Abstract: A provisioning control apparatus configured to be coupled to a provisioning equipment server electrically connectable with one or more electronic devices for provisioning the electronic devices with security sensitive provisioning data. The provisioning control apparatus includes a processor configured to generate a group context for sharing the group context with a first further provisioning control apparatus for creating a group of provisioning control apparatuses. The processor is configured to assign an identity to the first further provisioning control apparatus. The identity of the first further provisioning control apparatus is indicative of the provisioning control apparatus and the first further provisioning control apparatus. The processor is configured to generate the security sensitive provisioning data based on the group context.

Abstract: A provisioning control apparatus is configured to be coupled to a provisioning equipment server electrically connectable with one or more electronic devices for provisioning the electronic devices with security sensitive provisioning data. The provisioning control apparatus includes a processor configured to generate a group context for creating a group of provisioning control apparatuses. The processor is further configured to generate the security sensitive provisioning data based on the group context. The provisioning control apparatus includes a communication interface configured to provide the security sensitive provisioning data to the provisioning equipment server. The communication interface is configured to provide the group context to a security server for generating a proxy provisioning control apparatus on the security server.

Abstract: A provisioning system is provided for provisioning a plurality of electronic devices with provisioning data. Each of the plurality of electronic devices is associated with an electronic device type. The provisioning system includes a provisioning control apparatus, and a provisioning equipment configured to be electrically connected with at least one of the plurality of electronic devices for provisioning the at least one electronic device. The provisioning system includes a provisioning security module configured to receive the device type information from the provisioning control apparatus and to generate provisioning data on the basis of the device type information. The provisioning security module transmits the provisioning data to the provisioning equipment for provisioning the at least one electronic device with provisioning data.

Abstract: A provisioning control apparatus coupled to a provisioning equipment server electrically connectable with electronic components each including a security enclave and a non-volatile memory. The provisioning control apparatus includes a processor configured to encrypt the security sensitive provisioning data using a secure vault encryption key for obtaining encrypted security sensitive provisioning data. The provisioning control apparatus has a communication interface configured to securely provide the secure vault encryption key to the provisioning equipment server for storing the secure vault encryption key in the security enclave of the electronic component.

Abstract: An apparatus is provided for generating a plurality of provisioning data sets for provisioning a plurality of electronic devices, such as chips or microprocessors for electronic equipment. The apparatus includes a processing circuitry configured to obtain a first provisioning data set for provisioning an electronic device and to generate at least one further provisioning data set for provisioning at least one further electronic device by generating at least one copy of the first provisioning data set. Furthermore, the apparatus has a communication interface configured to output the at least one further provisioning data set for provisioning the at least one further electronic device. Moreover, a corresponding method to the apparatus is provided for generating a plurality of provisioning data sets for provisioning a plurality of electronic devices.

Abstract: A method for provisioning a plurality of electronic devices with a respective provisioning data set includes, in a test provisioning stage: generating at least one test application key in plaintext and encrypting the at least one test application key using a first wrapping key for generating at least one encrypted test application key; encrypting the first wrapping key using the secret device master key for generating an encrypted first wrapping key; provisioning one or more of the plurality of electronic devices with a respective first provisioning data set, wherein the respective first provisioning data set comprises the at least one test application key in plaintext, the at least one encrypted test application key and the encrypted first wrapping key; and testing a security function of the electronic device on the basis of at least a portion of the first provisioning data set.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of the operating system when executed by the processor, performs a cryptographic operation when processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory stores the operating system. A communication interface receives data over a communication network. The processor retrieves the boot program code from the first memory area and executes the boot program code to start execution of the operating system. The processor terminates execution of the boot program code. The processor is configured to re-execute the boot program code while the operating system is executed to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of an operating system when executed by the processor, and performs a cryptographic operation when the processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory area stores the operating system. The processor retrieves the boot program code from the first memory area and executes the boot program code to start the execution of the operating system. The processor re-executes the boot program code to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.

Abstract: A provisioning control apparatus is configured for coupling to a provisioning equipment server electrically connectable with an electronic device(s) for provisioning the electronic device(s) with a program code. The apparatus comprises: a communication interface configured to receive an electronic provisioning token including a provisioning counter indicating a total of transmissions of the program code towards the provisioning equipment server; and a processor configured to retrieve the provisioning counter from the received token. The interface can transmit the program code towards server; the processor can update a value of the counter for each transmission of the program code towards the server for an updated counter. The processor prohibits transmission of the program code towards the server if the updated counter indicates a total number of transmissions has been reached.

Abstract: A provisioning control apparatus couples to a provisioning equipment server electrically connectable with an electronic device(s) for provisioning the electronic device(s) with a program code. The provisioning control apparatus has a communication interface which transmits the program code to the provisioning equipment server for provisioning the electronic device(s) with the program code and to receive an electronic provisioning token having provisioning control data. The provisioning control apparatus includes a processor that controls the transmission of the program code via the communication interface to the provisioning equipment server. The electronic provisioning token has time adjustment information for adjusting the clock, and the processor adjusts the time of the clock. A provisioning control system includes the provisioning control apparatus and a method involves provisioning the electronic device(s).