Secure mechanism for finite provisioning of an integrated circuit

This application discloses an electronic system including active circuitry configured to be selectively enabled for authorized number of times. The electronic system also includes security circuitry to detect an enablement event associated with the electronic system. The enablement event can correspond to reception of a reset signal associated with the electronic system, a lapse of a predetermined time period, or the like. In response to the detection of the enablement event, the security circuitry can determine a number of times the security circuitry has previously enabled the active circuitry. The security circuitry can generate the enablement signals capable of enabling the active circuitry when the determined number of times the security circuitry has previously enabled the active circuitry is fewer than the authorized number of times.

TECHNICAL FIELD

This application is generally related to electronic systems and, more specifically, to secured provisioning for an integrated circuit.

BACKGROUND

Circuit developers typically utilize a “design flow” to develop circuit designs representing electronic devices. The particular steps of the design flow often are dependent upon a type of electronic device to be manufactured, its complexity, the design team, and a fabricator or foundry that will manufacture integrated circuits implementing the electronic device. Typically, these circuit developers utilize software and hardware “tools” to help develop and verify the circuit design at various stages of the design flow. The circuit design at the end of the design stage is often specified as a layout design, for example, in a Graphic Database System II (GSDII) format or Open Artwork System Interchange Standard (OASIS) format.

Manufacturing of the integrated circuits based on the layout design can include several different phases, such as wafer fabrication, in-circuit testing, die cutting, wire bonding, device packaging, burn-in testing, device binning, and device marking, which can produce integrated circuit chips implementing the electronic device described in the circuit design. Since many circuit developers utilize third-party fabricators or foundries to manufacture integrated circuit chips, the lack of direct control over the manufacturing of the chips can lead to various manufacturing-related vulnerabilities, such as unauthorized (over)production and/or distribution of chips fabricated based on the layout designs, or the like.

Some circuit developers have attempted to combat these manufacturing-related vulnerabilities by initially locking or disabling manufactured integrated circuit chips, and providing an unlocking code or key to consumers having purchased the manufactured integrated circuit chips. Since part of the manufacturing process tests the integrated circuit chips while they are enabled, such as during the in-circuit testing and the burn-in testing, in order to perform this testing, the circuit developers would have to provide the unlocking code or key to the third-party fabricators or foundries.

SUMMARY

This application discloses provisioning for secured integrated circuits. The secured integrated circuits can be manufactured to include active circuitry and security circuitry. The security circuitry can be configured, for example, through an enrollment process, to enable the active circuitry for an authorized number of times, and disable the active circuitry after the authorized number of enablements has been exhausted. The security circuitry can selectively enable and disable the active circuitry in a system connected online or in a disconnected offline system. In some embodiments, the enrollment process can include receiving an enrollment message, for example, embedded in a test pattern provided to the secured integrated circuits during testing. The security circuitry can extract the enrollment message from the test pattern, for example, de-obfuscating it from the test pattern and/or decrypting the extracted enrollment message.

The security circuitry can analyze the enrollment message to determine whether to initiate the enrollment process. For example, the security circuitry can determine whether the enrollment message was accidentally or intentionally altered after generation. The security circuitry also can limit the enrollment process with the enrollment message depending on its own internal state, for example, when the security circuitry has already been enrolled or has already been enrolled a threshold number of times. During the enrollment process, in some embodiments, the security circuitry can configure its memory system, based on contents of the enrollment message.

The security circuitry can detect an enablement event associated with the electronic system, which can prompt the security circuitry to determine whether to enable or keep enabling the active circuitry. The enablement event can correspond to a reception of a reset signal associated with the secured integrated circuits, a lapse of a predetermined time period, or the like. In response to the detection of the enablement event, the security circuitry can determine a number of times the security circuitry has previously enabled the active circuitry, or if any of the authorized number of times (or enablement rations) remain unutilized. The security circuitry can generate the enablement signals capable of enabling the active circuitry when the determined number of times the security circuitry has previously enabled the active circuitry is fewer than the authorized number of times.

In some embodiments, the security circuitry also can receive a drain message, for example, via a test pattern input to the secured integrated circuits. The security circuitry, in response to the drain message, can re-configure the memory system, which can eliminate the ability of the security circuitry to enable the active circuitry. Embodiments will be described below in greater detail.

DETAILED DESCRIPTION

Illustrative Operating Environment

Various examples of the invention may be implemented through the execution of software instructions by a computing device101, such as a programmable computer. Accordingly,FIG. 1shows an illustrative example of a computing device101. As seen in this figure, the computing device101includes a computing unit103with a processing unit105and a system memory107. The processing unit105may be any type of programmable electronic device for executing software instructions, but will conventionally be a microprocessor. The system memory107may include both a read-only memory (ROM)109and a random access memory (RAM)111. As will be appreciated by those of ordinary skill in the art, both the read-only memory (ROM)109and the random access memory (RAM)111may store software instructions for execution by the processing unit105.

