Secure key access with one-time programmable memory and applications thereof
View Patent ↗A device includes a key store memory that stores one or more cryptographic keys. A rule set memory stores a set of rules for accessing the cryptographic keys. A key store arbitration module grants access to the cryptographic keys in accordance with the set of rules. The device can be used in conjunction with a key ladder. The device can include a one-time programmable memory and a load module that transfers the cryptographic keys from the one one-time programmable memory to the key store memory and the set of rules to the rule set memory. A validation module can validate the cryptographic keys and the set of rules stored in the key store and rule set memories, based on a signature defined by a signature rule.
1. A device comprises:
a key store memory operable to store at least one cryptographic key;
a rule set memory operable to store a set of rules for accessing the at least one cryptographic key, wherein the set of rules includes a signature rule that defines at signature corresponding to at least one of: the set of rules and the at least one cryptographic key;
a key store arbitration module operable to grant access to the cryptographic key in accordance with the set of rules;
at least one one-time programmable memory;
a load module, coupled to the at least one one-time programmable memory and the key store memory, that transfers the at least one cryptographic key from the at least one one-time programmable memory to the key store memory; and
a validation module, coupled to the key store memory, that validates the at least one cryptographic key stored in the key store memory, based on the signature.
2. The device of claim 1 wherein the load module further transfers the set of rules from the at least one one-time programmable memory to the rule set memory.
3. The device of claim 2 wherein the validation module, is further coupled to the rule set memory, and the validation module further validates the set of rules stored in the rule set memory, based on the signature.
4. A method comprising:
storing at least one cryptographic key from the at least one one-time programmable memory to a key store memory;
storing a set of rules from the at least one one-time programmable memory to a rule set memory, wherein the set of rules includes a signature rule that defines a first signature;
retrieving the first signature;
determining the validity of:
the set of rules stored in the rule set memory; and
the at least one cryptographic key stored in the key store memory;
erasing the key store memory and rule set memory, based on a failed validation of at least one of:
the set of rules stored in the rule set memory; and
the at least one cryptographic key stored in the key store memory.
5. The method of claim 4 wherein determining the validity includes:
determining a second signature based on the set of rules stored in the rule set memory, and the at least one cryptographic key stored in the key store memory;
comparing the first signature to the second signature; and
determining the failed validation when the second signature does not match the first signature.