Generating a key based on a combination of keys

A first key associated with a plurality of devices may be received. Furthermore, a second key associated with a single device may be received. The first key associated with the plurality of devices may be modified based on a device identification of the single device. Additionally, a primary key may be generated based on the modified first key and the second key.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various implementations of the disclosure.

FIG. 1illustrates an example environment to generate a primary key based on a combination of a first and a second key in accordance with some embodiments.

FIG. 2is a block diagram of an example key generator in accordance with some embodiments of the present disclosure.

FIG. 3is a block diagram of an example one-time programmable (OTP) memory in accordance with some embodiments.

FIG. 4is an example architecture of a key generator in accordance with some embodiments of the disclosure.

FIG. 5is a flow diagram of an example method to generate a primary key in accordance with some embodiments.

FIG. 6is a flow diagram of an example method to generate a common key split based on a modified common key in accordance with some embodiments.

FIG. 7is a flow diagram of an example method to select a device key to be used as a device key split in accordance with some embodiments.

FIG. 8is a block diagram of an example key tree in accordance with some embodiments of the present disclosure.

FIG. 9is a flow diagram of an example method to generate and store a device key using a key generator in accordance with some embodiments.

FIG. 10is a block diagram of an example device including a key generator in accordance with some embodiments.

FIG. 11illustrates a block diagram of an embodiment of a computer system in which some embodiments of the disclosure may operate.

DETAILED DESCRIPTION

Described herein is the generation of a key based on a combination of keys. In some embodiments, a key (i.e., a primary key) may be generated based on a combination of a first key and a second key. For example, a primary key may be generated based on the first key (also referred to as a first key split) and the second key (also referred to as a second key split). The first key may be associated with multiple devices (e.g., a processor, a field programmable gate array, a system on a chip, or any other integrated circuit or an electronic product that incorporates an integrated circuit) and the second key may be associated with a specific device (e.g., a single processor, a single field programmable gate array, a single system on a chip, or one other integrated circuit or one electronic product that incorporates an integrated circuit). For example, the first key may be a key or key split that is provided or assigned to multiple devices. Such a key, common to multitude of devices, is referred as the common key. Furthermore, the second key may be a key or key split that is device dependent or device unique such that each device is provided or assigned a different second key. Such a key may be referred to as a device key.

Each device may include the common key and one or more device keys. In some embodiments, each device may include multiple device keys and a single common key that is identical to a common key of other devices. A primary key may be generated based on a combination of the common key and one of the device keys. For example, the primary key may be generated based on an encryption of the combination of the two separate keys. The primary key may be used to authenticate or authorize operations to be performed by a device. In some embodiments, the primary key may be used by a portion of an integrated circuit to perform an operation or access a particular memory. For example, a first portion (e.g., a key generator as described in further detail below) of an integrated circuit may generate the primary key and a second portion of the integrated circuit may receive the primary key and use the primary key in order to authenticate or authorize an operation or memory access by the second portion of the integrated circuit. In some embodiments, the common key and the device keys may be stored in a one time programmable (OTP) memory of a device (e.g., a portion of an integrated circuit or another integrated circuit incorporated into an electronic product that uses one or more integrated circuits). The common key may be programmed into the OTP memory at a first time (e.g., when the OTP memory is first manufactured) and at a first location (e.g., at a first manufacturing site that manufactures the OTP memory) and the device keys may be programmed into the OTP memory at a second time (e.g., when the OTP memory is integrated into an electronic product that uses one or more integrated circuits) and at a second location (e.g., at a second manufacturing site that assembles the electronic product). Thus, since the programming of the common key into the OTP memory and the device keys into the OTP memory may be performed at different times in different locations (i.e., different manufacturing sites), the required use of both the common key and one of the device keys to generate a primary key may provide a level of security with regard to the primary key. For example, if the common key were leaked or compromised by an unauthorized entity (e.g., an employee involved in the manufacturing of the OTP memory or the programming of the common key into the OTP memory) at the first location (i.e., a first manufacturing location), the primary key would not be known or obtained by the unauthorized entity as the unauthorized entity may not have accessed or compromised the device keys as the device keys may be programmed into the OTP memory at a different location from the first location associated with the unauthorized entity. Thus, the use of the common key and the device keys may provide a greater level of security with regard to the primary key that may be generated based on a combination of the common key and one of the device keys.

