Granted Patent B2

US 12,566,838 · App. 18/478,418 · Granted Mar 3, 2026

Inventors: Rui Pimenta (Portishead, GB); Abbas Saadat (Quebec, CA)

Assignee: Avago Technologies International Sales Pte. Limited

G06F21/45

Abstract

Claims (91)

1 . An integrated circuit comprising:

a first circuit configured to:

receive at least one of a first key;

store the first key in a storage of a first device in response to receiving the first key, wherein the first device is external to the integrated circuit; and

a third circuit of the integrated circuit is configured to:

apply confidentiality to the first key;

add first data to the first key to protect against modification of the first key; and

add second data to the first key to associate the first key with a source;

apply confidentiality to a second key;

add additional first data to the second key to protect against modification of the second key; and

add additional second data to the second key to associate the second key with a second source; and

the first circuit is further configured to:

add the first key and the second key to a key table;

apply confidentiality to the key table;

add third data to the key table to protect against modification of the key table; and

store the key table having the first key and the second key in the storage of the first device;

control access to the first key stored in the storage of the first device.

2 . The integrated circuit of claim 1 , wherein the first device is external to a second device comprising the integrated circuit.

3 . The integrated circuit of claim 1 , wherein controlling access to the storage comprises controlling at least one of write access of the first key to the storage of the first device or read access of the first key in the storage of the first device.

4 . The integrated circuit of claim 3 , wherein controlling access to the storage comprises checking an access control list to determine whether a client of the integrated circuit has at least one of write access of the first key to the storage of the first device or read access of the first key in the storage of the first device.

5 . The integrated circuit of claim 4 , wherein checking the access control list to determine whether the client of the integrated circuit has at least one of write access of the first key to the storage of the first device or read access of the first key in the storage of the first device comprises comparing first information that is unique to the client against second information in the access control list.

6 . The integrated circuit of claim 1 , further comprising:

a second circuit associated with an application, wherein controlling access to the storage further comprises blocking the second circuit from reading the first key in the storage of the first device; and

a third circuit configured to access an asset using the first key, wherein controlling access to the storage further comprises allowing the third circuit read access to the first key in the storage of the first device.

7 . The integrated circuit of claim 1 , wherein storing the first key in the storage of the first device comprises:

storing the first key with first information unique to at least one of the integrated circuit or a client of the integrated circuit having read access or write access of the first key.

8 . The integrated circuit of claim 1 , wherein, after the third circuit of the integrated circuit encrypts the first key and adds the first data and the second data to the first key and, before the first key is stored in the storage of the first device, the first circuit is further configured to:

further apply confidentiality to the first key by associating the first key with information unique to the integrated circuit; and

add third data to the first key to protect against modification of the first key.

9 . The integrated circuit of claim 8 , wherein, after the first key is retrieved from the storage of the first device, the first circuit of the integrated circuit is configured to:

remove confidentiality from the first key; and

verify the third data of the first key.

10 . The integrated circuit of claim 9 , wherein, after the first key is retrieved from the storage of the first device, the first circuit of the integrated circuit is further configured to:

verify the first key was retrieved from the storage of the first device.

11 . The integrated circuit of claim 1 , wherein, after the first key is retrieved from the storage of the first device, a fourth circuit of the integrated circuit is configured to:

remove confidentiality from the first key;

verify the first data of the first key; and

verify the second data of the first key.

12 . The integrated circuit of claim 1 , wherein the first circuit is further configured to:

retrieve the key table from the storage of the first device;

remove confidentiality from the key table; and

verify the third data of the key table; and

a fourth circuit of the integrated circuit is configured to:

obtain the first key from the key table;

remove confidentiality from the first key;

verify the first data of the first key; and

verify the second data of the first key.

13 . The integrated circuit of claim 1 , the integrated circuit further comprising a memory, wherein the first circuit is further configured to:

determine an application or an asset associated with the first key;

based a determination that the application is a first type of application or the determination that the asset is a first type of asset, store the first key on the memory; and

based a determination that the application is a second type of application or the determination that the asset is a second type of asset, store the first key in the storage of the first device.

14 . The integrated circuit of claim 1 , the integrated circuit further comprising a memory, wherein the first circuit is further configured to:

determine a time when the first key is needed;

based a determination that the time is less than a threshold, store the first key on the memory; and

based a determination that the time is greater than the threshold, store the first key in the storage of the first device.

15 . The integrated circuit of claim 1 , the integrated circuit further comprising a memory, wherein the first circuit is further configured to:

determine a time when the first key is needed; and

based a determination that the time is less than a threshold, retrieve the first key from the storage of the first device and store the first key on the memory.

16 . The integrated circuit of claim 1 , wherein the first circuit is further configured to:

specify a first location to store the first key in the storage; and

send the first location of the first key to a second circuit configured to access an asset using the first key in parallel with at least one of sending the asset or a location of the asset to the second circuit.

17 . A method for storing or retrieving a key comprising:

receiving on a chip at least one of a first key,

apply confidentiality to the first key;

add first data to the first key to protect against modification of the first key; and

add second data to the first key to associate the first key with a source;

apply confidentiality to a second key;

add additional first data to the second key to protect against modification of the second key;

add additional second data to the second key to associate the second key with a second source;

add the first key and the second key to a key table;

apply confidentiality to the key table;

add third data to the key table to protect against modification of the key table

at least one of storing the first key in a storage of a device when the first key is received or retrieving the first key from the storage of the device when the request to retrieve the first key is received, wherein the device is external to the chip; and

store the key table having the first key and the second key in the storage of the first device;

controlling access to the first key stored in the storage of the device.

18 . A circuit of a first device configured to:

receive at least one of a first key;

store the key in a storage of a second device when the key is received, wherein the second device is external to the first device;

a third circuit is configured to:

apply confidentiality to the first key;

add first data to the first key to protect against modification of the first key; and

add second data to the first key to associate the first key with a source;

apply confidentiality to a second key;

add additional first data to the second key to protect against modification of the second key; and

add additional second data to the second key to associate the second key with a second source; and

the first circuit is further configured to:

add the first key and the second key to a key table;

apply confidentiality to the key table;

add third data to the key table to protect against modification of the key table;

store the key table having the first key and the second key in the storage of the first device; and

control at least one of read access of the key in the storage of the second device or write access of the key to the storage of the second device.

Assignments (1)

Continuity (1)

References Cited (11)