stored. Figure 1 (Memory 16 in the memory).

[0069] The cryptographic key management service 304 can respond to the call (step 412) by updating the cryptographic key access indicator associated with the cryptographic key identified using a cryptographic key reference to a disabled value (step 414). The cryptographic key store 404, which may be part of an integrated cryptographic engine (e.g., ...), Figure 1 The memory 16 in the cryptographic key can store updated cryptographic key access indicators associated with the cryptographic key (step 416). The cryptographic key memory 404 can store the association of updated cryptographic key access indicators associated with the cryptographic key in files, data structures, databases, etc. at the integrated cryptographic engine.

[0070] exist Figure 4B In the example shown, password key access control event 402b can trigger the enabling of password key access 420 in the key access control system. Password key access control event 402b can also trigger a non-secure host (e.g., non-secure host 202 in Figure 2) to send a password key access control event signal (e.g., ...) to secure host 204. Figure 2A Password key access control event signal 220)(step 430).

[0071] The secure host 204 can respond to the signal (step 430) by sending a call to the cryptographic key management service 304 to enable cryptographic key access (step 432). In some examples, the call (step 432) may include a cryptographic key reference for one or more cryptographic keys for which cryptographic key access is to be enabled. In some examples, the cryptographic key reference may be used to identify one or more cryptographic keys. The secure host 204 may retrieve information for use with the cryptographic key management service (e.g., the integrated cryptographic engine). Figure 2A and 2B The integrated cryptographic engine (206) may include cryptographic key references to one or more cryptographic keys associated with a cryptographic key access control policy. For example, the integrated cryptographic engine may include a memory (not shown) where the association between one or more cryptographic keys (which may be represented by cryptographic key references) and a cryptographic key access control policy can be stored. Figure 1 (Memory 16 in the memory).

[0072] The cryptographic key management service 304 can respond to the call (step 432) by updating the cryptographic key access indicator associated with the cryptographic key identified using the cryptographic key reference to an enabled value (step 434). The cryptographic key store 404, which may be part of an integrated cryptographic engine (e.g., ...), Figure 1 The memory 16 in the cryptographic key can store updated cryptographic key access indicators associated with the cryptographic key (step 436). The cryptographic key memory 404 can store the association of updated cryptographic key access indicators associated with the cryptographic key in files, data structures, databases, etc. at the integrated cryptographic engine.

[0073] Figure 5 A method for cryptographic key management for an integrated cryptographic engine, according to some embodiments, is illustrated. References Figures 1 to 5 Method 500 can be used in computing devices (e.g., Figure 1 In the computing device 10), in the processor (e.g., Figure 1 The processor 14 and the integrated cryptographic module 38 are located in the middle. Figure 2A and 2B The software executed in the integrated cryptographic engine 206, in general-purpose hardware, and in special-purpose hardware (e.g., Figure 1 The integrated cryptographic module 38, secure host 204, and integrated cryptographic engine 206 are included. Figure 2A and 2B Implemented in a secure cryptographic key manager 208, or in a combination of a software-configured processor and dedicated hardware, such as in a cryptographic key access control system (e.g., Figure 2A and 2B The processor executing software within the cryptographic key access control system 200 includes other separate components and various memory / cache controllers. To cover alternative configurations enabled in various embodiments, the hardware implementing method 500 is referred to herein as an "integrated cryptographic device".

[0074] In box 502, the integrated cryptographic device can program the cryptographic key. This document refers to the reference. Figure 6 Method 600 further describes a programmable cryptographic key. In some embodiments, the integrated cryptographic device for programming the cryptographic key in block 502 may include a processor (e.g., Figure 1 The processor 14 and the integrated cryptographic module 38 are located in the middle. Figure 2A and 2B The integrated cryptographic engine 206), integrated cryptographic modules (e.g., Figure 1 Integrated cryptographic module 38), secure host (e.g., Figure 2A and 2B Secure host 204), integrated cryptographic engine (e.g., Figure 2A and 2B The integrated cryptographic engine 206) and / or secure cryptographic key manager (e.g., Figure 2A and 2B (Secure password key manager 208 in the middle).

