Circuit personalization

• US 8,838,998 B2
• Filed: 01/25/2013
• Issued: 09/16/2014
• Est. Priority Date: 07/29/2005
• Status: Active Grant

• Current Assignee: STMicroelectronics Limited (STMicroelectronics NV)
• Original Assignee: STMicroelectronics Limited (STMicroelectronics NV)
• Inventors: Dellow, Andrew
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US13/750,817
• Publication Number:
  US 20130145176A1
• Time in Patent Office: 599 Days
• Field of Search: 713/189, 713/176, 726/4, 726/31, 726/10, 380/201
• US Class Current: 713/189
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers

Abstract

A method distributes personalized circuits to one or more parties. The method distributes a generic circuit to each party, encrypts a unique personalization value using a secret encryption key, and transmits each encrypted personalization value to the corresponding party. Each party then stores the encrypted personalization value in their circuit. The stored encrypted personalization value allows a piece of software to be properly executed by the circuit. A semiconductor integrated circuit is arranged to execute a piece of software that inputs a personalization value as an input parameter. The circuit comprises a personalization memory arranged to store an encrypted personalization value; a key memory for storing a decryption key; a control unit comprising a cryptographic circuit arranged to decrypt the encrypted personalization value using the decryption key; and a processor arranged to receive the decrypted personalization value and execute the software using the decrypted personalization value.

Claims

1. A method, comprising:

associating a first personalization value with a first plurality of generic circuits;

associating a second personalization value with a second plurality of generic circuits, the first and second pluralities of generic circuits being respective subsets of a set of generic circuits;

initiating storage of respective secret decryption keys associated with the first plurality of generic circuits and the second plurality of generic circuits;

encrypting, using one or more configured processing devices, the first personalization value;

encrypting, using the one or more configured processing devices, the second personalization value;

initiating storage of the encrypted first personalization value in the first plurality of generic circuits; and

initiating storage of the encrypted second personalization value in the second plurality of generic circuits, wherein each of the first plurality of generic circuits and each of the second plurality of generic circuits is configured to;

retrieve an encrypted personalization value stored in the respective generic circuit;

decrypt the retrieved encrypted personalization value using a stored secret encryption key associated with the generic circuit; and

use the decrypted personalization value to control execution of software.

2. The method of claim 1 wherein the associating the first personalization value with the first plurality of generic circuits comprises receiving the first personalization value.

3. The method of claim 2 wherein the initiating storage of the encrypted first personalization value in the first plurality of generic circuits comprises transmitting the encrypted first personalization value.

4. The method of claim 3 wherein the transmitting the first personalization value comprises further encrypting the encrypted first personalization value.

5. The method of claim 1 wherein the initiating storage of respective secret decryption keys comprises storing a first decryption key, in the first plurality of generic circuits and a second decryption key in the second plurality of generic circuits.

6. The method of claim 1 wherein the encrypting the first personalization value comprises using a first encryption key.

7. The method of claim 6 wherein the encrypting the second personalization value comprises using the first encryption key.

8. A method, comprising:

receiving a first plurality of generic circuits;

transmitting a first personalization value associated with the first plurality of generic circuits;

receiving the first personalization value in an encrypted form;

storing the received encrypted first personalization value in the first plurality of generic circuits, wherein each of the first plurality of generic circuits is configured to control execution of a piece of software by retrieving and decrypting the stored encrypted first personalization value, the decrypting the stored encrypted first personalization value including using a secret decryption key common to each of the first plurality of generic circuits;

receiving a second plurality of generic circuits;

transmitting a second personalization value associated with the second plurality of generic circuits;

receiving the second personalization value in an encrypted form; and

storing the received encrypted second personalization value in the second plurality of generic circuits, wherein each of the second plurality of generic circuits is configured to control execution of a second piece of software by retrieving and decrypting the stored encrypted second personalization value using a secret key common to the second plurality of generic circuits, the first and second pluralities of generic circuits being respective subsets of a set of generic circuits.

9. The method of claim 8 wherein the secret key common to the first plurality of generic circuits is the same key as the secret key common to the second plurality of generic circuits.

10. The method of claim 8 wherein the first personalization value comprises a first number and the second personalization value comprises a second number.

11. The method of claim 8 wherein the encrypted first personalization value is received in a further encrypted form.

12. The method of claim 8, further comprising incorporating each of the first plurality of generic circuits into a respective electronic device.

13. An integrated circuit, comprising:

a personalization memory;

a key memory configured to store a decryption key common to a first plurality of generic integrated circuits;

a personalization controller configured to;

control storage of a received encrypted version of a software personalization value, the personalization value being common to the first plurality of generic integrated circuits, in the personalization memory; and

decrypt the stored encrypted version of the personalization value using the decryption key stored in the key memory; and

a processor configured to control execution of software based on the decrypted software personalization value received from the personalization controller, wherein the integrated circuit is one of the first plurality of generic circuits, the first plurality of generic circuits is one of multiple pluralities of generic circuits each associated with respective decryption keys and personalization values, and each of the multiple pluralities of generic circuits is a respective subset of a set of generic circuits.

14. The integrated circuit of claim 13 wherein the personalization memory is a one-time-programmable memory.

15. The integrated circuit of claim 13 wherein the key memory is a one-time-programmable memory.

16. The integrated circuit of claim 13 wherein the decryption key is permanently recorded into the key memory at a circuit manufacturing stage.

17. The integrated circuit of claim 13 wherein the personalization controller is configured to restrict access to the personalization memory.

18. The integrated circuit of claim 17 wherein the personalization controller is configured to restrict access to the key memory.

19. The integrated circuit of claim 13 wherein the personalization value comprises a number.

20. The integrated circuit of claim 13 wherein the processor is configured to perform a circuit reset if the decrypted personalization value is different from the personalization value.

21. A system, comprising:

a system memory;

a processor configured to execute software;

a personalization memory;

a key memory; and

a personalization controller configured to;

control storage of a received encrypted version of a software personalization value in the personalization memory; and

decrypt the stored encrypted version of the personalization value using a decryption key stored in the key memory, wherein the processor is configured to control execution of software stored in the system memory based on the decrypted software personalization value, the decryption key and the personalization value are common to a first plurality of generic circuits, the first plurality of generic circuits being one of multiple pluralities of generic circuits each associated with respective decryption keys and personalization values, and each of the multiple pluralities of generic circuits being a respective subset of a set of generic circuits.

22. The system of claim 21 wherein the personalization memory is a one-time-programmable memory and the key memory is a one-time-programmable memory.

23. The system of claim 22 wherein the decryption key is permanently recorded into the key memory at a circuit manufacturing stage.

24. The system of claim 21 wherein the personalization controller is configured to restrict access to the personalization memory and to restrict access to the key memory.

25. The system of claim 21 wherein the processor is configured to perform a circuit reset if the decrypted personalization value is different from a software personalization value associated with the software stored in the software memory.

26. The system of claim 21, further comprising a number memory coupled to the processor and configured to store decrypted personalization values decrypted by the personalization controller.

27. The system of claim 21, further comprising an integrated circuit, the integrated circuit being one of the first plurality of generic circuits and including the personalization memory, the key memory and the personalization controller.

28. The system of claim 27 wherein the integrated circuit includes the processor and a number memory.

29. The system of claim 21 wherein the personalization controller comprises a cryptographic circuit configured to decrypt the stored encrypted version of the personalization value.