Integrated circuit personalisation

Patent metadata

Field	Value
Publication number	US-11206145-B2
Application number	US-201816763121-A
Country	US
Kind code	B2
Filing date	Nov 12, 2018
Priority date	Nov 14, 2017
Publication date	Dec 21, 2021
Grant date	Dec 21, 2021

Abstract

An integrated circuit and a method of configuring a plurality of integrated circuits are disclosed. Each integrated circuit comprises a cryptographic key specific to it. Each integrated circuit comprises a cryptographic key specific to it. Each cryptographic key can be generated on the respective integrated circuit using a physical unclonable function and data associated with the cryptographic key, e.g. a configuration message comprising instructions for generating the cryptographic key using the physical unclonable function. The cryptographic key specific to the integrated circuit is not stored on the integrated circuit. Each of the plurality of integrated circuits are configured using a data file that is encrypted with the respective cryptographic key specific to the integrated circuit, circuit.

First claim

The invention claimed is:

1. A method of configuring a plurality of integrated circuits, the method comprising:
receiving the plurality of integrated circuits, wherein each integrated circuit comprises a physical unclonable function and a memory storing data associated with a cryptographic key specific to the integrated circuit;
receiving a plurality of encrypted files, wherein each encrypted file is encrypted with the cryptographic key specific to a respective one of the plurality of integrated circuits; and
for each encrypted file of the plurality of encrypted files:
sending the encrypted file to the respective integrated circuit;
causing the respective integrated circuit to generate its cryptographic key using its data associated with the cryptographic key and its physical unclonable function;

causing the respective integrated circuit to decrypt the encrypted file using its generated cryptographic key; and
using the decrypted file to configure the respective integrated circuit.

2. The method of claim 1 , wherein using the decrypted file to configure the respective integrated circuit comprises storing the decrypted file in the memory of the integrated circuit.

3. The method of claim 1 , wherein using the decrypted file to configured the respective integrated circuit comprises determining data for configuring the integrated circuit, and storing the data for configuring the integrated circuit in the memory of the integrated circuit.

4. The method of claim 1 , wherein the physical unclonable function comprises a plurality of ring oscillators and the data associated with the cryptographic key specific to the integrated circuit comprises a sequence of challenge-response pairs of the plurality of ring oscillators.

5. The method of claim 1 , comprising, prior to sending the encrypted file to the respective integrated circuit, receiving, from each encrypted file of the plurality of encrypted files, a request for the encrypted file specific to the respective integrated circuit.

6. One or more non-transitory computer readable medium having computer-executable instructions to cause a computer system to perform the steps of the method of claim 1 .

7. A system for configuring a plurality of integrated circuits, the system comprising:
an integrated circuit interface configured to receive a plurality of integrated circuits, wherein each integrated circuit comprises a physical unclonable function and a memory storing data associated with a cryptographic key specific to the integrated circuit;
a memory circuit configured to store a personalization file database comprising a plurality of encrypted files, wherein each encrypted file is encrypted with the cryptographic key specific to a respective one of the plurality of integrated circuits; and
a processing circuit coupled to the memory circuit and configured to, for each encrypted file of the plurality of encrypted files:
send the encrypted file to the respective integrated circuit;
cause the respective integrated circuit to generate its cryptographic key using its data associated with the cryptographic key and its physical unclonable function;
cause the respective integrated circuit to decrypt the encrypted file using its generated cryptographic key; and
use the decrypted file to configure the respective integrated circuit.

8. The system of claim 7 , wherein using the decrypted file to configured to respective integrated circuit comprises storing the decrypted file in the memory of the integrated circuit.

9. The system of claim 7 , wherein using the decrypted file to configure the respective integrated circuit comprises determining data for configuring the integrated circuit, and storing the data for configuring the integrated circuit in the memory of the integrated circuit.

10. The system of claim 7 , wherein the physical unclonable function comprises a plurality of ring oscillators and the data associated with the cryptographic key specific to the integrated circuit comprises a sequence of challenge-response pairs of the plurality of ring oscillator.

11. The system of claim 7 , wherein the processing circuit is configured to, prior to sending the encrypted file to the respective integrated circuit, receive, from each encrypted file of the plurality of encrypted files, a request for the encrypted file specific to the respective integrated circuit.

12. An integrated circuit comprising:
a physical unclonable function;
a memory circuit configured to store data associated with a cryptographic key; and
a processing circuit configured to:
receive an encrypted file, wherein the encrypted file is encrypted with the cryptographic key;
generate the cryptographic key using the physical unclonable function and the data associated with the cryptographic key;
decrypt the encrypted file using cryptographic key; and
use the decrypted file to configure the integrated circuit;

wherein the physical unclonable function comprises a plurality of ring oscillators and the data associated with the cryptographic key specific to the integrated circuit comprises a sequence of challenge-response pairs specific to the plurality of ring oscillators.

13. A smart card suitable for a set-top box comprising the integrated circuit of claim 12 .

14. A netlist for use in manufacturing the integrated circuit of claim 12 .

Assignees

• Nagravision Sa

Inventors

• Bellon Sebastien
• Favi Claudio
• Hautier Roan
• Macchetti Marco
• Perrine Jerome

Classifications

• G09C1/00

  Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) · CPC title

• G06F21/72 Primary

  in cryptographic circuits · CPC title

• H04L9/3278 Primary

  using physically unclonable functions [PUF] · CPC title

• G06F21/73 Primary

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title