[0075] In box 504, the integrated cryptographic device can detect cryptographic key access control events. Cryptographic key access control events can be events that trigger the integrated cryptographic device to implement cryptographic key access control policies, such as by disabling and / or enabling cryptographic key access. Cryptographic key access control events can include computing devices (e.g., Figure 1 The computing device 10 in the computing device (integrated cryptographic device 10) changes the state of the computing device. For example, cryptographic key access control events may include switching between locked and unlocked states. The integrated cryptographic device can be integrated from components of the computing device (e.g., insecure hosts, etc.). Figure 2A and 2B The insecure host 202 in block 504 receives an indication of an integrated cryptographic key access control event. In some embodiments, the integrated cryptographic device that detects the cryptographic key access control event in block 504 may include a processor, an integrated cryptographic module, and / or a secure host.

[0076] In determination block 506, the integrated cryptographic device can determine whether a cryptographic key access control event is used to disable or enable cryptographic key access. The integrated cryptographic device can be configured to interpret different cryptographic key access control events used to trigger the disabling and / or enabling of cryptographic key access. For example, the integrated cryptographic device can be configured to interpret a cryptographic key access control event of a locked computing device as disabling cryptographic key access. Similarly, the integrated cryptographic device can be configured to interpret a cryptographic key access control event of an unlocked computing device as enabling cryptographic key access. In some embodiments, the integrated cryptographic device determining whether the cryptographic key access control event in block 506 is used to disable or enable cryptographic key access may include a processor, an integrated cryptographic module, and / or a security host.

[0077] In response to determining that a cryptographic key access control event is for enabling cryptographic key access (i.e., determining box 506 = "Enable"), in box 508, the integrated cryptographic device can enable cryptographic key access. The integrated cryptographic device can identify the cryptographic key that is enabled for its cryptographic key access control policy. For example, the integrated cryptographic device can retrieve and store in memory (e.g., ...) in a manner associated with an indication that the cryptographic key access control policy is enabled. Figure 1 Information related to the cryptographic key stored in memory 16. The integrated cryptographic device can use the information associated with the cryptographic key to update the associated cryptographic key access control policy to an enabled value for that cryptographic key. For example, the integrated cryptographic device can identify whether updating the cryptographic key access indicator to an enabled value is related to the cryptographic key access control policy used for it stored in memory (e.g., memory 16). Figure 1 Memory 16 in Figure 4A and Figure 4B The cryptographic key information related to the cryptographic key in the cryptographic key storage (404) is stored, and the cryptographic key access indicator is set to an enabled value. In some embodiments, the integrated cryptographic device that enables cryptographic key access in block 508 may include a processor, an integrated cryptographic module, a secure host, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0078] In block 510, the integrated cryptographic device can receive data requests from a non-secure host. Data requests can be read and / or write requests for which the integrated cryptographic device can use cryptographic key tools to decrypt and / or encrypt data. In some embodiments, the integrated cryptographic device receiving data requests from a non-secure host in block 510 may include a processor, an integrated cryptographic module, and / or an integrated cryptographic engine.

