# US 8,572,410 B1 · Virtualized protected storage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,410 B1 - Document ID: US8572410B1 - Status: Granted - Kind: B1 - Application number: 13/552,527 - Filed: 2012-07-18 - Granted: 2013-10-29 - Earliest claimed: 2012-07-18 - Assignees: Freescale Semiconductor, Inc. - Applicants: Thomas E. Tkacik; Carlin R. Covey - Inventors: Thomas E. Tkacik; Carlin R. Covey - Web page: https://patentgrep.com/patent/US8572410B1 ## CPC - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - G06F 21/72: in cryptographic circuits - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments of an electronic circuit include a cryptographic engine which includes a key derivation function and encryption logic. The key derivation function combines a master secret key with a plurality of key modifiers including at least an operating system tag specific to an operating system, and derives an encryption key from the combined master secret key and plurality of key modifiers. The encryption logic is coupled to the key derivation function and encrypts data using the derived encryption key to generate a cryptographic binary large object (blob) for virtualized protected storage that is accessible only to the operating system specified by the operating system tag. ## Claims ### Claim 1 An electronic circuit comprising: a cryptographic circuit comprising: a key derivation function that combines a master secret key with a plurality of key modifiers comprising at least an operating system tag specific to an operating system, and derives an encryption key from the combined master secret key and plurality of key modifiers; and encryption logic coupled to the key derivation function that encrypts data using the derived encryption key to generate a cryptographic binary large object (blob) that is tagged with a security state of the electronic circuit and the operating system tag for virtualized protected storage that is accessible only to the operating system specified by the operating system tag. ### Claim 2 (depends on 1) The electronic circuit according to claim 1 wherein the cryptographic engine further comprises: the key derivation function that derives a blob key encryption key from the combined master secret key and plurality of key modifiers; a random number generator that generates a random blob key; and encryption logic coupled to the key derivation function and the random number generator that encrypts the random blob key using the derived blob key encryption key to generate an encrypted random blob key that is stored with the blob. ### Claim 3 (depends on 1) The electronic circuit according to claim 1 wherein: the cryptographic engine is configured to receive a cryptographic blob from a storage; and the encryption logic is configured to decrypt the cryptographic blob using the encryption key. ### Claim 4 (depends on 1) The electronic circuit according to claim 1 further comprising: secure boot logic that performs a secure boot that validates system software and places the electronic circuit in a trusted state enabling access by the cryptographic engine to the master secret key. ### Claim 5 (depends on 1) The electronic circuit according to claim 1 wherein: the cryptographic blob further includes a user-specified application tag. ### Claim 6 (depends on 1) The electronic circuit according to claim 1 wherein: the operating system tag is enforced by the electronic circuit and unmodifiable by the operating system; and the operating system tag is a security domain identifier associated with the operating system. ### Claim 7 (depends on 1) The electronic circuit according to claim 1 further comprising: at least one interface portal; wherein: the operating system tag is a hardware interface tag specified by the at least one interface portal. ### Claim 8 (depends on 1) The electronic circuit according to claim 1 further comprising: at least one memory management unit; a plurality of interface portals; and a control operating system that configures the cryptographic engine for a plurality of operating systems, and programs the at least one memory management unit for operating system separation wherein the cryptographic engine is configured to allocate ones of the plurality of interface portals respectively to ones of the plurality of operating systems. ### Claim 9 A method of operating an electronic circuit comprising: combining a master secret key with a plurality of key modifiers comprising at least an operating system tag specific to an operating system; deriving an encryption key from the combined master secret key and plurality of key modifiers; encrypting data using the encryption key; and generating a cryptographic binary large object (blob) that is tagged with a security state of the electronic circuit and the operating system tag for virtualized protected storage that is accessible only to the operating system specified by the operating system tag. ### Claim 10 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: deriving a blob key encryption key from the combined master secret key and plurality of key modifiers; generating a random blob key; encrypting the random blob key using the derived blob key encryption key; and generating an encrypted random blob key that is stored with the blob. ### Claim 11 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: receiving a cryptographic blob from a storage; and decrypting the cryptographic blob using the encryption key. ### Claim 12 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: performing a secure boot; validating, via the secure boot, system software; and placing the electronic circuit in a trusted state enabling access of the cryptographic engine to the master secret key. ### Claim 13 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: tagging the cryptographic blob with user-specified application tag. ### Claim 14 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: enforcing the operating system tag by the electronic circuit wherein the operating system tag is unmodifiable by the operating system; and associating the operating system tag comprising a security domain identifier with the operating system. ### Claim 15 (depends on 9) The method of operating the electronic circuit according to claim 9 further comprising: configuring the cryptographic engine for a plurality of operating systems; programming at least one memory management unit for operating system separation; and allocating ones of a plurality of interface portals respectively to ones of the plurality of operating systems. ### Claim 16 A virtualized protected storage system comprising: at least one memory management unit; a plurality of interface portals; a control operating system that runs a plurality of operating systems, and programs the at least one memory management unit for operating system separation and allocates ones of the plurality of interface portals respectively to ones of the plurality of operating systems; and a cryptographic circuit comprising: a key derivation function that combines a master secret key with a plurality of key modifiers comprising at least an operating system tag specific to an operating system, and derives an encryption key from the combined master secret key and plurality of key modifiers; and encryption logic coupled to the key derivation function that encrypts data using the derived encryption key to generate a cryptographic binary large object (blob) that is tagged with a security state of the electronic circuit and the operating system tag and that is accessible only to the operating system specified by the operating system tag. ### Claim 17 (depends on 16) The virtualized protected storage system according to claim 16 wherein the cryptographic engine further comprises: the key derivation function that derives a blob key encryption key from the combined master secret key and plurality of key modifiers; a random number generator that generates a random blob key; and encryption logic coupled to the key derivation function and the random number generator that encrypts the random blob key using the derived blob key encryption key to generate an encrypted random blob key that is stored with the blob. ### Claim 18 (depends on 16) The virtualized protected storage system according to claim 16 further comprising: a storage; the cryptographic engine configured to receive a cryptographic blob from the storage; the encryption logic configured to decrypt the cryptographic blob using the encryption key; and secure boot logic that performs a secure boot that validates system software and places the virtualized protected storage system in a trusted state enabling access by the cryptographic engine to the master secret key. ### Claim 19 (depends on 16) The virtualized protected storage system according to claim 16 wherein: the cryptographic blob further includes a user-specified application tag; and the operating system tag is a security domain identifier associated with the operating system and is enforced by the cryptography module and unmodifiable by the operating system. ### Claim 20 (depends on 16) The virtualized protected storage system according to claim 16 further comprising: at least one interface portal; wherein: the operating system tag is a hardware interface tag specified by the at least one interface portal.