Granted Patent B2

US 12,536,267 · App. 18/111,799 · Granted Jan 27, 2026

Inventors: Christopher Anthony Grant Hillier (Fort Collins, CO); Raghupathy Krishnamurthy (San Jose, CA); Varun Sampath (Santa Clara, CA); Mayur Vivek Gudmeti (Durham, NC)

Assignee: Nvidia Corporation

G06F21/44H04L9/30

Abstract

Claims (64)

1 . A system for implementing mutable device ownership transfer of a device, the system comprising:

device ownership transfer circuitry; and

a processor operatively coupled to the device ownership transfer circuitry, wherein the processor is configured to:

receive a request from a first customer to record a mutable device ownership transfer of a device using a first customer authentication key;

receive the first customer authentication key from the first customer in response to receiving the request;

determine whether the device has an existing customer authentication key installation in a non-volatile memory of a Root of Trust (RoT) associated with the device; and

install, using the device ownership transfer circuitry, the first customer authentication key in the non-volatile memory of the ROT associated with the device in an instance in which the device does not have the existing customer authentication key installation, wherein installing the first customer authentication key in the non-volatile memory of the Root of Trust (ROT) results in no permanent modification to the device.

2 . The system of claim 1 , wherein the processor is configured to:

initially install the first customer authentication key in a volatile memory of the ROT associated with the device in an instance in which the device does not have the existing customer authentication key installation;

transfer the first customer authentication key from the volatile memory of the RoT associated with the device to the non-volatile memory of the ROT associated with the device; and

mutably lock the first customer authentication key using a first public lock authentication key in the non-volatile memory of the RoT associated with the device to prevent additional customer authentication key installation, wherein the first public lock authentication key is associated with the first customer.

3 . The system of claim 2 , wherein the processor is configured to:

receive a first authenticated unlock request associated with the device to replace the first customer authentication key with a second customer authentication key, wherein the second customer authentication key is associated with the first customer;

unlock the device in response to receiving the first authenticated unlock request;

transfer the first customer authentication key from the non-volatile memory of the RoT associated with the device to the volatile memory of the ROT associated with the device, thereby allowing for deletion of the first customer authentication key upon a subsequent device reset;

install, using the device ownership transfer circuitry, the second customer authentication key in the non-volatile memory of the ROT associated with the device; and

mutably lock the second customer authentication key using the first public lock authentication key in the non-volatile memory of the ROT associated with the device to prevent additional customer authentication key installation.

4 . The system of claim 3 , wherein, in unlocking the device, the processor is configured to:

retrieve a first private lock authentication key from the first authenticated unlock request to unlock access to the first customer authentication key; and

unlock, using the first private lock authentication key, access to the first customer authentication key installed in the non-volatile memory of the ROT associated with the device.

5 . The system of claim 2 , wherein the processor is configured to:

receive a second authenticated unlock request associated with the device to transfer ownership of the device from the first customer to a second customer by replacing the first customer authentication key with a third customer authentication key, wherein the third customer authentication key is associated with the second customer;

unlock the device in response to receiving the second authenticated unlock request;

transfer the first customer authentication key from the non-volatile memory of the RoT associated with the device to the volatile memory of the ROT associated with the device, thereby allowing for deletion of the first customer authentication key upon a subsequent device reset;

install, using the device ownership transfer circuitry, the third customer authentication key in the non-volatile memory of the ROT associated with the device, thereby transferring ownership of the device to the second customer, wherein installing the third customer authentication key in the non-volatile memory of the RoT results in no permanent modification to the device; and

mutably lock the third customer authentication key using a second public lock authentication key in the non-volatile memory of the ROT associated with the device to prevent additional customer authentication key installation, wherein the second public lock authentication key is associated with the second customer.

6 . The system of claim 1 , wherein the first customer authentication key is a public key associated with the first customer that is used for firmware signature authentication.

7 . The system of claim 1 , wherein the processor is configured to:

trigger a firmware update on the device;

receive a firmware image associated with the firmware update;

authenticate the firmware image using the first customer authentication key installed in the non-volatile memory of ROT associated with the device; and

authorize installation of the firmware update on the device in an instance in which the firmware image is authenticated.