[0079] In block 512, the integrated cryptographic device may attempt to retrieve the cryptographic key. The integrated cryptographic device may determine that a cryptographic key access indicator used for the cryptographic key is set to an enabled value. In some instances, the integrated cryptographic device may retrieve the cryptographic key from memory where the cryptographic key is stored. In some instances, the integrated cryptographic device may retrieve the location of the cryptographic key at the memory where the cryptographic key is stored. In some embodiments, the integrated cryptographic device attempting to retrieve the cryptographic key in block 512 may include a processor, an integrated cryptographic module, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0080] In block 514, the integrated cryptographic device can send a cryptographic key. For example, the integrated cryptographic device can send a cryptographic key from within one component of the integrated cryptographic device to another component of the integrated cryptographic device. In some examples, the integrated cryptographic device can send a cryptographic key retrieved from memory. In some examples, the integrated cryptographic device can send the location of the cryptographic key at memory. In some embodiments, the integrated cryptographic device sending the cryptographic key in block 514 may include a processor, an integrated cryptographic module, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0081] In block 516, the integrated cryptographic device may receive a cryptographic key. For example, the integrated cryptographic device may receive the cryptographic key internally from another component of the integrated cryptographic device at one component of the integrated cryptographic device. In some instances, the integrated cryptographic device may receive the cryptographic key retrieved from memory. In some examples, the integrated cryptographic device may receive the cryptographic key at a location in memory. In some embodiments, the integrated cryptographic device receiving the cryptographic key in block 516 may include a processor, an integrated cryptographic module, and / or an integrated cryptographic engine.

[0082] In response to determining that the cryptographic key access control event is for disabling cryptographic key access (i.e., determining box 506 = "Disable"), the integrated cryptographic device can disable cryptographic key access in box 518. The integrated cryptographic device can disable cryptographic key access in a manner similar to enabling cryptographic key access in box 508 by setting the cryptographic key access indicator to a disabled value instead of an enabled value. In some embodiments, the integrated cryptographic device disabling cryptographic key access in box 518 may include a processor, an integrated cryptographic module, a secure host, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0083] In block 520, the integrated cryptographic device can receive data requests from a non-secure host. Data requests can be read and / or write requests for which the integrated cryptographic device can use cryptographic key tools to decrypt and / or encrypt data. In some embodiments, the integrated cryptographic device receiving data requests from a non-secure host in block 520 may include a processor, an integrated cryptographic module, and / or an integrated cryptographic engine.

[0084] In box 522, the integrated cryptographic device may attempt to retrieve the cryptographic key. The integrated cryptographic device may determine that the cryptographic key access indicator used for the cryptographic key is set to a disabled value. The integrated cryptographic device may be unable to retrieve the cryptographic key. In some embodiments, the integrated cryptographic device attempting to retrieve the cryptographic key in box 522 may include a processor, an integrated cryptographic module, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0085] In box 524, the integrated cryptographic device may send an error response. An integrated cryptographic device that fails to retrieve a cryptographic key may generate and send an error response for the failure. For example, the integrated cryptographic device may send an error response from within one component of the integrated cryptographic device to another component of the integrated cryptographic device. In some embodiments, the integrated cryptographic device sending the error response in box 524 may include a processor, an integrated cryptographic module, an integrated cryptographic engine, and / or a secure cryptographic key manager.

[0086] In block 526, the integrated cryptographic device may receive an error response. For example, the integrated cryptographic device may receive an error response at one component of the integrated cryptographic device from within another component of the integrated cryptographic device. In some embodiments, the integrated cryptographic device receiving an error response in block 526 may include a processor, an integrated cryptographic module, and / or an integrated cryptographic engine.

[0087] Figure 6 Methods for programming cryptographic keys used in integrated cryptographic engines are illustrated according to some embodiments. References Figures 1 to 6 Method 600 can be used in computing devices (e.g., Figure 1 In the computing device 10), in the processor (e.g., Figure 1 The processor 14 and the integrated cryptographic module 38 are located in the middle. Figure 2A and 2B The software executed in the integrated cryptographic engine 206, in general-purpose hardware, and in special-purpose hardware (e.g., Figure 1 The integrated cryptographic module 38, secure host 204, and integrated cryptographic engine 206 are included. Figure 2A and 2B Implemented in a secure cryptographic key manager 208, or in a combination of a software-configured processor and dedicated hardware, such as in a cryptographic key access control system (e.g., Figure 2A and 2B The processor executing software within the cryptographic key access control system 200 includes other separate components and various memory / cache controllers. To cover alternative configurations enabled in various embodiments, the hardware implementing method 600 is referred to herein as an "integrated cryptographic device".

