Generating and distributing pre-computed data (PCD) assets to a target device

Patent metadata

Field	Value
Publication number	US-9923890-B2
Application number	US-201414535197-A
Country	US
Kind code	B2
Filing date	Nov 6, 2014
Priority date	May 7, 2014
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

The embodiments described herein describe technologies for pre-computed data (PCD) asset generation and secure deployment of the PCD asset to a target device in an operation phase of a manufacturing lifecycle of the target device in a cryptographic manager (CM) environment. One implementation includes a Root Authority (RA) device that receives a first command to generate a unique PCD asset for a target device. In response, the RA device generates the PCD asset and packages the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device. The RA device deploys the packaged PCD asset in a CM system for identification and tracking of the target device.

First claim

What is claimed is:

1. A method comprising:
receiving, by a Root Authority (RA) device, data signed by a provisioning device of a cryptographic manager (CM) system, wherein the data comprises definition files that specify an identity and credentials for a Service device of the CM system and an identity and credentials of an Appliance device of the CM system, wherein the RA device is a trusted, offline device that authorizes the Service device and the Appliance device and does not have a persistent connection to the Service device or the Appliance device:
receiving, by the RA device, a first command to create a Module with a placeholder for a pre-computed data (PCD) asset for a target device:
in response to the first command, generating by the RA device, the Module with the placeholder for the PCD asset for the target device:
deploying the Module with the placeholder in the CM system, wherein the deploying of the Module with the placeholder comprises storing, by the RA device, the Module with the placeholder in a removable storage device to transfer the Module with the placeholder to the Service device, wherein the Service device is configured to distribute the Module with the placeholder over a network to the Appliance device:
receiving, by the RA device, a second command to package the PCD asset for the target device, wherein the PCD asset is unique for the target device;
in response to the second command, generating, by the RA device, the PCD asset and packaging, by the RA device, the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device; and
deploying the packaged PCD asset in the CM system for identification and tracking of the target device, wherein the deploying of the packaged PCD comprises storing, by the RA device, the packaged PCD asset in an authorization file in the removable storage device to transfer the PCD asset to the Service device, wherein the authorization file is separate from the Module stored in the removable storage device, wherein the Service device is configured to distribute the PCD asset over the network to the Appliance device, wherein the PCD asset is input into the Module at the Appliance device, wherein the Module is an application that, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the PCD asset to the target device in an operation phase of a manufacturing lifecycle of the target device.

2. The method of claim 1 , wherein the Appliance device is to securely provision the PCD asset to a CM Core of the target device using the Module.

3. The method of claim 1 , wherein generating the PCD asset comprises generating the PCD asset in response to a command line interface (CLI) command to generate PCD assets in bulk based on a PCD Template, wherein the PCD Template is a description of how the PCD assets are formatted as an input for a particular type of Module.

4. The method of claim 3 , wherein the PCD Template corresponds to a PCD type, the PCD type is a set of PCD assets having a particular property of at least one of a uniqueness or serialization, and wherein the set of PCD assets of the PCD type are indexed.

5. The method of claim 1 , further comprising storing the PCD asset in a stand-alone record.

6. The method of claim 1 , further comprising storing the PCD asset as a PCD record in a PCD file containing at least one additional PCD record.

7. The method of claim 6 , wherein the PCD file is a sequential PCD file, the sequential PCD file comprising:
an inner header containing information that is shared by the PCD record and the at least one additional PCD record; an outer header containing information relevant to an instance of the sequential PCD file before any splitting of the sequential PCD file; and the PCD record and the at least one additional PCD record.

8. The method of claim 7 , further comprising: splitting the sequential PCD file into a first sequential PCD file and a second sequential PCD file; generating a first outer header containing information relevant to the first sequential PCD file, wherein the first sequential PCD file comprises the inner header, the first outer header containing information relevant to the first sequential PCD file and the PCD record; and generating a second outer header containing information relevant to the second sequential PCD file, wherein the second sequential PCD file comprises the inner header, the second outer header containing information relevant to the second sequential PCD file and the at least one additional PCD record.

9. The method of claim 6 , wherein the PCD file is a non-sequential PCD file, the non-sequential PCD file comprising: an inner header containing information that is shared by the PCD record and the at least one additional PCD record; an outer header containing information relevant to an instance of the nonsequential PCD file after a merge of a first non-sequential PCD file and a second nonsequential PCD file; and the PCD record and the at least one additional PCD record.

10. The method of claim 9 , further comprising:
merging the first non-sequential PCD file and the second non-sequential PCD file into the non-sequential PCD file; sorting the PCD record and the at least one additional PCD record; and generating the outer header, wherein the first non-sequential PCD file comprises the inner header, a first outer header containing information relevant to the first nonsequential PCD file and the PCD record, and wherein the second non-sequential PCD file comprises the inner header, a second outer header containing information relevant to the second sequential PCD file and the at least one additional PCD record.

11. A Root Authority (RA) device, the RA device being a trusted, offline device that authorizes a Service device of a cryptographic manager (CM) system and an Appliance device of the CM system, the RA device comprising:
a processor; and
a removable storage device interface configured to connect to a removable storage device, wherein the removable storage device interface is coupled to the processor, and wherein the RA device does not have a persistent connection to the Service device or the Appliance device, wherein the processor is operable to:
receive data signed by a provisioning device of the CM system, wherein the data comprises definition files that specify an identity and credentials for the Service device and an identity and credentials of the Appliance device;
receive a first command to create a Module with a placeholder for a precomputed data (PCD) asset for a target device;
in response to the first command, generate the Module with the placeholder for the PCD asset for the target device;
deploy the Module with the placeholder in the CM system, wherein the processor, to deploy the Module with the placeholder, is to store the Module with placeholder in the removable storage device to transfer the Module with the placeholder to the Service device, wherein the Service device is configured to distribute the Module with the placeholder over a network to the Appliance device;
receive a second command to generate the PCD asset for a target device, wherein the PCD asset is unique for the target device;
in response to the second command, generate the PCD asset and package the PCD asset for secure deployment of the PCD asset to the target device and to be used exclusively by the target device; and
deploy the packaged PCD asset in the CM system for identification and tracking of the target device, wherein the processor, to deploy the packaged PCD asset, is to store the packaged PCD asset in an authorization file in the removable storage device to transfer

Assignees

• Cryptography Res Inc

Inventors

• Hamburg Michael
• Jun Benjamin Che-Ming
• Kocher Paul C
• O'Loughlin Daniel
• Pochuev Denis Alexandrovich

Classifications

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• G06F2221/2153

  Using hardware token as a secondary aspect · CPC title

• G06F2221/2107

  File encryption · CPC title