Executing entity-specific cryptographic code in a cryptographic coprocessor
Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises receiving encrypted code that includes implementing a cryptographic algorithm from a service via a network, wherein the encrypted code further includes a symmetric encryption key; decrypting, by a cryptographic coprocessor, the encrypted code; executing, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and sending the cryptogram to the service via the network.
1. A system, comprising:
a computing device comprising a processor, a memory, and a cryptographic coprocessor; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
store a plurality of root keys within the cryptographic coprocessor, wherein at least one or more of the plurality of root keys are associated with a service;
receive encrypted code that includes implementing a cryptographic algorithm from the service via a network, wherein the encrypted code further includes a symmetric encryption key and a key identifier, wherein the key identifier identifies a particular root key of the one or more of the plurality of root keys that are associated with the service and are stored within the cryptographic coprocessor;
decrypt, by the cryptographic coprocessor, the encrypted code using the particular root key associated with the service;
execute, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and
send the cryptogram to the service via the network.
2. The system of claim 1 , wherein the cryptographic coprocessor complies with a version of a Trusted Platform Module (TPM) standard.
3. The system of claim 1 , wherein the cryptographic coprocessor is configured to verify a state of the computing device before decrypting the encrypted code.
4. The system of claim 1 , wherein the service is operated by an entity, and the cryptographic algorithm is a preferred cryptographic algorithm of the entity.
5. The system of claim 1 , wherein the cryptographic coprocessor is configured to verify that the encrypted code is signed by an entity from a predefined plurality of trusted entities before executing the decrypted code.
6. The system of claim 1 , wherein the encrypted code is decrypted using the particular root key of the cryptographic coprocessor that is associated with an entity that generated the encrypted code, wherein the entity provides the service.
7. The system of claim 1 , wherein the service comprises a first service and a second service which are associated with an entity, the encrypted code is received from the first service, and the cryptogram is sent to the second service.
8. The system of claim 1 , wherein the cryptographic coprocessor is implemented in firmware in the computing device, and data is transferred from a secure element of the computing device to the cryptographic coprocessor via an interface to enable decryption of the encrypted code by the cryptographic coprocessor.
9. The system of claim 1 , wherein the cryptographic coprocessor is configured to support a selection from a predefined plurality of cryptographic algorithms to perform a cryptographic operation, and the cryptographic algorithm is excluded from the predefined plurality of cryptographic algorithms.
10. The system of claim 1 , wherein the cryptographic coprocessor is configured to act as a root of trust to verify the cryptographic algorithm before transferring the cryptographic algorithm to a secure element of the computing device.
11. A method, comprising:
storing, by a cryptographic coprocessor, a plurality of root keys within the cryptographic coprocessor, wherein at least one or more of the plurality of root keys are associated with a service;
receiving, by a cryptographic coprocessor, encrypted code that includes implementing a cryptographic algorithm from the service via a network, wherein the encrypted code further includes a symmetric encryption key and a key identifier, wherein the key identifier identifies a particular root key of the one or more of the plurality of root keys that are associated with the service and are stored within the cryptographic coprocessor;
decrypting, by the cryptographic coprocessor, the encrypted code using the particular root key associated with the service;
executing, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and
sending, by the cryptographic coprocessor, the cryptogram to the service via the network.
12. The method of claim 11 , further comprising verifying, by the cryptographic coprocessor, that the encrypted code is signed by an entity from a predefined plurality of trusted entities before executing the decrypted code.
13. The method of claim 11 , further comprising verifying, by the cryptographic coprocessor of a computing device, a state of the computing device before decrypting the encrypted code.
14. The method of claim 11 , wherein the encrypted code is decrypted using the particular root key of the cryptographic coprocessor that is associated with an entity that generated the encrypted code, wherein the entity provides the service.
15. The method of claim 11 , wherein the service comprises a first service and a second service which are associated with an entity, the encrypted code is received from the first service, and the cryptogram is sent to the second service.
16. The method of claim 11 , wherein the cryptographic coprocessor is implemented in firmware in a computing device, and data is transferred from a secure element of the computing device to the cryptographic coprocessor via an interface to enable decryption of the encrypted code by the cryptographic coprocessor.
17. A non-transitory computer-readable medium comprising machine-readable instructions that, when executed by a first computing device, cause the first computing device to at least:
store a plurality of root keys within a cryptographic coprocessor, wherein at least one or more of the plurality of root keys are associated with a service;
receive encrypted code that includes implementing a cryptographic algorithm from the service via a network, wherein the encrypted code further includes a symmetric encryption key and a key identifier, wherein the key identifier identifies a particular root key of the one or more of the plurality of root keys that are associated with the service and are stored within the cryptographic coprocessor;
decrypt the encrypted code using the particular root key associated with the service;
execute the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and
send the cryptogram to the service via the network.
18. The non-transitory computer-readable medium of claim 17 , wherein encrypted code is encrypted using one of a predefined plurality of cryptographic algorithms supported by a standard for the cryptographic coprocessor.
19. The non-transitory computer-readable medium of claim 18 , wherein the encrypted code is decrypted using the particular root key of the cryptographic coprocessor that is associated with an entity that generated the encrypted code, wherein the entity provides the service.