[0088] In box 602, the integrated cryptographic device can receive a cryptographic key. The integrated cryptographic device can receive the key from memory (e.g., ...). Figure 1 Memory 24 in Figure 2A and Figure 2B The secure non-volatile memory 210 in the memory receives the cryptographic key. In some embodiments, the integrated cryptographic device that receives the cryptographic key in block 602 may include a processor (e.g., Figure 1 The processor 14 and the integrated cryptographic module 38 are located in the middle. Figure 2A and 2B The integrated cryptographic engine 206), integrated cryptographic modules (e.g., Figure 1 The integrated cryptographic module 38) and / or the secure host (e.g., Figure 2A and 2B (Security host 204 in the middle).

[0089] In block 604, the integrated cryptographic device may receive cryptographic key access control policy parameters for enabling a cryptographic key access control policy. In some examples, the received cryptographic key and the received cryptographic key access control policy parameters may be part of a call for programming the cryptographic key and / or enabling cryptographic key access control for the cryptographic key. In some embodiments, the integrated cryptographic device receiving the cryptographic key access control policy parameters for enabling a cryptographic key access control policy in block 604 may include a processor, an integrated cryptographic module, and / or a secure host.

[0090] In box 606, the integrated cryptographic device can enable a cryptographic key access control policy for the cryptographic key. Enabling the cryptographic key access control policy may include the integrated cryptographic device storing an association between the cryptographic key and a cryptographic key access control policy indicator in memory (not shown; for example, ...). Figure 1 The files, data structures, databases, etc., in the memory (16) are stored in the memory. In some embodiments, the integrated cryptographic device that enables the cryptographic key access control policy for the cryptographic key in block 606 may include a processor, an integrated cryptographic module, and / or a secure host.

[0091] In box 608, the integrated cryptographic device can enable key access to the cryptographic key. Enabling key access may include the integrated cryptographic device storing an association between the cryptographic key and a key access indicator in memory (not shown; for example, ...). Figure 1 In some embodiments, the integrated cryptographic device that enables cryptographic key access to the cryptographic key in block 608 may include a processor, an integrated cryptographic module, and an integrated cryptographic engine (e.g., ...). Figure 2A and 2BThe integrated cryptographic engine 206) and / or secure cryptographic key manager (e.g., Figure 2A and 2B (Secure password key manager 208 in the middle).

[0092] Various embodiments (including but not limited to the above-mentioned reference appendix) Figure 1-6 The described embodiments can be implemented in various computing systems, including mobile computing devices. Figure 7 Examples of mobile computing devices applicable to various embodiments are illustrated. Mobile computing device 700 may include a processor 702 coupled to a touchscreen controller 704 and internal memory 706. Processor 702 may be one or more multi-core integrated circuits designated for general or specific processing tasks. Internal memory 706 may be volatile or non-volatile memory, and may also be secure and / or encrypted memory, or insecure and / or unencrypted memory, or any combination thereof. Examples of memory types that can be utilized include, but are not limited to, DDR, LPDDR, GDDR, WideIO, RAM, SRAM, DRAM, P-RAM, R-RAM, M-RAM, STT-RAM, embedded DRAM, non-volatile flash memory, UFS, SDCC, etc. Touchscreen controller 704 and processor 702 may also be coupled to a touchscreen panel 712, such as a resistive-sensing touchscreen, a capacitive-sensing touchscreen, an infrared-sensing touchscreen, etc.

[0093] Mobile computing device 700 may have one or more wireless transceivers 708 (e.g., Peanut, Bluetooth, Zigbee, Wi-Fi, RF radio) and antennas 710 coupled to each other and / or coupled to processor 702 for transmitting and receiving communications. The transceivers 708 and antennas 710 may be used together with the circuitry mentioned above to implement various wireless transmission protocol stacks and interfaces. Mobile computing device 700 may include a cellular wireless modem chip 716, which enables communication via a cellular network and is coupled to processor 702.

