Anti-theft system and method for semiconductor devices and other electronic components

• US 7,681,247 B2
• Filed: 02/27/2003
• Issued: 03/16/2010
• Est. Priority Date: 02/27/2003
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Williams, Emrys J.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H
• Application Number:
  US10/375,158
• Publication Number:
  US 20040170068A1
• Time in Patent Office: 2,574 Days
• Field of Search: 726/34, 726/35, 726/36, 713/168, 365/200
• US Class Current: 726/34
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

A semiconductor device includes a stored device identifier that is accessible to external systems, and a stored secret key that is inaccessible to external systems. The device also includes an input, which in operation receives a system identifier, representing the system into which the device is to be incorporated, and an authorization key. An authorization unit within the device is then used for enabling or disabling the device in accordance with the values of the stored secret key, the received system identifier and the authorization key. The authorization key is typically supplied by a support center in response to being notified of the device identifier. In one embodiment, the authorization unit encrypts the system identifier using the stored secret key as the encryption key and then compares the result against the authorization key.

Claims

1. A semiconductor device, including:

a stored device identifier that identifies said device, wherein said device identifier is accessible to one or more particular external systems;

a stored secret key, wherein said secret key is inaccessible to said one or more particular external systems;

an input configured to receive a system identifier and an authorization key from said one or more particular external systems, wherein said system identifier is an identifier of said one or more particular external systems; and

an authorization unit configured to enable or disable said device in accordance with the stored secret key, the system identifier and the authorization key, wherein the authorization unit is configured to enable said device in response to determining that the authorization key is based on both the stored secret key and the system identifier.

2. The semiconductor device of claim 1, wherein said authorization unit incorporates an encryption facility.

3. The semiconductor device of claim 2, wherein said encryption facility is operable to encrypt said system identifier using said secret key as an encryption key to create an encrypted system identifier.

4. The semiconductor device of claim 3, wherein said authorization unit further includes a comparator configured to determine that said authorization key matches the encrypted system identifier.

5. The semiconductor device of claim 1, wherein said authorization unit further includes logic for determining a value representing a function of the system identifier and the secret key, and a comparator for verifying said authorization key against said value.

6. The semiconductor device of claim 1, further including a one-time programmable memory for storing said secret key.

7. The semiconductor device of claim 6, wherein said one-time programmable memory comprises a blown-fuse unit.

8. The semiconductor device of claim 1, wherein the authorization unit enables or disables said device in accordance with the values of the stored secret key and device identifier, and of the system identifier and the authorization key.

9. The semiconductor device of claim 1, wherein said secret key is inaccessible to external systems when said device is mounted on a printed circuit board (PCB).

10. The semiconductor device of claim 1, further comprising a pin to allow access to said secret key, wherein said pin is configured so as to be inaccessible or inoperative when the device is mounted on a PCB.

11. The semiconductor device of claim 10, wherein the pin is located underneath the device when the device is mounted on the PCB.

12. The semiconductor device of claim 1, further comprising a pin to allow the authorization unit to be disabled, wherein said pin is configured so as to be inaccessible or inoperative when the device is mounted on a PCB.

13. The semiconductor device of claim 12, wherein the pin is located underneath the device when the device is mounted on the PCB.

14. The semiconductor device of claim 1, wherein the operation of said device is modified according to the system identifier.

15. The semiconductor device of claim 14, wherein a communications protocol used by the device is modified according to the system identifier.

16. The semiconductor device of claim 1, wherein the device provides an external indication of whether the authorization unit is disabling or enabling the device in response to receiving the system identifier and the authorization key.

17. The semiconductor device of claim 16, wherein said external indication is delayed compared to receipt of the system identifier and authorization key.

18. The semiconductor device of claim 1, wherein the stored secret key is protected by an error correction code (ECC).

19. The semiconductor device of claim 18, wherein an external indication is provided if the ECC detects an error in the stored secret key.

20. The semiconductor device of claim 1, wherein said input is operable to receive only a single system identifier after power on, and wherein said device must be powered down before a further system identifier can be received.

21. The semiconductor device of claim 1, wherein said input is operable to receive only a single authorization key after power on, and wherein said device must be powered down before a further authorization key can be received.

22. The semiconductor device of claim 1, wherein said device is operable for a predetermined timeout period after power-on irrespective of the system identifier and the authorization key.

23. The semiconductor device of claim 1, wherein the authorization unit is responsive to input of a master authorization key to enable the device in accordance with the stored secret key, irrespective of the system identifier.

