Patent Description:
<CIT> discloses an anti-tamper module for protecting the contents and functionality of an integrated circuit incorporated in a module. The anti-tamper module is arranged in a stacked configuration having multiple layers. A connection layer is provided for connecting the module to an external system. Other layers include a configurable logic device, which is configured to provide routing connections between the integrated circuit and the connection layer, and/or a memory for storing code for controlling access to the contents and functionality of the integrated circuit.

<CIT> discloses a battery for supplying a power upon a removal from equipment. When the removal from the equipment is detected by a connection detecting unit, an injustice judgment unit judges whether it is an unjust removal from the equipment or not. If it is judged that an unjust removal has taken place, a security processing unit performs an information protective action such as erasing of data of a storage unit, enciphering, saving into different areas.

<CIT> discloses anti-tamper integrated circuit (IC) apparatus for use with an IC that carries an active component, such as a secure processor, which requires a constant power signal to operate. If the power signal is interrupted, data is erased from a volatile memory of the secure processor. The memory is located within the IC package.

In one aspect the present invention provides a device as defined in claim <NUM>. In another aspect, the present invention provides a method as defined in claim <NUM>. Optional features are specified in the dependent claims.

Numbers provided in flow charts and processes are provided for clarity in illustrating steps and operations and do not necessarily indicate a particular order or sequence. Unless otherwise defined, the term "or" can refer to a choice of alternatives (e.g., a disjunction operator, or an exclusive or) or a combination of the alternatives (e.g., a conjunction operator, and/or, a logical or, or a Boolean OR).

Some embodiments relate generally to mechanisms, methods, and systems to disable component authentication system when removed from a component. Some embodiments relate generally to switches and disabling components and/or circuitry.

Electronic devices may be used in an attempt to block the use of third-party components in systems such as computed tomography (CT) and x-ray systems. However, such electronic devices may be removed from systems including old, broken, worn out components, such as x-ray tubes. The electronic devices may then be installed on third-party or used tubes to be sold for use in an original equipment manufacturer (OEM) system. For example, a third-party may access an old, used, or broken x-ray tube from which the electronic devices can be removed. The electronic device can then be installed on a new, used, or third-party tube to enable the tube to simulate a genuine tube in the system.

As described herein, anti-tamper circuitry may not prevent the removal of the components or the electronic devices themselves but may disable at least some to all of the functionality of the device such as disabling authentication or other functions, deleting configuration information, or the like. As a result, the electronic device may not be able to perform those functions without having a manufacturer or authorized service representative reprogram the device. Thus, an unauthorized party may no longer be able to reuse the electronic device and access some to all of the functionality. As will be described in further detail below, the effect of the loss of some to all of the functionality may result in a range of effects from a warning message to disabling of the electronic device or a system including the electronic device.

In some embodiments, in an x-ray system, an x-ray tubes designed and built by the manufacturer may include tube specific information to be used in conjunction with a tube auxiliary unit (TAU) to function with proper imaging and without damage to the tube. That tube specific information may reside in non-volatile random-access memory (NVRAM), such as flash memory or solid-state storage, of the TAU. Since some of the information stored in the TAU is tube specific, if its TAU were to be swapped to a different tube, its tube specific information would no longer match the specific x-ray tube. The mismatch could cause image quality issues and/or irreparable x-ray tube damage if used. The anti-tamper circuitry may reduce or eliminate a chance that the TAU is swapped between different x-ray tubes and providing the incorrect tube specific information to a system.

<FIG> are block diagrams of systems including a device with anti-tamper circuitry according to some embodiments. <FIG> is a block diagram of a device with anti-tamper circuitry according to some embodiments.

Referring to <FIG> and <FIG>, the system 100a includes a device <NUM> configured to be mounted to an external component <NUM>. The device <NUM> includes anti-tamper circuitry <NUM> and circuitry <NUM>.

Examples of the device <NUM> include devices with circuitry <NUM> that may include customized components, firmware, software, data or the like. The firmware or software may include instructions that implement proprietary communication and/or control techniques with other circuitry <NUM> or circuitry <NUM> of the external component <NUM>. In other embodiments, the data may include authentication information, cryptographic information, performance data, or the like. Particular examples of the device <NUM> include an authentication circuit for a system, a control circuity for an x-ray tube, or the like.

The external component <NUM> may include a purely structural component and/or a circuity with some functional capabilities. For example, in some embodiments, the external component <NUM> is a housing of a system that includes the device <NUM>. The device <NUM> may be mounted to that housing and hence, mounted to the external component <NUM>.

The device <NUM> includes a housing <NUM> configured to restrict access to disarm the disarm the anti-tamper circuitry <NUM> when the device <NUM> is mounted to the external component <NUM>. For example, the housing <NUM> may include a sealed case surrounding the anti-tamper circuitry <NUM> and the circuitry <NUM>. When the housing <NUM> is mounted to the external component <NUM>, the combination of the housing <NUM> and the external component <NUM>, such as a wall <NUM> of the external component <NUM>, may completely enclose the anti-tamper circuitry <NUM> and the circuitry <NUM>. In some embodiments, the combination may enclose the anti-tamper circuitry <NUM> and the circuitry <NUM> sufficiently to prevent access to the anti-tamper circuitry <NUM> or the circuitry <NUM> without significantly modifying or destroying the housing <NUM>. The combination of the housing <NUM> and the external component <NUM> may be configured such that accessing the anti-tamper circuitry <NUM> or the circuitry <NUM> is significantly more difficult than removing the device <NUM> from the external component <NUM>.

The device <NUM> includes anti-tamper circuitry <NUM> electrically connected to circuitry <NUM>. The anti-tamper circuitry <NUM> is configured to disable at least one function of the circuitry <NUM> when the device <NUM> is removed from the external component <NUM>. In particular, the anti-tamper circuitry <NUM> is coupled to the external component <NUM> through coupling <NUM>. This coupling <NUM> may be a mechanical, electrical, optical, magnetic, other similar couplings, or a combination of such couplings. For example, a switch may be switched when the device <NUM> is mounted on the external component <NUM>. Switched can refer to either toggling from an on state to an off state or toggling from an off state to an on state. The switch may have a mechanically or magnetically switchable pole. A state of the switch may change depending on whether the device <NUM> is a mounted on the external component <NUM> or if it is being removed from the external component. In other embodiments, the switch may change state when a fastener that is used to mount the device <NUM> on the external component is removed. In other embodiments, an electrical circuit may be created through a portion of the external component <NUM>, such as through a metallic portion of the wall <NUM>. Removal of the device <NUM> from the external component may be detected by a break in that circuit. Although some circuits and structures have been used as examples of configurations by which the anti-tamper circuitry <NUM> may sense the removal of the device <NUM> from the external component <NUM>, the anti-tamper circuitry <NUM> may sense the removal in other ways.

