Tamper detection for hardware devices

Patent metadata

Field	Value
Publication number	US-9876645-B1
Application number	US-201514624480-A
Country	US
Kind code	B1
Filing date	Feb 17, 2015
Priority date	Feb 17, 2015
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

A manufacturer of computing equipment may generate a signature for computing equipment by measuring various attributes of the computing equipment, such as the impedance across circuits included in the computing equipment. Verification equipment may be provided to a recipient of the computing equipment. The verification equipment may be configured to generate a signature of the computing equipment over a physical connection between the verification equipment and the computing equipment. A determination may be made whether the computing equipment has been tamper with based at least in part on the signature generated by the manufacturer and the signature generated by the recipient.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
establishing a physical connection between a computing device and a verification device;
executing, by the verification device, a set of tests of the computing device, the set of tests configured to collect a set of measurements of properties of the computing device suitable for generating a signature of the computing device, the signature of the computing device based at least in part on a set of properties unique to the computing device that, when changed, indicates modification to the computing device, where at least one test of the set of tests comprising passing a waveform over the physical connection through a circuit of the computing device to measure an electrical property of the circuit;
obtaining a set of results corresponding to the set of tests;
determining the signature for the computing device based at least in part on the set of results; and
providing the signature to a recipient of the computing device to enable the recipient to verify the computing device.

2. The computer-implemented method of claim 1 , wherein the computer-implemented method further includes calibrating the verification device based at least in part on a standard determined by a manufacturer of the computing device.

3. The computer-implemented method of claim 1 , wherein the set of tests of the computing device further comprise a plurality of tests that, if executed by the verification device, each test passes waveform over the physical connection through a plurality of different circuits of the computing device to measure electrical properties of the computing device.

4. The computer-implemented method of claim 1 , wherein the computer-implemented method further includes determining a tolerance level for the signature, where the tolerance level indicates a range of values for the electrical property of the circuit associated with the signature.

5. A system, comprising:
at least one computer system configured to implement one or more services, wherein the one or more services are configured to:
perform a plurality of tests of a computing device to measure a plurality of attributes of the computing device, the plurality of tests measuring, over a physical connection between the system and the computing device, a plurality of attributes of the computing device that are unique to the computing device;
generate a signature based at least in part on a plurality of results, the signature being usable to detect unauthorized modifications to the computing device by determining whether the signature matches a signature of the computing device computed at a different time; and
provide the signature to a recipient of the computing device to enable the recipient to verify the computing device.

6. The system of claim 5 , wherein performing the plurality of tests of the computing device further comprises performing at least one memory test of the computing device in order to obtain information corresponding to a memory of the computing device.

7. The system of claim 5 , wherein the plurality of tests further comprises at least one configured to measure a frequency response to an applied signal.

8. The system of claim 5 , wherein the one or more services are further configured to generate the signature by at least combining the plurality of results.

9. The system of claim 5 , wherein the plurality of tests further comprises at least one configured to determine a weight of the computing device.

10. The system of claim 5 , wherein the one or more services are further configured to provide the signature to a recipient of the computing device in an electronic message.

11. The system of claim 5 , wherein the plurality of tests further comprises at least one configured to cause a processing unit of the computing device to perform a calculation and measure a latency in obtaining a result of the calculation.

12. The system of claim 5 , wherein the plurality of tests further comprises at least one configured to test executable code loaded into memory of the computing device.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
execute, by a verification device physically connected to a computing device, a plurality of tests of the computing device configured to determine a plurality of values corresponding to the computing device, where at least one value of the plurality of values is variable based at least in part on one or more attributes of the computing device;
generate a signature for the computing device based at least in part on the plurality of values; and
provide the signature to a recipient of the computing device to enable the recipient to verify the computing device.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the computer system to:
provide the signature to at least one other computer system, where the at least one other computer system includes a reference signature generated based at least in part on the computing device; and
receive from the at least one other computer system, an indication that the reference signature and the signature match.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to:
calculate a level of power consumption of the computing device; and
wherein generating the signature for the computing device is further based at least in the level of power consumption of the computing device.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to:
receive a reference signature generated based at least in part on the computing device;
verify the reference signature matches the signature; and
indicate whether the reference signature and the signature match.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to:
execute, by a verification device, a plurality of tests of the computing device; and
wherein generating the signature for the computing device further includes generating the signature based at least in part on a set of results obtained from the plurality of tests.

18. The non-transitory computer-readable storage medium of claim 13 , wherein:
the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to execute the test of the computing device over a plurality of executions; and
wherein generating the signature for the computing device further includes generating the signature based at least in part on a set of determined values corresponding to the plurality of executions of the test of the computing device.

19. The non-transitory computer-readable storage medium of claim 18 , wherein the instructions that cause the computer system to execute the test of the computing device further include instructions that cause the computer system to execute the test of the computing device a plurality of times, where at least a portion of the plurality of executions of the test pass a current over a different set of pins of the port then at least one other

Assignees

• Amazon Tech Inc

Inventors

• Ramalingam Harsha
• Johansson Jesper Mikael
• Mcclintock Jon Arron

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/645

  using a third party · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title