E-fuses for storing security version data

Abstract

Methods and devices that may be utilized in systems to dynamically update a security version parameter used to encrypt secure data are provided. The version may be maintained in persistent storage located on a device implementing the encryption, such as a system on a chip (SOC). The persistent storage does not require battery backing and, thus, the cost and complexity associated with conventional systems utilizing battery backed storage may be reduced.

1 . A method of handling secure data in a secure system, wherein the secure data is passed between a processor and memory external to the processor, comprising:
 maintaining a security version parameter in persistent storage on the processor, wherein blocks of secure data are encrypted as a function of the security version parameter; and   dynamically changing the security version parameter by modifying the contents of the persistent storage.   
     
     
         2 . The method of  claim 1 , wherein the security version parameter is dynamically changed while the secure system is running. 
     
     
         3 . The method of  claim 1 , further comprising:
 dynamically updating the privileges of a user;   encrypting a data structure containing privilege information indicating the updated privileges; and   generating an integrity check value on the data structure, wherein at least one of the encrypting or the generating is affected by the security version parameter.   
     
     
         4 . The method of  claim 1 , wherein dynamically changing the security version parameter comprises blowing a fuse. 
     
     
         5 . The method of  claim 1 , wherein dynamically changing the security version parameter comprises only one of increasing or decreasing the security version. 
     
     
         6 . A method of handling secure data in a secure system, wherein the secure data is passed between a processor and memory external to the processor, comprising:
 maintaining a security version parameter and master key data in persistent storage on the processor;   encrypting a block of secure data;   generating an integrity check value for the block of secure data, wherein at least one of the encrypting and the generating is performed as a function of the security version parameter;   storing the encrypted block of secure data in the external memory; and   dynamically changing the security version parameter by modifying the contents of the persistent storage.   
     
     
         7 . The method of  claim 6 , wherein the encrypting and generating is performed in software. 
     
     
         8 . The method of  claim 6 , wherein encrypting a block of secure data is affected by at least one of: the master key data, one or more keys derived from the master key data, and one or more keys protected by the master key data. 
     
     
         9 . The method of  claim 6 , further comprising encrypting the security version parameter and storing the security version parameter in external memory with the block of secure data. 
     
     
         10 . The method of  claim 9 , further comprising:
 retrieving the encrypted block of secure data and security version parameter from external memory;   decrypting the encrypted block of secure data and security version parameter retrieved from external memory; and   comparing the security version parameter retrieved from external memory with the security version parameter stored in persistent storage.   
     
     
         11 . The method of  claim 10 , further comprising:
 generating a security exception if the retrieved security version parameter and the security version parameter maintained in the persistent storage are not equal.   
     
     
         12 . The method of  claim 6 , wherein the master key information and security version parameter are stored in different types of persistent storage.