# US 9,432,184 B2 · Provisioning of secure storage for both static and dynamic rules for cryptographic key information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,432,184 B2
- Document ID: US9432184B2
- Status: Granted
- Kind: B2
- Application number: 14/614,797
- Filed: 2015-02-05
- Published: 2016-06-02
- Granted: 2016-08-30
- Earliest claimed: 2008-09-05
- Assignees: ViXS Systems, Inc.
- Applicants: ViXS Systems Inc.
- Inventors: Heyun Zheng; Norman Stewart; Jing Zhang
- Web page: https://patentgrep.com/patent/US9432184B2

## CPC

- H04L 9/0822: {using key encryption key}
- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/107: {License processing; Key processing}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3247: {involving digital signatures}
- H04N 21/4181: {for conditional access}
- H04N 21/4183: {providing its own processing capabilities, e.g. external module for video decoding}
- H04N 21/42623: {involving specific decryption arrangements}
- H04N 21/42692: {for reading from or writing on a volatile storage medium, e.g. Random Access Memory [RAM]}
- H04N 21/4431: {characterized by the use of Application Program Interface [API] libraries}
- H04N 21/4435: {Memory management (allocation of memory to service a request G06F9/5016; addressing or allocating within memory systems or architectures G06F12/02)}
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION

## Abstract

A media processing device includes a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys, a key store memory, and a rule set memory. The media processing device further includes an arbitration module to provision: a first segment of the key store memory to store cryptographic keys from the one-time programmable (OTP) memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys; and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptographic keys stored in the second segment of the key store memory.

## Claims

### Claim 1

In a media processing device, a method comprising:
providing a key store memory and a rule set memory;
provisioning a first segment of the key store memory to store cryptographic keys from a one-time programmable (OTP) memory of the media processing device and provisioning a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory;
provisioning a second segment of the key store memory to store cryptographic keys and provisioning a second segment of the rule set memory to store rules dynamically generated during runtime of the media processing device for cryptographic keys stored in the second segment of the key store memory;
receiving, at an interface, a first cryptographic key and a first rule for accessing the first cryptographic key;
storing the first cryptographic key to a set of one of more fixed-size blocks of the second segment of the key store memory;
storing the first rule to a set of one or more blocks of the second segment of the rule set memory;
receiving, at an interface, a second rule for accessing a cryptographic key stored at the set of one or more fixed-size blocks of the second segment of the key store memory; and
overwriting the first rule with the second rule in the set of one or more blocks of the second segment of the rule set memory.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
storing copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device.

### Claim 3 (depends on 2)

The method of claim 2, wherein:
provisioning the first segment of the key store memory comprises provisioning a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory; and
provisioning the second segment of the key store memory comprises provisioning a remainder of the key store memory as the second segment of the key store memory.

### Claim 4

In a media processing device, a method comprising:
providing a key store memory and a rule set memory, wherein the key store memory comprises a plurality of fixed-size blocks, each fixed-size block being separately indexed;
provisioning a first segment of the key store memory to store cryptographic keys from a one-time programmable (OTP) memory of the media processing device and provisioning a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory;
provisioning a second segment of the key store memory to store cryptographic keys and provisioning a second segment of the rule set memory to store rules dynamically generated during runtime of the media processing device for cryptographic keys stored in the second segment of the key store memory, wherein each cryptographic key stored in the second segment of the key store memory spans at least one fixed-size block;
receiving, at an interface, a key store request comprising a cryptographic key, a rule for accessing the cryptographic key, and a key store index identifying an initial block of the second segment of the key store memory to which the cryptographic key is requested to be stored; and
storing the cryptographic key to at least the initial block of the second segment of the key store memory responsive to verifying the key store request meets an alignment requirement.

### Claim 5 (depends on 4)

The method of claim 4, wherein the cryptographic key is associated with a cryptographic algorithm having a key size that is an integer multiple of the fixed-size of the fixed-size blocks, and the alignment requirement requires that that the key store index represent an integer multiple of the key size.

### Claim 6

A media processing device comprising:
a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys;
a key store memory, wherein the key store memory comprises a plurality of fixed-size blocks, each fixed-size block being separately indexed;
a rule set memory;
an arbitration module coupled to the OTP memory, the key store memory, and the rule set memory, the arbitration module to provision: a first segment of the key store memory to store cryptographic keys from the OTP memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys; and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptographic keys stored in the second segment of the key store memory, wherein each cryptographic key stored in the second segment of the key store memory spans at least one fixed-size block;
an interface to receive a key store request comprising a cryptographic key, a rule for accession the cryptographic key, and a key store index identifying an initial block of the second segment of the key store memory to which the cryptographic key is requested to be stored; and
wherein the arbitration module is to store the cryptographic key to at least the initial block of the second segment of the key store memory responsive to verifying the key store request meets an alignment requirement.

