Patent Description:
The production and assembly of state-of-the-art electronic consumer equipment, such as smartphones, tablet computers as well as other types of loT devices, often happens in a distributed fashion in that the various electronic components or devices, including the electronic chips or microprocessors of the electronic consumer equipment are manufactured, provisioned or personalized and finally assembled at different locations and by different parties. For instance, an electronic chip or microprocessor for an electronic consumer equipment may be originally manufactured by a chip manufacturer and provisioned by another party with a suitable firmware, before being assembled into the final end product by the manufacturer of the electronic consumer equipment, e.g. an OEM.

Document <CIT> discloses a provisioning system for provisioning multiple categories of products.

Document <CIT> discloses a system comprising a configuration file producer.

Document <CIT> discloses a secure programming system and a device programmer.

For such distributed processing chains of electronic equipment there is a need for systems and methods allowing for a secure and controlled provisioning of electronic components or devices, such as chips or microprocessors of the electronic equipment.

It is therefore an object of the invention to provide systems and methods allowing for a secure and controlled provisioning of electronic devices, such as chips or microprocessors for electronic equipment.

According to a first aspect a production provisioning system is provided for provisioning a plurality of electronic devices with provisioning data, wherein each of the plurality of electronic devices is associated with an electronic device type, such as an electronic chip or processor of a certain type. The plurality of electronic devices may comprise chips, microprocessors or other programmable electronic devices, such as Flash memories, electrically erasable programmable read only memories (EEPROM), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), or microcontrollers incorporating non-volatile memory elements or Physical Unclonable Functions (PUFs). The provisioning data may include a plurality of data elements, such as personalized cryptographic keys, a firmware, a software application or another type of program code. The respective provisioning data may be digitally signed.

The provisioning system comprises a provisioning control apparatus configured to obtain device type information about the respective electronic device type of the plurality of electronic devices. Moreover, the provisioning system comprises a provisioning equipment configured to be electrically connected at a time with at least one of the plurality of electronic devices for provisioning the at least one electronic device. The provisioning system further comprises a provisioning security module configured to receive the device type information from the provisioning control apparatus and to generate provisioning data on the basis of the device type information, wherein the provisioning security module is further configured to transmit the provisioning data via the provisioning control apparatus to the provisioning equipment for provisioning the at least one electronic device with provisioning data.

The provisioning security module is further configured to maintain a provisioning counter indicative of a remaining number of the plurality of electronic devices that can be provisioned with provisioning data.

In a further embodiment, the provisioning security module is further configured to update the provisioning counter for each provisioned electronic device of the plurality of electronic devices to obtain an updated provisioning counter.

In a further embodiment, the provisioning security module is configured to update the provisioning counter for each provisioned electronic device of the plurality of electronic devices by decrementing or incrementing the provisioning counter for each provisioned electronic device of the plurality of electronic devices to obtain the updated provisioning counter.

In a further embodiment, the provisioning security module is further configured to block provisioning of a further electronic device of the plurality of electronic devices, if the updated provisioning counter indicates that the remaining number of the plurality of electronic devices that can be provisioned has been reached.

In a further embodiment, the provisioning data comprises at least a first portion and a second portion, wherein the provisioning control apparatus is configured to forward the first portion of the provisioning data to the provisioning equipment for providing the first portion of the provisioning data to the at least one electronic device and wait for the provisioning equipment to provide the first portion of the provisioning data to the at least one electronic device before forwarding the second portion of the provisioning data to the provisioning equipment for providing the second portion of the provisioning data to the at least one electronic device.

In a further embodiment, the provisioning equipment is further configured to determine the electronic device type of the respective electronic device of the plurality of electronic devices and to transmit the device type information to the provisioning control apparatus.

In a further embodiment, the provisioning data comprises at least one of a unique identifier for the at least one electronic device, one or more cryptographic keys, one or more rules for operating and/or updating the at least one electronic device.

In a further embodiment, the provisioning control apparatus is configured to obtain the device type information about the respective electronic device type of the plurality of electronic devices, in response to receiving a provisioning request for provisioning the plurality of electronic devices.

In a further embodiment, the provisioning system further comprises a remote OEM server, wherein the provisioning control apparatus is configured to receive the provisioning request for provisioning the plurality of electronic devices from the remote OEM server.

