Systems and methods for providing a trusted keystore

1. A method for providing a trusted keystore, comprising:

in an information processing apparatus comprising at least one computer processor:

selecting and storing a root Keyblock Protection Key (KBPK) in a trusted domain;

for each key class:

creating a keyblock with a class KBPK; and

storing the keyblock in an untrusted keystore in an untrusted domain;

loading keyblocks to a trusted key manager in the trusted domain;

decrypting the keyblocks with an encryption class key;

verifying the keyblocks under a MAC class key;

loading class keyblocks to the trusted key manager from the untrusted keystore;

writing the keyblocks to the untrusted keystore; and

writing class keyblock MACs in a hierarchy to the untrusted keystore;

wherein a number of levels in the hierarchy is based on an amount of available storage in the trusted domain.

2. The method of claim 1 , wherein the root KBPK is pre-programed.

3. The method of claim 1 , wherein the keyblock is created using the root KBPK.

4. The method of claim 1 , wherein the step of loading class keyblocks to the trusted key manager from the untrusted keystore comprises authorizing and decrypting the class keyblocks with the root KBPK to get a class KBPK and a keyblockheader.

5. The method of claim 1 , wherein the step of writing the keyblocks to the untrusted keystore comprises creating the keyblock with a key, a keyblockheader payload, and a keyblock KBPK.

6. The method of claim 1 , wherein the step of hierarchically writing class keyblock MACs to the untrusted keystore comprises creating a MAC for all keyblocks in a keyblock class.

7. The method of claim 6 , further comprising verifying all the keyblocks under the MAC class key after hierarchically writing class keyblock MACs to the untrusted keystore.

8. A method for exercising a key in a trusted keystore, comprising:

in a trusted key manager comprising at least one computer processor:

receiving a request from an application to exercise a key in an untrusted keystore;

reading a keyblock including the key from the untrusted keystore;

decrypting and verifying keyblocks in a hierarchy that are below the read keyblock;

loading a class Keyblock Protection Key (KBPK) MAC;

verifying the class KBPK MAC;

trusting the class KeyBlocks MAC;

extracting the key from the keyblock; and

loading the key to an engine;

wherein the engine exercises the key.

9. The method of claim 8 , wherein the exercise comprises at least one of PIN encryption using the key and message authentication using the key.

10. The method of claim 8 , further comprising:

verifying that the application is authorized to exercise the key.

11. The method of claim 8 , wherein the engine performs a cryptographic operation with the key.

12. A trusted keystore system having at least one hardware computer processor, comprising:

an untrusted domain comprising an untrusted keystore and an untrusted key manager;

a trusted domain comprising a trusted key manager and an engine; and

persistent storage;

wherein:

the trusted key manager selects and stores a root Keyblock Protection Key (KBPK) in the trusted domain;

for each key class, the trusted key manager creates a keyblock with a class KBPK and stores the keyblock in the untrusted keystore;

the untrusted key manager loads keyblocks to the trusted key manager in the trusted domain;

the trusted key manager decrypts and verifies keyblocks under a MAC class key;

the untrusted key manager loads class keyblocks to the trusted key manager from the untrusted keystore;

the trusted key manager writes the keyblocks to the untrusted keystore via the untrusted key manager; and

the trusted key manager writes class keyblock MACs in a hierarchy to the untrusted keystore via the untrusted key manager;

wherein a number of levels in the hierarchy is based on an amount of available storage in the trusted domain.

13. The system of claim 12 , wherein the root KBPK is pre-programed in a system-on-a-chip.

14. The system of claim 12 , wherein the keyblock is created using the root KBPK.

15. The system of claim 12 , wherein the trusted key manager authorizes and decrypts the class keyblocks with the root KBPK to get a class KBPK and a keyblockheader.

16. The system of claim 12 , wherein the keyblock is created with a key, a keyblockheader payload, and a keyblock KBPK.

17. The system of claim 12 , wherein the untrusted keystore creates a MAC for all keyblocks in a keyblock class.

18. The system of claim 12 , wherein:

the trusted key manager receives a request from an application to exercise a key in the untrusted keystore;

the trusted key manager reads a keyblock including the key from the untrusted keystore via the untrusted key manager;

the trusted key manager decrypts and verifies keyblocks in the hierarchy that are below the read keyblock;

the trusted key manager loads a class Keyblock Protection Key (KBPK) MAC;

the trusted key manager verifies the class KBPK MAC;

the trusted key manager extracts the key from the keyblock; and

the trusted key manager loads the key to the engine;

wherein the engine exercises the key.

19. The system of claim 18 , wherein the exercise comprises at least one of PIN encryption using the key and message authentication using the key.

20. The system of claim 18 , wherein the engine performs a cryptographic operation with the key.