US 8,286,001 B2Granted

Method and central processing unit for processing encrypted software

AssigneeInternational Business Machines Corporation

InventorsHang J. Ye, Tao Zhou, Weikai Xie, Guo H. Lin, Yi Ge

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention provides a central processing unit for processing at least one encrypted software. The encrypted software comprises at least one encrypted software section. The encrypted software section is encrypted with a management key MK, and the MK being encrypted with a device key DK as a encrypted MK. The central processing unit comprises processing and cache unit, and cryptographic unit. The cryptographic unit comprises device key storage unit for storing the DK, a plurality of management key storage units for storing MKs, wherein each management key storage unit corresponding to a management key index MKI, and decryption unit. The decryption unit decrypts a encrypted MK with the DK to obtain a MK, stores the MK to a management key storage unit, and output a MKI corresponding to the management key storage unit, thus the MKI is used to correspond to the encrypted software section. Wherein, the decryption unit invokes corresponding MK according to the MKI and decrypts the encrypted software section, and directly transfers the decrypted software code and/or data to the processing and cache unit.

Claims15

Dependent claims

A central processing unit for processing at least one encrypted software, wherein the encrypted software comprises at least one encrypted software section, the encrypted software section being encrypted with a particular management key MK and stored in a memory area, the MK being encrypted with a device key DK as an encrypted MK, the central processing unit comprising:

a processing and cache unit;
a cryptographic unit, comprising:
a device key storage unit for storing the DK;
a plurality of management key storage units for storing MKs, wherein each management key storage unit corresponds to a management key index MKI;
a decryption unit for decrypting an encrypted MK with the DK to obtain a MK, storing the MK to a management key storage unit, and outputting a MKI corresponding to the management key storage unit, the MKI being used to identify a location of the encrypted software section in the memory area;
the cryptographic unit outputting the MKIs to the processing and cache unit, and the processing and cache unit storing the MKIs;
the processing and cache unit transferring software and one of the MKIs to the cryptographic unit, and the cryptographic unit using said one of the MKIs to obtain one of the MKs, and using said MKs to encrypt the software transferred from the processing and cache unit;
wherein the MKI corresponding to said particular MK is used both to identify the location of the particular MK, and to identify the location in the memory area of the encrypted software section encrypted by the particular MK;
and
wherein, the decryption unit invokes the corresponding MK according to the MKI and decrypts the encrypted software section, and directly transfers the decrypted software from the decryption unit to the processing and cache unit.

7 more elements

A method for processing at least one encrypted software with a central processing unit, wherein the central processing unit comprises a processing and cache unit, and a cryptographic unit, and the cryptographic unit comprises a decryption unit, a device key storage unit for storing a device key DK, and a plurality of management key storage units for storing management keys MKs, wherein each management key storage unit corresponds to a management key index MKI, the encrypted software being encrypted with a management key MK and stored in a memory area, the MK being encrypted with a device key DK as an encrypted MK, the method comprising:

storing the encrypted MK corresponding to the encrypted software into the cryptographic unit;
using a decryption unit for decrypting an encrypted MK with the DK to obtain a MK;
storing the obtained MK in a management key storage unit, and obtaining a MKI corresponding to the management key storage unit;
associating the obtained MKI with the encrypted software, wherein the obtained MKI identifies both the location of the obtained MK, and the location in the memory area of the encrypted software;
invoking corresponding MK according to the obtained MKI and decrypting the encrypted software with the MK in the cryptographic unit;
directly transferring the decrypted software code and/or data to the processing and cache unit, and processing the decrypted software with the processing and cache unit;
the cryptographic unit outputting the MKIs to the processing and cache unit, and the processing and cache unit storing the MKIs;
and
the processing and cache unit transferring software and one of the MKIs to the cryptographic unit, and the cryptographic unit using said one of the MKIs to obtain one of the MKs, and using said one of the MKs to encrypt the software transferred from the processing and cache unit.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/173,112Filed 15 Jul 2008 · continuation
Priority: CN 2005 1 008731427 Jul 2005
Published: US 2009/0019290 A115 Jan 2009
Granted: 9 Oct 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 12/1408
Protection against unauthorised use of memory or access to memory: by using cryptography
G06F 21/10
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: protecting distributed…
G06F 21/125
Restricting unauthorised execution of programs: by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits