Apparatus and method for providing a public key for authenticating an integrated circuit

Disclosed is a method for providing a public key for authenticating an integrated circuit. In the method, the integrated circuit obtains a hardware key and an integrated circuit identifier. The integrated circuit generates a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine. The integrated circuit generates a private key and a corresponding public key using the derived key as an input to a deterministic function. The integrated circuit then provides the public key and the integrated circuit identifier to a partner service for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

BACKGROUND

Field

The present invention relates generally to authenticating an integrated circuit.

Background

The identity of an integrated circuit/system-on-a-chip (SoC) is known during manufacture, but after a device leaves the factory, it is a challenge to truly verify the identity of an SoC. The SoC may have a randomly generated hardware (HW) key set in fuses during manufacture (before integration in a device.). The HW key is accessible only to a trusted platform module (TPM) of the SoC.

A partner service may desire to securely identify and authenticate the SoC as a trusted device. However, the manufacturer of the SoC may not be willing to add or dedicate fuses for the partner service. In addition, the manufacturer is generally unwilling to reveal the HW key or reveal manufacturing details to the partner service. Also, the manufacturer desires to limit the number of time-consuming steps required during the manufacture of the SoC.

There is therefore a need for a technique for allowing a partner service to authenticate an integrated circuit/SoC without exposing sensitive information.

SUMMARY

An aspect of the present invention may reside in a method for providing a public key for authenticating an integrated circuit. In the method, the integrated circuit obtains a hardware key and an integrated circuit identifier. The integrated circuit generates a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine. The integrated circuit generates a private key and a corresponding public key using the derived key as an input to a deterministic function. The integrated circuit then provides the corresponding public key and the integrated circuit identifier to a partner service for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

In more detailed aspects of the invention, the private key and the corresponding public key may be generated further using a partner salt as an input to the deterministic function. Also, the hardware key may be only known to a secure zone of the integrated circuit and to the manufacturing machine.

Another aspect of the invention may reside in an integrated circuit, comprising: means for obtaining a hardware key and an integrated circuit identifier; means for generating a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine; means for generating a private key and a corresponding public key using the derived key as an input to a deterministic function; and means for providing the corresponding public key and the integrated circuit identifier to a partner service for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

Another aspect of the invention may reside in an integrated circuit, comprising: a processor configured to: obtain a hardware key and an integrated circuit identifier; generate a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine; generate a private key and a corresponding public key using the derived key as an input to a deterministic function; and provide the corresponding public key and the integrated circuit identifier to a partner service for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

Another aspect of the invention may reside in a computer-readable medium, comprising: code for causing a computer to obtain a hardware key and an integrated circuit identifier; code for causing a computer to generate a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine; code for causing a computer to generate a private key and a corresponding public key using the derived key as an input to a deterministic function; and code for causing a computer to provide the corresponding public key and the integrated circuit identifier to a partner service for authentication of an integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

Another aspect of the invention may reside in a method for providing an anonymized credential database for a plurality of integrated circuits, comprising: for each integrated circuit of the plurality of integrated circuits; receiving, by a manufacturer, a derived key and an integrated circuit identifier from a manufacturing machine, wherein the derived key was generated by the manufacturing machine based on a hardware key of the integrated circuit, and using a key derivation function (KDF) shared with the integrated circuit; generating, by the manufacturer, a private key and a corresponding public key using the derived key as an input to a deterministic function; generating, by the manufacturer, an anonymized credential for the integrated circuit based on a hash of the integrated circuit identifier and the corresponding public key; and storing, by the manufacturer, the anonymized credential in the anonymized credential database.

In more detailed aspects of the invention, the method may further comprise: providing the anonymized credential database to a partner service for authenticating a public key provided to the partner service by an integrated circuit, and discarding, by the manufacturer, each private key before providing the anonymized credential database. Also, the private key and the corresponding public key may be generated further using a partner salt as an input to the deterministic function. The hardware key may be only known to a secure zone of the integrated circuit and to the manufacturing machine. A database distinguishing salt may be included in the hash used to generate the anonymized credential.