24. The semiconductor device of claim 1, further comprising a PROM containing at least one authorization key for the device.

25. An electronic subsystem for installation into a larger system, said subsystem including:

a stored device identifier that identifies the subsystem, wherein said device identifier is accessible to said larger system;

a stored secret key, wherein said secret key is inaccessible to said larger system;

an input configured to receive a system identifier and an authorization key from said larger system, wherein said system identifier is an identifier of said larger system; and

an authorization unit configured to enable or disable said subsystem in accordance with the stored secret key, the system identifier and the authorization key;

wherein the authorization unit is configured to enable said device in response to determining that the authorization key is based on both the stored secret key and the system identifier.

26. An electronic system, comprising:

a stored system identifier that identifies the electronic system; and

at least one component comprising a stored device identifier that identifies the at least one component and is accessible to one or more other components of said electronic system, the at least one component further comprising a stored secret key inaccessible to said one or more other components of said electronic system;

wherein the at least one component comprises a communications path configured to receive the system identifier and an authorization key from the electronic system;

wherein said at least one component is configured to be activated in response to determining that the authorization key is dependent on both the received system identifier and said stored secret key.

27. The electronic system of claim 26, further comprising mappings of authorization keys to corresponding device identifiers, wherein the electronic system is configured to supply said authorization key to the at least one component in response to determining that said stored device identifier matches a particular mapping of said mappings, wherein that mapping corresponds to said authorization key supplied to the at least one component.

28. The electronic system of claim 27, further comprising an on-line communications link for acquiring from a support center an authorization key for a device identifier whose authorization key is not in said mappings.

29. The electronic system of claim 26, wherein the operation of said at least one component is modified according to the system identifier.

30. The electronic system of claim 29, wherein a communications protocol used by the at least one component is modified according to the system identifier.

31. A method of manufacturing a semiconductor device, comprising:

storing a device identifier and a secret key on the device, wherein said device identifier identifies said device, wherein said device identifier is accessible to one or more particular external systems, and wherein said secret key is inaccessible to said one or more particular external systems; and

incorporating into the device an authorization unit for enabling or disabling the device in accordance with the stored secret key and a system identifier and an authorization key both received from said one or more particular external systems, wherein said system identifier is an identifier of said one or more particular external systems, wherein the authorization unit is configured to enable said device in response to determining that the authorization key is based on both the stored secret key and the system identifier.

32. The method of claim 31, wherein said authorization unit incorporates an encryption facility.

33. The method of claim 32, wherein said encryption facility is operable to encrypt said system identifier using said secret key as an encryption key.

34. The method of claim 31, further comprising using a one-time programmable memory for storing said secret key.

35. The method of claim 31, further comprising storing at least one authorization key appropriate to a predetermined system identifier in the device.

36. The method of claim 31, further comprising mounting said device on a PCB, and wherein said secret key is inaccessible to external systems after it has been mounted said PCB.

37. The method of claim 36, further comprising reading the secret key from the semiconductor device prior to said step of mounting on the PCB.

38. The method of claim 31, further comprising the step of making a record of the device identifier and the secret key stored on the device.

39. A method of manufacturing an electronic system, comprising:

storing a system identifier in the system;

installing at least one component including a stored device identifier and a stored secret key into the system, wherein said at least one component is configured to be enabled or disabled for use in accordance with the system identifier, a received authorization key, and the stored secret key, wherein the at least one component is configured to be enabled in response to determining that the authorization key is based on both the stored secret key and the system identifier; and

creating in the electronic system for each at least one component installed into the system, a record of a matched pair including an authorization key to be used with that component in conjunction with the stored system identifier, wherein the authorization key is mapped in the record to the device identifier for the corresponding component.

40. A method of operating an electronic system comprising:

accessing a system identifier for the electronic system;

ascertaining a device identifier associated with a component of the electronic system, said component including a secret key;

providing an authorization key and the system identifier to said component, wherein a correct authorization key is dependent upon said system identifier and said secret key;

determining within the component whether or not the provided authorization key is the correct authorization key, based on the system identifier and the secret key for the component;

disabling or enabling said component according to whether or not the authorization key is the correct authorization key.

41. The method of claim 40, wherein said steps of accessing, ascertaining, and providing are performed at system power-on by a system controller.

42. The method of claim 41, wherein said ascertaining comprises the system controller:

sending a request to each component installed in the system;

and receiving a response back including the device identifier for that component.