In a further embodiment, the provisioning request for provisioning the plurality of electronic devices comprises an electronic token, wherein the provisioning control apparatus is configured to forward the electronic token to the provisioning security module and wherein the electronic token comprises information indicative of a maximum number of the plurality of electronic devices that can be provisioned with provisioning data.

In a further embodiment, the electronic token further comprises data defining one or more validity time periods of the electronic token, wherein the security provisioning module is further configured to block provisioning of a further electronic device of the plurality of electronic devices outside of the one or more validity time periods. In an embodiment, the one or more validity time periods may comprise a time period by when the electronic token has to be used for the first time for provisioning an electronic device (i.e. a validity period for the token acceptance). In a further embodiment, the one or more validity time periods may comprise a time period defining up to when the electronic token can be used for provisioning electronic devices (i.e. an expiry period of the electronic token).

In a further embodiment, the electronic token further comprises a token identifier for identifying the electronic token, wherein the security provisioning module is further configured to store the token identifier in a list of electronic tokens already used or in use.

In a further embodiment, the security provisioning module is configured to receive the electronic token in encrypted form, wherein the security provisioning module is further configured to decrypt the encrypted electronic token.

In a further embodiment, the electronic token comprises a digital signature based on a private key of a token generator server, wherein the security provisioning module is configured to verify the digital signature of the electronic token using a public key of the token generator server.

According to a second aspect a method for provisioning a plurality of electronic devices with provisioning data is provided, wherein each of the plurality of electronic devices is associated with an electronic device type, such as an electronic chip or processor of a certain type. The method comprises the steps of:.

The provisioning method according to the second aspect of the invention can be performed by the provisioning system according to the first aspect of the invention. Further features of the provisioning method according to the second aspect of the invention result directly from the functionality of the provisioning system according to the first aspect of the invention and its different implementation forms described above and below.

Embodiments of the invention can be implemented in hardware and/or software.

In the figures, identical reference signs will be used for identical or at least functionally equivalent features.

In the following detailed description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the present invention may be implemented. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the present invention. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present invention is defined by the appended claims.

<FIG> shows a schematic diagram of a system <NUM> according to an embodiment of the invention, including a provisioning system <NUM> according to an embodiment of the invention for provisioning or personalizing a plurality of electronic devices <NUM>, <NUM>' such as chips or microprocessors <NUM>, <NUM>' with provisioning data <NUM>, wherein each of the plurality of electronic devices <NUM>, <NUM>' is associated with an electronic device type. In an embodiment, the provisioning data <NUM> may comprise an unique identifier for the at least one electronic device <NUM>, <NUM>', one or more cryptographic keys, one or more rules for operating and/or updating the at least one electronic device <NUM>, <NUM>' and/or a firmware for the electronic device <NUM>, <NUM>'.

As illustrated in <FIG>, the provisioning system <NUM> comprises a provisioning control apparatus <NUM> configured to obtain device type information about the respective electronic device type of the plurality of electronic devices <NUM>, <NUM>'. Moreover, the provisioning system <NUM> comprises a provisioning equipment <NUM> configured to be electrically connected with at a time at least one of the plurality of electronic devices <NUM>, <NUM>' for provisioning the at least one electronic device <NUM>, <NUM>'. In an embodiment, the provisioning equipment <NUM> is configured to determine the electronic device type of the plurality of electronic devices <NUM>, <NUM>' and to transmit the device type information to the provisioning control apparatus <NUM>.

The provisioning system <NUM> further comprises a provisioning security module <NUM> configured to receive the device type information from the provisioning control apparatus <NUM> and to generate provisioning data <NUM> on the basis of the device type information. In other words, depending on the type of the electronic device <NUM>, <NUM>' to be provisioning the provisioning security module <NUM> may generate different provisioning data <NUM>.

The provisioning security module <NUM> is further configured to transmit the provisioning data <NUM> generated on the basis of the electronic device type information via the provisioning control apparatus <NUM> to the provisioning equipment <NUM> for provisioning the at least one electronic device <NUM>, <NUM>' with the provisioning data <NUM>. The provisioning security module <NUM> is further configured to maintain a provisioning counter indicative of a remaining number of the plurality of electronic devices <NUM>, <NUM>' that can be provisioned with provisioning data <NUM>.