Another aspect of the invention may reside in a station, comprising: means for receiving a derived key and an integrated circuit identifier from a manufacturing machine for each integrated circuit of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; means for generating a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; means for generating an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and means for storing the respective anonymized credential for each integrated circuit in an anonymized credential database.

Another aspect of the invention may reside in a station, comprising: a processor configured to: receive a derived key and an integrated circuit identifier from a manufacturing machine for each integrated circuit of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; generate a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; generate an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and store the respective anonymized credential for each integrated circuit in an anonymized credential database.

Another aspect of the invention may reside in a computer-readable medium, comprising: code for causing a computer to receive a derived key and an integrated circuit identifier from a manufacturing machine for each integrated circuit of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; code for causing a computer to generate a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; code for causing a computer to generate an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and code for causing a computer to store the respective anonymized credential for each integrated circuit in an anonymized credential database.

DETAILED DESCRIPTION

With reference toFIGS. 2 and 3, an aspect of the present invention may reside in a method300for providing a public key for authenticating an integrated circuit/system-on-a-chip (SoC)10. In the method, the integrated circuit obtains a hardware (HW) key and an integrated circuit identifier (ID) (step310). The integrated circuit generates a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine20(step320). The integrated circuit generates a private key and a corresponding public key using the derived key as an input to a deterministic function (step330). The integrated circuit then provides the public key and the integrated circuit identifier to a partner service30for authentication of the integrated circuit using an anonymized credential database (DB)40to be provided to the partner service by a manufacturer50(step340).

In more detailed aspects of the invention, the private key and the corresponding public key may be generated further using a partner salt60as an input to the deterministic function. Also, the hardware key may be only known to a secure zone of the integrated circuit10and to the manufacturing machine20. The manufacturing machine may generate the hardware key (i.e., step204), and the integrated circuit may receive the hardware key from the manufacturing machine, as shown inFIG. 2. Alternatively, the integrated circuit may generate the hardware key and forward the hardware key to the manufacturing machine (not shown). Similarly, the integrated circuit may receive the integrated circuit identifier from the manufacturing machine (FIG. 2) or, alternatively, the integrated circuit may have an embedded integrated circuit identifier which it forwards to the manufacturing machine.

During manufacture, the HW key and the IC ID of the integrated circuit10may be stored in fuses45. The manufacturing machine20generates the derived key using the HW key as an input to the same KDF as was used by the integrated circuit (step210). The manufacturing machine discards the HW key (step220), and forwards the derived key and the IC ID to the manufacturer (supplier)50. Thus, the derived key is shared by only the integrated circuit, the manufacturing machine, and a secure facility computer of the manufacturer, and eventually may be discarded by the manufacturing machine. Both the manufacturer and the SoC deterministically generate a public/private key pair using the derived key as a seed (steps230and330). An optional first or partner salt value (S1)60may be included in the seed to generate partner specific key pairs (and DBs). The manufacturer keeps an internal database M-DB70of the IC IDs and corresponding public keys. The manufacturer calculates a hash of the IC ID, the public key, and a second salt value (S2), and includes the hash in the DB to generate an anonymized credential DB (A-DB) (step240). The A-DB is shown inFIG. 7. The private key may be discarded (step250). The anonymized credential DB is forwarded to the partner service30. Each time the internal database M-DB of the IC IDs/public keys is updated, or at periodic intervals, the manufacturer creates a new (fresh) second salt (S2), and creates an updated A-DB by calculating updated hash values (HASH(salt2, IC IDi, Public Keyi), where i is an index number of the ICs). The IC ID may be the serial number, batch number, or model number, of the integrated circuit. Also, the order of the values input to the hash function may be in any preset order. The A-DB of hash values may be padded using, e.g., random bits as shown inFIG. 7, to obscure the number of valid hash values, and then the A-DB is forwarded to the partner service along with the second salt (public information). The second salt may be set to a null value if its use is not desired.

