Systems and methods for protecting symmetric encryption keys
AssigneeIntel Corporation
InventorsSteven L. Grobman, Jason W. Brandt
Life of this patent
Estimating the term…
Abstract
Systems and methods for protecting symmetric encryption keys when performing encryption are described. In one embodiment, a computer-implemented method includes retrieving at least one real key from a secure area and executing, with a processor, a key transform instruction to generate at least one transformed key based on receiving the at least one real key. The at least one transformed key is an encrypted version of at least one round key that is encrypted by the processor using the at least one real key. The processor is able to decrypt the at least one transformed key and encrypt the at least one round key.
Claims8
A computer-implemented method, comprising:
- executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;
- storing the at least one transformed key in memory, wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a session key that is randomly derived at power initialization, wherein only the processor is able to decrypt the at least one transformed key and encrypt the at least one round key.
A computer-implemented method, comprising:
- executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;
- storing the at least one transformed key in memory wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a unique key for the processor that is derived and persisted internally through a derived key that is based on fusing.
A non-transitory machine-accessible medium including data that, when accessed by a machine, cause the machine to perform operations comprising:
- executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;
- storing the at least one transformed key in memory, wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a session key that is randomly derived at power initialization, wherein only the processor is able to decrypt the at least one transformed key and encrypt the at least one round key.
A system, comprising:
- a processor having access to at least one real key;
- and
- memory coupled to the processor, the memory to store at least one transformed key, the processor is configured to execute a key transform instruction to generate at least one transformed key based on the at least one real key, wherein the memory comprises a cache to store a mapping to map transformed keys to corresponding round keys that are based on the at
- least one real key, and wherein the processor is further configured to decrypt the transformed keys if a cache miss occurs.
A non-transitory machine-accessible medium including data that, when accessed by a machine, cause the machine to perform operations comprising:
- executing, with a processor, a key transform instruction to generate at least one transformed key of at least one round key;
- storing the at least one transformed key in memory wherein the at least one transformed key is an encrypted version of the at least one round key that is encrypted by the processor using at least one real key, wherein the at least one real key comprises a unique key for the processor that is derived and persisted internally through a derived key that is based on fusing.
Dependencies are inferred from the claim text.