Provisioning of secure storage for both static and dynamic rules for cryptographic key information

Patent metadata

Field	Value
Publication number	US-2016154744-A1
Application number	US-201514614797-A
Country	US
Kind code	A1
Filing date	Feb 5, 2015
Priority date	Sep 5, 2008
Publication date	Jun 2, 2016
Grant date	—

Abstract

A media processing device includes a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys, a key store memory, and a rule set memory. The media processing device further includes an arbitration module to provision: a first segment of the key store memory to store cryptographic keys from the one-time programmable (OTP) memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys; and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptographic keys stored in the second segment of the key store memory.

First claim

1 . In a media processing device, a method comprising:
providing a key store memory and a rule set memory; provisioning a first segment of the key store memory to store cryptographic keys from a one-time programmable (OTP) memory of the media processing device and provisioning a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; provisioning a second segment of the key store memory to store cryptographic keys and provisioning a second segment of the rule set memory to store rules dynamically generated during runtime of the media processing device for cryptographic keys stored in the second segment of the key store memory, receiving, at an interface, a first cryptographic key and first rule for accessing the first cryptographic key; storing the first cryptographic key to a set of one or more fixed-size blocks of the second segment of the key store memory; storing the first rule to a set of one or more blocks of the second segment of the rule set memory; receiving, at an interface, a second rule for accessing a cryptographic key stored at the set of one or more fixed-sized blocks of the second segment of the key store memory; and overwriting the first rule with the second rule in the set of one or more blocks of the second segment of the rule set memory.

2 . The method of claim 1 , further comprising:
storing copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device.

3 . The method of claim 2 , wherein:
provisioning the first segment of the key store memory comprises provisioning a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory; and provisioning the second segment of the key store memory comprises provisioning a remainder of the key store memory as the second segment of the key store memory.

4 . (canceled)

5 . (canceled)

6 . In a media processing device, a method comprising:
providing a key store memory and a rule set memory, wherein the key store memory comprises a plurality of fixed-size blocks, each fixed-size block being separately indexed; provisioning a first segment of the key store memory to store cryptographic keys from a one-time programmable (OTP) memory of the media processing device and provisioning a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; provisioning a second segment of the key store memory to store cryptographic keys and provisioning a second segment of the rule set memory to store rules dynamically generated during runtime of the media processing device for cryptographic keys stored in the second segment of the key store memory, wherein each cryptographic key stored in the second segment of the key store memory spans at least one fixed-size block; receiving, at an interface, a key store request comprising a cryptographic key, a rule for accessing the cryptographic key, and a key store index identifying an initial block of the second segment of the key store memory to which the cryptographic key is requested to be stored; and storing the cryptographic key to at least the initial block of the second segment of the key store memory responsive to verifying the key store request meets an alignment requirement.

7 . The method of claim 6 , wherein the cryptographic key is associated with a cryptographic algorithm having a key size that is an integer multiple of the fixed-size of the fixed-size blocks, and the alignment requirement requires that that the key store index represent an integer multiple of the key size.

8 . A media processing device comprising:
a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys; a key store memory, wherein the key store memory comprises a plurality of fixed-size blocks, each fixed-size block being separately indexed; a rule set memory; an arbitration module coupled to the OTP memory, the key store memory, and the rule set memory, the arbitration module to provision: a first segment of the key store memory to store cryptographic keys from the OTP memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys; and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptographic keys stored in the second segment of the key store memory, wherein each cryptographic key stored in the second segment of the key store memory spans at least one fixed-size block; an interface to receive a key store request comprising a cryptographic key, a rule for accessing the cryptographic key, and a key store index identifying an initial block of the second segment of the key store memory to which the cryptographic key is requested to be stored; and wherein the arbitration module is to store the cryptographic key to at least the initial block of the second segment of the key store memory responsive to verifying the key store requests meets an alignment requirement.

9 . The media processing device of claim 8 , wherein the key store memory and rule set memory comprise at least one random access memory.

10 . The media processing device of claim 8 , further comprising:
a loader module to store copies of cryptographic keys from the OTP memory at the first segment of the key store memory and storing copies of rules from the OTP memory at the first segment of the rule set memory during an initialization of the media processing device.

11 . The media processing device of claim 10 , wherein:
the arbitration module is to provision the first segment of the key store memory by provisioning a segment of the key store memory used to store the cryptographic keys from the OTP memory as first segment of the key store memory; and the arbitration module is to provision the second segment of the key store memory by provisioning a remainder of the key store memory as the second segment of the key store memory.

12 . The media processing device of claim 11 , further comprising:
an interface to receive a first cryptographic key and first rule for accessing the first cryptographic key; wherein the arbitration module is to store the first cryptographic key to a set of one or more fixed-size blocks of the second segment of the key store memory; and wherein the arbitration module is to store the first rule to a set of one or more blocks of the second segment of the rule set memory.

13 . A media processing device comprising:
a one time programmable (OTP) memory to store a first set of cryptographic keys and rule set for the first set of cryptographic keys; a key store memory; a rule set memory; an arbitration module coupled to the OTP memory, the key store memory, and the rule set memory, the arbitration module to provision: a first segment of the key store memory to store cryptographic keys from the OTP memory; a first segment of the rule set memory to statically store rules for the cryptographic keys stored in the first segment of the key store memory; a second segment of the key store memory to store cryptographic keys; and a second segment of the rule set memory to store rules dynamically generated during operation of the media processing device for cryptogr

Assignees

• Vixs Systems Inc

Inventors

• Zheng Heyun
• Stewart Norman
• Zhang Jing

Classifications

• H04N21/42623

  involving specific decryption arrangements · CPC title

• H04N21/4181

  for conditional access · CPC title

• H04N21/4435

  Memory management (allocation of memory to service a request G06F9/5016; addressing or allocating within memory systems or architectures G06F12/02) · CPC title

• H04L2209/60

  Digital content management, e.g. content distribution · CPC title

• H04N21/4431

  characterized by the use of Application Program Interface [API] libraries · CPC title