Decryption key management system
View Patent ↗A decryption key management system includes a memory, a memory controller, a decryption engine, and an on-chip crypto-accelerator. A key blob and an encrypted code are stored in the memory. The memory controller fetches the key blob and stores it in a memory buffer. The decryption engine fetches the key blob and decrypts it using an OTP key to generate a decryption key. The decryption key is used to decrypt the encrypted code and generate a decrypted code.
1. A decryption key management system, comprising:
a memory for storing an encrypted code and a key binary large object (BLOB), wherein the key BLOB is used for generating a decryption key;
a memory controller including a memory buffer and a receive buffer, wherein the memory controller is connected to the memory for fetching the key BLOB and a code segment of the encrypted code from the memory and storing the fetched key BLOB and the fetched code segment in the memory buffer;
a decryption engine connected to the memory controller for (i) fetching the key BLOB and the code segment from the memory buffer and storing them in a local buffer of the decryption engine, (ii) decrypting the key BLOB using a one time programmable (OTP) key to generate the decryption key, (iii) decrypting the code segment using the decryption key to generate a decrypted code segment, and (iv) providing the decrypted code segment to the memory controller for storage in the receive buffer; and
a crypto-accelerator connected to the decryption engine for generating and transmitting the OTP key to the decryption engine, wherein the crypto-accelerator and the decryption engine are formed on the same chip and communicate with each other using side band signals, and
wherein the crypto-accelerator generates the OTP key automatically when the system is powered on,
the local buffer of the decryption engine is not memory mapped so is not accessible by the memory controller, and
the local buffer of the decryption engine is not connected to a scan chain so is not accessible by a debugger.
2. The decryption key management system of claim 1 , wherein the side band signals comprise an OTP key signal for passing the OTP key to the local buffer of the decryption engine and an OTP valid signal for indicating a validity of the OTP key, wherein the OTP key and the OTP valid signals are transparent to any application software running on the system.
3. The decryption key management system of claim 1 , wherein the decryption engine returns a plurality of binary zeroes to the memory controller in response to a fetch operation corresponding to a storage location of the key BLOB.
4. The decryption key management system of claim 1 , wherein the encrypted code and key BLOB are encrypted based on advanced encryption standard-electronic codebook specification.
5. The decryption key management system of claim 1 , wherein the decryption engine decrypts the encrypted code and the key BLOB based on the advanced encryption standard-electronic codebook specification.
6. The decryption key management system of claim 1 , wherein the memory is a queued serial peripheral interface (QSPI) memory.
7. The decryption key management system of claim 1 , wherein the encrypted code is a boot code used for booting an electronic device.
8. The decryption key management system of claim 1 , wherein the decryption key is a symmetric key.
9. A decryption key management system, comprising:
a queued serial peripheral interface (QSPI) memory for storing an encrypted boot code and a key binary large object (BLOB);
a memory controller connected to the memory for fetching the key BLOB and a code segment of the encrypted boot code from the memory, wherein the memory controller includes a memory buffer for storing the key BLOB and the code segment, and a receive buffer for storing decrypted code;
a decryption engine connected to the memory controller for fetching the key BLOB and the code segment from the memory buffer, decrypting the key BLOB using a one time programmable (OTP) key to generate a decryption key, decrypting the code segment using the decryption key to generate a decrypted code segment, and providing the decrypted code segment to the receive buffer of the memory controller, wherein the decryption engine includes a local buffer for storing the fetched key BLOB and code segment and the decryption key; and
a crypto-accelerator connected to the decryption engine for generating the OTP key using a hardware master key and transmitting the OTP key to the decryption engine, wherein the decryption engine, the memory controller and the crypto-accelerator are all formed on the same chip, and the crypto-accelerator generates the OTP key automatically when the system is powered up;
wherein the decryption engine returns a plurality of binary zeroes in response to a fetch operation corresponding to a storage location of the key BLOB; and
wherein the local buffer of the decryption engine is not memory mapped and is masked from scan chains such that the local buffer is not accessible by a debugger.
10. A method of securely booting an electronic device, wherein the electronic device includes a memory, a memory controller, a decryption engine, and a crypto-accelerator, and the memory controller includes a memory buffer and a receive buffer, the method comprising:
storing an encrypted boot code and a key binary large object (BLOB) in the memory, wherein the key BLOB is used for generating a decryption key;
fetching the key BLOB from the memory by the memory controller and storing the key BLOB in the memory buffer;
transmitting the key BLOB from the memory controller to the decryption engine and storing the key BLOB in a local buffer of the decryption engine, wherein the local buffer is not memory mapped and is not connected to a scan chain;
generating a one time programmable (OTP) key by the crypto-accelerator, wherein the crypto-accelerator automatically generates the OTP key when the electronic device is powered on;
transmitting the OTP key to the decryption engine using a side band signal;
decrypting the key BLOB using the OTP key, by the decryption engine, to generate the decryption key;
storing the decryption key in the local buffer of the decryption engine, wherein the decryption key is not accessible by the memory controller;
fetching a code segment of the encrypted boot code from the memory by the memory controller and providing the fetched code segment to the decryption engine;
decrypting the code segment using the decryption key to generate a decrypted code segment, by the decryption engine; and
storing the decrypted code segment in the receive buffer, and
wherein the memory controller returns a string of binary zeroes in response to a fetch operation that indicates an address of the key BLOB.
11. The method of claim 10 , wherein the boot code and the key BLOB are stored in predetermined locations of the memory.
12. The method of claim 11 , wherein the memory controller automatically stops reading the memory after reading a predetermined number of memory addresses.
13. The method of claim 10 , wherein the memory is a queued serial peripheral interface (QSPI) memory.
14. The method of claim 10 , further comprising booting the electronic device using the decrypted code segment.
15. The method of claim 10 , wherein the decryption key is a symmetric key.