In some embodiments that may be constrained by cost or logistics issue, the common key and the device specific key may be programmed by the same entity, or at the same location, or at the same time.

Furthermore, in some embodiments, the common key may be modified or diversified based on a device identification and/or a selection of one of the device keys. For example, as previously described, the OTP memory of a device may be associated with multiple device keys. One of the device keys in the OTP memory of the device may be selected based on a device key selection signal or input. In some embodiments, the device key selection signal or input may be received from another portion of an integrated circuit. For example, an electronic product may incorporate an integrated circuit that includes an OTP memory and a control logic portion of the integrated circuit may transmit a device key selection signal. The use of the device key selection signal may allow the programming or retrieving of individual device keys into the OTP memory at specific locations in the OTP memory. For example, the OTP memory may include eight memory locations to store eight device keys and each of the eight memory locations may be identified by the device key selection signal to either retrieve the device key or store a device key at the OTP memory location identified by the device key selection signal. Thus, the device key selection signal or input may specify a particular device key of the multiple device keys that may be selected or retrieved from the OTP memory of the device. Furthermore, the device key selection signal or input may be used in a process to diversify or modify the common key of the device. Such diversification or modification of the common key may provide additional protection from possible compromise by an unauthorized entity of the common key that is used in the process to generate the primary key. For example, the diversification or modification of the common key may protect the use of the common key in the generation of the primary key from side channel attacks (e.g., an attack based on information gained from the physical implementation of a cryptographic system such as the circuitry of the device that is used to generate the primary key). Examples of side channel attacks are, but not limited to, differential power analysis (DPA), simple power analysis (SPA), timing analysis, etc. The diversification or modification of the common key may be performed by a key tree, which is described in further detail below, may perform a diversification or modification operation on the common key. The internal operations of the key tree may be implemented so that if an unauthorized entity performs a DPA analysis on the key tree, the information obtained by the DPA analysis may be infeasible to derive the output of the key tree. Thus, the use of a key tree may be used to improve the protection of the primary key from such side channel attacks. In some embodiments, the common key may also be modified or diversified based on a device identification.

Thus, the generation of the primary key based on two keys or key splits (e.g., the common key and one of the device keys) and the diversification or modification of the common key based on a device identification and/or a selection of one of the device keys may result in improved security for the process that is used to generate the primary key.

FIG. 1illustrates an example environment100to generate a primary key based on a combination of a first key and a second key. In general, the example environment100illustrates the use of a first key (e.g., a common key) and a second key (e.g., a device key) that may be used to generate or create a new key (e.g., a primary key).

As shown inFIG. 1, the example environment100illustrates a first key110that may represent a common key for a device and a second key120that may represent one or more device keys for a device. In some embodiments, a key generator130may be associated with a device. The key generator130may be implemented in an integrated circuit. In some embodiments, the key generator130may be a portion of a device that may receive the first key110and a second key120to generate a third key (e.g., the primary key140). In some embodiments, the common key corresponding to the first key110may be modified or diversified based on a device identification and/or a selection of the second key120that corresponds to one of multiple device keys. The modified or diversified first key110or common key may be used in conjunction with the second key120or the device key to generate the primary key140. Further details with regard to the architecture of the key generator130of a device and the modification or diversification of the common key are described in further detail below with regard toFIGS. 2-11.

FIG. 2is a block diagram of an example key generator200. In general, the key generator200may correspond to the key generator130ofFIG. 1. The key generator200may be used in a device to generate a primary key based on a combination of a common key and a device key.

