Cryptographic transmission system
A microcontroller includes on-chip key storage slots stored in a non-volatile memory, wherein selecting which key is to be used is restricted to software, wherein a predetermined key storage slot stores a Key Encrypt Key (KEK), and a register flag is provided for determining whether the predetermined key storage slot stores a key for encrypting/decrypting data or the KEK for encrypting/decrypting a key.
1. A microcontroller comprising:
a central processing unit,
a plurality of secure on-chip key storage slots arranged in a non-volatile memory for storing keys, wherein the secure on-chip key storage slots are each configured to store either a Key Encryption Key (KEK) or a key for encrypting/decrypting data and a hardware encryption/decryption engine coupled with the non-volatile memory for storing keys and being configured to have access to a selected key, wherein the secure on-chip key storage slots can only be accessed by the hardware encryption/decryption engine and cannot be accessed by the CPU thereby forming a firewall between non-volatile memory coupled with the encryption/decryption engine which are inside the firewall and the CPU which is outside the firewall, and
a select register coupled with the CPU and configured to select one of the on-chip key storage slots through said firewall wherein a content of the selected on-chip key storage slot is transferred to a key register and accessible to the hardware encryption/decryption engine through the key register, wherein a predetermined key storage slot is configured to store a Key Encryption Key (KEK), and a configuration register coupled with the hardware encryption/decryption engine comprises a register flag for determining whether a selected key storage slot stores a key for encrypting/decrypting data or the KEK for encrypting/decrypting a key.
2. The microcontroller according to claim 1 , wherein the non-volatile memory is a one-time programmable memory.
3. The microcontroller according to claim 1 , wherein the non-volatile memory is a flash memory, wherein the keys are stored in an encrypted format and wherein the KEK can be used to decrypt the keys.
4. The microcontroller according to claim 1 , wherein if said register flag is set and the predetermined key slot is used for an encryption or decryption operation, a key configuration error is generated.
5. The microcontroller according to claim 1 , wherein the register flag is not accessible by the CPU.
6. The microcontroller according to claim 1 , wherein the hardware encryption/decryption engine is configured to select a destination for encrypted data based on whether the register flag for the KEK selection is set and which key of a plurality of keys has been selected.
7. The microcontroller according to claim 1 , further comprising a current key register coupled with the hardware encryption/decryption engine, wherein the current key register stores a selected key or a decrypted key.
8. The microcontroller according to claim 1 , further comprising an error status register, wherein an error stored in the error status register prevents said hardware encryption/decryption engine to perform any encryption or decryption operations.
9. A method for handling encryption keys in processor microcontroller, comprising:
selecting a key encryption key (KEK) from a predetermined one of a plurality of key storage slots arranged in non-volatile memory through a select register coupled with a CPU of the microcontroller, wherein the plurality of key storage slots are each configured to store either a Key Encryption Key (KEK) or a key for encrypting/decrypting data and wherein the on-chip key storage slots can only be accessed by a hardware encryption/decryption engine and cannot be accessed by the CPU of the microcontroller thereby forming a firewall between non-volatile memory coupled with the hardware encryption/decryption engine which are inside the firewall and the CPU which is outside the firewall;
transferring a content of the selected on-chip key storage slot to a key register which is accessible to the hardware encryption/decryption engine;
checking a register flag in a configuration register coupled with the hardware encryption/decryption engine to determine if the key encryption key is to be used for encrypting/decrypting data or encrypting/decrypting a session key; and
if the key encryption key is to be used for encrypting/decrypting a session key, preventing the key encrypt key from encrypting/decrypting data.
10. The method according to claim 9 , wherein the non-volatile memory is a one-time programmable memory.
11. The method according to claim 9 , wherein the non-volatile memory is a flash memory, wherein the keys are stored in an encrypted format and wherein the KEK can be used to decrypt the keys.
12. The method according to claim 9 , wherein if said register flag is set and the predetermined key slot is used for an encryption or decryption operation, a key configuration error is generated.
13. The method according to claim 9 , wherein the register flag and the keys share a level of security permission.
14. The method according to claim 9 , further including selecting a destination for encrypted data based on whether the register flag for the KEK selection is set and which key of a plurality of keys has been selected for encrypting/decrypting data.
15. The method according to claim 9 , wherein the non-volatile memory is a one-time programmable memory.
16. The method according to claim 9 , wherein the non-volatile memory is a flash memory, wherein a plurality of keys are stored in an encrypted format and wherein the KEK or dual mode encryption key is used to decrypt the keys.
17. The method according to claim 9 , wherein if said status bit is set and the encryption key slot is used for an encryption or decryption operation, a key configuration error is generated.
18. The method according to claim 9 , wherein the status bit is not accessible by the CPU.
19. The method according to claim 9 , further including selecting a destination for decrypted data based on whether the status bit for the dual mode encryption key selection is set and which key of a plurality of keys has been selected for encrypting/decrypting data.
20. A method for handling encryption keys in processor
microcontroller comprising, a CPU, a hardware encryption/decryption engine, and a non-volatile memory with a plurality of key storage slots for storing keys, wherein each key storage slot is configured to store either a Key Encryption Key (KEK) or a key for encrypting/decrypting data, wherein the on-chip key storage slots can only be accessed by the hardware encryption/decryption engine and cannot be accessed by the CPU thereby forming a firewall between non-volatile memory coupled with the hardware encryption/decryption engine which are inside the firewall and the CPU which is outside the firewall, the method comprising:
providing a dual mode encryption key among the plurality of keys in the plurality of key storage slots in the non-volatile memory; and
defining whether the dual mode encryption key is to be used to encrypt/decrypt data or encrypt/decrypt a session key by a register flag in a configuration register coupled with the hardware encryption/decryption engine;
selecting one of the key storage slots through a select register coupled with the CPU thereby transferring a content of the selected key storage slot to a key register which is accessible to the hardware encryption/decryption engine;
wherein if the dual mode encryption key is selected to be used to encrypt/decrypt a session key, the dual mode encryption key cannot be used to encrypt or decrypt data.