Embodiments described herein may be used anywhere where a device <NUM> should stay physically paired to the system 100a, the external component circuitry <NUM>, the other circuitry <NUM>, or another component or device to which they are mounted and/or associated. Paired in this sense could mean physically in touch, in proximity, in communication with, integrated into the device, or the like.

In response to sensing the removal of the anti-tamper circuitry <NUM> from the external component <NUM>, the anti-tamper circuitry <NUM> may be configured to disable at least one function of the circuitry <NUM>. The particular function of the circuitry <NUM> may include a capability of general processing, the use of particular data, the ability to properly respond to authentication challenges, or the like. In some embodiments, data stored in the circuitry <NUM> may be erased. The data may include cryptographic information, authentication information, identification information, operational information, firmware, software, or the like. In some embodiments, non-volatile memory of the circuitry <NUM> may be erased to disable at least one function. In other embodiments, fuses that affect operation of the circuitry <NUM> may be blown to disable at least one function. While some embodiments may disable at least one function, in other embodiments, the anti-tamper circuitry <NUM> may be configured to disable all functions of the circuitry <NUM> or the entire device <NUM>.

In some embodiments, the circuitry <NUM> is configured to control the external component. The circuitry <NUM> may be coupled to the external component circuitry <NUM>. In a particular example, the circuitry <NUM> may include control circuitry for an x-ray tube. The external component circuitry <NUM> may include an anode, cathode, filament, emitter, motor, steering electronics, focusing electronics, or other circuitry that may be part of an x-ray tube.

In some embodiments, other techniques for preventing reuse could be triggered by radio-frequency identification sensors (RFID), light sensors, proximity sensors, bar code readers, cameras that process the tube serial number or other identifying features, trip wires, tamper resistant mounting, or any combination of such techniques. These techniques could be paired with the ability of the anti-tamper circuitry <NUM> to disable at least one function of the circuitry <NUM> as described herein.

Referring to <FIG> and <FIG>, in some embodiments, the external component <NUM> may be another device <NUM>. For example, the device <NUM> may be an interface circuit board configured to provide an interface between a system control component and other components of the system. In a particular example, the device <NUM> may be an interface board that converts controls and/or communication between the system controller for an x-ray system and particular sub-systems, such as an x-ray generation subsystem, a power sub-system, a detector sub-system, a cooling subsystem, a user interface sub-system, or the like.

The device <NUM> may be an authentication daughter board (ADB) configured to store authentication information, perform authentication functions, negotiate authentication between a system controller and the device <NUM> or other sub-systems of the system 100b, or the like.

Referring to <FIG>, in some embodiments, more than one device <NUM> may be mounted on the external component <NUM>. In this example, N devices <NUM> are mounted on the external component <NUM>. The devices <NUM>-<NUM> to <NUM>-N may be the same, similar, or different. However, some to all of the devices <NUM>-<NUM> to <NUM>-N may include the anti-tamper circuitry <NUM> described herein.

In some embodiments, the anti-tamper circuitry <NUM> prevents the reuse, modification, tampering, replacement, or reinstallation of the device <NUM>, by a third-party or onto a third-party component. As described above, the device <NUM> may be part of an authentication system. The authentication system may be configured to determine whether or not a component in the system, which may be the device <NUM>, the external component <NUM>, or another component, is a genuine manufacturer or OEM component by issuing an encrypted challenge question to a cryptographic electronic device on the component.

In a particular example, the device <NUM> may include the cryptographic electronic device as part of the circuitry <NUM>. The device <NUM> includes the circuitry that controls the external component <NUM>. If the cryptographic electronic device can be removed from the genuine component and installed on a counterfeit component, then the authentication system can be defeated. However, the anti-tamper circuitry <NUM> is triggered upon removal of the device <NUM>. The at least one function of the circuitry <NUM> that is disabled may include the authentication functions, authentication information, or the like. After the anti-tamper circuitry <NUM> is triggered, the cryptographic electronic device would no longer respond properly to authentication requests. As a result, the system <NUM> would have an indication that the device <NUM> and/or external component <NUM> can no longer be trusted to be a genuine manufacturer or OEM component.

In some embodiments, service contracts may be a large source of revenue for an OEM. Anti-tamper circuitry <NUM> as described herein may be used by the OEM to reduce or eliminate an ability of third-party manufacturers or resellers to install competing or replacement products, or incompatible components that can result in performance and patient safety issues.

<FIG> are block diagrams of circuitry of devices with anti-tamper circuitry according to some embodiments. In these embodiments, the circuitry includes anti-tamper circuitry <NUM> similar to that described above, a processor <NUM>, and a memory <NUM>. The processor <NUM> and memory <NUM> are examples of circuitry <NUM> described above.

The processor <NUM> may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit, a microcontroller, a programmable logic device, discrete circuits, a combination of such devices, or the like. The processor <NUM> may include internal portions, such as registers, cache memory, volatile memory, non-volatile memory, processing cores, or the like, and may also include external interfaces, such as address and data bus interfaces, interrupt interfaces, or the like. Although only one processor <NUM> is illustrated, multiple processors <NUM> may be present. In addition, other interface devices, such as logic chipsets, hubs, memory controllers, communication interfaces, or the like may be included to connect the processor <NUM> to internal and external components.

The processor <NUM> is coupled to the memory <NUM>. The memory <NUM> includes data such as cryptographic information, authentication information, identification information, operational information, firmware, software, or the like as described above. The anti-tamper circuitry <NUM> is configured to erase at least a portion of the memory <NUM> used by the processor <NUM> when the device <NUM> is removed from the external component <NUM>. In some embodiments, the erasure may be of all of such data. In other embodiments, the erasure may be of a sufficient quantity and quality of the data to render the device <NUM> inoperable, such as the erasure of secret information such as cryptographic keys.

Referring to <FIG>, in some embodiments, the processor <NUM> includes on-chip or otherwise integrated memory 118a. As a result, when the anti-tamper circuitry <NUM> erases at least a portion of the memory 118a, the memory erased is memory integrated with the processor <NUM>.