The processing unit105and the system memory107are connected, either directly or indirectly, through a bus113or alternate communication structure, to one or more peripheral devices117-123. For example, the processing unit105or the system memory107may be directly or indirectly connected to one or more additional memory storage devices, such as a hard disk drive117, which can be magnetic and/or removable, a removable optical disk drive119, and/or a flash memory card. The processing unit105and the system memory107also may be directly or indirectly connected to one or more input devices121and one or more output devices123. The input devices121may include, for example, a keyboard, a pointing device (such as a mouse, touchpad, stylus, trackball, or joystick), a scanner, a camera, and a microphone. The output devices123may include, for example, a monitor display, a printer and speakers. With various examples of the computing device101, one or more of the peripheral devices117-123may be internally housed with the computing unit103. Alternately, one or more of the peripheral devices117-123may be external to the housing for the computing unit103and connected to the bus113through, for example, a Universal Serial Bus (USB) connection.

With some implementations, the computing unit103may be directly or indirectly connected to a network interface115for communicating with other devices making up a network. The network interface115can translate data and control signals from the computing unit103into network messages according to one or more communication protocols, such as the transmission control protocol (TCP) and the Internet protocol (IP). Also, the network interface115may employ any suitable connection agent (or combination of agents) for connecting to a network, including, for example, a wireless transceiver, a modem, or an Ethernet connection. Such network interfaces and protocols are well known in the art, and thus will not be discussed here in more detail.

It should be appreciated that the computing device101is illustrated as an example only, and it not intended to be limiting. Various embodiments of the invention may be implemented using one or more computing devices that include the components of the computing device101illustrated inFIG. 1, which include only a subset of the components illustrated inFIG. 1, or which include an alternate combination of components, including components that are not shown inFIG. 1. For example, various embodiments of the invention may be implemented using a multi-processor computer, a plurality of single and/or multiprocessor computers arranged into a network, or some combination of both.

With some implementations of the invention, the processor unit105can have more than one processor core. Accordingly,FIG. 2illustrates an example of a multi-core processor unit105that may be employed with various embodiments of the invention. As seen in this figure, the processor unit105includes a plurality of processor cores201A and201B. Each processor core201A and201B includes a computing engine203A and203B, respectively, and a memory cache205A and205B, respectively. As known to those of ordinary skill in the art, a computing engine203A and203B can include logic devices for performing various computing functions, such as fetching software instructions and then performing the actions specified in the fetched instructions. These actions may include, for example, adding, subtracting, multiplying, and comparing numbers, performing logical operations such as AND, OR, NOR and XOR, and retrieving data. Each computing engine203A and203B may then use its corresponding memory cache205A and205B, respectively, to quickly store and retrieve data and/or instructions for execution.

Each processor core201A and201B is connected to an interconnect207. The particular construction of the interconnect207may vary depending upon the architecture of the processor unit105. With some processor cores201A and201B, such as the Cell microprocessor created by Sony Corporation, Toshiba Corporation and IBM Corporation, the interconnect207may be implemented as an interconnect bus. With other processor units201A and201B, however, such as the Opteron™ and Athlon™ dual-core processors available from Advanced Micro Devices of Sunnyvale, Calif., the interconnect207may be implemented as a system request interface device. In any case, the processor cores201A and201B communicate through the interconnect207with an input/output interface209and a memory controller210. The input/output interface209provides a communication interface to the bus113. Similarly, the memory controller210controls the exchange of information to the system memory107. With some implementations of the invention, the processor unit105may include additional components, such as a high-level cache memory accessible shared by the processor cores201A and201B. It also should be appreciated that the description of the computer network illustrated inFIG. 1andFIG. 2is provided as an example only, and it not intended to suggest any limitation as to the scope of use or functionality of alternate embodiments of the invention.

Secured Provisioning for an Integrated Circuit

FIG. 3illustrates an example of a system for design and manufacture of a secured integrated circuit device321according to various embodiments of the invention. Referring toFIG. 3, in a design development stage300, circuit developers can utilize a “design flow” to develop a secure circuit design304modeling an electronic device. The secure circuit design304can be a pattern layout design of the electronic device, for example, in a Graphic Database System II (GSDII) format, Open Artwork System Interchange Standard (OASIS) format, or the like. The circuit developers in the design development stage300can utilize one or more design automation tools303, which can be implemented as described above inFIGS. 1 and 2or implemented in a hardware deployment, to help develop and verify the secure circuit design304at various stages of the design flow.

The one or more design automation tools303can receive or internally develop a circuit design301describing active circuitry in the electronic device. The one or more design automation tools303also can receive or internally develop a security design302describing security circuitry capable of locking and/or enabling the active circuitry or portions thereof in the electronic device. The one or more design automation tools303can integrate the security design302with the circuit design301, which the one or more design automation tools303can transform in the design flow into the secured circuit design304. In some embodiments, the circuit design301and the security design302can model their respective circuitry at a register transfer level (RTL), a gate-level, a transistor-level, a layout design, or the like. At the register transfer level, the circuit design301and the security design302can model circuitry both in terms of an exchange of data signals between components in the electronic device, such as hardware registers, flip-flops, combinational logic, or the like, and in terms of logical operations that can be performed on the data signals in the electronic device, for example, with code in a hardware description language (HDL), such as Verilog, VHSIC (Very high speed integrated circuit) Hardware Design Language (VHDL), SystemC, or the like. At the gate-level, the circuit design301and the security design302can model circuitry as a network of devices, for example, in a gate-level netlist. At the transistor-level, the circuit design301and the security design302can model circuitry as a network of transistors, for example, with a Simulation Program with Integrated Circuit Emphasis (SPICE) circuit representation language.

The design development stage300also can include one or more test development tools305, such as an automatic test pattern generation (ATPG) tool, to develop a secure test program306. In some embodiments, the one or more test development tools305can be implemented in a computing environment, for example, as described above inFIGS. 1 and 2. The secure test program306, when executed by manufacturing equipment313in a manufacturing stage310, can direct manufacturing equipment313to input test patterns to an electronic device fabricated in the manufacturing stage310and, optionally, to log diagnostic information regarding the response of the electronic device to those test patterns.

The manufacturing stage310can include fabrication equipment312to fabricate an integrated circuit implementing the electronic device described in the secure circuit design304. For example, the fabrication equipment312can perform various semiconductor processing steps, such as deposition, etching or removal, patterning, and doping, which can build an electronic device on each die in a semiconductor wafer.

The manufacturing stage310can include the manufacturing equipment313to implement several different manufacturing phases, such as in-circuit testing, die cutting, wire bonding, device packaging, burn-in testing, device binning, device marking, or the like, the outcome of which produces an secured integrated circuit device321available for distribution. The in-circuit testing phase, for example, performed by Automatic Test Equipment (ATE) or the like, can implement the secure test program306to detect electrical defects in particular dies and optionally may be able to log diagnostic information about the detected defects that may be used to locate a source of a defect. The die cutting and wafer bonding phases can cut the wafer into individual die and attach bond wire to each of die having passed the in-circuit testing. The device packaging phase can encase the die implementing the electronic device into a supporting case or assembly, which forms the secured integrated circuit device321. The burn-in testing phase can exercise or stress the functionality of the components in the fabricated electronic device, for example, by forcing failures under supervised conditions. The device binning phase can allow the manufacturer to categorize integrated circuit devices according to their capabilities determined by the burn-in testing. The device marking phase can affix or ascribe physical marking corresponding to the categorization assigned during the device binning phase. In some embodiments, the physical marking can be adding paint or dye to the secured integrated circuit device321, or etching the integrated circuit, for example, through a laser etching process.

As will be discussed below in greater detail, the integrated circuits fabricated by the fabrication equipment312based on the secure circuit design304can be locked or disabled, for example, by security circuitry in the integrated circuits. The security circuitry in the integrated circuits can correspond to the security design302integrated into the secure circuit design304by the design automation tool(s)303.

The manufacturing equipment313can facilitate secured provisioning314of the integrated circuits. For example, the manufacturing equipment313can provide one or more messages to the integrated circuits, which can allow the security circuitry in the integrated circuits to temporarily unlock or enable portions of their active circuitry. The one or more messages may be embedded in test patterns generated via execution of the secure test program306, which the security circuitry in the integrated circuits can extract and utilize to perform the secured provisioning314of its active circuitry. In some embodiments, the messages generated via execution of the secure test program306can be encrypted or obfuscated in the test patterns, which the security circuitry in the integrated circuits can be configured to decrypt or de-obfuscate. Embodiments of secured provisioning with the security circuitry will be described below in greater detail.

FIG. 4illustrates an example secured integrated circuit device400including security circuitry500for rationed enablement according to various examples of the invention. Referring toFIG. 4, the secured integrated circuit device400can be manufactured according to a circuit design, and optionally packaged into a supporting case or assembly. The secured integrated circuit device400can include active circuitry410to perform the functionality described in the circuit design, and include security circuitry500configured to perform rationed enablement of the active circuitry410. For example, the active circuitry410can include registers or other logic to enable or disable portions of the active circuitry410based on enablement signals405generated by the security circuitry500. In some embodiments, the active circuitry410can be enabled or disabled by activating or deactivating a reset signal in the active circuitry410, altering power provided to portions of the active circuitry410, altering a clock signal provided to the active circuitry410, altering data paths in the active circuitry410, or the like.

The security circuitry500can enroll the secured integrated circuit device400for rationed enablement of the active circuitry410. The enrollment process can include configuring the security circuitry500to generate the enablement signals405, configuring the security circuitry500to detect enablement events capable of prompting the security circuitry500to generate the enablement signals405, setting a number of detected enablement events that the security circuitry500can respond to by generating the enablement signals405, a combination thereof, or the like.

The security circuitry500can perform enrollment based, at least in part, on an enrollment message401, for example, received in a test pattern generated by testing equipment in response to execution of a secure test program. The security circuitry500can include a security controller510to utilize the enrollment message401to configure a memory system520in the security circuitry500. The security controller510can utilize the configuration of the memory system520to determine when and how to generate and/or output the enablement signals405. In some embodiments, the memory system520can be configured without receiving the enrollment message401, for example, the memory system520can be configured during manufacture, configured automatically by the security controller510without receiving any messages, or the like.

After enrollment, the security circuitry500can perform rationed enablement of the active circuitry410in the secured integrated circuit device400. The security circuitry500can detect one or more enablement events, which can prompt the security controller510to utilize the configuration of the memory system520to determine whether to generate or change a state of the enablement signals405. These enablement events can include a toggle or state change of a reset signal403, lapsing of a period of time, for example, measured based on a clock signal404, during which the active circuitry410is enabled, or the like. The security controller510may receive the reset signal403from an external pin of the secured integrated circuit device400, other circuitry in the secured integrated circuit device400, or the like. The security controller510may receive the clock signal404from a clock generation circuitry in the secured integrated circuit device400, an external pin of the secured integrated circuit device400, or the like.

The security controller510also can receive a drain message402, for example, in a test pattern generated by testing equipment in response to execution of the secure test program. The security controller510, based on the drain message402, can reconfigure the memory system520, which can eliminate the ability of the security controller510to perform rationed enablement. For example, based on the drain message402, the security controller510can be configured to no longer detect enablement events, no longer respond to one or more detected enablement events by changing a state of the enablement signals405, no longer generate the enablement signals405with a state that can enable the active circuitry410, a combination thereof, or the like.

FIG. 5illustrates an example implementation of the security circuitry500described inFIG. 4. Referring toFIG. 5, the security circuitry500can include an interface device512to receive messages, such as an enrollment message401and/or a drain message402, in a test pattern from testing equipment. In some embodiments, the interface device512can communicate with the testing equipment or the like via a local connection, for example, utilizing a Joint Test Action Group (JTAG) protocol codified by one or more of Institute of Electrical and Electronics Engineers (IEEE) Standards 1149.1 or 1149.7. The interface device512, in some examples, can extract the messages from the test pattern and forward them to control circuitry514in the security controller510.

When the messages, such as the enrollment message401and/or the drain message402, are encrypted or obfuscated in the test pattern, the control circuitry514and/or cryptography circuitry516can decrypt, deobfuscate, or the like, the messages in the test pattern. The cryptography circuitry516, in some embodiments, can access a cryptography memory526of the memory system520to perform decryption, deobfuscation, or the like, of the message.

The cryptography circuitry516also can generate message authentication codes (MAC) from received messages, which the control circuitry514can compare against message authentication codes in received messages themselves. The control circuitry514can analyze the comparison of message authentication codes to detect accidental and intentional changes to the messages and also possibly confirm an origin of the messages. These message authentication codes can be a hash-based message authentication code (HMAC), a cipher-based message authentication code (CMAC), or the like.

The control circuitry514also can perform enrollment or drain operations based on the contents of the messages received from the interface device512. For example, when the control circuitry514receives the enrollment message401from the interface device512, the control circuitry514can direct a memory controller522in the memory system520to configure a test enablement memory524based, at least in part, on contents of the enrollment message401. As will be discussed below in greater detail, in some examples, the enrollment message401can include a key code, an enablement quantity, and a delta value as well as the aforementioned message authentication code. The control circuitry514can store information corresponding to the key code, the enablement quantity, and the delta value in the test enablement memory524.

In some embodiments, the test enablement memory524can be a one-time programmable (OTP) memory, or the like, where each bit in the memory starts in an initial state and can be irreversibly programmed or set by the memory controller522to a different state. The control circuitry514can configure the test enablement memory524by programming the test enablement memory524to include or represent the key code, the enablement quantity, the delta value, or the like. The key code can correspond to a value the security controller510can utilize to generate enablement signals405. In some embodiments, the key code can be encrypted or obfuscated in the test enablement memory524, which the control circuitry514and/or the cryptography circuitry516can decrypt or de-obfuscate.

In some embodiments, the test enablement memory524can include a section of memory, such that each bit in its initial state corresponds to a potential enablement event that the security controller510can respond to by generating enablement signals405. The control circuitry514can utilize the enablement quantity in the enrollment message401to configure the section of the test enablement memory524to include a number of bits in the initial state corresponding to a number identified in the enablement quantity. For example, if the section of the test enablement memory524can store 100 bit values and the enrollment message401includes an enablement quantity corresponding to70, the control circuitry514can prompt the memory controller522to program 30 bit values in the section of the test enablement memory524, leaving70in their initial state.

After enrollment, the security controller510can output the enablement signals405to the active circuitry. In some embodiments, the control circuitry514can set configuration registers518in the security controller510, and the configuration registers518, based on a state or settings of its registers, can output the enablement signals405capable of disabling or enabling the active circuitry or portions thereof. The control circuitry514can utilize the key code stored in the test enablement memory524to set the configuration registers518with a state or setting capable of enabling the active circuitry or portions thereof. The key code can have a bit pattern that can be provided to the configuration registers518as a setting, or control circuitry514can utilize the key code to generate a setting for the configuration registers518. In other embodiments, the control circuitry514can utilize a disablement value stored in the test enablement memory524to set the configuration registers518with a state or setting capable of disabling the active circuitry or portions thereof.

The control circuitry514can set the configuration registers518with a state or setting capable of enabling the active circuitry, or portions thereof, a limited number of times and/or for a limited duration of time. In some embodiments, the control circuitry514can utilize enablement events as triggers to set the configuration registers518. The enablement events can include a toggle or state change of a reset signal403, lapsing of a period of time, for example, measured based on a clock signal404, during which the active circuitry is enabled, or the like. The control circuitry514can monitor the reset signal403, the clock signal404, the enablement signals405, the configuration of the test enablement memory524, or the like, to detect the enablement events. For example, the control circuitry514can detect a toggle in the reset signal403as an enablement event. In another example, the control circuitry514can monitor the clock signal404to determine when a period of time—corresponding to the delta in the enrollment message401—has lapsed.

In response to detecting an enablement event, the control circuitry514can utilize the test enablement memory524to determine whether the security controller510can respond to the detected enablement event by generating enablement signals405. Since the test enablement memory524was configured during enrollment with a finite number of potential enablement events that the security controller510could respond to by generating enablement signals405, the control circuitry514can access the test enablement memory524to determine whether its configuration indicates a presence of at least one of the potential enablement events. As discussed above, in some embodiments, the test enablement memory524can store records of the potential enablement events by leaving memory cells in a predetermined portion of the test enablement memory524unset or unprogrammed.

When the control circuitry514determines that the test enablement memory524includes a record corresponding to at least one potential enablement event, the control circuitry514can program one of the memory cells in a predetermined portion of the test enablement memory524and set the configuration registers518with a state or setting capable of enabling the active circuitry or portions thereof. When the control circuitry514determines that the test enablement memory524does not include a record corresponding to at least one potential enablement event, the control circuitry514can set the configuration registers518with a state or setting capable of disabling the active circuitry or portions thereof. In some embodiments, when the control circuitry514determines that the test enablement memory524does not include a record corresponding to at least one potential enablement event, the control circuitry514also may reconfigure the test enablement memory524to remove the key code, enablement quantity, delta value, modify a chip state, or the like, which may also be performed in response to receiving a drain message402from the interface device512. For example, when the test enablement memory524is a one-time programmable memory, the control circuitry514can program one or more of the memory cells in the test enablement memory524to remove the key code, enablement quantity, delta value, modify a chip state.

FIGS. 6 and 7illustrate example enrollment of a manufactured chip601for rationed enablement according to various embodiments of the invention. Referring toFIG. 6, the manufactured chip601can receive an enrollment message610from a testing system603. In some embodiments, the enrollment message610can be integrated into a test pattern or test message that the testing system603generated in response to execution of a test program604. In some embodiments, some equipment in the testing system603can be implemented in a computing environment, for example, as described above inFIGS. 1 and 2.