As shown inFIG. 2, the key generator200may receive a device key210and a common key220. In some embodiments, the device key210and the common key220may be received from an OTP memory of a device. In the same or alternative embodiments, the OTP memory may be a type of digital memory implemented in circuitry or silicon of a device that may be programmed and cannot be changed after being programmed. For example, at a first time, the common key may be programmed into the OTP memory of a device and the common key may not be changed in the OTP memory after the programming of the common key into the OTP memory. Furthermore, at a second time, one or more device keys may be programmed into the OTP memory of the device and the device keys may not be changed in the OTP memory after the programming of the device keys into the OTP memory. Thus, the OTP memory may be considered a type of read only memory (ROM) after the programming of the common key and the one or more device keys into the OTP memory. In alternative embodiments, the common key and/or the device keys may be received in a device that does not include the OTP memory, and the common key and/or device keys may be stored in other types of memory of a device.

The key generator200may further receive a device identification (ID)230and a device key select240. In some embodiments, the device key select240may be received from another portion of an integrated circuit that includes the key generator200or may be received as a signal from off-chip (e.g., the device key select240is received at an input buffer to the integrated circuit from another source such as another integrated circuit). Furthermore, the device ID230may be received from a memory location of the device (e.g., another portion of an integrated circuit that may include the key generator200). In some embodiments, the device identification230may be a form of identification that is unique to a device. For example, the device identification may include, but is not limited to, a serial number of the device or any other information or number that may uniquely identify a specific device. Furthermore, the device key select240may be used to select a specific device key210. For example, each device may be associated with multiple device keys. As an example, each device may be associated with eight device keys that are stored in OTP memory and the device key select240may be used to select one of the eight device keys that are stored in the OTP memory.

Referring toFIG. 2, the key generator200may further generate or create a primary key250based on the device key210, the common key220, the device identification230, and the device key select240. For example, a device key210that is selected based on the device key select240and a common key that is modified or diversified based on the device identification230and the device key select240may be used to generate or create the primary key250. Thus, the device key select240may be used to determine the device key210as well as modify or diversify the common key220that is used to generate or create the primary key250. Further details with regard to the generation or creation of the primary key250and the modification or diversification of the common key220are described in further detail below.

FIG. 3is a block diagram of an example one-time programmable (OTP) memory300in accordance with some embodiments. In general, the OTP memory300may store a common key320that may correspond to the common key220ofFIG. 2and device keys310-317that may correspond to device key210ofFIG. 2. The OTP memory300may be part of a device that is used to generate a primary key (e.g., primary key250).

As previously discussed, the OTP memory300may be a type of programmable read-only memory where the programming or setting of the common key320and the device keys310-317is permanent and cannot be changed after a programming of the common key320and the device keys310-317.

The common key320and the device keys310-317may each be secret keys used in a cryptography process or algorithm to generate a third key (e.g., the primary key). Each of the common key320and the device keys310-317may be information or a parameter that determines the functional output of a cryptographic process or algorithm (e.g., the primary key). Thus, the common key320may be considered a first key of a pair of keys (i.e., a first key split) needed to generate the primary key and one of the device keys310-317may be considered a second key of the pair of keys (i.e., a second key split) that is needed to generate the primary key. In some embodiments, the primary key may be considered a working key that may be used by a device for authentication or performing authorized operations.

In some embodiments, the common key320may be associated with multiple devices. For example, the common key320may be stored in the OTP memory of a single type or class of devices. Thus, the OTP memory300of multiple devices of a same type or same class may include an identical common key320that is considered to be common to all devices of the type of device. In some embodiments, the device keys310-317may also be stored in the OTP memory of a device, but the device keys310-317may be different between devices so that the device keys310-317may be considered to be device dependent or unique to each device. Thus, as an example, a first device and a second device may be of a first type of device and a third device may be of a second type of device. The first device and the second device may be associated with a first common key and the third device may be associated with a second common key. The device keys for each of the first device, second device, and the third device may all be different or unique relative to the device keys of the other devices.

