Method for authenticating an integrated circuit device

• US 10,505,931 B2
• Filed: 06/02/2017
• Issued: 12/10/2019
• Est. Priority Date: 06/02/2017
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: De Jong, Hans, Brands, Jan Rene
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US15/611,904
• Publication Number:
  US 20180351948A1
• Time in Patent Office: 921 Days
• Field of Search: None
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

A method is provided for authenticating an IC device. The method includes provisioning an integrated circuit (IC) device with a unique identification number (UID). The IC device is configured to calculate a device-specific key (DSK) using the UID. The UID is used with a secure application separate from the IC device to calculate the DSK. The DSK calculated by the IC device is the same as the DSK calculated by the secure application. The UID and the DSK calculated by the secure application is provided to a provider of an online service. The provider of the online service is enabled to authenticate the IC device using the UID and the DSK calculated with the secure application in response to the IC device contacting the online service. The provider may authenticate the device using a standard cryptographic challenge-response protocol. If the IC device has knowledge of a particular DSK, then the IC device is a legitimate authorized device.

Claims

1. A method comprising:

provisioning, by an integrated circuit (IC) manufacturer, an IC device with a unique identification number (UID);

configuring the IC device to calculate a device-specific key (DSK) using the UID;

enabling an original device manufacturer to use the UID and a secure application separate from the IC device, to calculate a DSK for the IC device, the DSK calculated using the secure application being the same as the DSK calculated by the IC device;

providing the UID and the DSK calculated with the secure application separate from the IC device to a provider of an online service, wherein the original device manufacturer is separate from the provider of the online service; and

enabling the provider of the online service to authenticate the IC device using the UID and the DSK calculated with the secure application in response to the IC device accessing the online service.

2. The method of claim 1, wherein provisioning an integrated circuit (IC) device with a unique identification number (UID) further comprises provisioning a plurality of IC devices, each with a UID.

3. The method of claim 2, further comprising creating a log file of a UID and corresponding DSK for each of the plurality of IC devices.

4. The method of claim 3, wherein creating a log file of a UID and corresponding DSK for each of the plurality of IC devices further comprises providing the log file to the provider of the online service.

5. The method of claim 1, wherein enabling the provider of the online service to authenticate the IC device further comprises enabling the provider of the online service to authenticate the IC device using a predetermined cryptographic challenge-response protocol.

6. The method of claim 1, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

7. The method of claim 1, wherein provisioning the IC device with the UID further comprises using a wafer tester to provision the IC device with the UID.

8. The method of claim 1, wherein the IC device is characterized as being an internet of things (IoT) device.

9. The method of claim 1, wherein using the UID and a secure application separate from the IC device, calculating a DSK for the IC device further comprises calculating the DSK for the IC device by the original device manufacturer (ODM) using the secure application stored on a smartcard.

10. A method comprising:

provisioning, by an integrated circuit (IC) manufacturer, a plurality of IC devices with unique identification numbers, each of the plurality of IC devices being provided with a unique identification number (UID);

configuring each of the plurality of IC devices to calculate a device-specific key (DSK) using the UID;

enabling an original device manufacturer to use the UID and a secure application separate from the IC device, to calculate a DSK for each of the plurality of IC devices, the DSK calculated using the secure application being the same as the DSK calculated by the IC device;

providing the UIDs and the DSKs calculated with the secure application separate from the IC device to a provider of an online service, wherein the original device manufacturer is separate from the provider of the online service; and

enabling the provider of the online service to authenticate an IC device using the UIDs and the DSKs calculated with the secure application in response to the IC device accessing the online service.

11. The method of claim 10, further comprising creating a log file of a UID and corresponding DSK for each of the plurality of IC devices.

12. The method of claim 11, wherein creating the log file of a UID and corresponding DSK for each of the plurality of IC devices further comprises providing the log file to the provider of the online service.

13. The method of claim 10, wherein enabling the provider of the online service to authenticate the IC device further comprises enabling the provider of the online service to authenticate the IC device using a predetermined cryptographic challenge-response protocol.

14. The method of claim 10, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

15. The method of claim 10, wherein provisioning the plurality of IC devices with the UIDs further comprises using a wafer tester to provision the plurality of IC devices with the UIDs.

16. The method of claim 10, wherein the IC device is characterized as being an internet of things (IoT) device.

17. The method of claim 10, wherein using the UID and a secure application separate from the IC device, calculating a DSK for the IC device further comprises calculating the DSK for the plurality of IC devices by the original device manufacturer further comprises using a wafer tester to provision the plurality of IC devices with the UIDs.

18. A method comprising:

provisioning, by an integrated circuit (IC) manufacturer, a plurality of IC devices with unique identification numbers, each of the plurality of IC devices being provided with a unique identification number (UID);

configuring each of the plurality of IC devices to calculate a device-specific key (DSK) using the UID;

enabling an original device manufacturer to use the UID and a secure application separate from the IC device, to calculate a DSK for each of the plurality of IC devices, the DSK calculated using the secure application being the same as the DSK calculated by the IC device;

creating a log file of a UID and corresponding DSK for each of the plurality of IC devices;

providing the log file of UIDs and DSKs calculated with the secure application separate from the IC device to a provider of an online service, wherein the original device manufacturer is separate from the provider of the online service; and

enabling the provider of the online service to authenticate an IC device using the UIDs and the DSKs calculated with the secure application in response to the IC device accessing the online service.

19. The method of claim 18, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

20. The method of claim 18, wherein provisioning the plurality of IC devices with the UIDs is performed by a contract manufacturer that manufactured the plurality of IC devices for an original device manufacturer (ODM).