# US 2009/0268902 A1 · System for and method of cryptographic provisioning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2009/0268902 A1 - Document ID: US20090268902A1 - Status: Published application - Kind: A1 - Application number: 12/109,883 - Filed: 2008-04-25 - Published: 2009-10-29 - Earliest claimed: 2008-04-25 - Assignees: Koolspan, Inc. - Inventors: Anthony Fascenda; Emil Sturniolo; Robert Cichielo; Paul Benware - Web page: https://patentgrep.com/patent/US20090268902A1 ## CPC - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for and method of securely provisioning a module with cryptographic parameters, such as cryptographic keys and key tables, is presented. Such modules may be used to enable encrypted communications between mobile phones to which they are coupled. The system and method prevent a malevolent individual involved in manufacturing the modules from compromising the security of the module. In particular, the modules are provisioned by an entity different from the manufacturer. ## Claims ### Claim 1 A method of provisioning a module with cryptographic parameters, wherein the module comprises a first nonvolatile memory, a second nonvolatile memory and a processor, the method comprising: storing a first cryptographic key in at least one of the first nonvolatile memory and the second nonvolatile memory; and storing a first program encrypted using the first cryptographic key in at least one of the first nonvolatile memory and the second nonvolatile memory, wherein the first program is configured to: generate, within the module and using the processor, a second cryptographic key and a third cryptographic key; encrypt, within the module, the second cryptographic key using the third cryptographic key, whereby encrypting the second cryptographic key with the third cryptographic key generates an encrypted second cryptographic key and a first authenticator; store, within the first nonvolatile memory, the encrypted second cryptographic key and the first authenticator; and store, within the second nonvolatile memory, the third cryptographic key. ### Claim 2 (depends on 1) The method of claim 1, wherein the first nonvolatile memory and the second nonvolatile memory are logically partitioned portions of a single physical persistent memory. ### Claim 3 (depends on 1) The method of claim 1 further comprising storing in the module additional programming, encrypted using the second cryptographic key. ### Claim 4 (depends on 1) The method of claim 1 further comprising, when the module is activated, decrypting, within the module, the encrypted second cryptographic key, whereby decrypting the encrypted second cryptographic key generates a second authenticator; comparing the first authenticator and the second authenticator; and disabling at least some operations of the module if a result of the comparing indicates a lack of authenticity. ### Claim 5 (depends on 1) The method of claim 1 wherein the module lacks a power supply. ### Claim 6 (depends on 1) The method of claim 1 wherein a form factor for the module is selected from the group consisting of: SD, mini SD, micro SD, PCMCIA, P2, Compact Flash, Memory Stick, PRO Memory Stick, PRO Duo Memory Stick, Micro Memory Stick, Multi Media Card, SmartMedia Memory Card, MultiMedia Memory Card, Reduced Size MultiMedia Memory Card, MultiMedia Memory Card Mobile, MultiMedia Memory Card Plus, MultiMedia Memory Card Micro, xD Memory Card, SIP, DIP and USB. ### Claim 7 (depends on 1) The method of claim 1 further comprising, prior to the step of storing a first cryptographic key, receiving the module, wherein the received module comprises a test program and a test key, wherein the test program and test key are configured to test that the module has been correctly manufactured. ### Claim 8 (depends on 1) The method of claim 1 further comprising: accessing a public key associated with an entity; encrypting a symmetric key using the public key, whereby an encrypted symmetric key is generated; transmitting the encrypted symmetric key to the entity; receiving, from the entity, at least one key encrypted with the symmetric key; and decrypting, within the module, the at least one key. ### Claim 9 (depends on 8) The method of claim 8 further comprising: encrypting the at least one key using the second cryptographic key, whereby an encrypted symmetric key is generated; and storing the encrypted symmetric key in the second nonvolatile memory. ### Claim 10 A system for provisioning a module with cryptographic parameters, wherein the module comprises a first nonvolatile memory, a second nonvolatile memory and a processor, the system comprising: means for storing a first cryptographic key in at least one of the first nonvolatile memory and the second nonvolatile memory; and means for storing a first program encrypted using the first cryptographic key in at least one of the first nonvolatile memory and the second nonvolatile memory, wherein the first program is configured to: generate, within the module and using the processor, a second cryptographic key and a third cryptographic key; encrypt, within the module, the second cryptographic key using the third cryptographic key, whereby encrypting the second cryptographic key with the third cryptographic key generates an encrypted second cryptographic key and a first authenticator; store, within the first nonvolatile memory, the encrypted second cryptographic key and the first authenticator; and store, within the second nonvolatile memory, the third cryptographic key. ### Claim 11 (depends on 10) The system of claim 10, wherein the first nonvolatile memory and the second nonvolatile memory are logically partitioned portions of a single physical persistent memory. ### Claim 12 (depends on 10) The system of claim 10 further comprising storing in the module additional programming, encrypted using the second cryptographic key. ### Claim 13 (depends on 10) The system of claim 10 wherein the first programming is further configured to, when the module is activated, decrypt, within the module, the encrypted second cryptographic key, whereby decrypting the encrypted second cryptographic key generates a second authenticator; compare the first authenticator and the second authenticator; and disable at least some operations of the module if a result of the comparing indicates a lack of authenticity. ### Claim 14 (depends on 10) The system of claim 10 wherein the module lacks a power supply. ### Claim 15 (depends on 10) The system of claim 10 wherein a form factor for the module is selected from the group consisting of: SD, mini SD, micro SD, PCMCIA, P2, Compact Flash, Memory Stick, PRO Memory Stick, PRO Duo Memory Stick, Micro Memory Stick, Multi Media Card, SmartMedia Memory Card, MultiMedia Memory Card, Reduced Size MultiMedia Memory Card, MultiMedia Memory Card Mobile, MultiMedia Memory Card Plus, MultiMedia Memory Card Micro, xD Memory Card, SIP, DIP and USB.