AlthoughFIG. 3illustrates the common key and the device keys being stored in OTP memory of a device, the common key and device keys may be stored elsewhere on a device. For example, the common key and the device key may be stored in alternative storage (e.g., ROM, RAM, NVM, FRAM, hard drive, flash, etc.) or memory locations of a device. Furthermore, although eight device keys310-317are illustrated, any number of device keys may be associated with a device. For example, in some embodiments, each device may only be associated with a single device key.

FIG. 4is an architecture400of a device including a key generator420. In general, the key generator420may correspond to the key generator130ofFIG. 1and the key generator200ofFIG. 2. The key generator420may receive a device key (e.g., the second key120, device key210, and/or device keys310-317) and a common key (e.g., first key110, common key220, and/or common key320) and generate a primary key (e.g., primary key140and/or primary key250) based on the device key and the common key. The architecture400may further include an OTP memory410that may correspond to the OTP memory300ofFIG. 3.

As shown inFIG. 4, the architecture400may include an OTP memory410and a key generator420. In some embodiments, the OTP memory410and the key generator420may be part of a device. For example, the OTP memory410and the key generator420may be implemented in circuitry of the device. Furthermore, the OTP memory410may store a common key411and one or more device keys412-419that may be used to generate or create a primary key461.

As shown, the key generator420may receive a common key411, device keys412-419, a device identification431, and a device key select signal432. In some embodiments, one of the device keys412-419and a combination of the common key411, device identification431, and the device key select signal432may be used to generate or create the primary key461. For example, as shown, the key generator420may include a hash algorithm component430in which inputs of the hash algorithm component430include the device identification431and the device key select signal432. The hash algorithm component430may receive the inputs and perform a hash function that combines or maps the input data (e.g., the device identification431and the device key select signal432) into a hash data signal433of a fixed length. In some embodiments, the hash algorithm component430may perform, but is not limited to, a cryptographic hash function such as a secure hash algorithm (SHA). Examples of an SHA include, but are not limited to, SHA-1, SHA-2, and SHA-3. Thus, the hash algorithm component430may receive the device identification431and the device key select signal432and generate a hash number or value that corresponds to the hash data signal433. Although a hash algorithm component430is illustrated, in other embodiments, other operations may be used to generate the hash data signal433. For example, an XOR logic operation and/or a truncation of the bits corresponding to the device identification431and the device key select signal432may be used to generate the hash data signal433.

Referring toFIG. 4, the key generator420may include a key tree component440. In some embodiments, the key tree component440may receive the hash data signal433and the common key411as inputs and may output a common key split442based on a function (e.g., a hash function) to combine the hash data signal433and the common key411. In some embodiments, the key tree component440may include a key tree structure to protect the generation or creation of the common key split442by the key tree component440from external monitoring attacks such as differential power analysis (DPA) or other such unauthorized attacks that may attempt to gather information that is correlated to the internal operations of a device including the key generator420. An example function of the key tree component440may include, but is not limited to, a cryptographic hash function. Thus, the use of the key tree component may be to diversify or modify the common key411with the hash data signal433that is based on the device identification431and/or the device key select signal432. Further details with regard to the key tree component440are disclosed with regard toFIG. 8.

The key generator420may further include a selection unit such as a multiplexer450. In some embodiments, the multiplexer450may receive and select one of the device keys412-419and forward the selected device key to an output line in response to the device key selection signal432. For example, the device key selection signal432input of the multiplexer450may determine which of the device keys412-419may be forwarded as the output of the multiplexer450. Thus, a value of the device key selection signal432may correspond to one of the device keys412-419. In some embodiments, the output of the multiplexer450may be the device key split451. Although a multiplexer450is shown as being part of the key generator420, in some embodiments where a device or an OTP memory of a device includes a single device key as opposed to multiple device keys, the output of the OTP memory may not go through a selection unit450such as a multiplexer.

