Nvidia Corporation

Broadcom Corporation

Phillip Smith

Michael Brian Cox

Patrick Y Law

Stephen Donald Lew

Derrick Chu Lin

Joseph John Tardo

Gordon Grigor

Suresh Krishna

Christopher Owen

A method, an integrated circuit and a system for implementing a secure chain of trust is disclosed. While executing secure boot code in a secure boot mode, less-secure boot code may be authenticated using a secret key. A secure key may also be calculated or generated during the secure boot mode. After control is turned over to the authenticated less-secure boot code, at least one application may be authenticated using the secure key. Once authenticated in the less-secure boot mode, the application may be executed by the programmable integrated circuit. In this manner, a secure chain of trust may be implemented for the programmable integrated circuit.

Method and system for implementing a secure chain of trust

A method, system on a chip, and computer system for generating more robust keys which utilize data occupying relatively small die areas is disclosed. Embodiments provide a convenient and effective mechanism for generating a key for use in securing data on a portable electronic device, where the key is generated from repurposed data and a relatively small amount. A multi-stage encryption algorithm may be performed to generate the key, where the first stage may include encrypting the secure data, and the second stage may include encrypting the result of a logical operation on the encrypted secure data with a unique identifier of the portable electronic device. A secret key may be used as the encryption key for each stage. The result of the second encryption stage may include the generated key which may be used to perform subsequent operations on the portable electronic device.

Method and system for generating a secure key

Techniques for securely updating a boot image without knowledge of a secure key used to encrypt the boot image.

Secure update of boot image without knowledge of secure key

Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.

Growing community of inventors

Sunnyvale, CA, United States of America

Phillip Smith