System and method for product registration

Patent metadata

Field	Value
Publication number	US-9692737-B2
Application number	US-71186507-A
Country	US
Kind code	B2
Filing date	Feb 28, 2007
Priority date	Feb 28, 2006
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

A system and method for controlling a production process for producing a product is provided in which overproduction may be inhibited by introducing a separation of duties within a production process. Typically a producer will contract out the various stages of a production process to multiple contractors. In general, separation of duties involves purposefully separating production stages, for silicon chips or other products, so that the end product has been handled or “touched”, by each subcontractor, in order for the end product to be fully functional.

First claim

What is claimed is:

1. A system for providing a cryptographic key to an electronic device during manufacturing of the electronic device, the system comprising:
a controller external in a remote location to the electronic device; a first server external to the electronic device and the controller; and at least a second server external to the electronic device and the controller; wherein the controller is configured to:
divide the cryptographic key into a plurality of portions, all of which are required for use of the cryptographic key and to be added to the electronic device, and wherein the electronic device is operable after all portions from the plurality of portions of the cryptographic key have been added to the electronic device;
in response to receiving a provisioning request generated by the first server, send a provisioning response to the first server, wherein the provisioning request comprises identifying information of a module in the first server, wherein the identifying information comprises a unique identifier of the module in the first server, and wherein the unique identifier identifies that module during distribution of the first subset of portions from the plurality of portions of the cryptographic key;
distribute a first subset of portions from the plurality of portions of the cryptographic key to the first server and a second subset of portions from the plurality of portions of the cryptographic key to the second server; and
receive, from each of the first server and the second server, a log report indicative of addition of the first subset of portions from the plurality of portions of the cryptographic key and the second subset of portions from the plurality of portions of the cryptographic key, respectively, to the electronic device; and
wherein the first server is configured to authorize the first subset of portions form the plurality of portions to be added to the electronic device,
and wherein the second server is configured to authorize the second subset of portions to be added to the electronic device.

2. The system according to claim 1 , wherein the controller and the first server are communicatively coupled via a secure connection over a network.

3. The system according to claim 1 , further comprising one or more subsequent servers, wherein the controller is further configured to receive log reports indicative of addition of respective portions of the cryptographic key to the electronic device by respective ones of the one or more subsequent servers.

4. The system according to claim 1 , wherein the electronic device comprises an integrated circuit (IC).

5. The system according to claim 4 , wherein the IC is configured to receive one or more of the portions of the cryptographic key.

6. The system according to claim 1 , wherein the electronic device includes a mathematical transform module configured to intercept and transform data flow in the electronic device using the cryptographic key, and wherein the mathematical transform module includes at least a cryptographic transform.

7. The system according to claim 6 , wherein the cryptographic transform uses at least one exclusive-or (XOR) operation.

8. The system according to claim 1 , wherein the controller is further configured to:
in response to receiving a provisioning request generated by the first server, send a provisioning response to the first server, wherein the provisioning request comprises identifying information of a module in the first server, wherein the identifying information comprises a serial number of the module in the first server, and wherein the serial number identifies that module during distribution of the first subset of portions from the plurality of portions of the cryptographic key.

9. The system according to claim 8 , wherein the provisioning response comprises a token ID associated with the first server.

10. The system according to claim 9 , wherein the provisioning response further includes information for establishing a secure connection between the controller and the first server.

11. The system according to claim 1 , further comprising one or more subsequent servers, wherein the controller is further configured to send at least another portion of the cryptographic key to the one or more subsequent servers.

12. The system according to claim 1 , further comprising one or more subsequent servers, wherein the controller is further configured to send out remaining portions of the cryptographic key to respective ones of one or more subsequent servers.

13. The system according to claim 12 , wherein the electronic device is only operable after all of the portions of the cryptographic key have been added to the electronic device by the at least first server, the at least second server, and the one or more subsequent servers.

14. A controller configured to provide a cryptographic key, in a plurality of portions, to a plurality of servers, wherein the controller is external in a remote location to an electronic device and at least a first server of the plurality of servers, the controller comprising:
a non-transitory memory; and
a processor coupled to the non-transitory memory, the processor configured to:
divide the cryptographic key into the plurality of portions, all of which are required for use of the cryptographic key by the electronic device and all of which are to be added to the electronic device, and wherein the electronic device is operable after all portions from the plurality of portions of the cryptographic key have been added to the electronic device;
in response to receiving a provisioning request that is generated by the first server of the plurality servers, send a provisioning response to the first server, wherein the provisioning request comprises identifying information of a module in the first server, wherein the identifying information comprises a unique identifier of the module in the first server, and wherein the unique identifier identifies that module during distribution of the first subset of portions from the plurality of portions of the cryptographic key;
distribute a first subset of portions from the plurality of portions of the cryptographic key to the first server and a second subset of portions from the plurality of portions of the cryptographic key to at least a second server of the plurality of servers; and
receive, from each of first server and the second server, a log report indicative of addition of the first subset of portions from the plurality of portions of the cryptographic key and the second subset of portions from the plurality of portions of the cryptographic key, respectively, to the electronic device,
wherein the first server is configured to authorize the first subset of portions form the plurality of portions to be added to the electronic device, and
wherein the second server is configured to authorize the second subset of portions to be added to the electronic device.

15. The controller according to claim 14 , wherein the controller and the first server are communicatively coupled via a secure connection over a network.

16. The controller according to claim 14 , wherein the processor is further configured to receive log reports indicative of addition of respective portions of the cryptographic key to the electronic device by respective ones of one or more subsequent servers.

17. The controller according to claim 14 , wherein the electronic device includes a mathematical transform module configured to intercept and transform data flow in the electronic device using the cryptographic key, and wherein the mathematical transf

Assignees

• Walters Anthony J
• Neill Brian
• Rosati Tony
• Vadekar Ashok
• O'Loughlin Daniel
• Certicom Corp

Inventors

• Walters Anthony J
• Neill Brian
• Rosati Tony
• Vadekar Ashok
• O'Loughlin Daniel

Classifications

• G06F21/72 Primary

  in cryptographic circuits · CPC title

• H04L63/062 Primary

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06Q10/101

  Collaborative creation, e.g. joint development of products or services · CPC title