Patent Description:
The production and assembly of state-of-the-art electronic consumer equipment, such as smartphones, tablet computers as well as other types of loT devices, often happens in a distributed fashion in that the various electronic components or devices, including the electronic chips or microprocessors of the electronic consumer equipment are manufactured, provisioned or personalized and finally assembled at different locations and by different parties. For instance, an electronic chip or microprocessor for an electronic consumer equipment may be originally manufactured by a chip manufacturer (also known as "silicon vendor") and provisioned by another party with personalized provisioning data, before being assembled into the final end product by the manufacturer of the electronic consumer equipment, e.g. an OEM (Original Equipment Manufacturer).

Often the personalized provisioning data includes firmware, software applications or other types of program code of the OEM as well as one or more personalized cryptographic keys, such as RSA private/public key pairs or ECC-type keys, which are unique for each electronic device to be provisioned. However, before the actual production of electronics devices for the OEM, i.e. the provisioning of the electronics devices with personalized provisioning data, the provisioning process must usually be tested to work correctly. Generally, this testing phase is done by the OEM.

Document <CIT> discloses a method of securely provisioning a module with cryptographic parameters.

Document <CIT> discloses a method of cryptographic material provisioning.

For such distributed processing chains of electronic equipment there is a need for apparatuses, methods allowing for a secure and controlled provisioning of electronic components or devices, such as chips or microprocessors of the electronic equipment.

It is therefore an object of the invention to provide apparatuses, systems and methods allowing for a secure and controlled provisioning of electronic devices, such as chips or microprocessors for electronic equipment.

According to a first aspect of the invention a method for provisioning a plurality of electronic devices with a respective personalized provisioning data set is provided. Each electronic device comprises a hardware security enclave providing a secret device master key. The electronic devices may comprise chips, microprocessors or other programmable electronic components, such as Flash memories, electrically erasable programmable read only memories (EEPROM), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), and microcontrollers incorporating non-volatile memory elements.

The method comprises, in a test provisioning stage, i.e. in a stage where the provisioning of the electronic devices is developed and tested, the following steps:.

In an embodiment, the first provisioning data set further comprises data encrypted with the at least one test application key in plaintext.

In an embodiment, in a production provisioning stage, i.e. in a stage where the electronic devices are provisioned for production, the method further comprises the steps of:.

In an embodiment, the second provisioning data set further comprises data encrypted with the at least one application key in plaintext.

In an embodiment, the at least one test application key has a first key entropy and the at least one application key has a second key entropy, wherein the first key entropy is substantially, e.g. by many orders of magnitude smaller than the second key entropy.

In an embodiment, the at least one test application key has a first key size, i.e. key length and the at least one application key has a second key size, i.e. key length, wherein the first key size is equal to the second key size.

In an embodiment, the method comprises, in the test provisioning stage, generating the at least one test application key in plaintext based on a key generation mechanism and, in the production provisioning stage, generating the at least one application key based on the same key generation mechanism.

In an embodiment, the method comprises, in the test provisioning stage, generating the at least one test application key using a first set of random seed numbers and, in the production provisioning stage, generating the at least one application key using a second set of random seed numbers, wherein the entropy of the first set of random numbers is smaller than the entropy of the second set of random numbers.

In an embodiment, the second set of random numbers comprises substantially more random numbers than the first set of random numbers. In the case of the test application key used during the test provisioning stage, the first set of random numbers may be used to choose a key value from a set of predetermined key values which are fixed. Here, the randomness comes from randomly choosing a fixed key value from a set of maybe <NUM> numbers. Alternatively, for some applications there may only be a single, fixed number of keys be defined. In the case of the application key used during the production provisioning stage the second set of random numbers may be random numbers for the entire key. In this case, there could be up to <NUM> to the power <NUM> possible random numbers, i.e. much more than only <NUM> numbers.

In an embodiment, the method further comprises the step of decrypting the encrypted second wrapping key on the basis of the device master key and the step of decrypting the at least one encrypted application key using the second wrapping key for retrieving the at least one application key.

In an embodiment, the method further comprises storing the at least one application key in the hardware security enclave of the electronic device.

In an embodiment, the first wrapping key (used for wrapping the at least one application test key for the test provisioning stage) and the second wrapping key (used for wrapping the at least one application key for the production provisioning stage) have substantially the same key entropy.

In an embodiment, the first wrapping key has the same key bit length as the second wrapping key.

In an embodiment, the method further comprises, in the production provisioning stage, transmitting the respective second provisioning data set from a production provisioning control apparatus to a production provisioning equipment server.

In an embodiment, the method comprises, in the production provisioning stage, transmitting the respective second provisioning data set towards the provisioning equipment server via a wired connection.

