Integrated circuit access

• US 9,619,647 B2
• Filed: 05/07/2015
• Issued: 04/11/2017
• Est. Priority Date: 05/07/2015
• Status: Active Grant

• Current Assignee: NXP USA, Inc. (NXP Semiconductors NV)
• Original Assignee: NXP USA, Inc. (NXP Semiconductors NV)
• Inventors: Rohleder, Michael, Doll, Stefan, Roettgermann, Clemens Alfred
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/706,128
• Publication Number:
  US 20160328554A1
• Time in Patent Office: 705 Days
• Field of Search: 726 2
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00

Abstract

A method provides access to an integrated circuit which may comprise a storage containing an unalterable first security key and a memory containing a second security key. The method may comprise:

• • checking the second security key by comparing the first security key and the second security key,
  • if the second security key is valid,
    • providing access to the integrated circuit, optionally depending on the validity of an access key, and
  • if the second security key is invalid,
    • enabling erasing the memory, and
    • storing in the memory a new second security key which corresponds to the first security key.
      Erasing the memory may be followed by checking the erasing for completeness.

Claims

1. An integrated circuit comprising:

an unalterable storage to store a first security key;

a memory to store a second security key;

a comparator unit to compare the first security key and the second security key; and

an access control unit to communicate with the comparator unit, the access control unit to check a validity of the second security key, and to;

if the second security key is valid,

provide access to the integrated circuit, and

if the second security key is invalid,

restrict memory access to an erase operation, and

store, after the erase operation, a new second security key in the memory, wherein the new second security key corresponds to the first security key.

2. The integrated circuit according to claim 1, further comprising a control logic unit to reset the integrated circuit before checking the second security key.

3. The integrated circuit according to claim 1, wherein the memory comprises a protected part to store the second security key.

4. The integrated circuit according to claim 1, wherein the first security key stored in the storage has an equal amount of ones and zeros.

5. The integrated circuit according to claim 1, further comprising a protected flag register to store a flag indicating whether the erase operation is completed.

6. The integrated circuit according to claim 5, wherein writing to the memory is enabled only when the flag is set.

7. The integrated circuit according to claim 1, further comprising a protected flag register to store a flag indicating whether the integrated circuit has been initialized.

8. The integrated circuit according to claim 7, wherein the protected flag register is to be reset when the integrated circuit is reset.

9. The integrated circuit according to claim 1, wherein the access control unit to check the erase operation and to only permit a new security key to be stored in the memory if the erase operation was successful.

10. A user device comprising an integrated circuit, which integrated circuit comprises:

an unalterable storage to store a first security key;

a memory to store a second security key;

a comparator unit configured to compare the first security key and the second security key; and

an access control unit to communicate with the comparator unit, the access control unit to check a validity of the second security key, and to;

if the second security key is valid,

provide access to the integrated circuit, and

if the second security key is invalid,

restrict memory access to an erase operation, and

store, after the erase operation, a new second security key in the memory wherein the new second security key corresponds to the first security key.

11. The user device according to claim 10, wherein the access control unit to check the erase operation and to only permit the new security key to be stored in the memory if the erase operation was successful.

12. A method of providing access to an integrated circuit, the method comprising:

comparing a first security key with a second security key, wherein the first security key is stored in an unalterable memory location and the second security key is stored in another memory location;

if the second security key matches the first security key,

providing access to the integrated circuit; and

if the second security key fails to match the first security key,

restricting memory access to an erase operation, and

after the erase operation, storing in the memory a new second security key which corresponds to the first security key.

13. The method according to claim 12, wherein providing access to the integrated circuit if the second security key matches the first security key is preceded by:

requesting, from another device, an access key and receiving an access key,

checking the received access key by comparing the received access key with a access key stored in a further memory location, and

preventing said providing access to the integrated circuit if the received access key fails to match.

14. The method according to claim 12, further comprising resetting the integrated circuit prior to the comparing the first security key with the second security key.

15. The method according to claim 12, further comprising checking the erase operation for completeness subsequent to the erase operation.

16. The method according to claim 15, further comprising, if the erase operation is complete, recording completeness of the erase operation in a protected flag register subsequent to checking the erase operation for completeness.

17. The method according to claim 12, further comprising disabling read access prior to the erase operation.

18. The method according to claim 12, further comprising disabling programming prior to the erase operation.

19. The method according to claim 12, further comprising storing the second security key in a protected part of the memory.

20. The method according to claim 12, wherein the first security key has an equal amount of ones and zeros.