Referring to <FIG>, in some embodiments, the anti-tamper circuitry <NUM> is coupled to the processor <NUM>. The processor <NUM> is coupled to external memory 118b. The anti-tamper circuitry <NUM> may be configured to activate the processor <NUM> and cause the processor <NUM> to execute commands to erase the at least a portion of the external memory 118b. For example, the anti-tamper circuitry <NUM> may cause the processor to execute an interrupt service routine that erases the portion of the memory 118b. In another example, the anti-tamper circuitry <NUM> may be configured to boot the processor <NUM> in a mode specifically designed to erase the portion of the memory 118b. Although the processor <NUM> is illustrated as being directly coupled to the memory 118b, in other embodiments, other intervening circuitry may be present, such as a memory controller.

Referring to <FIG>, in some embodiments, the anti-tamper circuitry <NUM> may be configured to access the memory 118c without accessing the processor <NUM>. Accordingly, the anti-tamper circuitry <NUM> may be configured to erase the portion of the memory by controlling the memory 118c.

While a variety of configurations of the anti-tamper circuitry <NUM>, processor <NUM>, and memory <NUM> have been described above, in other embodiments, the anti-tamper circuitry <NUM>, processor <NUM>, and memory <NUM> may be coupled in any manner such that the anti-tamper circuitry <NUM> may cause the portion of the memory <NUM> used by the processor <NUM> to be erased.

<FIG> are cross-sectional diagrams illustrating mounting a device with anti-tamper circuitry on an external component according to some embodiments. <FIG> illustrates a state of a device <NUM> and an external component <NUM> before the device <NUM> is mounted to the external component <NUM> or after the device <NUM> is removed from the external component <NUM>. <FIG> illustrates a state of the device <NUM> and the external component <NUM> when the device <NUM> is mounted to the external component <NUM>.

Referring to <FIG>, in some embodiments, the device <NUM> includes a housing <NUM>. The device <NUM> includes a switch <NUM>. The switch <NUM> is coupled to the housing <NUM>. Although the housing <NUM> is illustrated as an example of a mounting structure of the device <NUM>, in other embodiments, the mounting structure may be a structure other than the housing <NUM>. The mounting structure may be any structure, board, component, or the like that remains with the device <NUM> when the device is moved relative to the external component <NUM>. The housing includes a flange <NUM>. A fastener <NUM> may be used to attach the housing <NUM> to the wall <NUM> of the external component <NUM>. While mounting components such as the flange <NUM> and fastener <NUM> have been used as examples, in other embodiments, different mounting techniques may be used.

The switch <NUM> is configured to switch when the device <NUM> is removed from the external component <NUM>. When the device <NUM> is in the state illustrated in <FIG>, the switch <NUM> has a pole <NUM> in a first state. In a particular example, the switch <NUM> may be a momentary normally closed switch. Thus, in the state illustrated in <FIG>, the switch <NUM> is closed.

As the device <NUM> is mounted on the external component <NUM> as illustrated in <FIG>, a structure <NUM> of the external component <NUM> causes the pole <NUM> of the switch <NUM> to switch. Thus, the switch <NUM> is opened.

In some embodiments, the structure <NUM> is a protrusion, wall, rib, gusset, fastener, or the like. The structure <NUM> disposed on the external component <NUM> such that when the device <NUM> is mounted on the external component <NUM>, the structure <NUM> toggles the state of the switch <NUM>.

Although a particular structure of the device <NUM>, external component <NUM>, and switch <NUM> has been used as an example, any mechanism and associated structures may be used that causes the switch <NUM> to be in a first state when mounted and in a second state when removed. In particular, the mechanism and associated structures may be formed such that the switch <NUM> changes state before the anti-tamper circuitry <NUM> may be accessed to disable the anti-tamper circuitry <NUM> or otherwise prevent it from disabling at least one function of the circuitry <NUM> as described above.

In addition, the switch <NUM> need not be mechanically switched. For example, the switch <NUM> may be magnetically switched. The structure <NUM> may include a magnet or a ferromagnetic material according to the structure of the switch <NUM> such that the switch <NUM> changes state as the device <NUM> is mounted to or removed from the external component <NUM>.

While a single switch <NUM> has been used as an example, in other embodiments, multiple switches <NUM> in different locations and/or different configurations may be used. In some embodiments, any one of these switches <NUM> may be used by the anti-tamper circuitry <NUM> to disable at least one function of the circuitry <NUM>.

<FIG> are schematic diagrams of circuitry of anti-tamper circuitry according to some embodiments. Referring to <FIG>, the anti-tamper circuitry 110a includes a power supply <NUM> and a disable circuit <NUM>. The power supply <NUM> is configured to generate power that may be used by the disable circuit <NUM> and potentially a portion of the circuitry <NUM>.

The power supply <NUM> is disposed within the device <NUM>. The power supply <NUM> is configured to supply power after detecting removal of the device <NUM> from the external component <NUM>. The power supply <NUM> may include a battery, a capacitor, a supercapacitor, or any other energy storage device that may be disposed within the device <NUM>. In some embodiments, the power supply <NUM> may be charged by an external power source <NUM>.

In some embodiments, the power supply <NUM> may include switches that connect the power supply <NUM> to other components of the anti-tamper circuitry <NUM> when the device <NUM> is removed from the external component <NUM>.

The disable circuit <NUM> is a circuit configured to disable the at least one function of the circuitry <NUM>. In this example, the disable circuit <NUM> includes an ERASE output. The ERASE output is a signal coupled to an ERASE input on a processor, memory, or the like of the circuitry <NUM> that would initiate an erase command to erase memory or otherwise disable the at least one function.

In some embodiments, power PWR may also be provided to some components of the circuitry <NUM>. In particular, the device <NUM> may not be connected to an external power source or the external power source may be disabled when the device <NUM> is being removed from the external component <NUM>. The power supply <NUM> may instead supply the power needed to allow the disable circuit <NUM> to disable the at least one function of the circuitry <NUM>.

Referring to <FIG>, the anti-tamper circuitry 110b includes battery B1 and switch SW1. A single battery B1 is illustrated; however, in other embodiments, multiple batteries may be used. The switch SW1 is a double-pole double-throw switch (DPDT). The switch SW1 is coupled such that in the illustrated state, <NUM>. 3V is coupled to VDD_CPU and no connection is made to ERASE-CPU. In the other state, both VDD_CPU and ERASE_CPU are coupled to the battery B1.

VDD_CPU is a power supply for a processor that may be part of the circuitry <NUM>. ERASE_CPU is a signal that commands the processor of the circuitry <NUM> to erase some or all of its memory. As a result, the at least one function of the circuitry <NUM> may be disabled. The switch SW1 is illustrated in the state when the corresponding device <NUM> is mounted to the external component <NUM>. When removed, the switch SW1 will transition to the other state, which will supply power to the processor through VDD_CPU and supply the erase signal through ERASE_CPU.

