Secure feature and key management in integrated circuits
A mechanism for providing secure feature and key management in integrated circuits is described. An example integrated circuit includes a secure memory to store a secret key, and a security manager core, coupled to the secure memory, to receive a digitally signed command, verify a signature associated with the command using the secret key, and configure operation of the integrated circuit using the command.
1. An integrated circuit comprising:
a secure memory to store a base key;
a security manager (SM) core;
a plurality of hardware features configurable by the SM core; and
a hardware extractor coupled to the SM core and the plurality of hardware features, wherein:
the SM core is to receive feature update information comprising a command that, when executed by the SM core enables the SM core to update a functionality of one or more of the plurality of hardware features of the integrated circuit to be at least one of locked, unlocked, or modified;
the SM core is to derive a transport key based on the base key;
the SM core is to decrypt an encrypted payload associated with the command using the transport key to obtain a decrypted payload; and
the hardware extractor is to route information from the decrypted payload to the one or more of the plurality of hardware features.
2. The integrated circuit of claim 1 , wherein the SM core is to:
derive a mixed key using the base key; and
derive the transport key using the mixed key.
3. The integrated circuit of claim 1 , wherein the hardware extractor is to extract a feature state for a first hardware feature of the plurality of hardware features, wherein the feature state comprises at least one of an enable signal, metadata, configuration information, or calibration information for the first hardware feature.
4. The integrated circuit of claim 1 , further comprising a memory to store a feature space comprising one or more values, each value having an associated address and relating to one of the plurality of hardware features.
5. The integrated circuit of claim 4 , wherein a first set of values of the feature space relate to the SM core, and wherein a second set of values of the feature space relate to the plurality of hardware features.
6. The integrated circuit of claim 4 , wherein at least one value of the one or more values controls whether the base key is available for use.
7. An integrated circuit comprising:
a security manager (SM) core;
a plurality of hardware features configurable by the SM core; and
a memory to store a feature space comprising one or more values, each value having an associated address and relating to one of a plurality of hardware features;
a hardware extractor coupled to the SM core and the plurality of hardware features, wherein:
the SM core is to receive feature update information comprising a command that, when executed by the SM core enables the SM core to update a functionality of one or more of the plurality of hardware features of the integrated circuit to be at least one of locked, unlocked, or modified;
the SM core is to decrypt an encrypted payload of the command using a transport key to obtain a decrypted payload; and
the hardware extractor is to route information from the decrypted payload to the one or more of the plurality of hardware features,
wherein at least one value of the one or more values specifies geographical information about the integrated circuit, wherein the geographical information is used to control authorization of the integrated circuit in a specified geographical region.
8. The integrated circuit of claim 1 , further comprising:
a plurality of sub-extractors coupled to the extractor, wherein each of the plurality of sub-extractors is coupled to one of the plurality of hardware features.
9. The integrated circuit of claim 8 , wherein the feature update information is part of a digitally signed message comprising a signature and the feature update information, wherein the SM core comprises:
a crypto module to verify the signature of the digitally signed message;
an execution engine module to execute the command;
a communications module to facilitate communications by the SM core; and
a data storage module to manage internal storage of the SM core and to interface with a secure memory.
10. The integrated circuit of claim 1 , wherein the SM core, in connection with execution of the command, is to update a first state of a first hardware feature of the plurality of hardware features, wherein the update to the first state causes at least one of: locking the functionality of the first hardware feature, unlocking the functionality of the first hardware feature, or modifying the functionality of the first hardware feature.
11. The integrated circuit of claim 1 , wherein the SM core, in connection with execution of the command, is to deliver one or more keys to one or more components of the integrated circuit, wherein the keys pertain to at least one of: encryption operations of the components, digital rights management operations of the components, password management operations of the components, or authentication operations of the components.
12. The integrated circuit of claim 1 , wherein the SM core, in connection with execution of the command, is to identify one or more hardware constants and store the hardware constants in designated storage, the hardware constants comprising at least one of: a product chip identifier, one or more security keys, one or more base keys, or error correction data.
13. The integrated circuit of claim 1 , wherein the feature update information is part of a digitally signed message comprising a signature and the feature update information, wherein the digitally signed message is signed by private key associated with a root authority, wherein the SM core, in connection with execution of the command, is to verify the signature of the digitally signed message using a public key associated with the root authority, the public key being stored in a secure memory.
14. The integrated circuit of claim 9 , wherein the feature update information is part of a digitally signed message comprising a signature and the feature update information, wherein the digitally signed message is signed by private key associated with a delegate authority, wherein the SM core, in connection with execution of the command, is to verify the signature of the digitally signed message using a public key associated with the delegate authority, the public key being stored in a secure memory.
15. The integrated circuit of claim 14 , wherein the SM core, in connection with verifying the signature of the digitally signed message, is further to:
obtain delegate permissions and the public key associated with the delegate authority from a root signed block signed by a root authority;
determine that the signature associated with the digitally signed message is valid using the public key associated with the delegate authority; and
determine that the command is permitted using the delegate permissions.
16. An integrated circuit comprising:
a secure memory to store a secret key;
a security manager (SM) core;
a plurality of hardware features configurable by the SM core; and
a hardware extractor coupled to the SM core and the plurality of hardware features, wherein:
the SM core is to receive a digitally signed message comprising a signature and a command that, when executed by the SM core enables the SM core to update a functionality of one or more of the plurality of hardware features of the integrated circuit to be at least one of locked, unlocked, or modified, wherein the command is associated with an encrypted payload;
the SM core to verify the signature of the digitally signed message using the secret key;
the SM core is to derive a transport key based on a base key stored in the secure memory;
the SM core is to decrypt the encrypted payload associated with the command using the transport key to obtain a decrypted payload; and
the hardware extractor is to route information from the decrypted payload to the one or more of the plurality of hardware features.
17. The integrated circuit of claim 16 , further comprising:
a plurality of sub-extractors coupled to the hardware extractor, wherein each of the plurality of sub-extractors is coupled to one of a plurality of hardware features, wherein the hardware extractor is to deliver a portion of the decrypted payload to one of the plurality of sub-extractors and the one of the plurality of sub-extractors is to deliver the portion to one of the plurality of hardware features.
18. The integrated circuit of claim 16 , wherein the SM core is to:
derive a mixed key using the base key stored in the secure memory; and
derive the transport key using the mixed key.
19. The integrated circuit of claim 16 , wherein the SM core comprises:
a crypto module to verify the signature of the digitally signed message; and
an execution engine module to execute the command.
20. The integrated circuit of claim 16 , further comprising a memory to store a feature space comprising one or more values, each value having an associated address and relating to one of the plurality of hardware features, wherein at least one value of the one or more values specifies geographical information about the integrated circuit, wherein the geographical information is used to control authorization of the integrated circuit in a specified geographical region.