Programmable device key provisioning
AssigneeIntel Corporation
InventorsTing Lu, Robert Landon Pelt, James Ryan Kenny
Life of this patent
Estimating the term…
Abstract
The present disclosure provides systems and methods for improving provision of secret data on programmable devices. An appliance receives physical unclonable function (PUF) data pertaining to an integrated circuit. Secret data is provided to the appliance from a secret vault. Public and private PUF keys are derived based upon the PUF data. Further, ephemeral public and private keys are derived by the appliance. The public and private PUF keys, along with the ephemeral public and private keys are used to establish a secure channel for programming the secret data on the programmable device.
Claims21
An appliance, comprising:
- a database cache, configured to store physical unclonable function (PUF) enrollment data for an integrated circuit (IC);
- a secure enclave, configured to store a secret key for the IC;
- and
- a transport stream (TS) client, configured to:
- establish a secure channel with the IC using at least the PUF enrollment data;
- and
- provision the secret key on the IC, via the secure channel.
An integrated circuit (IC), comprising:
- a physical unclonable function (PUF);
- wherein the IC is configured to:
- provide a unique identifier (UID) to an appliance;
- receive, from the appliance, physical unclonable function (PUF) enrollment data associated with the UID;
- derive a private PUF key based upon the PUF and the PUF enrollment data;
- receive, from the appliance, an ephemeral public key from the appliance;
- establish a secure communication session with the appliance using the private PUF key of the IC, the ephemeral public key of the IC, a public PUF key of the appliance, and an ephemeral private key of the appliance;
- and
- receive secret data, from the appliance, via the secure communication session.
A computer-implemented method, comprising:
- receiving, at an appliance, from a physical unclonable function (PUF) database hosted by an integrated circuit developer, PUF enrollment data, comprising a public PUF key derived from a PUF of an integrated circuit;
- receiving, at the appliance, from a key vault hosted by a product owner of the integrated circuit, a certificate comprising secret data to provision on the integrated circuit;
- generating an ephemeral key set, comprising an ephemeral public key and an ephemeral private key;
- signing the ephemeral public key with a root public key;
- providing the signed ephemeral public key to the IC;
- and
- establishing a secure channel via a security protocol, using the ephemeral private key of the appliance, the PUF public key of the appliance, a PUF private key of the integrated circuit, and the signed ephemeral public key of the integrated circuit.
Dependencies are inferred from the claim text.