The manufactured chip601can include security circuitry602to extract the enrollment message610from the test pattern, for example, decrypting or deobfuscating the enrollment message610in the process. The enrollment messages610can include multiple fields, such as a key code611, an enablement quantity612, a delta value613, a message authentication code614, or the like. The key code611can identify a state or setting capable of enabling the active circuitry or portions thereof. The enablement quantity612can identify a ration value or a number of times the security circuitry602can utilize the key code611to generate signaling with the state capable of enabling the active circuitry or portions thereof. The delta value613or time quota can correspond to a time period or other resource measurement for the manufactured chip601, such as chip restarts, a power consumption measurement, an operating temperature measurement, a chip aging effect measurement, a memory access counter, a processor event counter, or the like. The security circuitry602can utilize the delta value613to determine when to consume a ration defined by the enablement quantity612. The security circuitry602can utilize the delta value613while the security circuitry602is outputting the signaling with the state capable of enabling the active circuitry or portions thereof. The message authentication code614can correspond to a value generated from at least a portion of the enrollment message610prior to transmission of the enrollment message610to the security circuitry602. In some embodiments, the message authentication code614can be a hash-based message authentication code (HMAC), a cipher-based message authentication code (CMAC), or the like.

The security circuitry602can utilize the enrollment message610to populate portions of a test enablement memory620included in the security circuitry602. Prior to populating the test enablement memory620, the security circuitry610can analyze the enrollment message610and/or the test enablement memory620to determine whether to utilize the enrollment message610to populate the test enablement memory620.

The security circuitry602can include enrollment circuitry630to determine whether the test enablement memory620can be configured by the security circuitry602during enrollment. For example, the security circuitry602may be configured to allow limited enrollment, such as a one-time enrollment, of the test enablement memory620. The enrollment circuitry630can determine whether the test enablement memory620has been previously enrolled, a number of times it has been enrolled, or the like.

If a state of the test enablement memory620indicates that a future enrollment of the test enablement memory620would exceed the limited enrollment authorized by the security circuitry602, the enrollment circuitry630can take action to ensure the test enablement memory620does not become re-enrolled. In some embodiments, the enrollment circuitry630can perform at least one logical operation on the enrollment message610, such as XOR the enrollment message610with data stored in the test enablement memory620. For example, the enrollment circuitry630can perform an operation on the key code611, the enablement quantity612, and/or the delta value613from the enrollment message610based on one or more portions of the test enablement memory620. When the test enablement memory620has a state or stored values that do not allow for enrollment or re-enrollment, the enrollment circuitry630can alter the key code611, the enablement quantity612, and/or the delta value613. In some embodiments, the enrollment circuitry630can alter the message authentication code614rather than the key code611, the enablement quantity612, and/or the delta value613, which can cause the security circuitry602to ensure the test enablement memory620does not become enrolled or re-enrolled in response to the enrollment message610.

In some embodiments, the test enablement memory620can store a chip state621, a tank state622, a delta value623, a quantity624, an identifier625, and a key code626. For example, the chip state621can identify whether the manufactured chip601has been previously enrolled. The tank state622can be a value configured to identify whether the manufactured chip601has utilized its rations corresponding to an enablement quantity to enable active circuitry in the manufactured chip601. If the test enablement memory620has been enrolled, the delta value623, quantity624, and key code626can identify information from the enrollment message utilized during the enrollment, such as the delta value613, the enablement quantity612, and the key code611from the enrollment message610. The identifier625can be a value configured to distinguish the manufactured chip601from other manufactured chips.

The security circuitry610can include cryptography circuitry640to generate a message authentication code from the output from the enrollment circuitry630. In some embodiments, the enrollment circuitry630can output an unaltered version of the enrollment message610to the cryptography circuitry640. In other embodiments, the enrollment circuitry630can output an altered version of the enrollment message610to the cryptography circuitry640, for example, with the message authentication code614altered based on the state of the test enablement memory620.

The security circuitry610can include comparison circuitry650to compare the message authentication code614in the received enrollment message610against the message authentication code generated by the cryptography circuitry640. The security circuitry602can analyze the comparison of message authentication codes to detect accidental and intentional changes to the enrollment message610. When the message authentication codes match, the security circuitry602can utilize the enrollment message610to enroll the manufactured chip601, for example, by populating and configuring portions of the test enablement memory620based on contents in the enrollment message610. When the message authentication codes do not match, the security circuitry602can elect to not initiate the enrollment process based on the received enrollment message610.

