Secure feature and key management in integrated circuits

A method comprising:

• obtaining, by a delegate authority system, a base key;
• deriving, by the delegate authority system, a mixed key using the base key;
• deriving, by the delegate authority system, a transport key using the mixed key;
• obtaining, by the delegate authority system, a payload key;
• encrypting the payload key using the transport key to obtain an encrypted payload key;
• deriving, by the delegate authority system, a validator using the encrypted payload key and the mixed key, wherein the validator enables a security manager core of an integrated circuit to verify that the encrypted payload key is valid and unmodified;
• receiving, by the delegate authority system, delegate input parameters;
• signing, by the delegate authority system, the delegate input parameters, the encrypted payload key, and the validator using a delegate private key to create a delegate signed block (DSB), wherein the delegate private key is associated with the delegate authority system;
• and
• providing the DSB to the security manager core of the integrated circuit, wherein the security manager core to extract a payload specifying at least one of a restriction, a binding, or a value intended for a hardware feature of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.

A method comprising:

• obtaining, by a delegate authority system, a mixed key or a precursor to the mixed key;
• deriving, by the delegate authority system, a transport key using the mixed key;
• obtaining, by the delegate authority system, a payload key;
• encrypting the payload key using the transport key to obtain an encrypted payload key;
• receiving, by the delegate authority system, delegate input parameters;
• signing, by the delegate authority system, the delegate input parameters and the encrypted payload key using a delegate private key to create a delegate signed block (DSB), wherein the delegate private key is associated with the delegate authority system;
• and
• providing the DSB to a security manager core of an integrated circuit, wherein the security manager core to extract a payload specifying at least one of a restriction, a binding, or a value intended for a hardware feature of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.

A delegate authority system comprising:

• a memory device;
• and
• a processing device operatively coupled to the memory device, the processing device to:
• obtain a mixed key or a precursor to the mixed key;
• derive a transport key using the mixed key;
• obtain a payload key;
• encrypt the payload key using the transport key to obtain an encrypted payload key;
• receive delegate input parameters;
• sign the delegate input parameters and the encrypted payload key using a delegate private key to create a delegate signed block (DSB), wherein the delegate private key is associated with the delegate authority system;
• and
• provide the DSB to a security manager core of an integrated circuit, wherein the security manager core to extract a payload specifying at least one of a restriction, a binding, or a value intended for a hardware feature of the integrated circuit, in response to a signature of the DSB being verified by the security manager core.