Referring toFIG. 4, the key generator420may include an advanced encryption standard (AES) component460. In some embodiments, the AES component460may receive the common key split442and the device key split451and combine the common key split442and the device key split451to generate or create a primary key461as the output. In some embodiments, the AES component460may generate or create the primary key461based on encrypting the combination of the common key split442and the device key split451. For example, the AES component460may receive 128 bits corresponding to the common key split442and an additional 128 bits corresponding to the device key split461and may generate or create the primary key461of 128 bits based on encrypting a combination of the common key split442and device key split461. An example of an encryption mechanism includes, but is not limited to, the Advanced Encryption Standard (AES).

In some embodiments, the AES component460may be considered invertible. For example, as previously described, the AES component460may receive the common key split442and the device key split451and generate the primary key461based on the common key split442and the device key split451. In some embodiments, the primary key461may be an input to the AES component460and one of the device key split that is derived from a device key or a common key split that is derived from a common key may be provided to the AES component460and the AES component460may provide or output either a common key (if a device key is provided) or a device key (if a common key is provided). Further details with regard to the invertible process performed by the AES component460are disclosed with regard toFIG. 9.

As such, the key generator420may receive a common key and a device key that is selected based on a device key selection signal. In some embodiments, the common key (i.e., first key) may be diversified or modified with a unique device identification and/or the device key selection signal to generate or create a modified common key (i.e., the common key split). The primary key may be generated based on a combination of the modified common key (i.e., the common key split) and the selected device key (i.e., the device key split).

FIG. 5is a flow diagram of an example method500to generate a key. In general, the method500may be performed by processing logic that may comprise hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method500may be performed by the key generator200ofFIG. 2or the key generator420ofFIG. 4.

As shown inFIG. 5, the method500may begin with the processing logic receiving a common key split based on a common key and a device identification (block510). For example, an AES component (e.g., AES component460) of the processing logic may receive the common key split. In some embodiments, if a device associated with the processing logic includes multiple devices keys (e.g., multiple devices keys stored in OTP memory or other memory location of the device) then the common key split may further be based on the device key selection. Further details with regard to the creation of the common key split are discussed with regard toFIG. 6.

The processing logic may further receive a device key split (block520). For example, an AES component (e.g., the AES component460) of the processing logic may receive the device key split. In some embodiments, if the device including the processing logic includes multiple device keys then the device key corresponding to the device key split that is received may be based on a device key selection signal. Such a selected device key may be referred to as the device key split. Further details with regard to the selection of the device key to be used as a device key split are discussed with regard toFIG. 7.

Returning toFIG. 5, the processing logic may further generate a primary key based on the common key split and the device key split. For example, the AES component of the processing logic may receive the common key split (e.g., common key split442) and a device key split (e.g., device key split451) and generate or create the primary key (e.g., primary key461) based on a combination of the common key split and the device key split.

FIG. 6is a flow diagram of an example method600to generate a common key split. In general, the method600may be performed by processing logic that may comprise hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method600may be performed by the key generator200ofFIG. 2or the key generator420ofFIG. 4.

As shown inFIG. 6, the method600may begin with the processing logic receiving a device identification (block610). For example, an SHA component (e.g., SHA component430) of the processing logic may receive the device identification. In some embodiments, the device identification may be a unique identification number or text string (e.g., combination of numbers and/or letters) that is assigned to a single device. Furthermore, the processing logic may receive a device key selection signal (block620). For example, the SHA component (e.g., SHA component430) of the processing logic may receive the device key selection signal. The processing logic may generate a hash value based on the device identification and the device key selection (block630). For example, the SHA component of the processing logic may generate or create the hash value (e.g., hash data signal433). The processing logic may further receive a common key (block640). For example, a common key (e.g., common key411) may be received by a key tree component (e.g., key tree component440) of the processing logic. Additionally, the processing logic may generate a common key split (i.e., the modified common key) based on the common key that has been received and the hash data signal that has been created based on the device identification and/or the device key selection signal. For example, the key tree component of the processing logic may generate or create the common key split or modified common key by performing a hash function on the common key and the hash value.

