Generation of working security key based on security parameters
Techniques for improving security of an electronics device are disclosed. In one aspect of the present disclosure, security of a device may be improved by generating a working key based on a hardware secret key and at least one security parameter of the device, e.g., with a key derivation function. The security parameter(s) may be related to software to be authenticated on the device and/or other aspects of security for the wireless device. The security parameter(s) may indicate whether the software is authorized and/or at least one operating function authorized for the software. At least one security function may be performed for the device based on the working key. For example, the working key may be used to encrypt, sign, decrypt, or verify data for the device. The working key may be used directly or indirectly by the software for the at least one security function.
1. A method of providing security, comprising:
generating by software a working key based on at least one security parameter of a set of security parameters and a secret key of a device, the set of security parameters and the secret key having been provisioned and stored on the device by at least two different entities, the software being authorized for execution on the device according to the set of security parameters, wherein the at least one security parameter determines at least one operating function authorized for the software on the device; and
performing at least one security function for the device based on the working key, the working key being used directly or indirectly for the at least one security function.
2. The method of claim 1 , the at least one security parameter comprising a public key used to determine whether the software is authorized for the device.
3. The method of claim 2 , the public key corresponding to a private key used to sign the software.
4. The method of claim 1 , the secret key and the at least one security parameter being loaded onto the device at different times.
5. The method of claim 1 , the generating a working key comprises generating the working key based on the at least one security parameter and the secret key of the device with a key derivation function.
6. The method of claim 1 , the performing at least one security function comprises encrypting or signing data for the device with the working key.
7. The method of claim 1 , the performing at least one security function comprises decrypting or verifying data for the device with the working key.
8. The method of claim 1 , the performing at least one security function comprises performing the at least one security function under control of the software.
9. The method of claim 1 , further comprising:
executing the software on the device without authenticating the software via a secure mechanism.
10. The method of claim 1 , further comprising:
storing the secret key in a secure memory on the device; and
storing the at least one security parameter in the secure memory or an unsecure memory on the device.
11. An apparatus comprising:
means for generating by software a working key based on at least one security parameter and a secret key of a device, the set of security parameters and the secret key having been provisioned and stored on the device by at least two different entities, the software being authorized for execution on the device according to the set of security parameters, wherein the at least one security parameter determines at least one operating function authorized for the software on the device; and
means for performing at least one security function for the device based on the working key, the working key being used directly or indirectly for the at least one security function.
12. The apparatus of claim 11 , the secret key and the at least one security parameter being loaded onto the device at different times.
13. The apparatus of claim 11 , the means for performing at least one security function comprising means for performing the at least one security function prior to activation of a secure mechanism to authenticate the software.
14. An apparatus comprising:
a memory configured to store software for a device; and
a processor coupled to the memory and configured to:
generate by software a working key based on at least one security parameter of a set of security parameters and a secret key of the device, the set of security parameters and the secret key having been provisioned and stored on the device by at least two different entities, the software being authorized for execution on the device according to the set of security parameters, wherein the at least one security parameter determines at least one operating function authorized for the software on the device; and
perform at least one security function for the device based on the working key, the working key being used directly or indirectly for the at least one security function.
15. The apparatus of claim 14 , the secret key and the at least one security parameter being loaded onto the device at different times.
16. The apparatus of claim 14 , the at least one processor being configured to perform the at least one security function prior to activation of a secure mechanism to authenticate the software.
17. A computer program product, comprising:
a non-transitory computer-readable medium comprising:
code for causing at least one computer to generate by software a working key based on at least one security parameter of a set of security parameters and a secret key of a device, the set of security parameters and the secret key having been provisioned and stored on the device by at least two different entities, the software being authorized for execution on the device according to the set of security parameters, wherein the at least one security parameter determines at least one operating function authorized for the software on the device; and
code for causing the at least one computer to perform at least one security function for the device based on the working key, the working key being used directly or indirectly by software for the at least one security function.
18. The computer program product of claim 17 , the secret key and the at least one security parameter being loaded onto the device at different times.
19. The computer program product of claim 17 , the code for causing the at least one computer to perform at least one security function comprising code for causing the at least one computer to perform the at least one security function prior to activation of a secure mechanism to authenticate the software.