43. The method of claim 42, further comprising storing a list of authorization keys within the system, and the system controller accessing said list to retrieve an authorization key for a component based on the received device identifier for that component.

44. The method of claim 40, further comprising storing at least one authorization key appropriate to a particular system identifier in association with said component, wherein a stored authorization key is provided for determining within the component whether or not to disable the component.

45. The method of claim 44, wherein multiple pairs of system identifiers and corresponding authorization keys are stored, and further comprising using the accessed system identifier in order to determine a corresponding stored authorization key from said multiple pairs of system identifiers and corresponding authorization keys.

46. The method of claim 40, wherein said determining includes performing an encryption function on the system identifier using the secret key.

47. The method of claim 40, further comprising:

in response to an authorization key not being available for a component having a particular device identifier, making a request for an authorization key for that component, wherein said request includes the device identifier for the component; and

receiving an authorization key for the component in response to the request.

48. The method of claim 47, wherein said request is made on-line to a remote support center.

49. The method of claim 48, wherein said response is received on-line from the support center.

50. The method of claim 40, wherein the operation of a component in the electronic system is modified according to the system identifier provided to the component.

51. The method of claim 50, wherein a communications protocol used by a component is modified according to the system identifier provided to the component.

52. A method of operating a support center comprising the steps of:

maintaining a database of components, wherein for each component there is a stored device identifier and secret key;

receiving a request to allow a component having a particular device identifier to be used in a system having a particular system identifier;

retrieving the secret key for the component based on the particular device identifier within said request;

determining an authorization key for the component, based on the received system identifier and retrieved secret key; and

providing a response to said request, wherein the response includes the determined authorization key.

53. The method of claim 52, wherein said determining step includes performing an encryption function on the received system identifier using the retrieved secret key.

54. The method of claim 52, wherein said request is received and said response provided via a web site.

55. The method of claim 52, wherein said request is received and said response provided via telephone.

56. The method of claim 52, wherein said request is received and said response provided via an on-line connection between said system and said support center.

57. The method of claim 52, further comprising the step of checking that the system identifier in the request does not correspond to a system that has been reported stolen.

58. The method of claim 52, further comprising the step of checking that the device identifier in the request does not correspond to a device that has been reported stolen.

59. The method of claim 52, further comprising the step of checking that the device identifier in the request does not correspond to a device that is incompatible with the system specified by the system identifier.

60. A semiconductor device, including:

means for storing a device identifier that identifies said device, wherein said device identifier is accessible to one or more particular external systems;

means for storing a secret key, wherein said secret key is inaccessible to said one or more particular external systems;

means for receiving a system identifier and an authorization key from said one or more particular external systems, wherein said system identifier is an identifier of said one or more particular external systems; and

means for enabling or disabling said device in accordance with the stored secret key, the system identifier and the authorization key, wherein said means for enabling or disabling includes means for enabling said device in response to determining that the authorization key is based on both the stored secret key and the system identifier.

61. An electronic system, comprising:

means for storing a system identifier identifying said system;

at least one component including means for storing a device identifier such that the device identifier is accessible to one or more other components of said electronic systems and a stored secret key such that the stored secret key is inaccessible to said one or more other components of said electronic system, wherein the device identifier identifies said at least one component;

means for supplying said at least one component with the stored system identifier and with an authorization key that is dependent on said system identifier and said stored secret key; and

means for enabling said at least one component in response to determining that the authorization key is dependent on said system identifier and said stored secret key.

62. A program product, comprising machine instructions on a medium for loading into an electronic system, wherein said instructions cause the system to perform the steps of:

accessing a system identifier for the electronic system;

ascertaining a device identifier associated with a particular component of the electronic system, said particular component including a stored secret key that is inaccessible to all other components of the electronic system; and

providing an authorization key and the system identifier to said particular component;

generating, via the particular component, a correct authorization key that is dependent upon said system identifier and said secret key; and

determining, via the particular component, whether or not the authorization key matches said correct authorization key and enabling or disabling the particular component in accordance with that determination.

63. A program product, comprising machine instructions on a medium for loading into a computer, wherein said instructions cause the computer to perform the steps of:

receiving a request to allow a component having a particular device identifier to be used in a system having a particular system identifier;

accessing a database of components, wherein for each component there is a stored device identifier and secret key;

retrieving from the database a secret key for the component based on the particular device identifier;

determining an authorization key for the component, based on the received system identifier and retrieved secret key; and

providing a response to said request, wherein the response includes the determined authorization key.