Data structure for encrypting sensitive data in autonomous systems and applications
Embodiments of the present disclosure relate to a method of encrypting a secret storage structure. The method may include storing a secret in a secret storage structure. The secret storage structure may be encrypted by encrypting the secret using a wrap key that is generated based at least on a hardware-based root key and a first context. The secret storage structure may additionally be encrypted by encrypting the secret storage structure using an authentication key that is generated based at least on the hardware-based root key and a second context.
1 . A method comprising:
storing a secret in a secret storage structure; and
encrypting the secret storage structure, at least, by:
encrypting the secret using a wrap key that is generated based at least on a hardware-based root key and a first context; and
encrypting the secret storage structure using an authentication key that is generated based at least on the hardware-based root key that generates the wrap key and a second context.
2 . The method of claim 1 , wherein the secret storage structure additionally includes a unique identifier, the method further comprising:
authenticating the secret storage structure, at least, by decrypting the secret storage structure using the authentication key and verifying the unique identifier using a cryptographic algorithm; and
decrypting the secret in the secret storage structure using the wrap key.
3 . The method of claim 1 , wherein the hardware-based root key is burned into one or more fuses in hardware associated with the secret storage structure.
4 . The method of claim 1 , wherein the first context is the same as the second context.
5 . The method of claim 1 , wherein the first context and the second context include at least one of one or more fixed vectors or unique strings.
6 . The method of claim 1 , wherein the secret is fixed in the secret storage structure prior to encrypting the secret and the secret storage structure.
7 . A system comprising:
one or more processing units to perform operations comprising:
storing a plurality of secrets in a secret storage structure; and
encrypting the secret storage structure, at least, by:
encrypting the plurality of secrets individually using a wrap key that is generated based at least on a hardware-based root key and a first context; and
encrypting the secret storage structure using an authentication key that is generated based at least on the hardware-based root key that generates the wrap key and a second context.
8 . The system of claim 7 , wherein the secret storage structure additionally includes a unique identifier, and the operations further comprise:
authenticating the secret storage structure, at least, by decrypting the secret storage structure using the authentication key and verifying the unique identifier using a cryptographic algorithm; and
decrypting the plurality of secrets in the secret storage structure using the wrap key.
9 . The system of claim 7 , wherein the hardware-based root key is burned into one or more fuses in hardware associated with the secret storage structure.
10 . The system of claim 7 , wherein the first context is the same as the second context.
11 . The system of claim 7 , wherein the first context and the second context include one or more fixed vectors.
12 . The system of claim 7 , wherein the plurality of secrets are fixed in the secret storage structure prior to encrypting the plurality of secrets and the secret storage structure.
13 . The system of claim 7 , wherein the system is comprised in at least one of:
a control system for an autonomous or semi-autonomous machine;
a perception system for an autonomous or semi-autonomous machine;
a system for performing simulation operations;
a system for performing digital twin operations;
a system for performing light transport simulation;
a system for performing collaborative content creation for 3D assets;
a system for performing deep learning operations;
a system for presenting at least one of augmented reality content, virtual reality content, or mixed reality content;
a system for hosting one or more real-time streaming applications;
a system implemented using an edge device;
a system implemented using a robot;
a system for performing conversational AI operations;
a system for generating synthetic data;
a system incorporating one or more virtual machines (VMs);
a system implemented at least partially in a data center; or
a system implemented at least partially using cloud computing resources.
14 . A processor comprising processing circuitry to perform operations, the operations comprising:
storing a secret in a secret storage structure; and
encrypting the secret storage structure, at least, by:
encrypting the secret using a wrap key that is generated based at least on a hardware-based root key and a first context; and
encrypting the secret storage structure using an authentication key that is generated based at least on the hardware-based root key that generates the wrap key and a second context.
15 . The processor of claim 14 , wherein the secret storage structure additionally includes a unique identifier, and the operations further comprise:
authenticating the secret storage structure, at least, by decrypting the secret storage structure using the authentication key and verifying the unique identifier using a cryptographic algorithm; and
decrypting the secret in the secret storage structure using the wrap key.
16 . The processor of claim 14 , wherein the hardware-based root key is burned into one or more fuses in hardware associated with the secret storage structure.
17 . The processor of claim 14 , wherein the first context is the same as the second context.
18 . The processor of claim 14 , wherein the first context and the second context include one or more fixed vectors.
19 . The processor of claim 14 , wherein the secret is fixed in the secret storage structure prior to encrypting the secret and the secret storage structure.
20 . The processor of claim 14 , wherein the operations are performed by a system and wherein the system is comprised in at least one of:
a control system for an autonomous or semi-autonomous machine;
a perception system for an autonomous or semi-autonomous machine;
a system for performing simulation operations;
a system for performing digital twin operations;
a system for performing light transport simulation;
a system for performing collaborative content creation for 3D assets;
a system for performing deep learning operations;
a system for presenting at least one of augmented reality content, virtual reality content, or mixed reality content;
a system for hosting one or more real-time streaming applications;
a system implemented using an edge device;
a system implemented using a robot;
a system for performing conversational AI operations;
a system for generating synthetic data;
a system incorporating one or more virtual machines (VMs);
a system implemented at least partially in a data center; or
a system implemented at least partially using cloud computing resources.