Referring toFIG. 7, in a block701, security circuitry in a chip can receive an enrollment message configured to enroll the chip for rationed enablement. In some embodiments, the security circuitry can receive the enrollment message in a test pattern from testing equipment. The security circuitry can communicate with the testing equipment or the like via a local connection, for example, utilizing a Joint Test Action Group (JTAG) protocol codified by one or more of Institute of Electrical and Electronics Engineers (IEEE) Standards 1149.1 or 1149.7. When the enrollment message is encrypted or obfuscated in the test pattern, the security circuitry can decrypt, deobfuscate, or the like, the enrollment message in the test pattern.

In a block702, the security circuitry can determine whether enrollment of the chip based on the enrollment message, would exceed an enrollment limit for the chip. In some embodiments, the security circuitry can include a memory system capable of storing a chip state, which can indicate whether the chip has been previously enrolled. When the security circuitry allows multiple enrollments of the chip, the chip state in the memory system can identify how many times the chip has been previously enrolled.

When the security circuitry, based on the chip state, determines that enrolling the chip would exceed the enrollment limit for the chip, the security circuitry can end the enrollment process. In some embodiments, the security circuitry can end the enrollment process by altering the enrollment message, for example, by altering the key code, enablement quantity, delta value, and/or the message authentication code in the enrollment message, to ensure that the enrollment message does not pass a subsequent authentication process performed by the security circuitry.

When the security circuitry, based on the chip state, determines that enrolling the chip would not exceed the enrollment limit for the chip, execution can proceed to a block703, where the security circuitry can determine whether the enrollment message is authentic. The enrollment message can include a message authentication code, such as a hash-based message authentication code (HMAC), a cipher-based message authentication code (CMAC), or the like. The security circuitry can generate a message authentication code from a portion of the enrollment message and compare the generated message authentication code against the message authentication code included in the message to determine whether the enrollment message was accidentally or intentionally altered. When the security circuitry determines the message authentication codes do not match, the security circuitry can end the enrollment process.

When the security circuitry determines the message authentication codes do match, execution can proceed to a block704, where the security circuitry can enroll the chip with contents in the enrollment message. In some embodiments, the enrollment message can include a key code, an enablement quantity, and a delta value as well as the aforementioned message authentication code. The security circuitry can store information corresponding to the key code, the enablement quantity, and the delta value in the memory system, thus enrolling the security circuitry to perform rationed enablement of active circuitry in the chip.

FIGS. 8 and 9illustrate example rationed enablement of a manufactured chip according to various examples of the invention. Referring toFIG. 8, the manufactured chip can include security circuitry800capable of performing rationed enablement of active circuitry in the manufactured chip, for example, in response to detection of an enablement event. The security circuitry800can utilize a configuration of a test enablement memory820to generate enablement signals851that, when provided to the active circuitry in the manufactured chip, can enable or disable the active circuitry.

In some embodiments, the test enablement memory820can store a chip state821, a tank state822, a delta value823, a quantity824, an identifier825, and a key code826. For example, the chip state821can identify whether a manufactured chip that includes the test enablement memory820has been previously enrolled. The tank state822can be a value configured to identify whether the manufactured chip has utilized its rations corresponding to an enablement quantity to enable active circuitry in the manufactured chip. If the test enablement memory820has been enrolled, the delta value823, quantity824, and key code826can identify information from the enrollment message utilized during the enrollment. The identifier825can be a value configured to distinguish the manufactured chip from other manufactured chips.

The security circuitry800can include cryptography circuitry840to decrypt the output value from the enablement circuitry830, for example, to generate a setting for configuration registers850. The cryptography circuitry840can load the setting into the configuration registers850, which the configuration registers850can utilize to generate the enablement signals851.

Referring toFIG. 9, in a block901, security circuitry in a chip can detect an enablement event associated with the chip. In some embodiments, the security circuitry can monitor a reset signal of the chip, a clock signal for the chip, or the like to detect the enablement event. For example, the security circuitry can detect a toggle in the reset signal as an enablement event. In another example, while the security circuitry has been enabling active circuitry in the chip, the security circuitry can monitor the clock signal to detect an enablement event when a period of time has lapsed. In some embodiments, the security circuitry can monitor power cycles, monitor an age of the chip, monitor memory accesses, or the like, to detect an enablement event.

In a block902, the security circuitry can determine whether the chip has been previously enrolled for rationed enablement. In some embodiments, the security circuitry can include a memory system capable of being configured for rationed enablement during enrollment. The memory system can include data corresponding to a chip state, which can identify whether the chip has been enrolled or not. The security circuitry can read the chip state from the memory system to determine whether the chip has been previously enrolled for rationed enablement. When the chip has not been enrolled for rationed enablement, the security circuitry can end a rationed enablement process.

