Providing an authenticating service of a chip

Patent metadata

Field	Value
Publication number	US-9690927-B2
Application number	US-201514658611-A
Country	US
Kind code	B2
Filing date	Mar 16, 2015
Priority date	Dec 7, 2012
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

Embodiments of the present invention provide an authenticating service of a chip having an intrinsic identifier (ID). In a typical embodiment, an authenticating device is provided that includes an identification (ID) engine, a self-test engine, and an intrinsic component. The intrinsic component is associated with a chip and includes an intrinsic feature. The self-test engine retrieves the intrinsic feature and communicates it to the identification engine. The identification engine receives the intrinsic feature, generates a first authentication value using the intrinsic feature, and stores the authentication value in memory. The self-test engine generates a second authentication value using an authentication challenge. The identification engine includes a compare circuitry that compares the first authentication value and the second authentication value and generates an authentication output value based on the results of the compare of the two values.

First claim

What is claimed is:

1. A system for providing an authenticating service of a chip, the system comprising:
an authentication device comprising an identification engine, a self-test engine, and an intrinsic component associated with a chip that is unique to the chip, results from manufacturing variability, and has an intrinsic feature;
the self-test engine configured to retrieve the intrinsic feature and communicate the intrinsic feature to the identification engine;
the identification engine further configured to receive the intrinsic feature, generate a first authentication value using the intrinsic feature, and store the authentication value in memory;
the self-test engine further configured to generate a second authentication value using an authentication challenge, wherein the authentication challenge is based on an address domain in the intrinsic component,
the self-test engine further configured to adjust a word line voltage for a plurality of DRAM cells in order to generate a specified fail count of a subset of DRAM cells from the plurality of DRAM cells, generate a vector pattern corresponding to the subset of DRAM cells, and store the vector fail pattern in a register, and wherein the intrinsic feature is a bit pattern generated from the specified fail count;
the identification engine further comprising a compare circuitry configured to compare the first authentication value and the second authentication value; and
the compare circuitry further configured to generate an authentication output value based on the results of the compare of the first authentication value and the second authentication value.

2. The system according to claim 1 , wherein the authentication device is embedded on the chip or the authentication device and the chip are integrated on a board.

3. The system according to claim 1 , further comprising a database configured to control the authentication challenge and store the authentication challenge and an extrinsic feature of the authentication device, wherein the extrinsic feature is associated with the intrinsic component.

4. The system according to claim 1 , wherein the intrinsic feature comprises a matrix of values, wherein a subset of the matrix of values is an intrinsic feature subset.

5. The system according to claim 4 , wherein the authentication challenge further comprises a location for each matrix value within the intrinsic feature subset.

6. The system according to claim 1 , further comprising a plurality of authentication challenges.

7. The system according to claim 3 , wherein the database confirms a string of authentication output values, from the authentication device, and generates an authentication output result.

8. The system according to claim 7 , wherein the confirmation process includes at least one authentication output value from the authentication device corresponding to a match between the 1 st authentication value and 2 nd authentication value, and at least one authentication output value corresponds to a mismatch between the two.

9. The system according to claim 1 , wherein the authentication challenge comprises a location challenge.

10. The system according to claim 1 , wherein the authentication challenge comprises at least one of an identification (ID) challenge or memory challenge.

11. A method for providing an authenticating service of a chip, the method comprising:
retrieving an intrinsic feature associated with a chip at a self-test engine, wherein the intrinsic feature is derived from an intrinsic component that is unique to the chip and results from manufacturing variability, wherein the intrinsic component is derived by:
adjusting a word line voltage for a plurality of DRAM cells in order to generate a specified fail count of a subset of DRAM cells from the plurality of DRAM cells,
generating a vector pattern corresponding to the subset of DRAM cells, and
storing the vector pattern in a fail register, wherein the intrinsic feature is a bit pattern generated from the specified fail count;

receiving the intrinsic feature at an identification engine;
generating a first authentication value using the intrinsic feature at the identification engine;
storing the first authentication value in memory;
generating a second authentication value at the self-test engine using an authentication challenge, wherein the authentication challenge is based on an address domain in the intrinsic component;
comparing the first authentication value and the second authentication value at a compare circuitry; and
generating an authentication output value at the compare circuitry based on the results of the compare of the first authentication value and the second authentication value.

12. The method according to claim 11 , wherein the authentication device is embedded on the chip or the authentication device and the chip are integrated on a board.

13. The method according to claim 11 , further comprising controlling the authentication challenge at a database and storing the first authentication challenge and an extrinsic feature of the authentication device, wherein the extrinsic feature is associated with the intrinsic component.

14. The method according to claim 11 , wherein the intrinsic feature comprises a matrix of values, wherein a subset of the matrix of values is an intrinsic feature subset.

15. The method according to claim 14 , wherein the authentication challenge further comprises a location for each matrix value within the intrinsic feature subset.

16. The method according to claim 11 , further comprising a plurality of authentication challenges.

17. The method according to claim 13 , wherein the database confirms a string of authentication output values, from the authentication device, and generates an authentication output result.

18. The method according to 17 , wherein the confirmation process includes at least one authentication output value from the authentication device corresponding to a match between the 1 st authentication value and 2 nd authentication value, and at least one authentication output value corresponds to a mismatch between the two.

19. The method according to claim 11 , wherein the authentication challenge comprises at least one of a location challenge, identification (ID) challenge, or memory challenge.

20. A method for deploying a system for providing an authenticating service of a chip, the system comprising:
authenticating device comprising an identification engine, a self-test engine, and an intrinsic component associated with a chip that is unique to the chip, results from manufacturing variability, and has an intrinsic feature;
the self-test engine configured to retrieve the intrinsic feature and communicate the intrinsic feature to the identification engine;
the identification engine further configured to receive the intrinsic feature, generate a first authentication value using the intrinsic feature, and store the authentication value in memory;
the self-test engine further configured to generate a second authentication value using an authentication challenge, wherein the authentication challenge is based on an address domain in the intrinsic component,
the self-test engine further configured to adjust a word line voltage for a plurality of DRAM cells in order to generate a specified fail count of a subset of DRAM cells from the plurality of DRAM cells, generate a vector pattern corresponding to the subset of DRAM cells, and store the vector pattern in a fail register, and wherein the intrinsic feature is a bit patt

Assignees

• IBM

Inventors

• Chellappa Srivatsan
• Iyer Subramanian S
• Kirihata Toshiaki
• Rosenblatt Sami

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• G11B20/00086

  Circuits for prevention of unauthorised reproduction or copying, e.g. piracy (indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00) · CPC title

• G06F21/30 Primary

  Authentication, i.e. establishing the identity or authorisation of security principals · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title