Method and device for secure communications over a network using a hardware security engine

1. A system-on-a-chip apparatus comprising:

a system-on-a-chip comprising a security engine that is separate from a processor core of the system-on-a-chip and has a secure memory accessible only by the security engine, wherein the secure memory includes a security key that was encoded in the secure memory during a manufacturing process of the system-on-a-chip, the security engine to:

generate a random nonce for initiating a request for a secure communication session with a remote server over a network using the nonce;

perform a cryptographic key exchange with the remote server;

generate a symmetric session key, based on the cryptographic key exchange, to encrypt messages sent to the remote server and decrypt messages received from the remote server during the secure communication session;

encrypt the symmetric session key based on the security key; and

store the encrypted session key in the secure memory,

the system-on-a-chip to establish the secure communication session with the remote server over the network using the session key.

2. The system-on-a-chip apparatus of claim 1 , wherein the security engine is further to receive a server nonce from the remote server in a response message to the request for the secure communication session, the response message including a server nonce and store the server nonce in the secure memory.

3. The system-on-a-chip apparatus of claim 1 , wherein the security engine is further to generate a pre-master key, encrypt the pre-master key using the security key of the security engine, and send the encrypted pre-master key to the remote server.

4. The system-on-a-chip apparatus of claim 3 wherein the security engine is further to wrap the pre-master key using a server public key and store the wrapped pre-master key in the secure memory.

5. The system-on-a-chip apparatus of claim 3 , wherein the security engine is further to:

generate the session key as a function of the pre-master key; and

calculate a hash function as a function of the random nonce generated by the security engine and a nonce received from the remote server.

6. The system-on-a-chip apparatus of claim 1 , wherein the security engine is further to generate a public Diffie-Hellman client key and a private Diffie-Hellman client key, sign the public Diffie-Hellman client key using the security key of the security engine, and send the signed public Diffie-Hellman key to the remote server.

7. The system-on-a-chip apparatus of claim 6 , wherein the security engine is further to receive a public Diffie-Hellman server key from the remote server and generate the session key as a function of the private Diffie-Hellman client key and the public Diffie-Hellman server key.

8. The system-on-a-chip apparatus of claim 1 , wherein the security engine is further to receive Diffie-Hellman global values and a public Diffie-Hellman server key from the remote server and store at least one of the Diffie-Hellman global values and the public Diffie-Hellman server key in the secure memory.

9. A method comprising:

generating a random nonce in a security engine that is separate from a processor core of a system-on-a-chip of a client device;

initiating, using the client device, a request for a secure communication session with a remote server over a network, the request including the random nonce;

performing a cryptographic key exchange, using the security engine of the system-on-a-chip, with the remote server;

generate a symmetric session key to encrypt messages sent to the remote server and decrypt messages received from the remote server during the secure communication session;

encrypting the session key based on a security key that was encoded in a secure memory of the security engine during a manufacturing process of the system-on-a-chip;

storing the encrypted session key in the secure memory of the security engine of the system-on-a-chip; and

establishing, using the client device, the secure communication session with the remote server using the session key.

10. The method of claim 9 , wherein initiating a request for a secure communication session comprises sending a ClientHello message, including the nonce, to the remote server; and further comprising:

receiving a ServerHello message from the remote server, the ServerHello message including a server nonce; and

storing the server nonce in the secure memory of the security engine of the system-on-a-chip.

11. The method of claim 9 , wherein performing the cryptographic key exchange with the remote server comprises:

generating a pre-master key in the security engine;

encrypting the pre-master key using the security key of the security engine; and

sending the encrypted pre-master key to the remote server.

12. The method of claim 11 , further comprising:

wrapping the pre-master key in the security engine of the system-on-a-chip using a server public key, and

storing the wrapped pre-master key in the secure memory of the security engine of the system-on-a-chip.

13. The method of claim 11 , wherein performing the cryptographic key exchange with the remote server comprises generating the session key in the security engine of the system-on-a-chip as a function of the pre-master key.

