Granted Patent B2

US 11,329,967 · App. 16/882,201 · Granted May 10, 2022

Inventors: Tat Keung Chan (San Diego, CA); Alexander Medvinsky (San Diego, CA)

Assignee: ARRIS Enterprises LLC

H04L63/062G06F21/6245H04L9/0869H04L63/0442H04L63/0876

Abstract

Claims (138)

1. A method of provisioning device-specific uniquely encrypted personalization data to a device, the device having a global root key GK_ 0 and a secure processing environment having unique information, the method comprising:

accepting a provisioning request from the device, the provisioning request comprising the unique information and an identifier of a type of provisioning data requested;

converting the personalization data from globally-encrypted personalization data to the device-specific uniquely encrypted personalization data, wherein:

the globally-encrypted personalization data is generated by:

generating a first intermediate global key GK_ 1 from a first global parameter KL_Param 1 and the global root key GK_ 0 ;

generating a second intermediate global key GK_ 2 from a second global parameter KL_Param 2 and the first intermediate global key GK_ 1 ;

globally-encrypting the personalization data;

providing the globally-encrypted personalization data to a provisioning entity for storage; and

the converting the personalization data from the globally-encrypted personalization data to the device-specific personalization data comprises:

decrypting the globally-encrypted personalization data;

deriving a first device-specific unique parameter KL_Param 1 _Prime and a second device-specific unique parameter KL_Param 2 _Prime from at least the unique information;

deriving a first intermediate device-specific unique key UK_ 1 Prime from the derived first device-specific unique parameter KL_Param 1 _Prime and the global root key GK_ 0 ;

deriving a second intermediate device-specific unique key UK_ 2 Prime from the derived second device-specific unique parameter KL_Param 2 _Prime and the derived first intermediate device-specific unique key UK_ 1 Prime;

generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted globally-encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime; and

transmitting the converted personalization data to the device.

2. The method of claim 1 , wherein:

the globally-encrypted personalization data comprises device model-based provisioning data; and

the device-specific uniquely encrypted of personalization data encrypted to a specific chip.

3. The method of claim 1 , wherein:

globally-encrypting the personalization data comprises:

encrypting the personalization data according to the second intermediate global key GK_ 2 ;

providing the encrypted personalization data to a provisioning entity for storage comprises:

transmitting the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity;

decrypting the encrypted personalization data comprises:

decrypting the globally-encrypted personalization data Enc(GK_ 2 , PD) according to the second intermediate global key GK_ 2 ;

generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted globally-encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime comprises:

re-encrypting the decrypted globally-encrypted personalization data according to the derived second intermediate device-specific unique key UK_ 2 Prime to produce the device-specific uniquely encrypted personalization data; and

transmitting the converted personalization data comprises:

transmitting the device-specific uniquely encrypted personalization data having the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device.

4. The method of claim 3 , wherein:

transmitting the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity comprises:

generating provisioning data comprising the globally-encrypted personalization data Enc(GK_ 2 , PD);

wherein the provisioning data further comprises the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 ;

transmitting the generated provisioning data comprising the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity;

transmitting the converted device-specific uniquely encrypted personalization data having the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device comprises:

generating converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD), comprising:

removing the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 from the provisioning data; and

transmitting the generated converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device.

5. The method of claim 4 , wherein:

the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime are further derived from random values; and

generating converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD) further comprises:

inserting the random values used to derive the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime in the converted provisioning data.

6. The method of claim 1 , wherein:

globally-encrypting the personalization data comprises:

encrypting the personalization data according to a unique key UK, resulting in Enc(UK, PD); and

globally-encrypting the unique key according to the second intermediate global key, resulting in Enc(GK_ 2 , UK);

providing the encrypted personalization data to a provisioning entity for comprises:

transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the globally-encrypted unique key Enc(GK_ 2 , UK) to the provisioning entity;

decrypting the personalization data comprises:

decrypting the globally-encrypted unique key Enc(GK_ 2 , UK) according to the second intermediate global key GK_ 2 ; and

decrypting the encrypted personalization data Enc(UK, PD) according to the decrypted unique key UK;

generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime comprises:

encrypting the personalization data according to a unique key UK, resulting in Enc(UK, PD); and

encrypting the unique key according to the derived second intermediate device-specific unique key, resulting in Enc(UK_ 2 Prime, UK); and

transmitting the converted personalization data comprises:

transmitting the personalization data encrypted according to a unique key UK Enc(UK, PD) and the encrypted unique key Enc(UK_ 2 Prime, UK) to the device.

