Decryption key management system

摘要

A decryption key management system includes a memory, a memory controller, a decryption engine, and an on-chip crypto-accelerator. A key blob and an encrypted code are stored in the memory. The memory controller fetches the key blob and stores it in a memory buffer. The decryption engine fetches the key blob and decrypts it using an OTP key to generate a decryption key. The decryption key is used to decrypt the encrypted code and generate a decrypted code.

主权项

1. A decryption key management system, comprising:
a memory for storing an encrypted code and a key binary large object (BLOB), wherein the key BLOB is used for generating a decryption key; a memory controller including a memory buffer and a receive buffer, wherein the memory controller is connected to the memory for fetching the key BLOB and a code segment of the encrypted code from the memory and storing the fetched key BLOB and the fetched code segment in the memory buffer; a decryption engine connected to the memory controller for (i) fetching the key BLOB and the code segment from the memory buffer and storing them in a local buffer of the decryption engine, (ii) decrypting the key BLOB using a one time programmable (OTP) key to generate the decryption key, (iii) decrypting the code segment using the decryption key to generate a decrypted code segment, and (iv) providing the decrypted code segment to the memory controller for storage in the receive buffer; and a crypto-accelerator connected to the decryption engine for generating and transmitting the OTP key to the decryption engine, wherein the crypto-accelerator and the decryption engine are formed on the same chip and communicate with each other using side band signals, and wherein the crypto-accelerator generates the OTP key automatically when the system is powered on, the local buffer of the decryption engine is not memory mapped so is not accessible by the memory controller, and the local buffer of the decryption engine is not connected to a scan chain so is not accessible by a debugger.