Cryptographic unit for public key infrastructure (PKI) operations

A cryptographic unit for securely receiving and using an updated firmware, the cryptographic unit comprising:

• a protected nonvolatile memory for recording, before the cryptographic unit is distributed to a user, (i) a first set of cryptographic parameters, (ii) a cryptographic unit identity, (iii) a cryptographic unit private key, and (iv) a certificate authority public key;
• an interface for transferring the cryptographic unit identity, for receiving a nonce, for transferring a first digital signature for the nonce, and for receiving the updated firmware, wherein the received updated firmware is encrypted with a first symmetric ciphering key;
• a cryptographic unit boot firmware for operating a set of cryptographic algorithms, wherein the set of cryptographic algorithms (i) derives the first symmetric ciphering key with (a) an elliptic curve Diffie Hellman (ECDH) key exchange, (b) at least the cryptographic unit private key, and (c) the first set of cryptographic parameters, and (ii) decrypts the updated firmware with the derived first symmetric ciphering key, wherein the updated firmware includes a second set of cryptographic parameters;
• a random number generator for generating a pseudo-random number, wherein the pseudo-random number is input into a key pair generation algorithm with the second set of cryptographic parameters in order to derive a module private key and a module public key;
• a processor for loading the cryptographic unit boot firmware, for generating the first digital signature of the nonce with at least the cryptographic unit private key and the first set of cryptographic parameters, and for generating a second digital signature of the derived module public key with at least the cryptographic unit private key;
• a data bus for sending from the processor to the interface (i) the second digital signature of the derived module public key and (ii) the derived module public key, and for receiving a certificate of the derived module public key from the interface, wherein the certificate is verified with the certificate authority public key;
• and
• a memory controller for writing the updated firmware to a device nonvolatile memory, wherein the memory controller encrypts the updated firmware for storage in the device nonvolatile memory with a second symmetric ciphering key.