The isolator I is a removable structure configured to disconnect the battery B1 from the switch. When in place, the battery B1 be disconnected and will not supply power to the switch SW1. Thus, ERASE_CPU will not be activated. The isolator I may be in place during installation to disable the anti-tamper circuitry 110b.

Other circuitry illustrated may provide a status indicator for a variety of states. R1 is coupled to VDD_CPU and pulls down the input to AND gate U1. The other input to AND gate U1 is an error signal ERROR_N. When the device <NUM> is being installed and the <NUM>. 3V power is applied, the switch SW1 will be in the opposite state. However, as the isolator I is present, the battery will not enable ERASE_CPU. VDD_CPU will not be coupled to <NUM>. 3V and will be pulled down by R1. Thus, the output of AND gate U1 will be low, turning on LED D1. Once the device <NUM> is properly installed, the switch SW1 will change to the illustrated state and VDD_CPU will be set to <NUM>. The AND gate U1 output will switch to high, assuming there is no error indicated by a low on ERROR_N. The high output will cause the LED D1 to turn off. As a result, an installer will receive a visual indication that the device <NUM> is installed such that the switch SW1 is in the illustrated state.

Once installed, the isolator I may be removed. ERROR_N will control the output of the AND gate U1 and whether LED D1 is on. Thus, the LED D1 will act as an error indicator. However, if the device <NUM> is removed, the switch SW1 will change state, activating VDD_CPU and ERASE_CPU.

In an example, the SW1 switch is a normally closed (NC) double pole, double throw (DPDT) switch where the closed state couples the battery B1 to ERASE_CPU. The switch can be normally closed (NC) and open when the switch is depressed, such as when the device <NUM> is installed and a feature of the external component <NUM> presses on the switch.

Referring to <FIG>, the operation may be similar to that of <FIG>. However, VCC_INSTALL is a power voltage supplied during installation when <NUM>. 3V may not be active. Resistors R3 and R4 are in series with LED D2 for either VCC_INSTALL or <NUM>. Thus, when the cathode of LED D2 is pulled low, LED D2 will turn on. Buffer U2 is an open-drain buffer. Inverter U3 is an open-drain inverter. Thus, if the input to U2 is low or if the input to U3 is high, the LED D2 will be turned on.

When the switch is in the installed state, ERASE_CPU and the nodes coupled to resistors R5, R6, R7, and Q1 are pulled to ground and transistor Q1 is off. However, once the device <NUM> is removed from the external component <NUM>, switch SW1 changes state, increasing the voltage of node N1, pulsing ERASE_CPU until C1 charges. R5 and C1 are selected to provide a sufficient pulse to erase a portion of the memory to disable the at least one function.

Referring to <FIG>, the operation of U2, U3, resistors R8, R9, and R10, diodes D3 and D4, and LED D5 may be similar to that of <FIG>. Here diodes D3 and D4 may isolate VCC_INSTALL from <NUM>. The operation of the anti-tamper circuitry 110d may be similar to that of anti-tamper circuitry 110c of <FIG>.

Although <NUM>. 3V has been used as an example of a power supply voltage, in other embodiments, the power supply voltage may be different.

<FIG> are flowcharts showing techniques of operating a device with anti-tamper circuitry according to some embodiments. Referring to <FIG>, in <NUM> the removal of a device <NUM> from an external component <NUM> is detected. As described above, a variety of techniques may be used to detect the removal of the device <NUM>. For example, the change in the state of a switch, the change in a magnetic field, the breaking of a circuit or the like may provide an indication of whether the device <NUM> is being removed from the external component <NUM>.

In <NUM>, at least one function of the device <NUM> is disabled. As described above, the at least one function may be disabled by erasing data, disabling components, such as a processor, or the like. Various forms of the anti-tamper circuitry <NUM> may be used to perform the disabling.

In some embodiments, the detecting of the removal of the device <NUM> may include detecting the physical separation of structure of the device <NUM> and a structure of the external component <NUM>. For example, the switch <NUM> may detect when device <NUM> is moved relative to the external component <NUM>.

Referring to <FIG>, in <NUM>, the device <NUM> is installed on the external component <NUM>. For example, during authorized installation, replacement of a part, and/or maintenance of a system, a device <NUM> may be prepared and mounted on the external component <NUM>. During installation, the anti-tamper circuitry <NUM> may be disarmed. For example, as described above, a removable isolator I such as an insulating tape may be disposed between the power supply <NUM> contacts and the disable circuit <NUM>.

In <NUM>, the anti-tamper circuitry <NUM> may be armed. For example, once the device <NUM> is installed, the insulating tape may be removed, arming the anti-tamper circuitry <NUM>. Before the insulating tape is removed, the device <NUM> may be mounted and removed repeatedly without engaging the anti-tamper circuitry <NUM>. However, once removed, the anti-tamper circuitry <NUM> is armed and any attempt to remove the device <NUM> from the external component <NUM> may be detected and used to disable at least on function of the circuitry <NUM> of the device <NUM> in operations <NUM> and <NUM>.

Once the anti-tamper circuitry <NUM> has been triggered and at least one function of the circuitry <NUM> has been disabled, the device <NUM> may be reset in <NUM>. Resetting the device <NUM> includes operations that return the device <NUM> to a state where it may again be installed or operated in an authorized manner. For example, the device <NUM> may be returned to an authorized repair facility. The erased data may be restored to the device <NUM>, the disabled components may be reenabled, disabled components may be replaced, the isolator I described above may be reinstalled, or the like such that the device <NUM> is in a state similar to a device <NUM> that had not had the at least one function of the circuitry <NUM> disabled. Although returning the device <NUM> to an authorized repair facility has been used as an example, the resetting of the device <NUM> may be performed by an authorized repair technician with the appropriate data and/or components. An unauthorized party may not have the appropriate data and/or components and would not be able to restore the device <NUM> to an operating condition.

<FIG> is a block diagram of an x-ray system according to some embodiments. The x-ray system <NUM> includes a host controller <NUM>, an interface board (IFB) <NUM>, and tube auxiliary unit (TAU) <NUM>, and an x-ray tube <NUM>. These components may be mounted on a rotatable gantry <NUM>.

In some embodiments, a device <NUM> is the IFB <NUM> or is part of the IFB <NUM>. The external component <NUM> may be the gantry <NUM>. Thus, if the IFB <NUM> is removed from the gantry, at least one function of the IFB <NUM> may be disabled if the interface board is removed from the gantry <NUM>. The IFB <NUM> may include firmware, software, calibration data, secret information such as keys, IDs, or other cryptographic information, or the like that may be erased to disable at least one function.