The partner service30requests the IC ID and public key from the integrated circuit10, and calculates a hash of the received IC ID and public key. The partner service inquires whether the calculated hash value is in the anonymized credential DB (step270). If the hash is in the anonymized DB40, the IC/SoC is authenticated (step280). Otherwise, the authentication fails. False entries may be included in the anonymized credential DB to hide the number entries. Alternatively, Bloom filters may be used for the anonymized credential DB.

The method of the invention avoids additional fuses or pushing credentials onto the integrated circuit10during manufacturing, and the HW key never leaves the manufacturing machine20. The derived key and the public/private keys may be derived/generated after the integrated circuit is integrated in a device. The integrated circuit may include a secure zone (e.g., trustzone (TZ) of the ARM architecture) and the authentication verifies that the end-point of its secure communications is in the TZ and is not in a higher level operating system (HLOS). The hash stored by the credential DB is much shorter than the corresponding key(s), and does not place at the risk the security of the key(s). A partner specific salt60means that the compromised keys of one partner service30will not compromise the security of other partners. Each partner needs to interact only with the integrated circuit for ID verification.

The IC/SoC10may be integrated into a remote station102(FIG. 1). With additional reference toFIG. 5, the remote station102may comprise a computer500that includes a processor510of hardware having a TPM520, a storage medium530such as memory, a display540, and an input such as a keypad550, and a wireless connection860. The IC/SoC10may comprise the processor and the storage medium.

Another aspect of the invention may reside in an integrated circuit10, comprising: means (e.g., processor510) for obtaining a hardware key and an integrated circuit identifier; means (e.g., processor510) for generating a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine20; means (e.g., processor510) for generating a private key and a corresponding public key using the derived key as an input to a deterministic function; and means (e.g., processor510) for providing the public key and the integrated circuit identifier to a partner service30for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer50.

Another aspect of the invention may reside in an integrated circuit10, comprising: a processor510configured to: obtain a hardware key and an integrated circuit identifier; generate a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine20; generate a private key and a corresponding public key using the derived key as an input to a deterministic function; and provide the public key and the integrated circuit identifier to a partner service30for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer50.

Another aspect of the invention may reside in a computer-readable medium530, comprising: code for causing a computer500to obtain a hardware key and an integrated circuit identifier; code for causing a computer500to generate a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine20; code for causing a computer500to generate a private key and a corresponding public key using the derived key as an input to a deterministic function; and code for causing a computer500to provide the public key and the integrated circuit identifier to a partner service30for authentication of an integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer50.

With reference toFIG. 4, another aspect of the invention may reside in a method400for providing an anonymized credential database40for a plurality of integrated circuits10, comprising: for each integrated circuit of the plurality of integrated circuits; receiving, by a manufacturer50, a derived key and an integrated circuit identifier from a manufacturing machine20, wherein the derived key was generated by the manufacturing machine based on a hardware key of the integrated circuit, and using a key derivation function (KDF) shared with the integrated circuit; generating, by the manufacturer, a private key and a corresponding public key using the derived key as an input to a deterministic function; generating, by the manufacturer, an anonymized credential for the integrated circuit based on a hash of the integrated circuit identifier, the public key, and, optionally, a database distinguishing salt (S2); and storing, by the manufacturer, the anonymized credential in the anonymized credential database40.

In more detailed aspects of the invention, the method may further comprise: providing the anonymized credential database40to a partner service30for authenticating a public key provided to the partner service by an integrated circuit10, and discarding, by the manufacturer50, each private key before providing the anonymized credential database. Also, the private key and the corresponding public key may be generated further using a partner salt60as an input to the deterministic function. The hardware key may be only known to a secure zone of the integrated circuit and to the manufacturing machine.

With reference toFIG. 6, the manufacturer50may use a computer600that includes a processor610, a storage medium620such as memory and/or a disk drive, a display630, an input640such as a keypad, and a network/internet connection650.