### Claim 7 (depends on 6)

The media processing device of claim 6, wherein the key store memory and rule set memory comprise at least one random access memory.

### Claim 8 (depends on 6)

The media processing device of claim 6, further comprising:
a loader module to store copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device.

### Claim 9 (depends on 8)

The media processing device of claim 8, wherein:
the arbitration module is to provision the first segment of the key store memory by provisioning a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory; and
the arbitration module is to provision the second segment of the key store memory by provisioning a remainder of the key store memory as the second segment of the key store memory.

### Claim 10 (depends on 9)

The media processing device of claim 9, further comprising:
an interface to receive a first cryptographic key and first rule for accessing the first cryptographic key;
wherein the arbitration module is to store the first cryptographic key to a set of one or more fixed-size blocks of the second segment of the key store memory; and
wherein the arbitration module is to store the first rule to a set of one or more blocks of the second segment of the rule set memory.

### Claim 11

A media processing device comprising:
a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys;
a key store memory;
a rule set memory;
an arbitration module coupled to the (OTP) memory, the key store memory, and the rule set memory, the arbitration module to provision, it first segment of the key store memory to store cryptographic keys from the OTP memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys, and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptographic keys stored in the second segment of the key store memory;
a loader module to store copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device;
an interface to receive a first cryptographic key and first rule for accessing the first cryptographic key;
wherein the arbitration module is to provision the first segment of the key store memory by provisioning a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory;
wherein the arbitration module is to provision the second segment of the key store memory by provisioning a remainder of the key store memory as the second segment of the key store memory;
wherein the arbitration module is to store the first cryptographic key to a set of one or more fixed-size blocks of the second segment of the key store memory; and
wherein the arbitration module is to store the first rule to a set of one or more blocks of the second segment of the rule set memory;
wherein the interface further is to receive a second rule for accessing a cryptographic key stored at the set of one or more fixed-size blocks of the second segment of the key store memory; and
wherein the arbitration module is to overwrite the first rule with the second rule in the set of one or more blocks of the second segment of the rule set memory.

### Claim 12 (depends on 6)

The media processing device of claim 6, wherein the cryptographic key is associated with a cryptographic algorithm having a key size that is an integer multiple of the fixed-size of the fixed-size blocks, and the alignment requirement requires that the key store index represent an integer multiple of the key size.

### Claim 13

A media processing device comprising:
at least one processor; and
a computer readable storage medium storing instructions to manipulate the at least one processor to:
provision a first segment of a key store memory to store cryptographic keys from a one-time programmable (OTP) memory of the media processing device and provisioning a first segment of a rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory, wherein the key store memory comprises plurality of fixed-size blocks, each fixed-size block being separately indexed;
provision a second segment of the key store memory to store cryptographic keys and provisioning a second segment of the rule set memory to store rules dynamically generated during runtime of the media processing device for cryptographic keys stored in the second segment of the key store memory, wherein each cryptographic key stored in the second segment of the key store memory spans at least one fixed-size block;
receive, at an interface, a key store request comprising a cryptographic key, a rule for accessing the cryptographic key, and a key store index identifying an initial block of the second segment of the key store memory to which the cryptographic key is requested to be stored; and
store the cryptographic key to at least the initial block of the second segment of the key store memory responsive to verifying the key store request meets an alignment requirement that the key store index represent an integer multiple of a key size that is associated with a cryptographic algorithm for the cryptographic key and which is an integer multiple of the fixed-size of the fixed-size blocks.

### Claim 14 (depends on 13)

The media processing device of claim 13, wherein the instructions further are to manipulate the at least one processor to:
store copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device.

### Claim 15 (depends on 14)

The media processing device of claim 14, wherein:
the instructions to manipulate the at least one processor to provision the first segment of the key store memory comprise instructions to manipulate the at least one processor to provision a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory; and
the instructions to manipulate the at least one processor to provision the second segment of the key store memory comprise instructions to manipulate the at least one processor to provision a remainder of the key store memory as the second segment of the key store memory.

### Claim 16 (depends on 13)

The media processing device of claim 13, wherein the instructions further are to manipulate the at least one processor to:
receive, at an interface, a first cryptographic key and first rule for accessing the first cryptographic key;
store the first cryptographic key to a set of one or more fixed-size blocks of the second segment of the key store memory; and
store the first rule to a set of one or more blocks of the second segment of the rule set memory.