# US 8,787,582 B2 · Key implementation system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,787,582 B2
- Document ID: US8787582B2
- Status: Granted
- Kind: B2
- Application number: 13/253,591
- Filed: 2011-10-05
- Published: 2012-02-02
- Granted: 2014-07-22
- Earliest claimed: 2009-04-06
- Assignees: Panasonic Corporation
- Applicants: Kaoru Yokota; Akihito Katsura; Yusuke Nemoto; Yuishi Torisaki; Makoto Fujiwara
- Inventors: Kaoru Yokota; Akihito Katsura; Yusuke Nemoto; Yuishi Torisaki; Makoto Fujiwara
- Web page: https://patentgrep.com/patent/US8787582B2

## CPC

- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)}
- G06F 21/72: in cryptographic circuits
- H04L 9/0822: {using key encryption key}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 21/109: {by using specially-adapted hardware at the client}
- H04L 2209/605: Copy protection
- H04L 2463/101: applying security measures for digital rights management
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An LSI includes a first decryptor which receives first encrypted key data, and decrypts the first encrypted key data using a first cryptographic key, thereby generating first decrypted key data, a second cryptographic key generator which generates a second cryptographic key based on a second ID, a second encryptor which encrypts the first decrypted key data using the second cryptographic key, thereby generating second encrypted key data, and a second decryptor which decrypts the second encrypted key data using the second cryptographic key, thereby generating second decrypted key data. At a time of key setting, the second encryptor stores the second encrypted key data in a storage unit. At a time of key usage, the second decryptor reads the second encrypted key data from the storage unit.

## Claims

### Claim 1

A key implementation system, comprising:
a large-scale integrated circuit (LSI); and
a storage unit, wherein:
the LSI includes:
a first decryptor configured to receive first encrypted key data, and to decrypt the first encrypted key data using a first cryptographic key, thereby generating first decrypted key data;
a second cryptographic key generator configured to generate a second cryptographic key based on a second ID;
a second encryptor configured to encrypt the first decrypted key data using the second cryptographic key, thereby generating second encrypted key data, and to store the second encrypted key data in the storage unit; and
a second decryptor configured to read the second encrypted key data that has been stored by the second encryptor from the storage unit, and decrypt the second encrypted key data using the second cryptographic key, thereby generating second decrypted key data, and
at a time of key setting, the second encryptor stores the second encrypted key data in the storage unit, and at a time of key usage, the second decryptor reads the second encrypted key data from the storage unit.

### Claim 2 (depends on 1)

The key implementation system of claim 1, wherein
the LSI includes a first cryptographic key generator configured to generate the first cryptographic key based on a first ID.

### Claim 3 (depends on 2)

The key implementation system of claim 2, wherein
the first cryptographic key generator generates the first cryptographic key based on a first LSI key and the first ID, and
the second cryptographic key generator generates the second cryptographic key based on a second LSI key and the second ID.

### Claim 4 (depends on 2)

The key implementation system of claim 2, wherein
the first ID has a different value for every predetermined number of the LSIs, and
the second ID has a different value for each LSI.

### Claim 5 (depends on 2)

The key implementation system of claim 2, wherein
the LSI holds ID data including first partial data, second partial data, and third partial data,
the first ID includes the first and the third partial data, and
the second ID includes the second and the third partial data.

### Claim 6 (depends on 2)

The key implementation system of claim 2, wherein
the first ID is held in the storage unit, and
the second ID is held in the LSI.

### Claim 7 (depends on 1)

The key implementation system of claim 1, wherein
the first decrypted key data includes verification data, and
the LSI includes a first verifier configured to confirm the verification data, and to verify a validity of the first decrypted key data.

### Claim 8 (depends on 1)

The key implementation system of claim 1, wherein
the second decrypted key data includes verification data, and
the LSI includes a second verifier configured to confirm the verification data, and to verify a validity of the second decrypted key data.

### Claim 9 (depends on 1)

The key implementation system of claim 1, comprising:
a content decryption processor configured to perform, using the second decrypted key data, authentication processing in relation to access to encrypted content, or decryption processing of encrypted content.

