# US 2019/0245702 A1 · Compact Security Certificate > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0245702 A1 - Document ID: US20190245702A1 - Status: Published application - Kind: A1 - Application number: 16/261,593 - Filed: 2019-01-30 - Published: 2019-08-08 - Earliest claimed: 2018-02-04 - Assignees: Altair Semiconductor Ltd. - Applicants: Altair Semiconductor Ltd. - Inventors: Yehuda Ben Simon; Omer Botvinik; Avishay Sharaga - Web page: https://patentgrep.com/patent/US20190245702A1 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - G06F 21/44: Program or device authentication - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 21/72: in cryptographic circuits - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3247: {involving digital signatures} - H04L 2209/12: Details relating to cryptographic hardware or logic circuitry - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An Integrated Circuit (IC) includes an on-chip non-volatile memory (NVM) and an on-chip processor. The on-chip NVM is configured to store a representation of a device-specific part of a security certificate assigned to the IC. The on-chip processor is configured to obtain a common part of the security certificate, to reconstruct the security certificate from the obtained common part and from the representation of the device-specific part stored in the on-chip NVM, and to perform a security operation using the reconstructed security certificate. ## Claims ### Claim 1 An Integrated Circuit (IC), comprising: an on-chip non-volatile memory (NVM), configured to store a representation of a device-specific part of a security certificate assigned to the IC; and an on-chip processor, configured to obtain a common part of the security certificate, to reconstruct the security certificate from the obtained common part and from the representation of the device-specific part stored in the on-chip NVM, and to perform a security operation on data using the reconstructed security certificate. ### Claim 2 (depends on 1) The IC according to claim 1, wherein the representation comprises a compressed form of the device-specific part of the security certificate, and wherein the on-chip processor is configured to decompress the representation of the device-specific part. ### Claim 3 (depends on 1) The IC according to claim 1, wherein the on-chip processor is configured to verify a signature of the reconstructed certificate. ### Claim 4 A certificate-signing server, comprising: an interface for communicating with an Integrated Circuit (IC); and a processor, configured to receive from the IC at least a public key, to create a security certificate for the IC, to partition the security certificate into a device-specific part that is specific to the IC and a common part that is not specific to the IC, and to send to the IC less than the entire security certificate, but at least a representation of the device-specific part. ### Claim 5 (depends on 4) The certificate-signing server according to claim 4, wherein the processor is configured to sign the security certificate, and to send a signature of the security certificate to the IC. ### Claim 6 (depends on 5) The certificate-signing server according to claim 5, wherein the processor is configured to receive the public key from the IC, and to sign the certificate using the public key. ### Claim 7 (depends on 4) The certificate-signing server according to claim 4, wherein the processor is configured to produce the representation by compressing the device-specific part. ### Claim 8 A certificate-signing server, comprising: an interface for communicating with an Integrated Circuit (IC); and a processor, configured to generate a pair of public and private keys, to create a security certificate for the IC, to partition the security certificate into a device-specific part that is specific to the IC and a common part that is not specific to the IC, and to send to the IC less than the entire security certificate, but at least a representation of the device-specific part. ### Claim 9 (depends on 8) The certificate-signing server according to claim 8, wherein the processor is configured to sign the security certificate, and to send a signature of the security certificate to the IC. ### Claim 10 (depends on 9) The certificate-signing server according to claim 9, wherein the processor is configured sign the certificate using a private key. ### Claim 11 (depends on 8) The certificate-signing server according to claim 8, wherein the processor is configured to produce the representation by compressing the device-specific part. ### Claim 12 A method, comprising: storing, in an on-chip non-volatile memory (NVM) in an Integrated Circuit (IC), a representation of a device-specific part of a security certificate assigned to the IC; and using an on-chip processor in the IC, obtaining a common part of the security certificate, reconstructing the security certificate from the obtained common part and from the representation of the device-specific part stored in the on-chip NVM, and performing a security operation using the reconstructed security certificate. ### Claim 13 (depends on 12) The method according to claim 12, wherein the representation comprises a compressed form of the device-specific part of the security certificate, and wherein reconstructing the security certificate comprises decompressing the representation of the device-specific part. ### Claim 14 (depends on 12) The method according to claim 12, and comprising verifying a signature of the reconstructed certificate by the on-chip processor. ### Claim 15 A method, comprising: receiving from an Integrated Circuit (IC) at least a public key; creating a security certificate for the IC; partitioning the security certificate into a device-specific part that is specific to the IC and a common part that is not specific to the IC; and sending to the IC less than the entire security certificate, but at least a representation of the device-specific part. ### Claim 16 (depends on 15) The method according to claim 15, and comprising signing the security certificate and sending a signature of the security certificate to the IC. ### Claim 17 (depends on 16) The method according to claim 16, wherein signing the security certificate comprises signing the certificate using a private key. ### Claim 18 (depends on 15) The method according to claim 15, and comprising producing the representation by compressing the device-specific part. ### Claim 19 A method, comprising: generating a pair of public and private keys; creating a security certificate for an integrated circuit (IC); partitioning the security certificate into a device-specific part that is specific to the IC and a common part that is not specific to the IC; and sending to the IC less than the entire security certificate, but at least a representation of the device-specific part. ### Claim 20 (depends on 19) The method according to claim 19, and comprising signing the security certificate and sending a signature of the security certificate to the IC. ### Claim 21 (depends on 20) The method according to claim 20, wherein signing the certificate comprises signing the certificate using the private key. ### Claim 22 (depends on 10) The method according to claim 10, and comprising producing the representation by compressing the device-specific part.