As such, the common key split (also referred to as the modified common key) may be created based on diversifying or modifying a common key with a device identification. Furthermore, in some embodiments with a device that is associated with multiple device keys, the common key split may be further based on the device key selection signal that is also used to select one of the device keys.

FIG. 7is a flow diagram of an example method700to select a device key. In general, the method700may be performed by processing logic that may comprise hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method700may be performed by the key generator200ofFIG. 2or the key generator420ofFIG. 4.

As shown inFIG. 7, the method700may begin with the processing logic receiving multiple device keys (block710). For example, a selection unit (e.g., the multiplexer450) of the processing logic may receive multiple device keys or be coupled to a memory (e.g., OTP memory410) storing multiple device keys. The processing logic may further receive a device key selection signal (block720). For example, the selection unit of the processing logic may receive a device key selection signal corresponding to one of the device keys. Furthermore, the processing logic may select one of the device keys based on the device key selection signal (block730).

FIG. 8is a block diagram of an example key tree800in accordance with some embodiments. In general, the key tree800may correspond to the key tree component440ofFIG. 4. The key tree800may receive a first input (e.g., the hash data signal433) that is based on a device identification and a second input (e.g., the common key411) and produce a hash result that may correspond to a key (e.g., common key split442) used to generate or create another key (e.g., the primary key461).

In some embodiments, the key tree800may perform an entropy redistribution operation. As used herein, an “entropy redistribution operation” (or “entropy distribution operation”) may be an operation that mixes its input(s) (e.g., the hash data signal433and the common key split442) such that unknown information about input bits is redistributed among the output bits. For example, suppose an x bit cryptographic key K0is processed repeatedly with an entropy redistribution operation f such that key Ki=f(Ki-1) for each i>1. Next, suppose an adversary obtains y bits of information (e.g., obtained as part of an attempted external monitoring attack) about each of n different keys Ki, providing more than enough information to solve for key K0(e.g., y*n>x). The use of the entropy distribution operation f may make such solution computationally infeasible. A cryptographic hash function H is an example of an operation that may be used as an entropy redistribution operation. For example, consider a strong hash function H that produces a 256-bit result. Given a random 256-bit initial key K0, let Ki=H(Ki-1) for each i>1. An adversary with knowledge of (for example) the least-significant bit of each K0. . . K999,999has 1,000,000 bits of data related to K0. A hypothetical adversary with infinite computing power could find K0by testing all possible 2256values for K0to identify a value which is consistent with the known sequence of least-significant bits. Actual adversaries have finite computational power available, however, and the entropy redistribution operation prevents there from being a computationally practical way to solve for K0(or any other Ki) given the information leaked through attempted external monitoring attacks.

Entropy redistribution operations may be implemented, without limitation, using cryptographic hash functions, operations constructed using block ciphers (such as AES), pseudorandom transformations, pseudorandom permutations, other cryptographic operations, or combinations thereof. As a matter of convenience, certain exemplary embodiments are described with respect to a hash, but those skilled in the art will understand that, pursuant to the foregoing, other entropy redistribution functions may also be used instead or in addition.

Multiple entropy redistribution operations may also be constructed from a base operation. By way of example, if two 256-bit entropy redistribution operations f0( ) and fi( ) are required, f0( ) could comprise applying the SHA-256 cryptographic hash function to the operation identifier string “f0” concatenated with the input to f0( ) while f1( ) could comprise applying SHA-256 to the operation identifier string “f1” concatenated with the input to f1( ). Entropy redistribution operations can be construed using the well-known AES block cipher. For example, to implement f0( ) . . . fb-1( ) each fi( ) can use its input as an AES-256 key to encrypt a pair of 128-bit input blocks that are unique to the choice of i within 0 . . . b−1, yielding 256 bits of output.

