Secure provisioning of secret keys during integrated circuit manufacturing

Patent metadata

Field	Value
Publication number	US-9742563-B2
Application number	US-201213631512-A
Country	US
Kind code	B2
Filing date	Sep 28, 2012
Priority date	Sep 28, 2012
Publication date	Aug 22, 2017
Grant date	Aug 22, 2017

Abstract

A method, of an aspect, includes challenging a set of Physically Unclonable Function (PUF) cells, of an integrated circuit device, and receiving a set of PUF bits from the PUF cells in response. A PUF key is generated based on the set of PUF bits. An encryption of the PUF key with an embedded key is output from the integrated circuit device. The integrated circuit device receives an encryption of a fuse key with the PUF key. Fuses of the integrated circuit device are programmed with at least one of the fuse key and the received encryption of the fuse key with the PUF key. Other methods, apparatus, and systems are also disclosed.

First claim

What is claimed is:

1. A method comprising:
applying one or more electrical signals to a set of Physically Unclonable Function (PUF) cells, of an integrated circuit device, and receiving a set of PUF bits from the PUF cells in response;
generating a PUF public key and a PUF secret key based on the set of PUF bits; and
outputting, from the integrated circuit device, an encryption of the PUF public key with an embedded key, to a first manufacturing equipment, which is one of (1) a tester and prober and (2) test and debug equipment, through electrical probes of the first manufacturing equipment that are in contact with electrical contacts of the integrated circuit device, which are at least one of pads, bumps, solder material, and pins of the integrated circuit device;
receiving, at the integrated circuit device, a public key encryption of a fuse key with the PUF public key from electrical probes of a second manufacturing equipment that are in contact with the electrical contacts of the integrated circuit device, which are said at least one of the pads, the bumps, the solder material, and the pins, wherein the second manufacturing equipment is one of (1) a tester and prober and (2) test and debug equipment, and wherein the first and second manufacturing equipment are at different locations;
decrypting the public key encryption of the fuse key with the PUF public key using the PUF secret key; and
programming fuses of the integrated circuit device with at least one of the fuse key and the received encryption of the fuse key with the PUF key at a time of manufacture of the integrated circuit device.

2. The method of claim 1 , wherein generating the PUF public key comprises generating the PUF public key from the set of PUF bits.

3. The method of claim 1 , further comprising accessing the embedded key from at least one of a read only memory (ROM), a resistor-transistor logic (RTL), a set of tie-ups, and a set of tie-downs.

4. The method of claim 1 , wherein outputting comprises outputting a public key encryption of the PUF public key with an embedded public key.

5. The method of claim 1 , wherein the outputting is performed at a first stage of the manufacture of the integrated circuit device and the receiving is performed at a second, different stage of the manufacture of the integrated circuit device.

6. The method of claim 1 , further comprising, after receiving the public key encryption of the fuse key with the PUF public key, sending an authentication message to authenticate at least one of the fuse key and the received public key encryption of the fuse key.

7. An integrated circuit device comprising:
a set of Physically Unclonable Function (PUF) cells to provide a set of PUF bits in response to a stimuli;
PUF key generation logic coupled with the set of PUF cells to generate a PUF public key and a PUF secret key based on the set of PUF bits;
an embedded key;
encryption logic coupled with the embedded key and the PUF key generation logic, the encryption logic to generate an encryption of the PUF public key with the embedded key;
decryption logic coupled with the PUF key generation logic to decrypt an encryption of a fuse key with the PUF public key by using the PUF secret key; and
a plurality of fuses to be programmed with at least one of the encryption of the fuse key with the PUF public key and the fuse key.

8. The integrated circuit device of claim 7 , wherein the PUF key generation logic is to generate the PUF public key and the PUF secret key by using PUF bits.

9. The integrated circuit device of claim 7 , wherein the embedded key is implemented in at least one of read only memory (ROM), resistor-transistor logic (RTL), metal tie-ups, and metal tie-downs.

10. The integrated circuit device of claim 7 , wherein the decryption logic is to decrypt a public key encryption of the fuse key with the PUF public key by using the PUF secret key.

11. The integrated circuit device of claim 7 , wherein the encryption logic is to perform a public key encryption of the PUF public key with an embedded public key.

12. The integrated circuit device of claim 7 , wherein the integrated circuit device is to output the encryption of the PUF public key with the embedded key to a first manufacturing equipment at a first stage of manufacture, and wherein the integrated circuit device is to receive the encryption of the fuse key with the PUF public key from a second, different manufacturing equipment at a second, different stage of manufacture.

13. The integrated circuit device of claim 7 , wherein the fuses are to be programmed with the received encryption of the fuse key with the PUF public key.

14. A system comprising:
an integrated circuit device, the integrated circuit device comprising:
a set of Physically Unclonable Function (PUF) cells to provide a set of PUF bits in response to one or more electrical signals;
PUF key generation logic coupled with the set of PUF cells to generate a PUF public key and a PUF secret key based on the set of PUF bits;
an embedded key;
encryption logic coupled with the embedded key and the PUF key generation logic, the encryption logic to generate an encryption of the PUF public key with the embedded key;
decryption logic coupled with the PUF key generation logic to decrypt an encryption of a fuse key with the PUF public key by using the PUF secret key; and
a plurality of fuses; and
manufacturing equipment coupled with the integrated circuit device, wherein the manufacturing equipment is one of (1) a tester and prober and (2) test and debug equipment that has at least one probe and is also operative to communicate with a secure key provisioning system, the manufacturing equipment to program the plurality of fuses with at least one of the fuse key and the encryption of the fuse key with the PUF public key, wherein the manufacturing equipment is not to be coupled with the integrated circuit device until a manufacture stage after the encryption of the PUF public key with the embedded key has been transmitted from the integrated circuit device.

15. The system of claim 14 , wherein the encryption logic is to perform a public key encryption of the PUF public key with an embedded public key.

16. A method comprising:
applying one or more electrical signals to a set of Physically Unclonable Function (PUF) cells, of an integrated circuit device, and receiving a set of PUF bits from the PUF cells in response;
outputting, from the integrated circuit device, an encryption of a first public key which is to have been derived from the PUF bits with an embedded key, to a first manufacturing equipment, through electrical probes of the first manufacturing equipment that are in contact with electrical contacts of the integrated circuit device, which are at least one of pads, bumps, solder material, and pins of the integrated circuit device;
receiving, at the integrated circuit device, a public key encryption of a fuse key with the first public key from electrical probes of a second manufacturing equipment that are in contact with the electrical contacts of the integrated circuit device, which are said at least one of the pads, the bumps, the solder material, and the pins, wherein the first and second manufacturing equipment are at different locations; and
decrypting the public key encryption of the fuse key with the first public key using a secret key which is to have been derived from the PUF bits; and
programming fuses of the integrated circuit device with at least one of the fuse key and the received encryption of the fuse key with the first public key at a time of manufacture of the

Assignees

• Intel Corp

Inventors

• Gotze Kevin C
• Iovino Gregory M
• Li Jiangtao

Classifications

• G09C1/00

  Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) · CPC title

• H04L9/0866 Primary

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/3278

  using physically unclonable functions [PUF] · CPC title

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title