According to a second aspect the invention relates to a provisioning control system implementing the method according to the first aspect. The provisioning control system may comprise a production provisioning control apparatus and a production provisioning equipment server being electrically connectable with a plurality of electronic devices for provisioning the plurality of electronic devices with a respective personalized provisioning data set, wherein the production provisioning control apparatus is coupled to the production provisioning equipment server for controlling the provisioning of the one or more electronic devices.

Embodiments of the invention can be implemented in hardware and/or software.

In the figures, identical reference signs will be used for identical or at least functionally equivalent features.

In the following detailed description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the present invention may be implemented. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the present invention. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present invention is defined by the appended claims.

<FIG> shows a schematic diagram of a provisioning system <NUM> according to an embodiment of the invention. As will be described in more detail further below, the provisioning system <NUM> may comprise in addition to a production provisioning control apparatus <NUM> a remote server 110a, a token generator server <NUM> and a production provisioning equipment server <NUM> for provisioning or personalizing electronic devices <NUM>, such as chips or microprocessors <NUM> with a respective personalized provisioning data set <NUM>'. In an embodiment, the remote server <NUM> may comprise or implement a development provisioning apparatus 110a for testing and developing the provisioning of the electronic devices <NUM> with a respective personalized provisioning data set <NUM>. In an embodiment, the remote server 110a may be operated by the electronic equipment manufacturer, i.e. the OEM as a part of a testing and developing environment <NUM> of the OEM. As illustrated in <FIG>, the development provisioning apparatus 110a may comprise a processor <NUM>, a communication interface <NUM> and a memory <NUM>.

Under further reference to <FIG> and as will be described in more detail below, the provisioning control system <NUM> of <FIG> may implement a method for provisioning the plurality of electronic devices <NUM> with a respective provisioning data set <NUM>, <NUM>'.

As illustrated in <FIG>, the production provisioning control apparatus <NUM>, the remote server 110a and the token generator server <NUM> may be configured to communicate with each other via a communication network, such as the Internet. Thus, the production provisioning control apparatus <NUM>, the remote server <NUM> and the token generator server <NUM> may be at different locations and under the control of different parties. As illustrated in <FIG>, the production provisioning control apparatus <NUM> and the production provisioning equipment server <NUM> may be located within a production environment <NUM>, such as a personalization factory <NUM>. As already mentioned above, the remote server <NUM> implementing the development provisioning apparatus 110a may be under the control or associated with an electronic equipment manufacturer, e.g. an OEM, wherein the electronic equipment manufacturer assembles electronic equipment, such as smartphones, tablet computers or other types of IoT or electronic consumer equipment, using the electronic devices <NUM> provisioned by the production provisioning equipment server <NUM> with the respective personalized provisioning data set <NUM>. In an embodiment, the respective personalized provisioning data set <NUM> may comprise a firmware or software application of the electronic equipment manufacturer associated with the remote server <NUM>. Advantageously, this allows the electronic equipment manufacturer to have control over the provisioning of the electronic devices with its firmware or software applications.

In an embodiment, the production provisioning control apparatus <NUM>, the remote server <NUM> and the token generator server <NUM> are configured to securely communicate with each other using one or more cryptographic schemes, such as a public key infrastructure and/or a hybrid cryptographic scheme.

The production provisioning control apparatus <NUM> is configured to be coupled to the provisioning equipment server <NUM>, for instance, by a wired or a wireless connection. In an embodiment, the production provisioning equipment server <NUM> may be implemented as a personal computer and the production provisioning control apparatus <NUM> may be implemented as a PC card inserted in the production provisioning equipment server <NUM>. The production provisioning equipment server <NUM> may comprise an electrical and/or mechanical interface for interacting directly or indirectly via a provisioning equipment with the electronic devices <NUM>. For instance, the production provisioning equipment server <NUM> may comprise a personalization tray for personalizing a batch of electronic devices <NUM> inserted therein.

In the embodiment illustrated in <FIG> the production provisioning control apparatus <NUM> comprises a processor <NUM>, a communication interface <NUM> and a non-transient memory <NUM>. The communication interface <NUM> is configured to transmit the plurality of personalized provisioning data sets <NUM>' to the production provisioning equipment server <NUM>.

<FIG> shows a flow diagram illustrating a provisioning method <NUM> according to an embodiment implemented within the provisioning system <NUM> shown in <FIG>. Further embodiments of the provisioning method shown in <FIG> will be described in the following under further reference to <FIG>, <FIG> and <FIG>, <FIG>. <FIG> and <FIG> illustrate the generation of keys and the provisioning of an electronic device during a test provisioning stage of the provisioning method <NUM> according to an embodiment, whiles <FIG> and <FIG> illustrate the generation of keys and the provisioning of an electronic device during a production provisioning stage of the provisioning method <NUM> according to an embodiment.