The key tree800may be able to compute a set of non-linear cryptographic entropy redistribution operations f0( ), f1( ), . . . fb-1( ), where b>1 is a positive integer. These b entropy redistribution functions can be configured in a tree structure. For example, a simple b-ary tree structure of height Q (i.e., having Q+1 levels, from 0 through Q) can be created by using b distinct entropy distribution functions, f0( ) . . . fb-1( ), to represent the b possible branches of this b-ary tree at each node of the tree, each node representing a possible derived key. In such a tree, starting from a root cryptographic key KSTART(which is at level 0), b possible derived keys can be computed at level 1: f0(KSTART) for the leftmost branch; f1(KSTART) for the next branch; and continuing until fb-1(KSTART) for the rightmost branch. At level 2, b2possible keys can be derived, since each of f0( ) . . . fb-1( ) could be applied to each of the b possible level 1 keys. Of course, computing a specific level 2 node only requires two, not b2, computations (i.e., the nodes not on the path are not computed). The tree continues for successive levels 1 through Q, where each possible key (i.e., a different node) of a prior level can be processed by applying f0( ) . . . fb-1( ) in turn to derive b additional possible derived keys. The entire key tree has Q+1 levels, starting with a single node at level 0, continuing with binodes at level i, and ending with bQnodes at level Q. Thus, there are bQpossible paths from the root node at level 0 to the bQfinal nodes at level Q. Each such possible path, corresponding to a unique the sequence of functions applied at the different levels, can be represented as a sequence of Q integers, each integer being selected from (0 . . . b−1). For example, in an exemplary embodiment, b=2. Thus, two entropy redistribution operations, f0( ) and f1( ) are used (and may be constructed from a base operation, e.g., as described above). If Q=128 (i.e., the height is 128), 2128paths are possible and 128 entropy redistribution function computations are required to derive the level Q key from the level 0 node (i.e., the starting key).

As a variation, embodiments may involve more variety in the choice of b, such as varying the value of b among levels, and/or varying b based on the route taken to a particular level. Likewise, the entropy redistribution operations can also be varied, such as by making the entropy redistribution operations fi( ) differ at different levels or making these operations depend on the sequence taken to a particular level.

An example key derivation process is diagrammed inFIG. 8. The process begins with a starting point of the tree, which is denoted KSTART(801), and a path P1. . . PQ(802). For example, KSTARTis the value of common key411and path P1. . . PQ(802) is determined by hash data signal433. (The conversion of hash data signal433into P1. . . PQis discussed below.) The path specifies a succession of entropy redistribution operations to be applied to KSTART.

In an implementation, message identifier H1is decomposed into Q parts P1, P2, . . . PQ. In an example decomposition, each part Piis an integer from 0 thru (b−1) (e.g., if b=4 then each Piis a two-bit value (0, 1, 2, or 3)). Likewise, if b=2, each Piis a single bit (0 or 1). Hence, the path parts P1. . . PQcan be used to specify a specific path from KSTARTto KSTART,PATHby applying functions f0( ), f1( ) . . . , fb-1( ) to produce a plurality of intermediate keys leading to KSTART,PATHas follows. First, the function fP 1is applied to KSTART(803) to yield an intermediate key KSTART,P 1, followed by the application of fP 2on KSTART,P 1to yield the intermediate key KSTART,P 1,P 2(804) and so on, until the final application of fP Qon the intermediate key KSTART,P 1, P 2, . . . , P Q-1(805) to yield the final derived key, KSTART,P 1, P 2, . . . , P Q(806). Note that the derivation of each intermediate key depends on at least one predecessor key and the relevant portion of the message identifier. For convenience, this final derived key may be denoted with the notation KSTART,PATH(indicating the key that was reached by starting with KSTARTand following PATH).