As will be described in more detail further below, the system <NUM> may comprise in addition to the provisioning system <NUM> a remote OEM server <NUM> and a token generator server <NUM>. As illustrated in <FIG>, the provisioning system <NUM>, the remote server <NUM> and the token generator server <NUM> may be configured to communicate with each other via a communication network, such as the Internet. Thus, the provisioning system <NUM>, the remote server <NUM> and the token generator server <NUM> may be at different locations and under the control of different parties. In an embodiment, the remote server <NUM> may be under the control or associated with an electronic equipment manufacturer, e.g. an OEM, wherein the electronic equipment manufacturer assembles electronic equipment, such as smart phones, tablet computers or other types of loT or electronic consumer equipment, using the electronic devices <NUM>, <NUM>' provisioned by the provisioning system <NUM> with the provisioning data <NUM>. In an embodiment, the provisioning data <NUM> may comprise a firmware of the electronic equipment manufacturer associated with the remote server <NUM>. Advantageously, this allows the electronic equipment manufacturer to have control over the provisioning of the electronic devices <NUM>, <NUM>' with its firmware.

In an embodiment, the provisioning system <NUM>, the remote server <NUM> and the token generator server <NUM> are configured to securely communicate with each other using one or more cryptographic schemes, such as a public key infrastructure and/or a hybrid cryptographic scheme.

In an embodiment, the provisioning security module <NUM> is configured to be coupled to the provisioning control apparatus <NUM>, for instance, by a wired or a wireless connection. In an embodiment, the provisioning control apparatus <NUM> may be implemented as a personal computer and the provisioning security module <NUM> may be implemented as a PC card inserted in the provisioning control apparatus <NUM>. The provisioning equipment <NUM> may comprise an electrical and/or mechanical interface for interacting directly or indirectly with one or more of the plurality of electronic devices <NUM>, <NUM>'. For instance, the provisioning equipment <NUM> may comprise a personalization tray for personalizing a batch of electronic devices <NUM>, <NUM>' inserted therein.

In an embodiment, the provisioning security module <NUM> is configured to update the provisioning counter for each provisioned electronic device of the plurality of electronic devices <NUM>, <NUM>' to obtain an updated provisioning counter. For instance, the provisioning security module <NUM> may be configured to update the provisioning counter for each provisioned electronic device of the plurality of electronic devices <NUM>, <NUM>' by decrementing the provisioning counter for each provisioned electronic device of the plurality of electronic devices <NUM>, <NUM>' to obtain the updated provisioning counter. In another embodiment, the provisioning counter may be incremented until the maximum number of allowed electronic devices <NUM>, <NUM>' have been provisioned. The provisioning security module <NUM> may be further configured to block provisioning of a further electronic device of the plurality of electronic devices <NUM>, <NUM>', if the updated provisioning counter indicates that the remaining number of the plurality of electronic devices <NUM>, <NUM>' that can be provisioned has been reached, e.g. if the updated provisioning counter is equal to zero (in case of decrementing the provisioning counter for each device) or equal to the maximum number of allowed electronic devices <NUM>, <NUM>' (in case of incrementing the provisioning counter for each device). In other words, once the total number of electronic devices <NUM>, <NUM>' have been provisioned, the provisioning security module <NUM> will prevent the provisioning of any further electronic devices <NUM>, <NUM>' with the provisioning data <NUM> by the provision equipment <NUM>.

In an embodiment, the provisioning control apparatus <NUM> is configured to obtain the device type information about the respective electronic device type of the plurality of electronic devices <NUM>, <NUM>', in response to receiving a provisioning request for provisioning the plurality of electronic devices <NUM>, <NUM>'. In an embodiment, the provisioning control apparatus <NUM> is configured to receive the provisioning request for provisioning the plurality of electronic devices <NUM>, <NUM>' from the remote OEM server <NUM>.

In an embodiment, the provisioning request for provisioning the plurality of electronic devices <NUM>, <NUM>' comprises an electronic token <NUM>, wherein the provisioning control apparatus <NUM> is configured to forward the electronic token <NUM> to the provisioning security module <NUM> and wherein the electronic token <NUM> comprises information <NUM>, as illustrated in <FIG>, indicative of a maximum number of the plurality of electronic devices <NUM>, <NUM>' that can be provisioned by the provisioning equipment <NUM> with the provisioning data <NUM>. In an embodiment, the security provisioning module <NUM> is configured to receive the electronic token <NUM> in encrypted form, wherein the security provisioning module <NUM> is further configured to decrypt the encrypted electronic token <NUM>. In an embodiment, the electronic token <NUM> comprises a digital signature <NUM> (see <FIG>) based on a private key 121a of the token generator server <NUM>, wherein the security provisioning module <NUM> is configured to verify the digital signature <NUM> of the electronic token <NUM> using a public key 121b of the token generator server <NUM>.

