# US 12,192,348 B2 · Key management in an integrated circuit > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,348 B2 - Document ID: US12192348B2 - Status: Granted - Kind: B2 - Application number: 17/432,153 - Filed: 2020-02-14 - Published: 2022-06-16 - Granted: 2025-01-07 - Earliest claimed: 2019-02-21 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Hans Aschauer; Rainer Falk; Christian Peter Feist; Steffen Fries; Aliza Maftun; Hermann Seuschek; Thomas Zeschg - Web page: https://patentgrep.com/patent/US12192348B2 ## CPC - G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for key management in a field-programmable integrated part of an integrated circuit is disclosed herein. According to the method, a hardware configuration for the field-programmable integrated part is loaded into the field-programmable integrated part. The hardware configuration includes a key derivation functionality. Further, using the key derivation functionality, a cryptographic key is derived based on information provided in the field-programmable integrated part. ## Claims ### Claim 1 A method for key management in a field-programmable integrated part of an integrated circuit, the method comprising: loading a hardware configuration for the field-programmable integrated part into the field-programmable integrated part, wherein the hardware configuration comprises a key derivation functionality; and deriving, by operation of the hardware configuration in the field-programmable integrated part using the key derivation functionality, a cryptographic key based on information provided in the field-programmable integrated part, wherein the information in the field-programmable integrated part comprises a fingerprint of a bitstream of the hardware configuration. ### Claim 2 (depends on 1) The method of claim 1, wherein the hardware configuration comprises a control functionality for controlling, using the cryptographic key, operation of an application implemented by the field-programmable integrated part. ### Claim 3 (depends on 1) The method of claim 1, wherein the information provided in the field-programmable integrated part further comprises: a hardware application identifier comprised in the hardware configuration loaded into the field-programmable integrated part, a hardware system key provided by an application executed by a logic coupled to the field-programmable integrated part, a secret system parameter comprised in the field-programmable integrated part, or combinations thereof. ### Claim 4 (depends on 1) The method of claim 1, further comprising: performing a cryptographic operation in the field-programmable integrated part using the derived cryptographic key. ### Claim 5 (depends on 4) The method of claim 4, further comprising: generating encrypted data in the field-programmable integrated part using the cryptographic key; and transmitting the encrypted data to a memory remote from the field-programmable integrated part. ### Claim 6 (depends on 4) The method of claim 4, further comprising: receiving encrypted data from a memory remote from the field-programmable integrated part; and decrypting the encrypted data in the field-programmable integrated part using the cryptographic key. ### Claim 7 (depends on 1) The method of claim 1, wherein the deriving of the cryptographic key comprises applying a hash function on the information provided in the field-programmable integrated part. ### Claim 8 (depends on 1) The method of claim 1, further comprising: generating encrypted data in the field-programmable integrated part using the cryptographic key; and transmitting the encrypted data to a memory remote from the field-programmable integrated part. ### Claim 9 (depends on 1) The method of claim 1, further comprising: receiving encrypted data from a memory remote from the field-programmable integrated part; and decrypting the encrypted data in the field-programmable integrated part using the cryptographic key. ### Claim 10 (depends on 1) The method of claim 1, wherein the field-programmable integrated part represents a first field-programmable integrated part of the integrated circuit, the method further comprising: loading a further hardware configuration into a second field-programmable integrated part of the integrated circuit, wherein the further hardware configuration comprises a further key derivation functionality; and deriving, by the further key derivation functionality, a further cryptographic key based on further information provided in the second field-programmable integrated part. ### Claim 11 (depends on 10) The method of claim 10, further comprising: generating a session key for protecting messages communicated between the first field-programmable integrated part and the second field-programmable integrated part using a key agreement protocol in the first field-programmable integrated part and the second field-programmable integrated part. ### Claim 12 (depends on 11) The method of claim 11, wherein the session key comprises: a first directional session key for protecting messages communicated from the first field-programmable integrated part to the second field-programmable integrated part, a second directional session key for protecting messages communicated from the second field-programmable integrated part to the first field-programmable integrated part, or combinations thereof. ### Claim 13 (depends on 12) The method of claim 12, further comprising: protecting messages of the key agreement protocol communicated from the first field-programmable integrated part to the second field-programmable integrated part using the cryptographic key, protecting messages of the key agreement protocol communicated from the second field-programmable integrated part to the first field-programmable integrated part using the further cryptographic key, or combinations thereof. ### Claim 14 (depends on 13) The method of claim 13, wherein the protecting of the messages comprises encrypting the messages, decrypting the messages, protecting integrity of the messages, or combinations thereof. ### Claim 15 (depends on 11) The method of claim 11, further comprising: protecting messages of the key agreement protocol communicated from the first field-programmable integrated part to the second field-programmable integrated part using the cryptographic key, protecting messages of the key agreement protocol communicated from the second field-programmable integrated part to the first field-programmable integrated part using the further cryptographic key, or combinations thereof. ### Claim 16 (depends on 11) The method of claim 11, wherein the protecting of the messages comprises encrypting the messages, decrypting the messages, protecting integrity of the messages, or combinations thereof. ### Claim 17 A system comprising: a field-programmable integrated part of an integrated circuit, wherein the field-programmable integrated part is configured to: load a hardware configuration for the field-programmable integrated part into the field-programmable integrated part, the hardware configuration comprising a key derivation functionality enabling the field-programmable integrated part to perform a key derivation function, and derive, by operation of the hardware configuration in the field-programmable integrated part using the key derivation functionality, a cryptographic key based on information provided in the field-programmable integrated part, wherein the information in the field-programmable integrated part comprises a fingerprint of a bitstream of the hardware configuration. ### Claim 18 (depends on 17) The system of claim 17, wherein the system is configured to: generate encrypted data in the field-programmable integrated part using the cryptographic key and transmit the encrypted data to a memory remote from the field-programmable integrated part; or receive the encrypted data from the memory and decrypt the encrypted data in the field-programmable integrated part using the cryptographic key. ### Claim 19 A non-transitory hardware configuration for a field-programmable integrated part of an integrated circuit, which is configured to be loaded into the field-programmable integrated part, wherein the non-transitory hardware configuration causes the field-programmable integrated part to: derive, by operation of the non-transitory hardware configuration in the field-programmable integrated part using a key derivation functionality of the non-transitory hardware configuration, a cryptographic key based on information provided in the field-programmable integrated part, wherein the information in the field-programmable integrated part comprises a fingerprint of a bitstream of the non-transitory hardware configuration.