Another aspect of the invention may reside in a station (e.g., computer600), comprising: means (e.g., processor610) for receiving a derived key and an integrated circuit identifier from a manufacturing machine20for each integrated circuit10of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; means (e.g., processor610) for generating a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; means (e.g., processor610) for generating an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and means (e.g., processor610) for storing the respective anonymized credential for each integrated circuit in an anonymized credential database40.

Another aspect of the invention may reside in a station (e.g., computer600), comprising: a processor610configured to: receive a derived key and an integrated circuit identifier from a manufacturing machine20for each integrated circuit10of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; generate a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; generate an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and store the respective anonymized credential for each integrated circuit in an anonymized credential database40.

Another aspect of the invention may reside in a computer-readable medium (e.g., storage medium620), comprising: code for causing a computer600to receive a derived key and an integrated circuit identifier from a manufacturing machine20for each integrated circuit10of a plurality of integrated circuits, wherein the respective derived key was generated by the manufacturing machine based on a hardware key of the respective integrated circuit, and using a key derivation function (KDF) shared with the integrated circuits; code for causing a computer600to generate a respective private key and a corresponding respective public key using the respective derived key as an input to a deterministic function; code for causing a computer600to generate an anonymized credential for the respective integrated circuit based on a hash of the respective integrated circuit identifier and the respective public key; and code for causing a computer600to store the respective anonymized credential for each integrated circuit in an anonymized credential database40.

The KDF may be selected from the ones described in NIST SP800-108(e.g., one in counter mode, one in feedback mode, or any other one). In addition, a suitable KDF may be selected from ISO-18033-2 (KDF1, KDF2, KDF3, KDF4). Note that KDF1 and KDF2 in ISO-18033-2 are similar to the counter mode KDF in NIST SP800-108. Also, KDF2 in ISO-18033-2 is the same as the KDF based on concatenation algorithm in Section 7.7.2 of ANSI X9.42 [AX942]. The input to the KDF may be the IC ID concatenated with the HW key, or an encryption thereof.

The deterministic function may be selected based on several components. A pseudorandom number generator (PRNG) may be used directly with elliptic curve cryptography (ECC) to deterministically generate the private key from which the corresponding public key is derived. Alternatively, an RSA key generation technique may be used. If additional keys are needed, the derived key may be encrypted with several distinguishing values used as keys, several distinguishing values may be encrypted using the derived key, or other similar functions of two inputs may be used. One input may be the derived key, and the other input may be one of several distinguishing values, to get more seeds for the PRNG. For each one of these seeds, elliptic curve cryptography may be performed, or, alternatively, the RSA key generation technique may be performed. If only one key pair is needed, one distinguishing value may be used, or only the derived key may be used, as the seed. Also, the PRNG seed may be based on the derived key (or derived key concatenated with a distinguishing value) concatenated with the partner seed, or an encryption thereof.

Several pseudo random number generators (deterministic) may be used, e.g., AES in counter mode, and other PRNGs in NIST Special Publication800-90A. The seed for the PRNG may be the result of the previous step. For ECC, the output of this function is used to generate the secret key directly. If the result is a zero or another invalid value (very rare), the PRNG is commanded to generate another value. For RSA, the PRNG may be used as the source or “random bits” in the RSA key generation technique. An RSA key generation techniques is NIST Special Publication800-56B, or simplifications thereof.

With reference toFIG. 1, a wireless remote station (RS)102(e.g. a mobile station MS) may communicate with one or more base stations (BS)104of a wireless communication system100. The wireless communication system100may further include one or more base station controllers (BSC)106, and a core network108. Core network may be connected to an Internet110and a Public Switched Telephone Network (PSTN)112via suitable backhauls. A typical wireless mobile station may include a handheld phone, or a laptop computer. The wireless communication system100may employ any one of a number of multiple access techniques such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), space division multiple access (SDMA), polarization division multiple access (PDMA), or other modulation techniques known in the art.