In some embodiments, a device <NUM> is an authentication daughter board (ADB) <NUM> that is mounted on the IFB <NUM>. The external component <NUM> may be the IFB <NUM>. Information such as that described above may be erased if the ADB <NUM> is removed from the IFB <NUM>.

In some embodiments, a device <NUM> is the TAU <NUM>. The TAU <NUM> may be mounted on the x-ray tube <NUM>. The external component <NUM> may be the x-ray tube <NUM>. Thus, if the TAU <NUM> is removed from the x-ray tube <NUM>, at least on function of the TAU <NUM> may be disabled. The TAU <NUM> may include data or firmware that may be erased similar to the IFB <NUM> or ADB <NUM>.

In some embodiments, the host controller <NUM> is configured to control operations of components such as the gantry <NUM>, the IFB <NUM>, the x-ray tube <NUM> though the TAU <NUM>. While these components are used as examples, other components may be present such as an image detector, a high voltage (HV) generator, a heat exchanger, or the like. The host controller <NUM> may also be configured to communicate with the IFB <NUM> and perform various actions such as identification, authentication, or the like in addition to directing control of the system <NUM>.

As described above, in some embodiments the IFB <NUM> includes the ADB <NUM>. This configuration may allow for easier retrofitting of the ADB <NUM> to existing CT systems. The IFB <NUM> has a communication link to the host controller <NUM> and another communication link to the TAU <NUM>. The ADB <NUM> contains cryptographic authentication hardware/firmware that allows for encrypted communication with both the host controller <NUM> and the TAU <NUM>. The IFB <NUM> is a device that holds the ADB <NUM> and supplies power to it and translates the communications to the ADB's <NUM> native communication protocol.

The TAU <NUM> contains cryptographic authentication hardware/firmware that allows for encrypted communication with the IFB <NUM>/ADB <NUM> and is attached to the x-ray tube <NUM>. When a hospital installs a new x-ray tube with its attached TAU <NUM> the IFB <NUM>/ADB <NUM> may challenge the TAU <NUM> to see if it is a genuine manufacturer or OEM x-ray tube.

In some embodiments, the authentication unit of the TAU <NUM> is mounted to the x-ray tube <NUM>, but the authentication unit could also be an integral part of the x-ray tube <NUM>. The anti-tamper circuitry <NUM> would be part of that authentication unit. Similarly, with other components such as an x-ray detector or imager, accelerator, or other device where it may be beneficial to render the unusable after its removal from its original installation location may include a device <NUM>. Each of those may have associated anti-tamper circuitry <NUM>.

In a particular example, the removal of a used x-ray tube, x-ray detector, or imager from an x-ray or mammography system for the purpose of resale into another system may be prevented. Upon removal of the device <NUM>, a switch in the anti-tamper circuitry <NUM> would trigger and could disable the authentication function, render the firmware unusable, prevent communication, or any other essential function that would allow further usage of the device <NUM>.

In some embodiments, the anti-tamper circuitry <NUM> could also be used to reinforce software/firmware (SW/FW) licensing of TAU <NUM>, x-ray tube <NUM>, detector, or other device software that was sold to a specific customer under a license agreement that would only allow the original buyer to utilize the firmware/software (FW/SW) or hardware. In such an embodiment, the respective FW/SW would be automatically erased when the device is removed.

While a CT system with a rotatable gantry <NUM> has been used as an example of an x-ray system <NUM>, the x-ray system <NUM> may take other forms.

Some embodiments relate generally to mechanisms, methods, and systems using a system identifier (ID) (or a device ID) in an encrypted form to a component.

In some embodiments, the mechanisms, methods, and systems described herein allows manufacturers or OEMs to detect unauthorized installation of components into their system. Currently, third-party suppliers can swap components on a system against used OEM components or third-party components which can lead to warranty issues, quality issues, and, in the case of an imaging system, image quality issues, diagnostic issues, and misdiagnosis. Embodiments described herein allow for the detection of such unauthorized component changes to ensure the integrity of the system.

Without a system such as those described herein, third parties can buy used components and sell them back to customers and undercut OEM service contracts. In contrast, embodiments described herein allow OEM host systems to determine if their components are being swapped without their permission and/or prevent installation of old, outdated or compromised component into a system that may affect operation, such as replacing a component in an imaging system that will affect the diagnosis of patients. Defective or not optimally functional components can lead to misdiagnosis and in extreme case can cause permanent harm to the patient and even death.

<FIG> are block diagrams of systems including an authorization system according to some embodiments. Referring to <FIG>, the system 800a includes a first device <NUM> and a second device <NUM>. The devices <NUM> and <NUM> are coupled through a communication link <NUM>. The communication link may be any medium that allows the devices <NUM> and <NUM> to communication. For example, the communication link <NUM> may include a serial link, a parallel link, and automation communication link such as Modbus, CANbus, or the like, a computer bus such as peripheral component interconnect express (PCIe), nonvolatile memory express (NVMe), or the like, and/or a network such as an Ethernet network, a Fibre Channel network, or the like.

The second device <NUM> includes a non-volatile memory <NUM>. The memory <NUM> may include any variety of non-volatile memory such as static random access memory (SRAM), flash memory, electrically erasable programmable read only memory (EEPROM), magnetic storage, or the like. In particular, the memory <NUM> includes at least a portion that is operable in a one-time-write manner. The memory <NUM> may include other non-volatile memory that is not configured for one-time-writes and/or volatile memory such as a dynamic random access memory (DRAM), a double data rate synchronous dynamic random access memory (DDR SDRAM) according to various standards such as DDR, DDR2, DDR3, DDR4.

Being one-time-write means that the portion of the memory <NUM> is writable once in a normal write operation. In some embodiments, the one-time write memory <NUM> may not be erased by other means. As a result, to change a value stored in the memory <NUM> would require replacing the memory <NUM>. However, in other embodiments, the portion of the memory <NUM> may be erased by erasing the entire memory <NUM>.

The memory <NUM> is configured to store a system identifier (ID) in the one-time-write portion. The system ID is an identifier associated with the system 800a. The system ID may be unique to the system 800a such as by being a universally unique ID (UUID) or globally unique ID (GUID). The system ID for all devices <NUM> and <NUM> may be the same. However, in other embodiments, the system ID for a particular device <NUM> or <NUM> may be unique to both the system 800a and that device <NUM> or <NUM>. In some embodiments, the system ID may include a portion unique to the system 800a and a portion unique to the particular device <NUM> or <NUM>, the particular type of device <NUM> or <NUM>, or the like.