7. The method of claim 6 , wherein:

transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the globally-encrypted unique key Enc(GK_ 2 , UK) to the provisioning entity comprises:

generating provisioning data comprising the unique key UK (Enc(UK, PD)) and the globally-encrypted unique key Enc(GK_ 2 , UK);

wherein the provisioning data further comprises the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 ;

transmitting the generated provisioning data comprising the unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(GK_ 2 , UK) to the provisioning entity; and

transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(UK_ 2 Prime, UK) to the device comprises:

generating converted provisioning data comprising the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(UK_ 2 Prime, UK), comprising:

transmitting the generated converted provisioning data comprising the personalization data encrypted according to a unique key UK Enc(UK, PD) and the encrypted unique key Enc(GK_ 2 , UK).

8. The method of claim 7 , wherein:

the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime are further derived from random values; and

generating converted provisioning data comprising the personalization data encrypted according to a unique key UK, resulting in Enc(UK, PD) and the encrypted unique key Enc(GK_ 2 , UK) further comprises:

inserting the random values used to derive the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime in the provisioning data.

9. An apparatus for provisioning device-specific uniquely encrypted personalization data to a device, the device having a global root key GK_ 0 and a secure processing environment having unique information, comprising:

a processor;

a memory, communicatively coupled to the processor, the memory storing processor instructions comprising instructions for:

accepting a provisioning request from the device, the provisioning request comprising the unique information and an identifier of a type of provisioning data requested;

converting the personalization data from globally-encrypted personalization data to the device-specific uniquely encrypted personalization data, wherein:

the globally-encrypted personalization data is generated by:

generating a first intermediate global key GK_ 1 from a first global parameter KL_Param 1 and the global root key GK_ 0 ;

generating a second intermediate global key GK_ 2 from a second global parameter KL_Param 2 and the first intermediate global key GK_ 1 ;

globally-encrypting the personalization data;

providing the globally-encrypted personalization data to a provisioning entity for storage;

converting the personalization data from the globally-encrypted personalization data to the device-specific personalization data comprises:

decrypting the globally-encrypted personalization data;

deriving a first device-specific unique parameter KL_Param 1 _Prime and a second device-specific unique parameter KL_Param 2 _Prime from at least the unique information;

deriving a first intermediate device-specific unique key UK_ 1 Prime from the derived first device-specific unique parameter KL_Param 1 _Prime and the global root key GK_ 0 ;

deriving a second intermediate device-specific unique key UK_ 2 Prime from the derived second device-specific unique parameter KL_Param 2 _Prime and the derived first intermediate device-specific unique key UK_ 1 Prime;

generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted globally-encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime; and

transmitting the converted personalization data to the device.

10. The apparatus of claim 9 , wherein:

the globally-encrypted personalization data comprises device model-based provisioning data; and

the device-specific uniquely encrypted of personalization data encrypted to a specific chip.

11. The apparatus of claim 9 , wherein:

the instructions for globally encrypting the personalization data comprise instructions for:

encrypting the personalization data according to the second intermediate global key GK_ 2 ;

the instructions for providing the encrypted personalization data to a provisioning entity for storage comprise instructions for:

transmitting the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity;

the instructions for decrypting the encrypted personalization data comprise instructions for:

decrypting the globally-encrypted personalization data Enc(GK_ 2 , PD) according to the second intermediate global key GK_ 2 ;

the instructions for generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted globally-encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime comprise instructions for:

re-encrypting the decrypted globally-encrypted personalization data according to the derived second intermediate device-specific unique key UK_ 2 Prime to produce the device-specific uniquely encrypted personalization data; and

the instructions for transmitting the converted personalization data comprise instructions for:

transmitting the device-specific uniquely encrypted personalization data having the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device.

