Secure provisioning in an untrusted environment

Patent metadata

Field	Value
Publication number	US-9100174-B2
Application number	US-201414220507-A
Country	US
Kind code	B2
Filing date	Mar 20, 2014
Priority date	Aug 31, 2012
Publication date	Aug 4, 2015
Grant date	Aug 4, 2015

Abstract

Embodiments include methods for securely provisioning copies of an electronic circuit. A first entity (e.g., a chip manufacturer) embeds one or more secret values into copies of the electronic circuit. A second entity (e.g., an OEM): 1) embeds a trust anchor in a first copy of the electronic circuit; 2) causes the electronic circuit to generate a message signing key pair using the trust anchor and the embedded secret value(s); 3) signs provisioning code using a code signing private key; and 4) sends a corresponding code signing public key, the trust anchor, and the signed provisioning code to a third entity (e.g., a product manufacturer). The third entity embeds the trust anchor in a second copy of the electronic circuit and causes the electronic circuit to: 1) generate the message signing private key; 2) verify the signature of the signed provisioning code using the code signing public key; and 3) launch the provisioning code on the electronic circuit. The electronic circuit can authenticate itself to the OEM using the message signing key pair.

First claim

What is claimed is:

1. A method performed by a first entity, a second entity, and a third entity, the method comprising:
embedding, by the first entity, one or more secret values in first and second electronic circuits, wherein each of the first and second electronic circuits includes private key derivation logic, public key derivation logic, and secure boot code;
generating, by the second entity, a code signing public key, a code signing private key, and a trust anchor derived from the code signing public key;
embedding, by the second entity, the trust anchor in the first electronic circuit;
activating, by the second entity, the secure boot code, wherein the secure boot code causes the private key derivation logic of the first electronic circuit to generate a message signing private key using a combination of the trust anchor and the one or more embedded secret values, causes the public key derivation logic of the first electronic circuit to generate a message signing public key that corresponds to the message signing private key, and stores the message signing private key in the first electronic circuit;
signing, by the second entity, provisioning code using the code signing private key, resulting in signed provisioning code that includes the provisioning code and a signature;
sending, by the second entity, the code signing public key, the trust anchor, and the signed provisioning code to the third entity;
embedding, by the third entity, the trust anchor in the second electronic circuit;
activating, by the third entity, the secure boot code in the second electronic circuit, wherein the secure boot code causes the private key derivation logic of the second electronic circuit to generate a message signing private key that is the same as the message signing private key generated by the first electronic circuit using a combination of the trust anchor and the one or more embedded secret values, stores the message signing private key in the protected register of the second electronic circuit, derives a value from the code signing public key, and compares the value derived from the code signing public key with the trust anchor embedded in the second electronic circuit, verifies the signature of the signed provisioning code using the code signing public key, and when the signature of the signed provisioning code is verified, launches the provisioning code on the second electronic circuit;
receiving, by the provisioning code, a challenge message from a first computer system associated with the second entity;
preparing, by the provisioning code, a signed response message that includes the challenge message signed using the message signing private key;
sending, by the second electronic circuit, the signed response message to the first computer system;
receiving, by the second electronic circuit over a secure channel between the first computer system and the second electronic circuit, sensitive provisioning information from the first computer system; and
storing the sensitive provisioning information on the second electronic circuit.

2. The method of claim 1 , wherein embedding the one or more secret values in the first electronic circuit comprises embedding one or more secret values selected from a value embedded in logic gates of the first electronic circuit, a value burned into a set of fuses of the first electronic circuit, and a value embedded in masked read only memory (ROM) of the first electronic circuit.

3. The method of claim 1 , further comprising:
embedding, by the first entity, the secure boot code in the first and second electronic circuits; and
storing, by the first entity, unique identifiers in the first and second electronic circuits.

4. The method of claim 1 , further comprising:
providing, by the first entity, the first electronic circuit to the second entity; and
providing, by the first entity, the second electronic circuit to the third entity.

5. The method of claim 1 , wherein generating the trust anchor comprises generating a hash of the code signing public key.

6. The method of claim 1 , wherein embedding the trust anchor comprises burning the trust anchor into a set of fuses of the first electronic circuit.

7. The method of claim 1 , wherein storing the message signing private key comprises storing the message signing private key in protected registers of the first and second electronic circuits.

8. The method of claim 1 , wherein code running on the first electronic circuit provides the message signing public key to the first computer system associated with the second entity.

9. The method of claim 1 , wherein preparing the signed response message comprises:
concatenating together the challenge message a unique identifier of the second electronic circuit; and
signing the concatenated message using the message signing private key to produce the signed response message.

10. The method of claim 9 , further comprising:
determining, by the first computer system, whether the unique identifier matches any previously-stored unique identifiers maintained by the first computer system in a log of electronic circuits that have been previously provisioned; and
when the unique identifier matches a unique identifier in the log, the first computer system refraining from providing the sensitive provisioning information to the second electronic circuit.

11. The method of claim 9 , further comprising:
determining, by the first computer system, whether a maximum number of electronic circuits have been previously provisioned; and
when the maximum number of electronic circuits have been previously provisioned, the first computer system refraining from providing the sensitive provisioning information to the second electronic circuit.

12. A method performed by a first entity and a first computer system associated with the first entity, the method comprising the steps of:
generating a code signing public key and a code signing private key;
generating a trust anchor based on the code signing public key;
signing provisioning code using the code signing private key, resulting in signed provisioning code that includes the provisioning code and a signature;
embedding the trust anchor in a first electronic circuit, wherein the first electronic circuit includes private key derivation logic, public key derivation logic, secure boot code, and one or more embedded secret values;
activating the secure boot code, wherein the secure boot code causes the private key derivation logic to generate a message signing private key using a combination of the trust anchor and the one or more embedded secret values, causes the public key derivation logic of the first electronic circuit to generate a message signing public key that corresponds to the message signing private key, and stores the message signing private key in the first electronic circuit;
sending a challenge message to a second electronic circuit that is connected to a second computer system associated with a second entity;
receiving, from a second electronic circuit, a signed response message generated by the second electronic circuit, wherein the signed response message was generated using a message signing private key that was generated using the trust anchor and the one or more embedded secret values, which also are stored in the second electronic circuit, wherein the message signing private key used by the second electronic circuit is the same as the message signing private key generated by the first electronic circuit; and
verifying, by the first computer system, the signed response message using a message signing public key that was derived from the message signing private key.

13. T

Assignees

• Freescale Semiconductor Inc

Inventors

• Hartley David H
• Tkacik Thomas E
• Covey Carlin R
• Case Lawrence L
• Ziolkowski Rodney D

Classifications

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/0866 Primary

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L9/3247

  involving digital signatures · CPC title