The value of the system ID may take a variety of forms. For example, the system ID may exist in an original form where the stored data is the system ID. However, in other examples, an encrypted form of the system ID, a hash of the system ID, or other representations of the system ID may be stored as the system ID and treated as such with appropriate decoding or other manipulation.

As will be described in further detail below, a system ID can be stored on devices <NUM> in a system 800a. The first device <NUM> can verify that the system ID stored on the second device <NUM> or third device <NUM> matches the expected system ID such as a system ID associated with the system 800a. A match of the system ID may indicate that the second device <NUM> or third device <NUM> is a genuine component intended and originally installed on the system 800a. If the system ID does not match, the device <NUM> or <NUM> may have been provided or installed by an unauthorized party. As a result, swapping of devices from other systems of the same manufacturer or from a third party may be detected.

In some embodiments, the first device <NUM> may be coupled to multiple second devices <NUM>-<NUM> to <NUM>-N. Each second device <NUM> may be coupled to zero to multiple third devices <NUM>-<NUM> to <NUM>-M.

<FIG> are flowcharts showing examples of techniques of operating an authorization system according to some embodiments. In the following descriptions of techniques of operating the system, operations of a first device <NUM>, a second device <NUM>, and a third device <NUM> of <FIG> will be used as examples.

Referring to <FIG> and <FIG>, in <NUM>, the first device <NUM> transmits a request for a system ID stored on the second device <NUM> to the second device. The second device <NUM> receives the request in <NUM>. This transmission and other similar operations may occur over the communication link <NUM>.

In <NUM>, the second device <NUM> determines if the system ID stored on the second device has an empty value. The empty value represents a state where the second device <NUM> has not stored a system ID in the memory <NUM>. An actual value may not be stored in the memory <NUM>. Instead, a flag, register, state, or the like may indicate that the system ID has not been programmed into the memory <NUM>. Checking such an indicator may be part of determining if the system ID has the empty value. A processor of the second device <NUM> may be configured to attempt to read the system ID, flag, register, state, or the like to make the determination.

In <NUM>, a response based on the empty value is transmitted to the first device <NUM>. In some embodiments, the response may be a system ID that has a specific meaning. For example, all zeros or all ones may be designated as an empty value for the system ID. In other embodiments, a particular value or values of the system ID may be designated as the empty value. That specific value may be specific to the second device <NUM> or the type of the second device <NUM>, specific to the system 800a or the type of the system 800a, or the like. Regardless, it is a value that the first device <NUM> will recognize as indicating that the second device <NUM> does not store a system ID or that the system ID is the empty value.

In other embodiments, the empty value response may be a different type of message from that used to transmit an actual system ID. For example, the empty value response may be an error message. The error message may have an error number or code that indicates that the system ID is empty.

In <NUM>, the empty value response is received by the first device <NUM>. In response, the first device <NUM> transmits the system ID to the second device <NUM> in <NUM>. The second device <NUM> receives the system ID in <NUM> and stores it in the one-time write portion of the memory <NUM>. Once the system ID is stored, the memory <NUM> cannot be reprogrammed with a different system ID without extraordinary steps as described above. As a result, the second device <NUM> is paired with the system 800a. If the second device <NUM> is removed from the system 800a and placed in another system, even an identical system, the system ID may not match.

If the system ID is determined to be stored at the second device <NUM> in <NUM>, a response based on the system ID is returned to the first device <NUM> in <NUM>. For example, the second device <NUM> may read the system ID, encrypt it, and transmit the encrypted system ID to the first device <NUM>.

The first device <NUM> receives the response based on the system ID stored at the second device <NUM> in <NUM> and determines if the response indicates that the system ID stored at the second device <NUM> matches the actual system ID in <NUM>. For example, the first device <NUM> may extract the system ID by reading it from the response, decoding an encrypted response, or the like and comparing it to the system ID stored on the first device <NUM>. As described above, the system ID may be stored or encoded in a variety of formats. The comparison may be performed in a manner appropriate to the different formats.

If the system ID indicated by the response from the second device <NUM> is not correct, if the second device <NUM> does not respond or times out, if the second device <NUM> returns an improper response, or the like, counter measures may be performed in <NUM>. The counter measures may take a variety of forms. For example, in some embodiments, the system 800a may be shutdown, the devices <NUM>, <NUM>, <NUM>, or the like may be disabled temporarily or permanently, particular functions may be disabled, ranges of operation may be reduced or limited, or the like. In other embodiments, a notification, a warning, or other communication of the mismatched system IDs may be presented to a user of the system 800a, reported over a network, or the like. In other embodiments, information related to the mismatching system IDs may be recorded in memory <NUM> of the first device <NUM> and/or the second device <NUM>. The related information may include a timestamp, model numbers and/or serial numbers of the first device <NUM> and/or the second device <NUM>, number of times the system IDs had not matched, the mismatched system ID, the entire response received in <NUM>, or the like.

In some embodiments, when response based on the system ID is transmitted to the first device <NUM> from the second device <NUM> in <NUM>, the communication may be encrypted. For example, a secure communication link may be established between the first and second devices <NUM> and <NUM>, the response or portions of it may be encrypted, the system ID stored on the second device <NUM> may be encrypted, or the like. As a result, it may be more difficult for an eavesdropper to obtain the correct system ID response from the second device <NUM>.

The system 800a may be a hierarchical system that includes a third device or devices <NUM> that are downstream from an associated second device <NUM>. In some embodiments, some or all communication between the first device <NUM> and the third device <NUM> may pass through or be manipulated by the associated second device <NUM>. However, in other embodiments, only the communications related to the system ID may pass through or be manipulated by the associated second device <NUM>.

In some embodiments, the interactions between the second device <NUM> and the third device <NUM> may be the same or similar to the operations described with respect to the first device <NUM> and the second device <NUM>. That is, once the second device <NUM> stores the system ID, the requesting, storing if empty, and verifying of the system ID may be performed between the second and third devices <NUM> and <NUM>.

