Method and apparatus for distributing encrypted device unique credentials

An apparatus for providing credentials to a device including a chip, comprising:

• a processor;
• and
• a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
• receiving the credentials in credential provisioning server (CPS), the credentials having information encrypted according to a secure server key (SSK) securely stored in a hardware security module (HSM) communicatively coupled to the CPS, the hardware security module also securely storing a master key;
• receiving a credential request in the CPS, the credential request comprising a chip identifier that identifies the chip;
• securely decrypting the encrypted information in the HSM according to the SSK;
• securely computing a chip-unique key in the HSM, according to the chip identifier and the master key;
• re-encrypting the decrypted information according to the computed chip-unique key;
• and
• providing the credentials having the re-encrypted information to the device;
• wherein:
• the chip included in the device is pre-provisioned during chip manufacturing with:
• the chip identifier;
• a one-time programmable (OTP) secret key associated with the chip identifier;
• and
• the chip-unique key is computed at least in part from the OTP secret key.

An apparatus for providing credentials to a device including a chip, comprising:

• means for receiving the credentials in credential provisioning server (CPS), the credentials having information encrypted according to a secure server key (SSK) securely stored in a hardware security module (HSM) communicatively coupled to the CPS, the hardware security module also securely storing a master key;
• means for receiving a credential request in the CPS, the credential request comprising a chip identifier that identifies the chip;
• means for securely decrypting the encrypted information in the HSM according to the SSK;
• means for securely computing a chip-unique key in the HSM, according to the chip identifier and the master key;
• means for re-encrypting the decrypted information according to the computed chip-unique key;
• and
• means for providing the credentials having the re-encrypted information to the device;
• wherein:
• the chip included in the device is pre-provisioned during chip manufacturing with:
• the chip identifier;
• a one-time programmable (OTP) secret key associated with the chip identifier;
• and
• the chip-unique key is derived at least in part from the OTP secret key.