As already described above, the method <NUM> shown in <FIG> allows provisioning the electronic devices <NUM> with a respective provisioning data set <NUM>, <NUM>' during a test provisioning stage and during a production provisioning stage. As illustrated in <FIG>, each electronic device <NUM> comprises a hardware security enclave 170a (also referred to as "crypto enclave") providing a secret device master key <NUM>. The hardware security enclave 170a of the electronic device <NUM> may comprise or be similar to the security enclave processor as disclosed in <CIT>.

As illustrated in <FIG> and <FIG>, the provisioning method <NUM> comprises in the test provisioning stage a first step <NUM> of generating at least one test application key 305a-n in plaintext and encrypting, i.e. wrapping the at least one test application key 305a-n using a first wrapping key <NUM> (referred to as "vendor wrapping key" in <FIG>) for generating at least one encrypted test application key 305a'-n'. Moreover, as illustrated in <FIG> and <FIG>, the provisioning method <NUM> comprises in the test provisioning stage a further step <NUM> of encrypting, i.e. wrapping the first wrapping key <NUM> using the secret device master key <NUM> for generating an encrypted first wrapping key <NUM>'. This wrapping of the first wrapping key <NUM> using the secret device master key <NUM> may be provided by a wrapping service <NUM> of the manufacturer of the electronic device <NUM>, i.e. the silicon vendor.

As illustrated in <FIG>, in the test provisioning stage the provisioning method <NUM> comprises a further step <NUM> of provisioning one or more of the plurality of electronic devices <NUM> (referred to as "silicon device" in <FIG>) with a respective first provisioning data set <NUM>, wherein the respective first provisioning data set <NUM> comprises the at least one test application key 305a-n in plaintext, the at least one encrypted test application key 305a'-n' and the encrypted first wrapping key <NUM>' (also illustrated in <FIG>). As illustrated in <FIG>, in an embodiment, the first provisioning data set <NUM> may further comprise data encrypted with the at least one test application key 305a-n in plaintext.

Moreover, the provisioning method <NUM> in the test provisioning stage comprises a further step of testing a security function of the electronic device <NUM> using at least a portion of the first provisioning data set <NUM>, such as the plaintext and/or wrapped test application key 305a-n.

As already mentioned above, <FIG> and <FIG> illustrate further steps of the method <NUM> during the production provisioning stage, namely the generation of keys and the provisioning of the electronic device <NUM> during a production provisioning stage of the provisioning method <NUM> according to an embodiment.

As illustrated in <FIG>, in the production provisioning stage the method <NUM> may further comprise a step of generating at least one application key 405a in plaintext and encrypting, i.e. wrapping the at least one application key 405a using a second wrapping key <NUM> (referred to as "vendor wrapping key" in <FIG>) for generating at least one encrypted, i.e. wrapped application key. As illustrated in <FIG>, in the production provisioning stage the method <NUM> may further comprise a step of encrypting, i.e. wrapping the second wrapping key <NUM> using the secret device master key <NUM> for generating an encrypted, i.e. wrapped second wrapping key <NUM>'. This wrapping of the second wrapping key <NUM> using the secret device master key <NUM> may be provided by the wrapping service <NUM> of the manufacturer of the electronic device <NUM>, i.e. the silicon vendor. As illustrated in <FIG>, in the production provisioning stage the method <NUM> may further comprise a step of provisioning the electronic device <NUM> with a second provisioning data set <NUM>', wherein the second provisioning data set <NUM>' comprises the at least one encrypted, i.e. wrapped application key 405a' and the encrypted, i.e. wrapped second wrapping key <NUM>'.

As illustrated in <FIG>, the encrypted, i.e. wrapped application key 405a' and the encrypted, i.e. wrapped second wrapping key <NUM>' may be provided to and/or stored within the hardware security enclave 170a of the electronic device <NUM>. Within the hardware security enclave 170a of the electronic device <NUM> a key recovery algorithm <NUM> may be configured to unwrap the wrapped second wrapping key <NUM>' based on the secret device master key <NUM> for obtaining the plaintext second wrapping key <NUM>, which may be further used to unwrap, i.e. decrypt the least one encrypted, i.e. wrapped application key 405a' for obtaining the plaintext application key 405a. In an embodiment, the method further comprises storing the at least one plaintext application key 405a in the hardware security enclave 170a of the electronic device <NUM>. In an embodiment, the method may further comprise decrypting further data of the second provisioning data set <NUM>' using the at least one plaintext application key 405a.

In an embodiment, the at least one test application key 305a-n has a first key entropy and the at least one application key 405a has a second key entropy, wherein the first key entropy is substantially, e.g. by many orders of magnitude smaller than the second key entropy.

