Controlled secure code authentication

Patent metadata

Field	Value
Publication number	US-10474823-B2
Application number	US-201615044770-A
Country	US
Kind code	B2
Filing date	Feb 16, 2016
Priority date	Feb 16, 2016
Publication date	Nov 12, 2019
Grant date	Nov 12, 2019

Abstract

Systems, methods, circuits and computer-readable mediums for controlled secure code authentication are provided. In one aspect, a non-transitory computer-readable storage medium having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform a method including: sending a request to a client device, the request including a challenge for a property of a particular portion from among a plurality of portions of code stored within the client device, the challenge including data indicating a particular memory address range corresponding to the particular portion of the code, receiving a response to the request from the client device, the response including information associated with the property of the code, verifying correctness of the response based on the received information, and based on verifying correctness of the response, determining that the code is an authorized code.

First claim

What is claimed is:

1. A system comprising:
a client device storing an entire image of a code; and
an authentication device physically arranged adjacent to the client device and coupled to the client device through a local connection, the authentication device configured to:
select a plurality of memory address ranges of an authorized code;
determine a respective portion of the authorized code for each of the plurality memory address ranges;
calculate a respective property of each of the respective portions;
send a request to the client device, the request including a challenge for a property of a particular portion from among a plurality of portions of the code stored within the client device, the challenge comprising data indicating a particular memory address range corresponding to the particular portion of the code;
receive a response to the request from the client device, the response including information associated with the property of the code, the information being generated by the client device based on a portion of the code stored within the client device and comprising the property of the portion of the code;
verify correctness of the response based on the received information; and
based on verifying correctness of the response, determine that the entire image of the code stored within the client device is authorized,
wherein the verifying correctness of the response comprises determining that the property of the portion of the code in the response matches the property of the particular portion of the authorized code that is obtained based on stored information of the particular portion of the authorized code in a secure storage associated with the authentication device, the stored information of the particular portion of the authorized code comprising the calculated property of the particular portion of the authorized code corresponding to the particular memory address range of the plurality of memory address ranges of the authorized code.

2. The system of claim 1 , wherein the authentication device is coupled to a remote host device through a network, and
wherein the remote host device is configured to provide an entire image of the authorized code to the authentication device and the client device.

3. The system of claim 1 , wherein the local connection comprises a data cable, a wireless connection, a hardware interface, a conductor, or a conductive connection on a circuit board.

4. The system of claim 1 , wherein the code comprises at least one of a boot code for the client device to boot and an operation code for the client device to perform a corresponding operation.

5. A non-transitory computer-readable storage medium having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform a method comprising:
selecting, by an authentication device, a plurality of memory address ranges of an authorized code;
determining, by the authentication device, a respective portion of the authorized code for each of the plurality memory address ranges;
calculating, by the authentication device, a respective property of each of the respective portions;
sending, from the authentication device, a request to a client device coupled to the authentication device, the request including a challenge for a property of a particular portion from among a plurality of portions of an entire image of a code stored within the client device, the challenge comprising data indicating a particular memory address range corresponding to the particular portion of the code, the authentication device being physically arranged adjacent to the client device and coupled to the client device through a local connection;
receiving, at the authentication device, a response to the request from the client device, the response including information associated with the property of a portion of the code stored within the client device;
verifying correctness of the response based on the received information; and
based on verifying correctness of the response, determining that the entire image of the code stored within the client device is authorized,
wherein the verifying correctness of the response comprises determining that the property of the portion of the code in the response matches the property of the particular portion of the authorized code that is obtained based on stored information of the particular portion of the authorized code in a secure storage associated with the authentication device, the stored information of the particular portion of the authorized code comprising the calculated property of the particular portion of the authorized code corresponding to the particular memory address range of the plurality of memory address ranges of the authorized code.

6. The computer-readable storage medium of claim 5 , wherein the method further includes:
storing first information indicative of the respective properties of the portions of the authorized code and second information indicative of the respective memory address ranges in the secure storage; and
respectively associating memory address ranges from among the plurality of memory address ranges with properties from among the properties of the portions in the secure storage.

7. The computer-readable storage medium of claim 6 , wherein the selecting the plurality of memory address ranges of the authorized code comprises:
randomly selecting the plurality of memory address ranges from a range defined by a starting address of the authorized code and an ending address of the authorized code.

8. The computer-readable storage medium of claim 6 , wherein the method further comprises:
randomly selecting the particular memory address range from among the plurality of memory address ranges, the particular memory address range being associated with a particular property of the particular portion of the authorized code in the secure storage.

9. The computer-readable storage medium of claim 5 , wherein the method further includes:
receiving an entire image of the authorized code;
receiving a signature associated with the authorized code;
calculating a digest of the received entire image of the authorized code; and
verifying authenticity of the received entire image based on the received signature and the calculated digest of the received entire image.

10. The computer-readable storage medium of claim 5 , wherein the method further includes:
receiving a second entire image of the authorized code;
selecting randomly a plurality of second address ranges of the second entire image of the authorized code;
determining a respective second portion of the authorized code for each second address range;
calculating a respective second property of each determined second portion of the authorized code; and
replacing the respective properties of the portions of the authorized code with the respective second properties of the second portions of the authorized code in the secure storage.

11. The computer-readable storage medium of claim 5 , wherein the method further includes:
in response to determining that the code is the authorized code, enabling the client device to use secret data or cryptographic keys stored in the secure storage.

12. The computer-readable storage medium of claim 5 , wherein the method further comprises:
in response to determining that the code is the authorized code, enabling the client device through a pin coupled to the client device to power on or enable one or more hardware blocks in the client device.

13. The computer-readable storage medium of claim 5 , wherein the request includes a second challenge for a property of an entir

Assignees

• Atmel Corp

Inventors

• Maletsky Kerry David

Classifications

• G06F2221/2129

  Authenticate client device independently of the user · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/3271

  using challenge-response · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/125 Primary

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title