Cryptographic transmission system

A method for handling encryption keys in processor microcontroller, comprising:

• selecting a key encryption key (KEK) from a predetermined one of a plurality of key storage slots arranged in non-volatile memory through a select register coupled with a CPU of the microcontroller, wherein the plurality of key storage slots are each configured to store either a Key Encryption Key (KEK) or a key for encrypting/decrypting data and wherein the on-chip key storage slots can only be accessed by a hardware encryption/decryption engine and cannot be accessed by the CPU of the microcontroller thereby forming a firewall between non-volatile memory coupled with the hardware encryption/decryption engine which are inside the firewall and the CPU which is outside the firewall;
• transferring a content of the selected on-chip key storage slot to a key register which is accessible to the hardware encryption/decryption engine;
• checking a register flag in a configuration register coupled with the hardware encryption/decryption engine to determine if the key encryption key is to be used for encrypting/decrypting data or encrypting/decrypting a session key;
• and
• if the key encryption key is to be used for encrypting/decrypting a session key, preventing the key encrypt key from encrypting/decrypting data.

A method for handling encryption keys in processor

• microcontroller comprising, a CPU, a hardware encryption/decryption engine, and a non-volatile memory with a plurality of key storage slots for storing keys, wherein each key storage slot is configured to store either a Key Encryption Key (KEK) or a key for encrypting/decrypting data, wherein the on-chip key storage slots can only be accessed by the hardware encryption/decryption engine and cannot be accessed by the CPU thereby forming a firewall between non-volatile memory coupled with the hardware encryption/decryption engine which are inside the firewall and the CPU which is outside the firewall, the method comprising:
• providing a dual mode encryption key among the plurality of keys in the plurality of key storage slots in the non-volatile memory;
• and
• defining whether the dual mode encryption key is to be used to encrypt/decrypt data or encrypt/decrypt a session key by a register flag in a configuration register coupled with the hardware encryption/decryption engine;
• selecting one of the key storage slots through a select register coupled with the CPU thereby transferring a content of the selected key storage slot to a key register which is accessible to the hardware encryption/decryption engine;
• wherein if the dual mode encryption key is selected to be used to encrypt/decrypt a session key, the dual mode encryption key cannot be used to encrypt or decrypt data.