In an embodiment, the at least one test application key 305a-n has a first key size, i.e. key length and the at least one application key 405a has a second key size, i.e. key length, wherein the first key size is equal to the second key size.

In an embodiment, the method <NUM> comprises, in the test provisioning stage, generating the at least one test application key 305a-n in plaintext based on a key generation mechanism and, in the production provisioning stage, generating the at least one application key <NUM> based on the same key generation mechanism. Thus, in an embodiment, the method <NUM> may generate the test application key 305a-n in the test provisioning stage and the application key 405a in the production provisioning stage using the same key generation mechanism for ensuring, for instance, that the keys have the same key size.

In an embodiment, the method <NUM> comprises, in the test provisioning stage, generating the at least one test application key 305a-n using a first set of random numbers or random seed numbers and, in the production provisioning stage, generating the at least one application key <NUM> using a second set of random number or random seed numbers, wherein the entropy of the first set of random numbers or random seed numbers is smaller than the entropy of the second set of random numbers or random seed numbers.

In an embodiment, the second set of random numbers or random seed numbers comprises substantially more random numbers or random seed numbers than the first set of random numbers. In the case of the test application key 305a-n used during the test provisioning stage, the first set of random numbers or random seed numbers may be used to choose a key value from a set of predetermined key values which are fixed. Here, the randomness comes from randomly choosing a fixed key value from a set of maybe <NUM> numbers. Alternatively, for some applications there may only be a single, fixed number of keys defined. In the case of the application key 405a used during the production provisioning stage the second set of random numbers may be random numbers for the entire key. In this case, there could be up to <NUM> to the power <NUM> possible random numbers, i.e. much more than only <NUM> numbers.

By way of example, in an embodiment, in the test provisioning stage a reduced set of numbers may be used as the source for a key generation mechanism. In an embodiment, rather than using a small set of "random" numbers, the numbers may be chosen such that they do not appear very random at all. By way of example, the following "random numbers" may be used for generating the weakened test application key 305a-n in the test provisioning stage:
0x111111111111111111111111111111111111111111111111
0x222222222222222222222222222222222222222222222222.

Thus, in an embodiment, the method <NUM> may implement the following scheme in the test provisioning stage for generating the weakened test application key 305a-n.

In an embodiment, the first wrapping key <NUM> (used for wrapping the at least one application test key 305a-n for the test provisioning stage) and the second wrapping key <NUM> (used for wrapping the at least one application key <NUM> for the production provisioning stage) have substantially the same key entropy. In an embodiment, the first wrapping key <NUM> has the same key bit length as the second wrapping key <NUM>.

While a particular feature or aspect of the disclosure may have been disclosed with respect to only one of several implementations or embodiments, such feature or aspect may be combined with one or more other features or aspects of the other implementations or embodiments as may be desired and advantageous for any given or particular application.

Furthermore, to the extent that the terms "include", "have", "with", or other variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprise". Also, the terms "exemplary", "for example" and "e.g." are merely meant as an example, rather than the best or optimal. The terms "coupled" and "connected", along with derivatives may have been used. It should be understood that these terms may have been used to indicate that two elements cooperate or interact with each other regardless whether they are in direct physical or electrical contact, or they are not in direct contact with each other.

Although the elements in the following claims are recited in a particular sequence, unless the claim recitations otherwise imply a particular sequence for implementing some or all of those elements, those elements are not necessarily intended to be limited to being implemented in that particular sequence.

Claim 1:
A method (<NUM>) for provisioning a plurality of electronic devices (<NUM>) with a respective provisioning data set (<NUM>, <NUM>'), wherein each electronic device (<NUM>) comprises a hardware security enclave (170a) providing a secret device master key (<NUM>), wherein the method (<NUM>) comprises in a test provisioning stage:
generating (<NUM>) at least one test application key (305a-n) in plaintext and encrypting the at least one test application key (305a-n) using a first wrapping key (<NUM>) for generating at least one encrypted test application key (305a'-n');
encrypting (<NUM>) the first wrapping key (<NUM>) using the secret device master key (<NUM>) for generating an encrypted first wrapping key (<NUM>');
provisioning (<NUM>) at least one of the plurality of electronic devices (<NUM>) with a respective first provisioning data set (<NUM>), wherein the respective first provisioning data set (<NUM>) comprises the at least one test application key (305a-n) in plaintext, the at least one encrypted test application key (305a'-n') and the encrypted first wrapping key (<NUM>'); and
testing (<NUM>) a security function of the electronic device (<NUM>) on the basis of at least a portion of the first provisioning data set (<NUM>), such as the plaintext test application key (305a-n) and the encrypted test application key (305a'-n'), for debugging the first provisioning data set (<NUM>) in order to test and develop the provisioning of the electronic devices (<NUM>) with a respective second provisioning data set (<NUM>').