As illustrated in <FIG>, the electronic token <NUM> may further comprise data <NUM> defining one or more validity time periods of the electronic token <NUM>, wherein the security provisioning module <NUM> is further configured to block provisioning of a further electronic device of the plurality of electronic devices <NUM>, <NUM>' outside of the one or more validity time periods. In an embodiment, the one or more validity time periods may comprise a time period by when the electronic token <NUM> has to be used for the first time for provisioning an electronic device <NUM>, <NUM>' (i.e. a validity period for the token acceptance). In a further embodiment, the one or more validity time periods may comprise a time period defining up to when the electronic token <NUM> can be used for provisioning electronic devices <NUM>, <NUM>' (i.e. an expiry period of the electronic token <NUM>).

In the embodiment shown in <FIG>, the electronic token <NUM> further comprises a token identifier <NUM> for identifying the electronic token <NUM>, wherein the security provisioning module <NUM> is further configured to store the token identifier <NUM> in a list of electronic tokens already used or in use in order to prevent replay attacks. In an embodiment, the token identifier <NUM> may be a nonce <NUM>.

As illustrated in <FIG>, the electronic token <NUM> may comprise further data, such as provisioning control data <NUM> for controlling communications between the security provisioning module <NUM> and the provisioning control apparatus <NUM>. In an embodiment, these provisioning control data <NUM> may be provided in a header <NUM> of the electronic token <NUM>. In an embodiment, the provisioning control data <NUM> may identify a secure communication protocol for securing the communication between the security provisioning module <NUM> and the provisioning control apparatus <NUM>. As illustrated in <FIG>, the electronic token <NUM> may further comprise an OEM identifier <NUM>, a firmware identifier <NUM>, an electronic device type identifier <NUM>.

<FIG> shows a signaling diagram illustrating the interaction of the components of the provisioning system <NUM> and the electronic device(s) <NUM>, <NUM>' to be provisioned. In <FIG> the following steps are illustrated, some of which already have been described in the context of <FIG> and <FIG> above.

In step <NUM> of <FIG>, the provisioning control apparatus <NUM> receives a request for provisioning one or more of the plurality of electronic devices <NUM>, <NUM>'. As already described above, in an embodiment, this request may be issued by the remote OEM server <NUM> and may comprise the electronic token <NUM>.

In step <NUM> of <FIG>, the provisioning equipment <NUM> obtains information about electronic device type of the currently to be provisioned electronic device(s) <NUM>, <NUM>', such as the electronic device(s) currently inserted into a personalization tray of the provisioning equipment <NUM>.

In steps <NUM> and <NUM> of <FIG>, the provisioning equipment <NUM> forwards the device type information to the provisioning control apparatus <NUM>, which, in turn, relays the device type information to the security provisioning module <NUM>.

In step <NUM> of <FIG>, the security provisioning module <NUM> checks whether the current value of the electronic provisioning counter allows provisioning of a further electronic device <NUM>, <NUM>'. If this is the case, the security provisioning module <NUM> generates the provisioning data <NUM> (step <NUM>) and decrements the electronic provisioning counter (step <NUM>). In the embodiment shown in <FIG>, the provisioning data <NUM> comprises a plurality of data sets or chunks, including at least a first data set and a second data set.

In step 313a of <FIG>, the security provisioning module <NUM> forwards the first data set (Data Set A) of the provisioning data <NUM> to the provisioning control apparatus <NUM>, which, in turn, relays the first data set (Data Set A) of the provisioning data <NUM> to the provisioning equipment <NUM> (step 315a).

In step 317a of <FIG>, the provisioning equipment <NUM> writes the first data set of the provisioning data <NUM> to the electronic device <NUM>, <NUM>', such as to a memory of the electronic device <NUM>, <NUM>' (as will be appreciated, in an embodiment, where the provisioning data <NUM> only includes a first data set generated in step <NUM>, the provisioning would be complete with step 317a of <FIG>). In parallel to or after writing the first data set (Data Set A) of the provisioning data <NUM> to the electronic device <NUM>, <NUM>', the provisioning equipment <NUM> may send an acknowledgement message to the provisioning control apparatus <NUM> (step 318a), which, in turn, relays the acknowledgement message to the security provisioning module <NUM> for requesting a further data set of the provisioning data <NUM> (step 319a).