8 . The system of claim 1 , wherein the first customer authentication key is preserved when the device is rebooted.

9 . A method for implementing mutable device ownership transfer of a device, the method comprising:

receiving a request from a first customer to record a mutable device ownership transfer of a device using a first customer authentication key;

receiving the first customer authentication key from the first customer in response to receiving the request;

determining whether the device has an existing customer authentication key installation in a non-volatile memory of a Root of Trust (ROT) associated with the device; and

installing, using the device ownership transfer circuitry, the first customer authentication key in the non-volatile memory of the ROT associated with the device in an instance in which the device does not have the existing customer authentication key installation, wherein installing the first customer authentication key in the non-volatile memory of the Root of Trust (ROT) results in no permanent modification to the device.

10 . The method of claim 9 , wherein the method further comprises:

initially installing the first customer authentication key in a volatile memory of the RoT associated with the device in an instance in which the device does not have the existing customer authentication key installation;

transferring the first customer authentication key from the volatile memory of the RoT associated with the device to the non-volatile memory of the ROT associated with the device; and

mutably locking the first customer authentication key using a first public lock authentication key in the non-volatile memory of the ROT associated with the device to prevent additional customer authentication key installation, wherein the first public lock authentication key is associated with the first customer.

11 . The method of claim 10 , wherein the method further comprises:

receiving a first authenticated unlock request associated with the device to replace the first customer authentication key with a second customer authentication key, wherein the second customer authentication key is associated with the first customer;

unlocking the device in response to receiving the first authenticated unlock request;

transferring the first customer authentication key from the non-volatile memory of the RoT associated with the device to the volatile memory of the ROT associated with the device, thereby allowing for deletion of the first customer authentication key upon a subsequent device reset;

installing, using the device ownership transfer circuitry, the second customer authentication key in the non-volatile memory of the ROT associated with the device; and

mutably locking the second customer authentication key using the first public lock authentication key in the non-volatile memory of the ROT associated with the device to prevent additional customer authentication key installation.

12 . The method of claim 11 , wherein, in unlocking the device, the method further comprises:

retrieving a first private lock authentication key from the first authenticated unlock request to unlock access to the first customer authentication key; and

unlocking, using the first private lock authentication key, access to the first customer authentication key installed in the non-volatile memory of the ROT associated with the device.

13 . The method of claim 10 , wherein the method further comprises:

receiving a second authenticated unlock request associated with the device to transfer ownership of the device from the first customer to a second customer by replacing the first customer authentication key with a third customer authentication key, wherein the third customer authentication key is associated with the second customer;

unlocking the device in response to receiving the second authenticated unlock request;

transferring the first customer authentication key from the non-volatile memory of the RoT associated with the device to the volatile memory of the ROT associated with the device, thereby allowing for deletion of the first customer authentication key upon a subsequent device reset;

installing, using the device ownership transfer circuitry, the third customer authentication key in the non-volatile memory of the ROT associated with the device, thereby transferring ownership of the device to the second customer, wherein installing the third customer authentication key in the non-volatile memory of the RoT results in no permanent modification to the device; and

mutably locking the third customer authentication key using a second public lock authentication key in the non-volatile memory of the ROT associated with the device to prevent additional customer authentication key installation, wherein the second public lock authentication key is associated with the second customer.

14 . The method of claim 9 , wherein the first customer authentication key is a public key associated with the first customer that is used for firmware signature authentication.

15 . The method of claim 9 , wherein the method further comprises:

triggering a firmware update on the device;

receiving a firmware image associated with the firmware update;

authenticating the firmware image using the first customer authentication key installed in the non-volatile memory of ROT associated with the device; and

authorizing installation of the firmware update on the device in an instance in which the firmware image is authenticated.

16 . The method of claim 9 , wherein the first customer authentication key is preserved when the device is rebooted.

Assignments (1)

Continuity (1)

References Cited (15)