[0094] Mobile computing device 700 may include a peripheral device connection interface 718 coupled to processor 702. The peripheral device connection interface 718 may be configured individually to accept one type of connection, or it may be configured to accept various types of physical and communication connections, common or proprietary, such as Universal Serial Bus (USB), FireWire, Thunderbolt, or PCIe. The peripheral device connection interface 718 may also be coupled to a similarly configured peripheral device connection port (not shown).

[0095] The mobile computing device 700 may also include a speaker 714 for providing audio output. The mobile computing device 700 may also include a housing 720 made of plastic, metal, or a combination of materials for housing all or some of the components described herein. The mobile computing device 700 may include a power supply 722 coupled to the processor 702, such as a disposable or rechargeable battery. The rechargeable battery may also be coupled to a peripheral connection port to receive charging current from a source external to the mobile computing device 700. The mobile computing device 700 may also include a physical button 724 for receiving user input. The mobile computing device 700 may also include a power button 726 for turning the mobile computing device 700 on and off.

[0096] Various embodiments (including but not limited to the above-mentioned reference appendix) Figure 1-6 The described embodiments can be implemented in a wide variety of computing systems, including a laptop computer 800, an example of which is... Figure 8 As shown in the figure. Many laptop computers include a touchpad touch surface 817 that serves as a pointing device for the computer and can therefore receive drag, scroll, and flick actions similar to those described above on computing devices equipped with touchscreen displays. Laptop computer 800 typically includes a processor 802 coupled to volatile memory 812 and a hard disk drive 813 of mass non-volatile memory (e.g., flash memory). Additionally, computer 800 may have one or more antennas 808 for transmitting and receiving electromagnetic radiation, which may be connected to a wireless data link and / or a cellular transceiver 816 coupled to processor 802. Computer 800 may also include a floppy disk drive 814 and a compact optical disc (CD) drive 815 coupled to processor 802. In a laptop configuration, the computer casing includes a touchpad 817, a keyboard 818, and a display 819, all coupled to processor 802. Other configurations of the computing device may include (e.g., via USB input) a computer mouse or trackball coupled to processor 802, which, as is known, may also be used in combination with various embodiments.

[0097] Various embodiments (including, but not limited to, those referenced above) can also be implemented in fixed computing systems (such as any of a variety of commercially available servers). Figure 1-6 (Described embodiments). Figure 9 Example server 900 is shown. Such a server 900 typically includes one or more multi-core processor components 901, coupled to volatile memory 902 and mass non-volatile memory (such as disk drives 904). Figure 9As shown, multi-core processor components 901 can be added to server 900 by inserting them into a component rack. Server 900 may also include a floppy disk drive, compact optical disc (CD), or digital versatile optical disc (DVD) drive 906 coupled to processor 901. Server 900 may also include a network access port 903 coupled to multi-core processor components 901 for establishing a network interface connection to network 905, such as a local area network, the Internet, the public switched telephone network, and / or a cellular data network (e.g., CDMA, TDMA, GSM, PCS, 3G, 4G, 5G, LTE, or any other type of cellular data network) coupled to other broadcast system computers and servers.

[0098] Computer program code or "program code" for execution on a programmable processor to implement the operations of the various embodiments may be written in high-level programming languages ​​such as C, C++, C#, Smalltalk, Java, JavaScript, Visual Basic, Structured Query Language (e.g., Transact-SQL), Perl, or in various other programming languages. As used herein, program code or program stored on a computer-readable storage medium may refer to machine language code (such as object code) in a format understandable by a processor.