In step 313b of <FIG>, in response to receiving the acknowledgement message from the provisioning control apparatus <NUM>, the security provisioning module <NUM> forwards the next portion, e.g. the second data set (Data Set B) of the provisioning data <NUM> to the provisioning control apparatus <NUM>, which, in turn, relays the second data set (Data Set B) of the provisioning data <NUM> to the provisioning equipment <NUM> (step 315b).

The further steps 317b, 318b and 319b are identical to the steps 317a, 318a and 319a already described above. The sequence of steps 313a-319a will be repeated until all of the data sets making up the provisioning data <NUM> have been provided to the currently provisioned electronic device <NUM>, <NUM>'. Once this has been completed, the next electronic device <NUM>, <NUM>' or batch of electronic devices <NUM>, <NUM>' may be provisioned in the way illustrated in <FIG>.

<FIG> shows a flow diagram illustrating steps of a correspond provisioning method <NUM> according to an embodiment of the invention. The provisioning method <NUM> according to an embodiment of the invention comprises the following steps:.

While a particular feature or aspect of the disclosure may have been disclosed with respect to only one of several implementations or embodiments, such feature or aspect may be combined with one or more other features or aspects of the other implementations or embodiments as may be desired and advantageous for any given or particular application.

Furthermore, to the extent that the terms "include", "have", "with", or other variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprise". Also, the terms "exemplary", "for example" and "e.g." are merely meant as an example, rather than the best or optimal. The terms "coupled" and "connected", along with derivatives may have been used. It should be understood that these terms may have been used to indicate that two elements cooperate or interact with each other regardless whether they are in direct physical or electrical contact, or they are not in direct contact with each other.

Although the elements in the following claims are recited in a particular sequence, unless the claim recitations otherwise imply a particular sequence for implementing some or all of those elements, those elements are not necessarily intended to be limited to being implemented in that particular sequence.

Claim 1:
A provisioning system (<NUM>) for provisioning a plurality of electronic devices (<NUM>, <NUM>') with provisioning data (<NUM>), each of the plurality of electronic devices (<NUM>, <NUM>') being associated with an electronic device type, wherein the production provisioning system (<NUM>) comprises:
a remote server (<NUM>);
a provisioning control apparatus (<NUM>) configured to obtain device type information about the electronic device type of the plurality of electronic devices (<NUM>, <NUM>'), in response to receiving a provisioning request for provisioning the plurality of electronic devices (<NUM>, <NUM>') from the remote server (<NUM>);
a provisioning equipment (<NUM>) configured to be electrically connected with at least one of the plurality of electronic devices (<NUM>, <NUM>') for provisioning the at least one electronic device (<NUM>, <NUM>'); and
a provisioning security module (<NUM>) configured to receive the device type information from the provisioning control apparatus (<NUM>) and to generate provisioning data (<NUM>) on the basis of the device type information, wherein the provisioning security module (<NUM>) is further configured to transmit the provisioning data (<NUM>) via the provisioning control apparatus (<NUM>) to the provisioning equipment (<NUM>) for provisioning the at least one electronic device (<NUM>, <NUM>') with provisioning data (<NUM>);
wherein the provisioning security module (<NUM>) is further configured to maintain a provisioning counter indicative of a remaining number of the plurality of electronic devices (<NUM>, <NUM>') that can be provisioned with provisioning data (<NUM>),
wherein the provisioning request for provisioning the plurality of electronic devices (<NUM>, <NUM>') comprises an electronic token (<NUM>) and wherein the provisioning control apparatus (<NUM>) is configured to forward the electronic token (<NUM>) to the provisioning security module (<NUM>), wherein the electronic token (<NUM>) comprises information (<NUM>) indicative of a maximum number of the plurality of electronic devices (<NUM>, <NUM>') that can be provisioned with the provisioning data (<NUM>),
wherein the electronic token (<NUM>) comprises provisioning control data for controlling communications between the provisioning security module (<NUM>) and the provisioning apparatus (<NUM>).