14. The method of claim 13 , wherein generating the session key in the security engine comprises calculating, using the security engine of the system-on-a-chip, a hash function as a function of the random nonce generated by the security engine and a nonce received from the remote server.

15. The method of claim 9 wherein performing the cryptographic key exchange with the remote server comprises:

generating, in the security engine of the system-on-a-chip, a public Diffie-Hellman client key and a private Diffie-Hellman client key;

signing the public Diffie-Hellman client key using the security key of the security engine of the system-on-a-chip;

sending the signed public Diffie-Hellman key to the remote server;

receiving a public Diffie-Hellman server key from the remote server; and

generating, in the security engine of the system-on-a-chip, the session key as a function of the private Diffie-Hellman client key and the public Diffie-Hellman server key.

16. The method of claim 9 , further comprising:

generating, in the security engine of the system-on-a-chip, a hash code of a preceding message sent from the client to the remote server;

signing the hash code using the security key stored in the secure memory of the security engine; and

sending a client certificate verification message to the remote server, the client certificate verification message including the signed hash code.

17. One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing device, cause the computing device to:

generate a random nonce in a security engine that is separate from a processor core of a system-on-a-chip of the computing device;

initiate a request for a secure communication session with a remote server over a network, the request including the random nonce;

perform a cryptographic key exchange, using the security engine of the system-on-a-chip, with the remote server;

generate, based on the cryptographic key exchange, a symmetric session key to encrypt messages sent to the remote server and decrypt messages received from the remote server during the secure communication session;

encrypt the session key based on a security key that was encoded in a secure memory of the security engine during a manufacturing process of the system-on-a-chip;

store the session key in the secure memory of the security engine of the system-on-a-chip; and

establish the secure communication session with the remote server using the session key.

18. The one or more non-transitory machine-readable storage media of claim 17 , wherein to initiate a request for a secure communication session comprises to send a ClientHello message, including the nonce, to the remote server; and

wherein the plurality of instructions further cause the computing device to: receive a ServerHello message from the remote server, the ServerHello message including a server nonce; and

store the server nonce in the secure memory of the security engine of the system-on-a-chip.

19. The one or more non-transitory machine-readable storage media of claim 17 , wherein to perform the cryptographic key exchange with the remote server comprises to:

generate a pre-master key in the security engine;

encrypt the pre-master key using the security key of the security engine; and

send the encrypted pre-master key to the remote server.

20. The one or more non-transitory machine-readable storage media of claim 19 , wherein the plurality of instructions further cause the computing device to:

wrap the pre-master key in the security engine of the system-on-a-chip with a server public key, and

store the wrapped pre-master key in the secure memory of the security engine of the system-on-a-chip.

21. The one or more non-transitory machine-readable storage media of claim 19 , wherein to perform the cryptographic key exchange with the remote server comprises to generate the session key in the security engine of the system-on-a-chip as a function of the pre-master key.

22. The one or more non-transitory machine-readable storage media of claim 21 , wherein to generate the session key in the security engine comprises to calculate, using the security engine of the system-on-a-chip, a hash function as a function of the random nonce generated by the security engine and a nonce received from the remote server.

23. The one or more non-transitory machine-readable storage media of claim 17 , wherein to perform the cryptographic key exchange with the remote server comprises to:

generate, in the security engine of the system-on-a-chip, a public Diffie-Hellman client key and a private Diffie-Hellman client key;

sign the public Diffie-Hellman client key using the security key of the security engine of the system-on-a-chip;

send the signed public Diffie-Hellman key to the remote server;

receive a public Diffie-Hellman server key from the remote server; and

generate, in the security engine of the system-on-a-chip, the session key as a function of the private DiffieHellman client key and the public Diffie-Hellman server key.

24. The system-on-a-chip apparatus of claim 1 , wherein the security engine is communicatively coupled to the processor core through an interconnect of the system-on-a-chip.