[0099] The following paragraphs describe implementation examples. While some implementation examples are described below based on example systems, devices, or methods, further example implementations may include: the example system or device discussed in the following paragraphs being implemented as a method for performing operations of the example system or device; the example system, device, or method discussed in the following paragraphs being implemented by an inline cryptographic device configured to perform operations of the example system, device, or method; the example system, device, or method discussed in the following paragraphs being implemented by a computing device including a processing device configured to process device-executable instructions to perform operations of the example system, device, or method; a computing device including units for performing the functions of the example system, device, or method; and the example system, device, or method discussed in the following paragraphs being implemented as a non-transitory processor-readable storage medium having processor-executable instructions stored thereon configured to cause a processor of the computing device to perform operations of the example system, device, or method.

[0100] Example 1. A method for managing cryptographic keys of an integrated cryptographic engine, implemented in a processor, comprising: detecting a cryptographic key access control event; determining whether the cryptographic key access control event is used to disable cryptographic key access at a cryptographic key memory of the integrated cryptographic engine; disabling cryptographic key access at the cryptographic key memory in response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key memory; and maintaining one or more cryptographic keys at the cryptographic key memory for which cryptographic key access is disabled.

[0101] Example 2, the method according to Example 1, further includes: receiving a data request after disabling access to the cryptographic key at the cryptographic key storage; attempting to retrieve the cryptographic key from the cryptographic key storage; and sending an error response.

[0102] Example 3, the method according to any one of Examples 1 or 2, wherein disabling access to the cryptographic key at the cryptographic key storage includes setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to a disabled value.

[0103] Example 4, the method according to any one of Examples 1-3, further includes: enabling password key access at the password key storage in response to determining that the password key access control event is not used to disable password key access at the password key storage.

[0104] Example 5, the method according to Example 4, further includes: after enabling access to the cryptographic key at the cryptographic key storage, receiving a data request; attempting to retrieve the cryptographic key from the cryptographic key storage; and sending the cryptographic key.

[0105] Example 6, the method according to any one of Examples 4 or 5, wherein enabling cryptographic key access at the cryptographic key storage location includes setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to an enabled value.

[0106] Example 7, the method according to any one of Examples 1-6, further includes: receiving a cryptographic key access control policy parameter for the one or more cryptographic keys configured to enable a cryptographic key access control policy; and enabling the cryptographic key access control policy for the one or more cryptographic keys in response to receiving the cryptographic key access control policy parameter.

[0107] Example 8, according to the method of Example 7, wherein enabling the cryptographic key access control policy for the one or more cryptographic keys may include associating the one or more cryptographic keys with one or more cryptographic key access indicators.

[0108] The foregoing method descriptions and process flow diagrams are provided as illustrative examples only and are not intended to require or imply that the operations of the various embodiments must be performed in the given order. The order of operations in the foregoing embodiments can be performed in any order. Words such as "then," "following," "next," etc., are not intended to limit the order of operations; these words are only used to guide the reader in reading the description of the method. Furthermore, any reference to singular claim elements, such as the use of the articles "a," "an," or "the," should not be construed as limiting the elements to the singular.

[0109] The various illustrative logic blocks, modules, circuits, and algorithmic operations described in conjunction with the various embodiments can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and operations have been generally described above in accordance with their functions. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the entire system. Those skilled in the art can implement the described functionality in varying ways for each specific application, but such implementation decisions should not be construed as causing a departure from the scope of the claims.

[0110] Hardware for implementing the various illustrative logic units, logic blocks, modules, and circuits described herein can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors incorporating a DSP core, or any other such configuration. Alternatively, some methods or operations may be performed by a circuit system specific to a given function.

[0111] In one or more embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code on a non-transitory computer-readable medium or a non-transitory processor-readable medium. The operation of the methods or algorithms disclosed herein may be embodied in a processor-executable software module, which may reside on a non-transitory computer-readable or processor-readable storage medium. A non-transitory computer-readable or processor-readable storage medium may be any storage medium accessible by a computer or processor. By way of example and not limitation, such a non-transitory computer-readable or processor-readable medium may include RAM, ROM, EEPROM, flash memory, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium capable of storing desired program code having the form of instructions or data structures and accessible by a computer. As used herein, "disk" and "optical disc" include compact optical discs (CDs), laser optical discs, optical discs, digital versatile optical discs (DVDs), floppy disks, and Blu-ray discs, wherein disks typically magnetically copy data, while optical discs utilize lasers to optically copy data. The combinations above are also included within the scope of non-transitory computer-readable and processor-readable media. Additionally, the operation of a method or algorithm may reside as one or any combination or set of code and / or instructions on a non-transitory processor-readable medium and / or computer-readable medium that may be incorporated into a computer program product.