Referring to <FIG>, <FIG>, and <FIG>, in some embodiments, once the second device <NUM> has transmitted the system ID response in <NUM>, the second device <NUM> may begin the operations described above with respect to <FIG>. A request for the system ID stored on the third device <NUM> may be transmitted in <NUM> from the second device <NUM> to the third device <NUM>. The third device <NUM> may receive the request for the system ID stored on the third device <NUM> in <NUM>. Similar to the operations in <NUM> and <NUM> of <FIG>, in <NUM> and <NUM>, the third device <NUM> may determine if the system ID is the empty value or has not been stored and, if so, return the empty value response. Similar to the operations in <NUM> and <NUM> of <FIG>, in <NUM> and <NUM>, the second device <NUM> receives the response indicating that the system ID stored on the third device <NUM> has the empty value and transmits the system ID in response. In <NUM>, the third device <NUM> stores the system ID in the memory <NUM>. Similar to the operations in <NUM> and <NUM>, in <NUM> and <NUM>, the third device <NUM> may transmit a response based on the system ID stored on the third device <NUM> and that response is received by the second device <NUM>. Although the operations of the second device <NUM> and the third device <NUM> have been described as being similar to those of the first device <NUM> and second device <NUM>, in other embodiments, the operations may be different. For example, different encodings of the system ID, encryption used in transmission, format of responses, particular protocol, or the like may be used.

In <NUM>, the second device <NUM> may prepare a verification response based on the responses from the third device <NUM>. In some embodiments, the verification response may include the system ID response from the third device <NUM> itself. In other embodiments, the second device <NUM> may determine if the system ID stored on the third device <NUM> matches the system ID stored on the second device <NUM> similar to the interaction of the first device <NUM> in <NUM> of <FIG>. The verification response may include an indication of whether the system ID stored on the third device <NUM> is the correct system ID.

Referring to <FIG>, and <FIG>, in some embodiments, if the system ID stored on the second device <NUM> is determined to be the correct system ID in <NUM>, the first device <NUM> may transmit a verification request to the second device <NUM> in <NUM>. In <NUM>, the second device <NUM> receives the verification request. As described above, the second device <NUM> may prepare a verification response in <NUM>. This verification response may be transmitted by the second device <NUM> to the first device <NUM> in <NUM>. In <NUM>, the first device <NUM> receives the verification response and determines if the verification was successful in <NUM> based on the response. If the verification was successful, operations continue in <NUM>.

However, if the verification was not successful, counter measures may be performed in <NUM>. The counter measures may be similar to those described with respect to <NUM>. However, as the verification response may be associated with the third device <NUM>, the counter measures may also apply to the third device <NUM>. For example, the third device <NUM> may be disabled, a notification may be presented identifying the third device <NUM>, or the like.

Referring to <FIG>, <FIG>, <FIG>, and <FIG>, in some embodiments, once the second device <NUM> has prepared the verification response in <NUM>, the second device <NUM> may transmit the verification response in <NUM> to the first device <NUM> without waiting for the request transmitted in <NUM>. The operations of the first device <NUM> in <NUM>, <NUM>, <NUM>, and <NUM> may be similar to those described above.

Although the operations of the first device <NUM> and second device <NUM> have been described in the context of communications between the first device <NUM> and one second device, the same or similar communications may occur between the first device <NUM> and multiple second devices <NUM>-<NUM> to <NUM>-N. That is, the first device <NUM> may request the system ID for each of the second devices <NUM>-<NUM> to <NUM>-N and perform operations similar to those described above. The operations for different second devices <NUM>-<NUM> to <NUM>-N may be performed serially or in parallel. Decisions may be based on responses of only one of the second devices <NUM>-<NUM> to <NUM>-N, some of the second devices <NUM>-<NUM> to <NUM>-N, or all of the second devices <NUM>-<NUM> to <NUM>-N. The results of matching or mismatching system IDs may be the same, similar, or different for different second devices <NUM>-<NUM> to <NUM>-N. The operations described between a second device <NUM> and a third device <NUM> may similarly be performed with multiple third devices <NUM>. Moreover, although a three-tier hierarchy has been used as an example, and hierarchy of devices may be part of the system 800a where the first device <NUM> queries other devices for a system ID.

Referring to <FIG>, in some embodiments, an x-ray system 800b includes a host controller <NUM>, an ADB <NUM>, a TAU <NUM>, and an x-ray tube <NUM>. The host controller <NUM> may be a system controller for the x-ray system 800b. The host controller <NUM> may act as the first device <NUM> of <FIG> and perform the associated operations described in <FIG>.

The ADB <NUM> may be a circuit that manages the system ID and authentication operations of the system 800b. The ADB <NUM> may include a memory <NUM>. The ADB <NUM> may act as the second device <NUM> of <FIG> and perform the associated operations described in <FIG>.

The TAU <NUM> is a circuit configured to control the operation of the x-ray tube <NUM>. For example, the TAU <NUM> may be configured to control cathode voltages/currents, anode voltages/currents, filament voltages/currents, focusing electronics, steering electronics, motors, or the like depending on the particular x-ray tube <NUM>. The TAU <NUM> includes a memory <NUM> and may act as the third device <NUM> of <FIG> and perform the associated operations described in <FIG>.

While the TAU <NUM> has been used as an example of a device in an x-ray system 800b that may operate using a system ID as described herein, other devices in an x-ray system 800b may operate similarly. For example, a heat exchanger <NUM>, detector <NUM>, high voltage (HV) power supply, <NUM>, accelerator <NUM>, or the like may operate using a system ID as described herein.

In some embodiments, at initialization or installation, a system ID may be transmitted from the host controller <NUM> to the ADB <NUM> and stored in memory <NUM>. The ADB <NUM> may similarly propagate the system ID to the other devices <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, or the like for storage in corresponding memory <NUM> of those devices. Thus, the devices of the system 800b may be paired with that system 800b. In normal operation, the devices will report the correct system ID and the system 800b may continue operation. However, if a part is replaced in an unauthorized manner with a different, existing system ID, the counter measures described above may be performed.

In some embodiments, the host controller uses the ADB <NUM> to communicate with the rest of the manufacturer or OEM's components in the system 800b. In some embodiments the only components that are paired with the system 800b are the ADB <NUM> and the TAU <NUM>.

The use of the system ID as described herein in an x-ray system 800b may improve safety and/or longevity of the system 800b. In particular, the components of the system 800b may be aligned, calibrated, or otherwise configured for that specific x-ray system 800b. When the system 800b is initially installed, the empty system IDs in the various devices of the x-ray system 800b may be initialized to a system ID unique to that particular x-ray system 800b. If a device in the x-ray system 800b is replaced by a device from another system with a different system ID, the operation of the x-ray system 800b may not be the same and, with devices such as the x-ray tube <NUM>, may become dangerous. As described above, the x-ray system 800b may take counter measures when such a situation is detected, notifying a user, shutting down the x-ray system 800b or a component, or the like. As a result, a chance that the x-ray system 800b will be operated in a manner that may lead to erroneous results and/or dangerous operating conditions may be reduced or eliminated.

