Systems and methods for protecting symmetric encryption keys

1. A computer-implemented method, comprising:

executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;

storing the at least one transformed key in memory, wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a session key that is randomly derived at power initialization, wherein only the processor is able to decrypt the at least one transformed key and encrypt the at least one round key.

2. A computer-implemented method, comprising:

executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;

storing the at least one transformed key in memory wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a unique key for the processor that is derived and persisted internally through a derived key that is based on fusing.

3. A non-transitory machine-accessible medium including data that, when accessed by a machine, cause the machine to perform operations comprising:

executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;

storing the at least one transformed key in memory, wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a session key that is randomly derived at power initialization, wherein only the processor is able to decrypt the at least one transformed key and encrypt the at least one round key.

4. A system, comprising:

a processor having access to at least one real key; and

memory coupled to the processor, the memory to store at least one transformed key, the processor is configured to execute a key transform instruction to generate at least one transformed key based on the at least one real key, wherein the memory comprises a cache to store a mapping to map transformed keys to corresponding round keys that are based on the at

least one real key, and wherein the processor is further configured to decrypt the transformed keys if a cache miss occurs.

5. The system of claim 4 , wherein the memory has limited storage for the transformed keys and the processor executes instructions to specify an index for selecting a transformed key.

6. The system of claim 4 , wherein the memory comprises a table or other structure to store a mapping to map transformed keys to corresponding real keys.

7. The system of claim 4 , wherein the processor is configured to receive a single key and automatically generate a plurality of round keys to be stored and accessed by the processor, wherein the processor is configured to execute the key transform instruction to generate at least one transformed key in response to generating at least one round key.

8. A non-transitory machine-accessible medium including data that, when accessed by a machine, cause the machine to perform operations comprising:

executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;

storing the at least one transformed key in memory wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a unique key for the processor that is derived and persisted internally through a derived key that is based on fusing.