Protecting cryptographic keys stored in non-volatile memory

1. A method, comprising:

storing a device root key in a non-volatile memory;

storing a volatile key in a volatile memory;

storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is produced by combining a cryptographic key and the device root key;

storing a masked device root key in the non-volatile memory, wherein the masked device root key is produced by combining the device root key and the volatile key; and

erasing the device root key from the non-volatile memory.

2. The method of claim 1 , further comprising:

responsive to detecting a tampering event, erasing the volatile key from the volatile memory.

3. The method of claim 2 , wherein erasing the volatile key from the volatile memory further comprises at least one of:

sending a reset signal to the volatile memory or interrupting power supply to the volatile memory.

4. The method of claim 1 , further comprising:

restoring the device root key by combining the masked device root key and the volatile key;

restoring the cryptographic key by combining the masked cryptographic key and the device root key; and

utilizing the cryptographic key for performing a cryptographic data processing operation.

5. The method of claim 1 , wherein combining the cryptographic key and the device root key further comprises:

performing an exclusive disjunction operation of the cryptographic key and the device root key.

6. The method of claim 1 , wherein combining the device root key and the volatile key further comprises:

performing an exclusive disjunction operation of the device root key and the volatile key.

7. The method of claim 1 , further comprising:

receiving, from an external source, at least one of: the device root key, the volatile key, or the cryptographic key.

8. The method of claim 1 , further comprising:

generating at least one of: the device root key; the volatile key, or the cryptographic key.

9. A system comprising:

a non-volatile memory;

a volatile memory;

a voltage control circuit configured to interrupt power supply to the volatile memory responsive to receiving a signal indicating a tampering event; and

a processor configured to:

store a device root key in the non-volatile memory;

store a volatile key in the volatile memory;

store a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is produced by combining a cryptographic key and the device root key;

store a masked device root key in the non-volatile memory, wherein the masked device root key is produced by combining the device root key and the volatile key; and

erase the device root key from the non-volatile memory.

10. The system of claim 9 , wherein the processor is further configured to:

restore the device root key by combining the masked device root key and the volatile key;

restore the cryptographic key by combining the masked cryptographic key and the device root key; and

utilize the cryptographic key for performing a cryptographic data processing operation.

11. The system of claim 9 , wherein combining the cryptographic key and the device root key further comprises:

performing an exclusive disjunction operation of the cryptographic key and the device root key.

12. A method, comprising:

storing a device root key in a non-volatile memory;

storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is produced by combining a cryptographic key and the device root key;

storing the device root key in a volatile memory;

erasing the device root key from the non-volatile memory; and

responsive to detecting a tampering event, erasing the device root key from the volatile memory.

13. The method of claim 12 , wherein erasing the device root key from the volatile memory further comprises:

sending a reset signal to the volatile memory or interrupting power supply to the volatile memory.

14. The method of claim 12 , further comprising:

restoring the cryptographic key by combining the masked cryptographic key and the device root key; and

utilizing the cryptographic key for performing a cryptographic data processing operation.

15. The method of claim 12 , wherein combining the cryptographic key and the device root key further comprises:

performing an exclusive disjunction operation of the cryptographic key and the device root key.

16. The method of claim 12 , further comprising:

receiving, from an external source, at least one of: the device root key or the cryptographic key.

17. The method of claim 12 , further comprising:

generating at least one of: the device root key or the cryptographic key.

18. A system comprising:

a non-volatile memory;

a volatile memory;

a voltage control circuit configured to interrupt power supply to the volatile memory responsive to receiving a signal indicating a tampering event; and

a processor configured to:

store a device root key in the non-volatile memory;

store a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is produced by combining a cryptographic key and the device root key;

store the device root key in the volatile memory; and

erase the device root key from the non-volatile memory.

19. The system of claim 18 , wherein the processor is further configured to:

restore the cryptographic key by combining the masked cryptographic key and the device root key; and

utilize the cryptographic key for performing a cryptographic data processing operation.

20. The system of claim 18 , wherein combining the cryptographic key and the device root key further comprises:

performing an exclusive disjunction operation of the cryptographic key and the device root key.