Abstract: A method for configuring the features of an integrated circuit. In the method, the integrated circuit receives a feature vector message from a first party. The feature vector message is included in a response to a feature set request from the first party to a second party. The integrated circuit configures at least one feature of the integrated circuit based on a feature vector in the feature vector message. The integrated circuit generates an attestation result based on the at least one configured feature of the integrated circuit and using a key securely stored in the integrated circuit and known to the second party and not known to the first party. The integrated circuit forwards the attestation result to the first party.

Abstract: A method for configuring the features of an integrated circuit. In the method, the integrated circuit receives a feature vector message from a first party. The feature vector message is included in a response to a feature set request from the first party to a second party. The integrated circuit configures at least one feature of the integrated circuit based on a feature vector in the feature vector message. The integrated circuit generates an attestation result based on the at least one configured feature of the integrated circuit and using a key securely stored in the integrated circuit and known to the second party and not known to the first party. The integrated circuit forwards the attestation result to the first party.

Abstract: Aspects may relate to a device that comprises: a non-volatile storage medium (NVM) to store a signature and a device key, the device key based on a symmetric master key and an identifier; an interface; and a processor coupled to the interface and the NVM. The processor may be configured to: apply a key derivation function (KDF) to the device key to generate a derivative key; apply a key generation function to the derivative key to generate at least one public key; and command transmission of the signature and the at least one public key through the interface to a service provider.

Abstract: A system and method for securely distributing PKI data, such as one or more private keys or other confidential digital information, from a PKI data generation facility to a product in a product personalization facility that is not connected to the PKI data generation facility and is assumed to be a non-secure product personalization facility. The system includes a PKI data loader for securely transmitting the encrypted PKI data transferred from the PKI data generator to a PKI server at the product personalization facility. The PKI server then transfers the PKI data to the product of interest, typically via a PKI station acting as a proxy between the PKI server and the product. In each communication step, PKI data being transferred is encrypted multiple times and the system is designed such that if any intermediate node is compromised with all of its keys, the overall system has not yet been compromised.

Abstract: A system and method for securely distributing PKI data, such as one or more private keys or other confidential digital information, from a PKI data generation facility to a product in a product personalization facility that is not connected to the PKI data generation facility and is assumed to be a non-secure product personalization facility. The system includes a PKI data loader for securely transmitting the encrypted PKI data transferred from the PKI data generator to a PKI server at the product personalization facility. The PKI server then transfers the PKI data to the product of interest, typically via a PKI station acting as a proxy between the PKI server and the product. In each communication step, PKI data being transferred is encrypted multiple times and the system is designed such that if any intermediate node is compromised with all of its keys, the overall system has not yet been compromised.