### Claim 10

A large-scale integrated circuit (LSI), comprising:
a second cryptographic key generator configured to generate a second cryptographic key based on a second ID;
a first decryptor configured to receive first encrypted key data, and to decrypt the first encrypted key data using a first cryptographic key, thereby generating first decrypted key data;
a second encryptor configured to encrypt the first decrypted key data using the second cryptographic key, thereby generating second encrypted key data, and to store the second encrypted key data in an external storage unit; and
a second decryptor configured to read the second encrypted key data that has been stored by the second encryptor from the external storage unit, and decrypt the second encrypted key data using the second cryptographic key, thereby generating second decrypted key data,
wherein at a time of key setting, the second encryptor stores the second encrypted key data in the external storage unit, and at a time of key usage, the second decryptor reads the second encrypted key data from the external storage unit.

### Claim 11 (depends on 10)

The LSI of claim 10, further comprising:
a first cryptographic key generator configured to generate the first cryptographic key based on a first ID.

### Claim 12 (depends on 11)

The LSI of claim 11, wherein:
the first cryptographic key generator generates the first cryptographic key based on a first LSI key and the first ID, and
the second cryptographic key generator generates the second cryptographic key based on a second LSI key and the second ID.

### Claim 13 (depends on 11)

The LSI of claim 11, wherein:
the LSI holds ID data including first partial data, second partial data, and third partial data,
the first ID includes the first and the third partial data, and
the second ID includes the second and the third partial data.

### Claim 14 (depends on 11)

The LSI of claim 11, wherein
the first ID is held in the storage unit, and
the second ID is held in the LSI.

### Claim 15 (depends on 10)

The LSI of claim 10, wherein:
the first decrypted key data includes verification data, and
the LSI includes a first verifier configured to confirm the verification data, and to verify a validity of the first decrypted key data.

### Claim 16 (depends on 10)

The LSI of claim 10, wherein:
the second decrypted key data includes verification data, and
the LSI includes a second verifier configured to confirm the verification data, and to verify a validity of the second decrypted key data.

### Claim 17 (depends on 10)

The LSI of claim 10, further comprising:
a content decryption processor configured to perform, using the second decrypted key data, authentication processing in relation to access to encrypted content, or decryption processing of encrypted content.

### Claim 18

A key implementation system, comprising:
a large-scale integrated circuit (LSI); and
a storage unit, wherein:
the LSI includes:
a first decryptor configured to receive first encrypted key data, and to decrypt the first encrypted key data using an LSI key, thereby generating first decrypted key data;
a second cryptographic key generator configured to generate a second cryptographic key based on an ID;
a second encryptor configured to encrypt the first decrypted key data using the second cryptographic key, thereby generating second encrypted key data, and to store the second encrypted key data in the storage unit; and
a second decryptor configured to read the second encrypted key data that has been stored by the second encryptor from the storage unit, and decrypt the second encrypted key data using the second cryptographic key, thereby generating second decrypted key data, and
at a time of key setting, the second encryptor stores the second encrypted key data in the storage unit, and at a time of key usage, the second decryptor reads the second encrypted key data from the storage unit.

### Claim 19 (depends on 18)

The key implementation system of claim 18, wherein
the LSI key and the ID is held in the LSI.

### Claim 20 (depends on 18)

The key implementation system of claim 18, further comprising:
a content decryption processor configured to perform, using the second decrypted key data, authentication processing in relation to access to encrypted content, or decryption processing of encrypted content.

### Claim 21

A large-scale integrated circuit (LSI), comprising:
a second cryptographic key generator configured to generate a second cryptographic key based on an ID;
a first decryptor configured to receive first encrypted key data, and to decrypt the first encrypted key data using an LSI key, thereby generating first decrypted key data;
a second encryptor configured to encrypt the first decrypted key data using the second cryptographic key, thereby generating second encrypted key data, and to store the second encrypted key data in an external storage unit; and
a second decryptor configured to read the second encrypted key data that has been stored by the second encryptor from the external storage unit, and decrypt the second encrypted key data using the second cryptographic key, thereby generating second decrypted key data,
wherein at a time of key setting, the second encryptor stores the second encrypted key data in the external storage unit, and at a time of key usage, the second decryptor reads the second encrypted key data from the external storage unit.

### Claim 22 (depends on 21)

The LSI of claim 21, wherein
the LSI key and the ID is held in the LSI.

### Claim 23 (depends on 21)

The LSI of claim 21, further comprising:
a content decryption processor configured to perform, using the second decrypted key data, authentication processing in relation to access to encrypted content, or decryption processing of encrypted content.