[0112] The foregoing description of the disclosed embodiments is provided to enable any person skilled in the art to implement or use the claims. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and implementations without departing from the scope of the claims. Therefore, this disclosure is not intended to be limited to the embodiments and implementations shown herein, but is accorded the widest scope consistent with the appended claims and the principles and novel features disclosed herein.

Claims

1. A method for managing cryptographic keys of an integrated cryptographic engine, implemented in a processor, comprising: Detect password key access control events; Determine whether the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage of the integrated cryptographic engine; In response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage, the cryptographic key access at the cryptographic key storage is disabled; as well as One or more cryptographic keys whose access to cryptographic keys is disabled are maintained at the cryptographic key storage.

2. The method according to claim 1, further comprising: After disabling access to the cryptographic key at the cryptographic key storage: Receive data requests; Attempt to retrieve the cryptographic key from the cryptographic key storage; as well as Send an error response.

3. The method according to claim 1, wherein, Disabling access to the cryptographic key storage includes setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to a disabled value.

4. The method according to claim 1, further comprising: In response to determining that the cryptographic key access control event is not used to disable cryptographic key access at the cryptographic key storage, enable cryptographic key access at the cryptographic key storage.

5. The method according to claim 4, further comprising: After enabling access to the cryptographic key at the cryptographic key storage: Receive data requests; Attempt to retrieve the cryptographic key from the cryptographic key storage; as well as Send the password key.

6. The method according to claim 4, wherein, Enabling access to the cryptographic key storage includes setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to an enabled value.

7. The method according to claim 1, further comprising: Receive cryptographic key access control policy parameters for the one or more cryptographic keys configured to enable cryptographic key access control policy; as well as In response to receiving the cryptographic key access control policy parameters, the cryptographic key access control policy for the one or more cryptographic keys is enabled.

8. The method according to claim 7, wherein, Enabling the cryptographic key access control policy for the one or more cryptographic keys includes associating the one or more cryptographic keys with one or more cryptographic key access indicators.

9. A computing device, comprising: The processor is configured as follows: Detect password key access control events; Determine whether the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage of the integrated cryptographic engine; In response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage, the cryptographic key access at the cryptographic key storage is disabled; as well as One or more cryptographic keys whose access to cryptographic keys is disabled are maintained at the cryptographic key storage.

10. The computing device according to claim 9, wherein, The processor is also configured to: Receive data requests; Attempt to retrieve from the cryptographic key store a cryptographic key for which access to cryptographic keys is disabled; and Send an error response.

11. The computing device according to claim 9, wherein, The processor is also configured to set one or more cryptographic key access indicators associated with the one or more cryptographic keys to a disabled value.

12. The computing device according to claim 9, wherein, The memory is also configured to enable password key access at the password key memory in response to determining that the password key access control event is not used to disable password key access at the password key memory.

13. The computing device according to claim 12, wherein, The processor is also configured to: Receive data requests; Attempt to retrieve from the cryptographic key store the cryptographic key for which cryptographic key access is enabled; and Send the password key.

14. The computing device according to claim 12, wherein, The computing device is also configured to set one or more cryptographic key access indicators associated with the one or more cryptographic keys to an enabled value.

15. The computing device according to claim 9, wherein, The computing device is also configured to: Receives cryptographic key access control policy parameters for the one or more cryptographic keys configured to enable the cryptographic key access control policy; and In response to receiving the cryptographic key access control policy parameters, the cryptographic key access control policy for the one or more cryptographic keys is enabled.