In some embodiments, the storage and verification of the system ID as described herein may limit a manufacturer or vendor's customers ability to swap components themselves or through a third party. The verification process checks to see if the ADB <NUM>, TAU <NUM>, or the like is a genuine manufacturer or OEM product and that it hasn't been swapped to/from other x-ray systems. It prevents third party service organizations buying used x-ray tubes on the open market, refurbishing them and then selling them back to customers such as hospitals. A manufacturer, vendor, system integrator, or the like may reduce a chance that their system is modified with devices from other systems, which may lead to undesirable or dangerous results.

In some embodiments, use of the system ID as described herein may reduce a chance that a reworked device is installed in a system for which it was not intended. For example, a device that has been paired with a system and has a system ID may returned for repair, updates, or the like. The device may be programmed with the original system ID or the system ID may be left intact. As a result, when that device is supplied to a customer or installer, the system ID will match the system ID of the original system. If the device is installed in a different system, even if a similar system or the same type of system, the system ID will not match and the counter measures described above may be performed. In some embodiments. , the system ID may be left unprogrammed if a known customer or installer will reinstall the device in the same system.

Referring to <FIG> and <FIG>, in some embodiments, authentication operations may be performed after successful verification in <NUM> described above. For example, in <NUM>, the first device <NUM> transmits an authentication request to the second device <NUM>. In <NUM>, the authentication request is received by the second device <NUM>. The second device <NUM> transmits an authentication request to the third device <NUM> in <NUM>.

The third device <NUM> receives the authentication request in <NUM>. In <NUM>, the third device generates an authentication response and transmits that authentication response to the second device <NUM> in <NUM>.

The second device <NUM> receives the authentication response from the third device <NUM> in <NUM>. The second device <NUM> analyzes the authentication response <NUM>, logs failures in <NUM>, and generates its own authentication response in <NUM>. The authentication response generated in <NUM> may aggregate the authentication response or responses received from one or more third devices <NUM> and the second device's <NUM> own authentication response.

In <NUM>, the first device <NUM> may transmit a request for the authentication status that is received by the second device in <NUM> as illustrated in <FIG>. In response, the second device <NUM> transmits the authentication response to the first device <NUM> in <NUM>. Alternatively, the second device <NUM> may transmit the authentication response to the first device <NUM> in <NUM> after generating it in <NUM> as illustrated in <FIG> and <FIG>.

Once the authentication response is received in <NUM>, the response may be analyzed to determine if the authentication is successful in <NUM>. If so, the operations may continue in <NUM>. If not, counter measures make be performed in <NUM> similar to the counter measures described above.

A variety of different techniques may be used to authenticate the devices <NUM> and <NUM>. In some embodiments, the authentication may be performed using a challenge using hidden numbers. An encryption algorithm may use an initialization vector (IV) and an encryption key (key). The first device <NUM> and/or the second device <NUM> may create a challenge (math problem) using its IV and key and sends it the downstream second device <NUM> or third device <NUM>. If that device has the same key and IV then it may do the same math problem and get the same result. The second device <NUM> or third device <NUM> that was "challenged" may then send back the "answer" to that math problem in an encrypted form and the original component can make sure that it answered the challenge correctly. If it responded with the correct answer then the first device <NUM> and/or the second device <NUM> may treat the corresponding second device <NUM> or third device <NUM> as a genuine part.

In some embodiments, the IV and the key are maintained in restricted memory of a cryptographic authentication integrated circuit. For example, an ATSHA integrated circuit may include such restricted memory and may be capable of performing calculations related to encrypted communications. The authentication operations may be more secure if the IV and key are stored in such restricted memory.

In some embodiments, the authentication process may be used to ensure that all required components are in the system, are designed for the particular customer, and/or are genuine manufacturer or OEM components. Different customers may have customer specific encryption keys so that a third party cannot take a component designed for one customer and sell it to another. Any missing components will fail the authentication process as they will not authenticate if they are not present. The authentication process may prevent a third party from supplying part of the system. If the full computed tomography (CT) system is designed to have <NUM> manufacturer or OEM components but only <NUM> of them are genuine and the fifth was sourced from a third party, the authentication process would identify that fifth component as not genuine.

As described above, more than one second device <NUM> and more than one third device <NUM> may be present in the system 800a. The authentication with each of these as described with respect to the single second device <NUM> and single third device <NUM>.

While the system 800a of <FIG> was used as an example, the authentication operation operations described above with respect to <FIG>may be implemented by other systems, such as the x-ray system 800b of <FIG>.

In addition to the examples described above, further aspects, features, and advantages of the invention will be made apparent by reference to the drawings, the following detailed description, and the appended claims.

Circuitry can include hardware, firmware, program code, executable code, computer instructions, and/or software. A non-transitory computer readable storage medium can be a computer readable storage medium that does not include a signal.

The operations described above may be implemented in various circuitry. For example, the operations may be implemented as a hardware circuit comprising custom very-large-scale integration (VLSI) circuits or gate arrays, including but not limited to logic chips, transistors, or other components. The operations may also be implemented in programmable hardware devices, including but not limited to field programmable gate arrays (FPGA), programmable array logic, programmable logic devices or similar devices.

Reference throughout this specification to an "example" or an "embodiment" means that a particular feature, structure, or characteristic described in connection with the example is included in at least one embodiment of the invention. Thus, appearances of the words an "example" or an "embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment.

Furthermore, the described features, structures, or characteristics may be combined in a suitable manner in one or more embodiments. In the following description, numerous specific details are provided (e.g., examples of layouts and designs) to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention can be practiced without one or more of the specific details, or with other methods, components, layouts, etc. In other instances, well-known structures, components, or operations are not shown or described in detail to avoid obscuring aspects of the invention.

Claim 1:
A device, comprising:
a mounting structure configured to mount the device (<NUM>) to an external component (<NUM>);
first circuitry (<NUM>); and
anti-tamper circuitry (<NUM>) electrically connected to the first circuitry (<NUM>) and configured to disable at least one function of the first circuitry (<NUM>) when the device (<NUM>) is removed from the external component (<NUM>),
wherein the first circuitry (<NUM>) is configured to control the external component (<NUM>),
characterized in that the device (<NUM>) comprises:
a switch (<NUM>, SW1) coupled to the mounting structure and configured such that a structure (<NUM>) of the external component (<NUM>) switches the switch (<NUM>, SW1) when the device (<NUM>) is removed from the external component (<NUM>), the switch (<NUM>, SW1) being used by the anti-tamper circuitry (<NUM>) to disable the at least one function of the first circuitry (<NUM>) until the device (<NUM>) is reset.