Outputting a key based on an authorized sequence of operations

Patent metadata

Field	Value
Publication number	US-10218496-B2
Application number	US-201514808691-A
Country	US
Kind code	B2
Filing date	Jul 24, 2015
Priority date	Aug 4, 2014
Publication date	Feb 26, 2019
Grant date	Feb 26, 2019

Abstract

Values and a sequence of operations associated with generating a key may be received. A determination may be made as to whether the sequence of operations associated with the key matches an authorized sequence of operations. The key may be outputted when the received sequence of operations matches the authorized sequence of operations and the key may not be outputted when the received sequence of operations does not match the authorized sequence of operations.

First claim

What is claimed is:

1. A method comprising:
receiving a plurality of values associated with generating a key;
receiving a sequence of operations associated with generating the key;
determining, by a processing device, whether an ordering of operations and a number and type of the operations from the received sequence of operations matches an ordering of operations and a number and type of operations from an authorized sequence of operations; and
outputting the key when the ordering of the operations and the number and type of the operations from the received sequence of operations matches the ordering and the number and type of the operations from the authorized sequence of operations and not outputting the key when the ordering of the operations and the number and type of the operations from the received sequence of operations does not match the ordering of the operations and the number and type of the operations from the authorized sequence of operations.

2. The method of claim 1 , further comprising:
generating the key based on the received plurality of values and the sequence of operations;
receiving a first hash value; and
calculating a second hash value associated with the generated key, wherein the outputting of the key is further performed when the first hash value matches the second hash value.

3. The method of claim 1 , further comprising:
receiving status information associated with a component providing at least one of the received plurality of values;
determining if the status information is different than a prior status information associated with the generating of a prior key; and
transmitting a request for a hash value in response to determining that the status information is different than the prior status information and not transmitting the request for the hash value in response to determining that the status information is not different than the prior status information.

4. The method of claim 1 , wherein the ordering of the operations from the received sequence of operations matches the ordering of the operations from the authorized sequence of operations when the received sequence of operations comprises an identical number and types of operations with same input sources and output destinations in a same order as the authorized sequence of operations.

5. The method of claim 1 , further comprising:
decrypting encrypted data with the outputted key when the ordering of the operations and the number and type of the operations from the received sequence of operations matches the ordering of the operations and the number and type of the operations from the authorized sequence of operations.

6. The method of claim 1 , wherein the sequence of operations comprises a plurality of cryptographic operations.

7. The method of claim 1 , wherein plurality of values comprises at least one software based value and at least one hardware based value.

8. A system comprising:
a memory; and
a processing device, operatively coupled with the memory, to:
receive a plurality of values;
receive a plurality of operations to be performed with the received plurality of values;
determine whether an ordering and a number and type of the plurality of operations to be performed with the received plurality of values matches an ordering and a number and type of an authorized plurality of operations; and
provide an output value when the ordering and the number and type of the plurality of operations to be performed with the received plurality of values matches the ordering and the number and type of the authorized plurality of operations and not providing the output value when the ordering and the number and type of the plurality of operations to be performed with the received plurality of values does not match the ordering and the number and type of the authorized plurality of operations.

9. The system of claim 8 , wherein the processing device is further to:
generate the output value based on the received plurality of values and the plurality of operations;
receive a first hash value; and
calculate a second hash value associated with the output value, wherein the providing of the output value is further performed when the first hash value matches the second hash value.

10. The system of claim 8 , wherein the processing device is further to:
receive status information associated with a component providing at least one of the received plurality of values;
determine if the status information is different than a prior status information associated with the same component when a prior output value was generated; and
transmit a request for a hash value in response to determining that the received status information is different than the prior status information and not transmitting the request for the hash value in response to determining that the received status information is not different than the prior status information.

11. The system of claim 8 , wherein the ordering of the received plurality of operations matches the ordering of the authorized plurality of operations when the received plurality of operations are in an identical sequence as the authorized sequence of operations and uses the same input sources and output destinations.

12. The system of claim 8 , wherein the processing device is further to:
receive encrypted data; and
decrypt the encrypted data with the provided output value when the ordering and the number and type of the received plurality of operations matches the ordering and the number and type of the authorized plurality of operations.

13. The system of claim 8 , wherein the plurality of operations comprises a plurality of cryptographic operations.

14. The system of claim 13 , wherein the plurality of cryptographic operations comprise at least one of an exclusive-or (XOR) operation, an Advanced Encryption Standard (AES) encryption or decryption operation, or a Triple Data Encryption Standard (3DES) encryption or decryption operation.

15. An integrated circuit comprising:
a decryption component to receive encrypted data and to decrypt the encrypted data based on a key; and
a key engine to:
receive a plurality of values associated with generating the key;
receive a sequence of operations associated with generating the key;
determine whether an ordering and a number and type of operations from the sequence of operations associated with generating the key matches an ordering and the number and type of operations from an authorized sequence of operations; and
transmit, to the decryption component, the key when the ordering and the number and type of the operations from the received sequence of operations associated with generating the key matches the ordering and the number and type of the operations from the authorized sequence of operations.

16. The integrated circuit of claim 15 , wherein the key engine is further to:
generate the key based on the received plurality of values and the sequence of operations;
receive a first hash value; and
calculate a second hash value associated with the generated key, wherein the transmitting of the key to the decryption component is further performed when the first hash value matches the second hash value.

17. The integrated circuit of claim 15 , wherein the key engine is further to:
receive status information associated with a key contributor component providing at least one of the received plurality of values;
determine if the status information is different than a prior status information associated with the key contributor component when a prior key was generated; and
transmit a

Assignees

• Cryptography Res Inc

Inventors

• Wachs Megan Anneke
• Kumar Ambuj
• Jun Benjamin Che-Ming

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L9/0631 Primary

  Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title