16. The computing device according to claim 9, wherein, The computing device is also configured to associate the one or more cryptographic keys with one or more cryptographic key access indicators.

17. A computing device, comprising: A unit used to detect cryptographic key access control events; A unit for determining whether the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage of the integrated cryptographic engine; A unit for disabling password key access at the password key memory in response to determining that the password key access control event is used to disable password key access at the password key memory; as well as A unit for maintaining one or more cryptographic keys whose access to the cryptographic key is disabled at the cryptographic key storage.

18. The computing device of claim 17, further comprising: A unit used to receive data requests; A unit for attempting to retrieve from the cryptographic key storage a cryptographic key for which access to cryptographic key is disabled; as well as A unit used to send error responses.

19. The computing device according to claim 17, wherein, The unit for disabling access to the password key at the password key storage includes a unit for setting one or more password key access indicators associated with the one or more password keys to a disabled value.

20. The computing device of claim 17, further comprising: A unit for enabling access to the password key memory in response to determining that the password key access control event is not used to disable password key access at the password key memory.

21. The computing device of claim 20, further comprising: A unit used to receive data requests; A unit for attempting to retrieve from the cryptographic key storage a cryptographic key for which cryptographic key access is enabled; as well as A unit for sending the cryptographic key.

22. The computing device according to claim 20, wherein, The unit for enabling password key access at the password key storage includes a unit for setting one or more password key access indicators associated with the one or more password keys to an enabled value.

23. The computing device of claim 17, further comprising: A unit for receiving cryptographic key access control policy parameters for the one or more cryptographic keys configured to enable cryptographic key access control policy; as well as A unit for enabling the cryptographic key access control policy for the one or more cryptographic keys in response to receiving the cryptographic key access control policy parameters.

24. The computing device according to claim 23, wherein, The unit for enabling the cryptographic key access control policy for the one or more cryptographic keys includes a unit for associating the one or more cryptographic keys with one or more cryptographic key access indicators.

25. A non-transitory processor-readable medium having processor-executable instructions stored thereon, the processor-executable instructions being configured to cause a processing device of a computing device to perform operations including: Detect password key access control events; Determine whether the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage of the integrated cryptographic engine; In response to determining that the cryptographic key access control event is used to disable cryptographic key access at the cryptographic key storage, the cryptographic key access at the cryptographic key storage is disabled; as well as One or more cryptographic keys whose access to cryptographic keys is disabled are maintained at the cryptographic key storage.

26. The non-transitory processor-readable medium according to claim 25, wherein, The stored processor-executable instructions are configured to cause the processor to perform operations that include disabling cryptographic key access at the cryptographic key memory, such as: Receive data requests; Attempt to retrieve the cryptographic key from the cryptographic key storage; and Send an error response.

27. The non-transitory processor-readable medium according to claim 25, wherein, The stored processor-executable instructions are configured to cause the processor to perform an operation that disables access to the cryptographic key memory, including setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to a disabled value.

28. The non-transitory processor-readable medium according to claim 25, wherein, The stored processor-executable instructions are configured to cause the processor to perform operations that include: enabling cryptographic key access at the cryptographic key memory in response to determining that the cryptographic key access control event is not used to disable cryptographic key access at the cryptographic key memory.

29. The non-transitory processor-readable medium according to claim 28, wherein, The stored processor-executable instructions are configured to cause the processor to perform operations that include, after enabling cryptographic key access at the cryptographic key memory: Receive data requests; Attempt to retrieve the cryptographic key from the cryptographic key storage; and Send the password key.

30. The non-transitory processor-readable medium according to claim 28, wherein, The stored processor-executable instructions are configured to cause the processor to perform an operation that enables cryptographic key access at the cryptographic key memory, including setting one or more cryptographic key access indicators associated with the one or more cryptographic keys to an enabled value.

Images