Patent ID: 8484486

Claim:
A system comprising: a controller including a processor and a memory device having program instructions stored therein that, when executed by the processor, cause the controller to generate a request for a cryptographic operation, said request including one or more descriptors of the cryptographic operation; a cryptographic unit communicatively linked to the controller, the cryptographic unit including: a random number generator configured to generate random values; a non-volatile memory device having values generated by the random number generator stored therein; a restrictor device comprised of hardware logic, said restrictor logic causing the restrictor device to prevent access to the values stored in the non-volatile memory device based on a comparison of the one or more descriptors of the requested cryptographic operation with a currently performed cryptographic operation; a cryptographic accelerator comprised of hardware logic, the accelerator logic causing the cryptographic accelerator to perform the requested cryptographic operation using one or more of the values stored in the non-volatile memory device that correspond to the requested cryptographic operation; and a finite state device comprised of hardware logic, said finite state logic causing the finite state device to enter one of a plurality of states based on a command received from the controller, wherein the states include: a first state that (i) allows the cryptographic accelerator to retrieve values stored in the non-volatile memory device and prevents changes to said values when a value stored in a predetermined location of the non-volatile memory device is equal to a first predefined value, and (ii) enables the finite state device to receive a command to enter an arm state in which the finite state device replaces the value stored in the predetermined location of the non-volatile memory device with a second predefined value, a second state that (i) allows the cryptographic accelerator to retrieve values stored in the non-volatile memory device and prevents changes to said values when the value stored in the predetermined location of the non-volatile memory device is equal to the second predefined value, and (ii) enables the finite state device to receive a command to enter a zeroize state in which the finite state device replaces the value stored in the predetermined location of the non-volatile memory with a value other than the first and second predefined values, and a third state that allows the finite state device to overwrite the values stored in the non-volatile memory device with new values generated by the random number generator stored therein when the value stored in the predetermined location of the non-volatile memory device is not equal to either of the first predefined value or the second predefined value.