Methods and apparatus for secure hardware configuration

• US 5,530,753 A
• Filed: 08/15/1994
• Issued: 06/25/1996
• Est. Priority Date: 08/15/1994
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Campbell, John E., Spano, Vincent A., Easter, Randall J., Zajac, Myron W.
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/290,697
• Time in Patent Office: 680 Days
• Field of Search: 380/3, 380/4, 380/23
• US Class Current: 713/191
• CPC Class Codes: G01R 31/31719 Security aspects, e.g. preventing unauthorised access during test
• CPC Class Codes: G01R 31/318536 Scan chain arrangements, e.g. connections, test bus, analog signals
• CPC Class Codes: G06F 11/006 Identification G06F11/2289 takes precedence
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 2221/2121 Chip on media, e.g. a disk or tape with a chip embedded in its case
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme

Abstract

Methods and apparatus are provided for electronically configuring hardware features and options. A computer chip encoding method is provided in which a predetermined code or encryption sequence is uniquely associated with a computer chip. This code is used to modify a hardware configuration by enabling new features or options. The systems and methods reduce manufacturing and inventory costs by allowing a generic product to be produced which is then customized to meet the needs of the user. In addition, features and options of a data processing system can be dynamically upgraded without interruption of service or hardware replacement.

Claims

1. An electronic hardware configuration system, said system comprising:

a computer module in the form of a multichip module or an integrated circuit chip wherein said computer module includes a plurality of programmable features;

a first register on said computer module for storing a secure code unique to the computer module, said secure code including unique codes for each of said plurality of programmable features;

a second register for receiving a key code, said key code identifying a feature or features of said computer module to be enabled;

means connected to said first and second registers for comparing said key code to said secure code on said computer chip;

means for evaluating results from said means for comparing, wherein if said key code matches said secure code, a feature or features identified by said key code are enabled.

2. An electronic hardware configuration system, as recited in claim 1, wherein the secure code and the key code comprise keys in a public-key cryptographic algorithm.

3. An electronic hardware configuration system, as recited in claim 2, further including a customizable array of fuses, said array of fuses including said secure code encoded therein.

4. An electronic hardware configuration system, as recited in claim 3, wherein said customizable array of fuses comprises fusible links.

5. An electronic hardware configuration system, as recited in claim 2, wherein said secure code is stored in a programmable read only memory.

6. An electronic hardware configuration system, as recited in claim 2, wherein said computer module comprises:

a plurality of computer chips;

means for connecting a first of said computer chips to a second of said computer chips if said first computer chip and said second computer chip have at least one programmable feature in common, wherein said first computer chip and the common programmable feature have been previously enabled but said second computer chip and the corresponding common programmable feature have not been enabled; and

means for enabling the second of said computer chips and the corresponding common programmable feature if the first of said computer chips fails.

7. An electronic hardware configuration system, as recited in claim 2, wherein said computer module further stores a configuration constant and includes means for implementing said public-key cryptographic algorithm, said secure code and said configuration constant being encrypted in combination using said cryptographic algorithm to produce a configuration signature, said configuration signature being unique for each computer module.

8. An electronic hardware configuration system, as recited in claim 7, wherein said key code includes a public key, a signed configuration signature and configuration data.

9. An electronic hardware configuration system, as recited in claim 8, wherein said means for comparing of said key code includes means for deciphering said signed configuration signature so that said configuration constant stored in said computer module can be compared to said received and deciphered configuration constant.

10. An electronic hardware configuration system, as recited in claim 9, wherein said received configuration data is used to identify which one of said programmable features is enabled.

11. An electronic hardware configuration system, as recited in claim 10, wherein said computer module comprises:

a plurality of computer chips;

means for connecting a first of said computer chips to a second of said computer chips if said first computer chip and said second computer chip have at least one programmable feature in common, wherein said first computer chip and the common programmable feature have been previously enabled but said second computer chip and the corresponding common programmable feature have not been enabled; and

means for enabling the second of said computer chips and the corresponding common programmable feature if the first of said computer chips fails.

12. An electronic hardware configuration system, as recited in claim 1, wherein said computer module comprises:

a plurality of computer chips;

means for connecting a first of said computer chips to a second of said computer chips if said first computer chip and said second computer chip have at least one programmable feature in common, wherein said first computer chip and the common programmable feature have been previously enabled but said second computer chip and the corresponding common programmable feature have not been enabled; and

means for enabling the second of said computer chips and the corresponding common programmable feature if the first of said computer chips fails.