When the chip has been enrolled for rationed enablement, execution can proceed to a block903, where the security circuitry can determine whether the chip has any enablement rations remaining from the enrollment. The enrollment of the chip for rationed enablement can configure the security circuitry with an authorized number of times that the security circuitry can enable active circuitry in the chip. After each time the security circuitry determines to enable the active circuitry via the enablement process, the security circuitry can decrement the authorized number or otherwise consume a ration available to the security circuitry. In some embodiments, the memory system in the security circuitry can include a section of memory, such that each bit in its initial state can correspond to a different enablement ration. During enrollment, the memory system can be configured to leave the authorized number of bits in their initial state. The security circuitry, after determining to enable the active circuitry, can program one of the bits into a new state, which can consume one enablement ration.

In a block904, the security circuitry can enable active circuitry in the chip, for example, by outputting enablement signals having a state capable of enabling the active circuitry in the chip. In some embodiments, the security circuitry can utilize a key code stored in the memory system during enrollment to generate a setting for configuration registers in the security circuitry. The configuration registers can utilize the setting to set a state of the enablement signals provided to the active circuitry.

The system and apparatus described above may use dedicated processor systems, micro controllers, programmable logic devices, microprocessors, or any combination thereof, to perform some or all of the operations described herein. Some of the operations described above may be implemented in software and other operations may be implemented in hardware. Any of the operations, processes, and/or methods described herein may be performed by an apparatus, a device, and/or a system substantially similar to those as described herein and with reference to the illustrated figures.

The processing device may execute instructions or “code” stored in memory. The memory may store data as well. The processing device may include, but may not be limited to, an analog processor, a digital processor, a microprocessor, a multi-core processor, a processor array, a network processor, or the like. The processing device may be part of an integrated control system or system manager, or may be provided as a portable electronic device configured to interface with a networked system either locally or remotely via wireless transmission.

The processor memory may be integrated together with the processing device, for example RAM or FLASH memory disposed within an integrated circuit microprocessor or the like. In other examples, the memory may comprise an independent device, such as an external disk drive, a storage array, a portable FLASH key fob, or the like. The memory and processing device may be operatively coupled together, or in communication with each other, for example by an I/O port, a network connection, or the like, and the processing device may read a file stored on the memory. Associated memory may be “read only” by design (ROM) by virtue of permission settings, or not. Other examples of memory may include, but may not be limited to, WORM, EPROM, EEPROM, FLASH, NVRAM, OTP, or the like, which may be implemented in solid state semiconductor devices. Other memories may comprise moving parts, such as a known rotating disk drive. All such memories may be “machine-readable” and may be readable by a processing device.

Operating instructions or commands may be implemented or embodied in tangible forms of stored computer software (also known as “computer program” or “code”). Programs, or code, may be stored in a digital memory and may be read by the processing device. “Computer-readable storage medium” (or alternatively, “machine-readable storage medium”) may include all of the foregoing types of memory, as well as new technologies of the future, as long as the memory may be capable of storing digital information in the nature of a computer program or other data, at least temporarily, and as long at the stored information may be “read” by an appropriate processing device. The term “computer-readable” may not be limited to the historical usage of “computer” to imply a complete mainframe, mini-computer, desktop or even laptop computer. Rather, “computer-readable” may comprise storage medium that may be readable by a processor, a processing device, or any computing system. Such media may be any available media that may be locally and/or remotely accessible by a computer or a processor, and may include volatile and non-volatile media, and removable and non-removable media, or any combination thereof.

A program stored in a computer-readable storage medium may comprise a computer program product. For example, a storage medium may be used as a convenient means to store or transport a computer program. For the sake of convenience, the operations may be described as various interconnected or coupled functional blocks or diagrams. However, there may be cases where these functional blocks or diagrams may be equivalently aggregated into a single logic device, program or operation with unclear boundaries.

CONCLUSION

While the application describes specific examples of carrying out embodiments of the invention, those skilled in the art will appreciate that there are numerous variations and permutations of the above described systems and techniques that fall within the spirit and scope of the invention as set forth in the appended claims. For example, while specific terminology has been employed above to refer to certain processes, it should be appreciated that various examples of the invention may be implemented using any desired combination of processes.

One of skill in the art will also recognize that the concepts taught herein can be tailored to a particular application in many other ways. In particular, those skilled in the art will recognize that the illustrated examples are but one of many alternative implementations that will become apparent upon reading this disclosure.

Although the specification may refer to “an”, “one”, “another”, or “some” example(s) in several locations, this does not necessarily mean that each such reference is to the same example(s), or that the feature only applies to a single example.