METHOD FOR AUTHENTICATING AN INTEGRATED CIRCUIT DEVICE

• US 20180351948A1
• Filed: 06/02/2017
• Published: 12/06/2018
• Est. Priority Date: 06/02/2017
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: DE JONG, HANS, BRANDS, JAN RENE
• Granted Patent: US 10,505,931 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

A method is provided for authenticating an IC device. The method includes provisioning an integrated circuit (IC) device with a unique identification number (UID). The IC device is configured to calculate a device-specific key (DSK) using the UID. The UID is used with a secure application separate from the IC device to calculate the DSK. The DSK calculated by the IC device is the same as the DSK calculated by the secure application. The UID and the DSK calculated by the secure application is provided to a provider of an online service. The provider of the online service is enabled to authenticate the IC device using the UID and the DSK calculated with the secure application in response to the IC device contacting the online service. The provider may authenticate the device using a standard cryptographic challenge-response protocol. If the IC device has knowledge of a particular DSK, then the IC device is a legitimate authorized device.

Claims

1. A method comprising:

provisioning an integrated circuit (IC) device with a unique identification number (UID);

configuring the IC device to calculate a device-specific key (DSK) using the UID;

using the UID and a secure application separate from the IC device, calculating a DSK for the IC device;

providing the UID and the DSK calculated with the secure application separate from the IC device to a provider of an online service; and

enabling the provider of the online service to authenticate the IC device using the UID and the DSK calculated with the secure application in response to the IC device contacting the online service.

2. The method of claim 1, wherein provisioning an integrated circuit (IC) device with a unique identification number (UID) further comprises provisioning a plurality of IC devices, each with a UID.

3. The method of claim 2, further comprising creating a log file of a UID and corresponding DSK for each of the plurality of IC devices.

4. The method of claim 3, wherein creating a log file of a UID and corresponding DSK for each of the plurality of IC devices further comprises providing the log file to the provider of the online service.

5. The method of claim 1, wherein enabling the provider of the online service to authenticate the IC device further comprises enabling the provider of the online service to authenticate the IC device using a predetermined cryptographic challenge-response protocol.

6. The method of claim 1, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

7. The method of claim 1, wherein provisioning the IC device with the UID is performed by a IC manufacturer that manufactured the IC device for an original device manufacturer (ODM).

8. The method of claim 1, wherein the IC device is characterized as being an internet of things (IoT) device.

9. The method of claim 1, wherein using the UID and a secure application separate from the IC device, calculating a DSK for the IC device further comprises calculating the DSK for the IC device by an original device manufacturer (ODM).

10. A method comprising:

provisioning a plurality of integrated circuit (IC) devices with unique identification numbers, each of the plurality of IC devices being provided with a unique identification number (UID);

configuring each of the plurality of IC devices to calculate a device-specific key (DSK) using the UID;

using the UID and a secure application separate from the IC device, calculating a DSK for each of the plurality of IC devices;

providing the UIDs and the DSKs calculated with the secure application separate from the IC device to a provider of an online service; and

enabling the provider of the online service to authenticate an IC device using the UIDs and the DSKs calculated with the secure application in response to the IC device contacting the online service.

11. The method of claim 10, further comprising creating a log file of a UID and corresponding DSK for each of the plurality of IC devices.

12. The method of claim 11, wherein creating the log file of a UID and corresponding DSK for each of the plurality of IC devices further comprises providing the log file to the provider of the online service.

13. The method of claim 10, wherein enabling the provider of the online service to authenticate the IC device further comprises enabling the provider of the online service to authenticate the IC device using a predetermined cryptographic challenge-response protocol.

14. The method of claim 10, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

15. The method of claim 10, wherein provisioning the plurality of IC devices with the UIDs is performed by a IC manufacturer that manufactured the plurality of IC devices for an original device manufacturer (ODM).

16. The method of claim 10, wherein the IC device is characterized as being an internet of things (IoT) device.

17. The method of claim 10, wherein using the UID and a secure application separate from the IC device, calculating a DSK for the IC device further comprises calculating the DSK for the IC device by an original device manufacturer (ODM).

18. A method comprising:

provisioning a plurality of integrated circuit (IC) devices with unique identification numbers, each of the plurality of IC devices being provided with a unique identification number (UID);

configuring each of the plurality of IC devices to calculate a device-specific key (DSK) using the UID;

using the UID and a secure application separate from the IC device, calculating a DSK for each of the plurality of IC devices;

creating a log file of a UID and corresponding DSK for each of the plurality of IC devices;

providing the log file of UIDs and DSKs calculated with the secure application separate from the IC device to a provider of an online service; and

enabling the provider of the online service to authenticate an IC device using the UIDs and the DSKs calculated with the secure application in response to the IC device contacting the online service.

19. The method of claim 18, wherein the IC device is authenticated as a legitimately manufactured IC device when the DSK calculated by the IC device favorably matches the DSK calculated with the secure application.

20. The method of claim 18, wherein provisioning the plurality of IC devices with the UIDs is performed by a contract manufacturer that manufactured the plurality of IC devices for an original device manufacturer (ODM).