Federal Information Processing Standard (FIPS) compliant Device Identifier Composition Engine (DICE) certificate chain architecture for embedded systems

A method comprising:

• generating, at Deterministic Random Bit Generator (DRBG) logic circuitry, a random number for each layer of a Device Identifier Composition Engine (DICE), wherein the DRBG logic circuitry is a Federal Information Processing Standard (FIPS) approved DRBG logic circuitry;
• deriving, at derivative logic circuitry, an Elliptic Curve Digital Signature Algorithm (ECDSA) private key for a layer of the DICE based at least in part on one or more operations of a FIPS-approved ECDSA key pair generation logic circuitry;
• and
• constructing at least one certificate chain on an embedded system to link a secure state and transition to a specific attestation key for the layer.

One or more non-transitory computer-readable media comprising one or more instructions that when executed on a processor configure the processor to perform one or more operations to cause:

• Deterministic Random Bit Generator (DRBG) logic circuitry to generate a random number for each layer of a Device Identifier Composition Engine (DICE), wherein the DRBG logic circuitry is a Federal Information Processing Standard (FIPS) approved DRBG logic circuitry;
• and
• derivative logic circuitry to derive an Elliptic Curve Digital Signature Algorithm (ECDSA) private key for a layer of the DICE based at least in part on one or more operations of a FIPS-approved ECDSA key pair generation logic circuitry;
• and
• construction of at least one certificate chain on an embedded system to link a secure state and transition to a specific attestation key for the layer.

An apparatus comprising:

• Deterministic Random Bit Generator (DRBG) logic circuitry to generate a random number for each layer of a Device Identifier Composition Engine (DICE), wherein the DRBG logic circuitry is a Federal Information Processing Standard (FIPS) approved DRBG logic circuitry;
• and
• derivative logic circuitry to derive an Elliptic Curve Digital Signature Algorithm (ECDSA) private key for a layer of the DICE based at least in part on one or more operations of a FIPS-approved ECDSA key pair generation logic circuitry,
• wherein a plurality of DRBG logic circuitry is to generate a plurality of random numbers, wherein each of the random numbers is to correspond to a separate layer of the DICE.