12. The apparatus of claim 11 , wherein:

the instructions for transmitting the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity comprise instructions for:

generating provisioning data comprising the globally-encrypted personalization data Enc(GK_ 2 , PD);

wherein the provisioning data further comprises the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 ; and

transmitting the generated provisioning data comprising the globally-encrypted personalization data Enc(GK_ 2 , PD) to the provisioning entity;

the instructions for transmitting the converted device-specific uniquely encrypted personalization data having the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device comprise instructions for:

generating converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD), comprising:

removing the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 from the provisioning data; and

transmitting the generated converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD) to the device.

13. The apparatus of claim 12 , wherein:

the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime are further derived from random values; and

the instructions for generating converted provisioning data comprising the re-encrypted personalization data Enc(UK_ 2 Prime, PD) further comprise instructions for:

inserting the random values used to derive the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime in the converted provisioning data.

14. The apparatus of claim 9 , wherein:

the instructions for globally-encrypting the personalization data comprise instructions for:

encrypting the personalization data according to a unique key UK resulting in Enc(UK, PD); and

globally-encrypting the unique key according to the second intermediate global key resulting in Enc(GK_ 2 , UK);

the instructions for providing the encrypted personalization data to a provisioning entity for comprise instructions for:

transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the globally-encrypted unique key Enc(GK_ 2 , UK) to the provisioning entity;

the instructions for decrypting the personalization data comprise instructions for:

decrypting the encrypted unique key Enc(GK_ 2 , UK) according to the second intermediate global key GK_ 2 ; and

decrypting the encrypted personalization data Enc(UK, PD) according to the decrypted unique key UK;

the instructions for generating the device-specific uniquely encrypted personalization data as the converted personalization data from the decrypted encrypted personalization data and the derived second intermediate device-specific unique key UK_ 2 Prime comprise instructions for:

encrypting the personalization data according to a unique key UK Enc(UK, PD); and

encrypting the unique key according to the derived second intermediate device-specific unique key, resulting in Enc(UK_ 2 Prime, UK); and

the instructions for transmitting the converted personalization data comprises instructions for:

transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(UK_ 2 Prime, UK) to the device.

15. The apparatus of claim 14 , wherein:

the instructions for transmitting the personalization data encrypted according to a unique key UK Enc(UK, PD) and the globally-encrypted unique key (Enc(GK_ 2 , UK)) to the provisioning entity comprise instructions for:

generating provisioning data comprising the unique key UK (Enc(UK, PD)) and the globally-encrypted unique key Enc(GK_ 2 , UK);

wherein the provisioning data further comprises the first global parameter KL_Parm 1 and the second global parameter KL_Parm 2 ;

transmitting the generated provisioning data comprising the unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(GK_ 2 , UK) to the provisioning entity; and

the instructions for transmitting the personalization data encrypted according to a unique key UK (Enc(UK, PD)) and the encrypted unique key Enc(UK_ 2 Prime, UK) to the device comprise instructions for:

generating converted provisioning data comprising the personalization data encrypted according to a unique key UK Enc(UK, PD) and the encrypted unique key Enc(UK_ 2 Prime, UK), comprising:

transmitting the generated converted provisioning data comprising the personalization data encrypted according to a unique key UK Enc(UK, PD) and the encrypted unique key Enc(GK_ 2 , UK).

16. The apparatus of claim 15 , wherein:

the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime are further derived from random values; and

the instructions for generating converted provisioning data comprising the personalization data encrypted according to a unique key UK resulting in Enc(UK, PD) and the encrypted unique key Enc(GK_ 2 , UK) further comprise instructions for:

inserting the random values used to derive the derived first device-specific unique parameter KL_Param 1 _Prime and the derived second device-specific unique parameter KL_Param 2 _Prime in the provisioning data.

Assignments (8)

Continuity (2)