FIG. 9illustrates an example method900to determine a device key in accordance with some embodiments. In general, the method900may be performed by processing logic that may comprise hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method900may be performed by the key generator200ofFIG. 2or the key generator420ofFIG. 4.

As shown inFIG. 9, the method900may receive a primary key (block910). For example, an AES component (e.g., AES component460) may receive a primary key (e.g., primary key461). In some embodiments, the AES component may be invertible so that a primary key may be generated by the AES component based on a common key and a device key or a device key may be generated based on the common key and the primary key. Furthermore, the processing logic may receive a common key (block920). For example, the invertible AES component may further be supplied a common key (e.g., common key411). The processing logic may receive a device key selection (block930) and may generate a device key based on the primary key and the common key (block930). In some embodiments, the device key may be further generated based on the device key selection signal. Furthermore, the processing logic may store the generated device key (block950). For example, the generated device key may be stored in a particular location of a memory (e.g., OTP memory410) based on the device key selection.

FIG. 10is a block diagram of an example device1000including a key generator. In general, the example device may include an OTP memory1010that may correspond to OTP memory300ofFIG. 3and a key generator1020that may correspond to key generator130ofFIG. 1, key generator200ofFIG. 2, or key generator420ofFIG. 4.

Examples of the device1000may include, but are not limited to, a System on a Chip (SoC), field programmable gate array (FPGA), and a processor that may include an integrated circuit. As shown, the integrated circuit of a device1000may include an OTP memory1010, a key generator1020, device memory1030, and device components or architecture1040. In some embodiments, the OTP memory1010may be a type of programmable read-only memory that may store a common key and one or more device keys. The integrated circuit of the device1000may further include a device memory1030which may be a type of random access memory, read-only memory, or other such memory storage. In some embodiments, the memory1030may store a device identification. Additionally, the integrated circuit of the device1000may include a key generator1020, as previously described. In some embodiments, the integrated circuit of the device1000may further include device components or architecture1040. The device components or architecture1040may include a central processing unit (CPU) or other type of processing device, memory, or other such circuit components. In some embodiments, the device components or architecture1040may further include functionality to provide the common key of the device1000. As an example, a processing unit of the device components1040may use a primary key that is generated by the key generator1020. In some embodiments, the processing unit of the device components1040may initiate a request for the generation of the primary key by the key generator1020. In response, the key generator1020may retrieve the common key (e.g., from the OTP memory1010or from the device components1040) and may further retrieve a device key from the OTP memory1010and receive a device identification from the device memory1030and a device key selection signal from the device components1040.

The example computer system includes a processing device1102, a main memory1104(e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or DRAM (RDRAM), etc.), a static memory1106(e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device1118, which communicate with each other via a bus1130.

The computer system may further include a network interface device1108. The computer system also may include a video display unit1110(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device1112(e.g., a keyboard), a cursor control device1114(e.g., a mouse), a graphics processing unit1122, a video processing unit1128, an audio processing unit1132, and a signal generation device1116(e.g., a speaker).

The data storage device1118may include a machine-readable storage medium1124(also known as a computer-readable medium) on which is stored one or more sets of instructions or software1126embodying any one or more of the methodologies or functions described herein. The instructions1126may also reside, completely or at least partially, within the main memory1104and/or within the processing device1102during execution thereof by the computer system, the main memory1104and the processing device1102also constituting machine-readable storage media.

In one implementation, the instructions1126include instructions to implement functionality corresponding to a key generator (e.g., key generator200ofFIG. 2or key generator420ofFIG. 4). While the machine-readable storage medium1124is shown in an example implementation to be a single medium, the term “machine-readable storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term “machine-readable storage medium” shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term “machine-readable storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical media and magnetic media.