Device with privileged memory and applications thereof
View Patent ↗A device includes a key store memory, a rule set memory, a plurality of cryptographic clients, and a key store arbitration module. The key store memory stores a plurality of cryptographic keys and the rule set memory stores a set of rules for accessing the cryptographic keys. A cryptographic client is operable to issue a request to access a cryptographic key(s) and, when access to the cryptographic key is granted, execute a cryptographic function regarding at least a portion of the cryptographic key to produce a cryptographic result. The key store arbitration module is operable to determine whether the request to access the cryptographic key is valid; when the request is valid, interpret the request to produce an interpreted request; access the rule set memory based on the interpreted request to retrieve a rule of the set of rules; and grant access to the cryptographic key in accordance with the rule.
1. A device comprises:
a key store memory operable to store a plurality of cryptographic keys and a plurality of control words;
a rule set memory operable to store a set of rules for accessing the key store memory;
a plurality of cryptographic clients, wherein a cryptographic client of the plurality of cryptographic clients is operable to issue a request to access a control word of the plurality of control words; and
a key store arbitration module operable to:
determine whether the request to access the control word is valid;
when the request to access the control word is valid, interpret the request for access to the control word to produce an interpreted request;
access the rule set memory based on the interpreted request to retrieve a rule of the set of rules; and
grant access to the control word in accordance with the rule.
2. The device of claim 1 wherein the request to access the control word includes a read request.
3. The device of claim 2 wherein, when access to the control word is granted, the cryptographic client of the plurality of cryptographic clients is further operable to execute a cryptographic function regarding at least a portion of the control word to produce a cryptographic result.
4. The device of claim 1 wherein the request to access the control word includes a write request.
5. The device of claim 1 wherein the cryptographic client of the plurality of cryptographic clients is further operable to issue an access request to access a cryptographic key of the plurality of cryptographic keys in response to a decryption request.
6. The device of claim 5 wherein the request to access the cryptographic key includes a read request.
7. The device of claim 6 wherein, when access to the cryptographic key is granted, the cryptographic client of the plurality of cryptographic clients is further operable to execute a cryptographic function to decrypt at least a portion of an encrypted filed using at least a portion of the cryptographic key.
8. The device of claim 5 wherein the request to access the cryptographic key includes a write request.
9. The device of claim 5 , wherein the key store arbitration module is further operable to:
determine whether the request to access the cryptographic key is valid.
10. The device of claim 9 wherein, when the request to access the cryptographic key is valid, the key store arbitration module is further operable to:
access the rule set memory to retrieve another rule of the set of rules; and
grant access to the cryptographic key in accordance with the another rule.
11. A device comprises:
a key store memory operable to store a plurality of cryptographic keys and a plurality of initial vectors;
a rule set memory operable to store a set of rules for accessing the key store memory;
a plurality of cryptographic clients, wherein a cryptographic client of the plurality of cryptographic clients is operable to issue a request to access an initial vector of the plurality of initial vectors; and
a key store arbitration module operable to:
determine whether the request to access the initial vector is valid;
when the request to access the initial vector is valid, interpret the request for access to the initial vector to produce an interpreted request;
access the rule set memory based on the interpreted request to retrieve a rule of the set of rules; and
grant access to the initial vector in accordance with the rule.
12. The device of claim 11 wherein the request to access the initial vector includes a read request.
13. The device of claim 12 wherein, when access to the initial vector is granted, the cryptographic client of the plurality of cryptographic clients is further operable to execute a cryptographic function regarding at least a portion of the initial vector to produce a cryptographic result.
14. The device of claim 11 wherein the request to access the initial vector includes a write request.
15. The device of claim 11 wherein the cryptographic client of the plurality of cryptographic clients is further operable to issue an access request to access a cryptographic key of the plurality of cryptographic keys in response to a decryption request.
16. The device of claim 15 wherein the request to access the cryptographic key includes a read request.
17. The device of claim 16 wherein, when access to the cryptographic key is granted, the cryptographic client of the plurality of cryptographic clients is further operable to execute a cryptographic function to decrypt at least a portion of an encrypted file using at least a portion of the cryptographic key.
18. The device of claim 15 wherein the request to access the cryptographic key includes a write request.
19. The device of claim 15 , wherein the key store arbitration module is further operable to:
determine whether the request to access the cryptographic key is valid.
20. The device of claim 19 wherein, when the request to access the cryptographic key is valid, the key store arbitration module is further operable to:
access the rule set memory to retrieve another rule of the set of rules; and
grant access to the cryptographic key in accordance with the another rule.