System and method for product registration

• US 20080044026A1
• Filed: 02/28/2007
• Published: 02/21/2008
• Est. Priority Date: 02/28/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Rosati, Tony, Walters, Anthony, Neill, Brian, Vadekar, Ashok, O'Loughlin, Daniel
• Granted Patent: US 9,692,737 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06Q 10/101 Collaborative creation, e.g. joint development of products or services
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A system and method for controlling a production process for producing a product is provided in which overproduction may be inhibited by introducing a separation of duties within a production process. Typically a producer will contract out the various stages of a production process to multiple contractors. In general, separation of duties involves purposefully separating production stages, for silicon chips or other products, so that the end product has been handled or “touched”, by each subcontractor, in order for the end product to be fully functional.

Claims

1. A method for controlling a production process for a product comprising:

including in a design for said product, a module having a mathematical transform for intercepting and transforming data flow in said product, said mathematical transform requiring a key to be operable and said product requiring successful operation of said mathematical transform to be operable;

arranging said production process into a plurality of stages, each of said plurality of stages capable of being performed by respective ones of a plurality of entities;

dividing said key into a plurality of portions of sensitive data and distributing each of said plurality of portions to respective ones of said plurality of entities; and

distributing a mask for producing said product according to said design to a first one of said plurality of entities to enable said first one of said plurality of entities to add a first portion of sensitive data to said key;

wherein said product is operable upon adding all of said plurality of portions of sensitive data.

2. A method according to claim 1 further comprising distributing an inoperable product comprising said first portion of sensitive data to at least one other entity to perform subsequent stages whereby subsequent portions of sensitive data are added to said key to make said key operable thereby producing an operable product.

3. A method according to claim 1 further comprising establishing a communication channel between a producer and said plurality of entities for securing distributing said sensitive data.

4. A method according to claim 3 further comprising each of said plurality of entities providing a log report to said producer upon adding a respective portion of said sensitive data.

5. A method according to claim 3 wherein said producer generates said design and is responsible for dividing said key.

6. A method according to claim 1 wherein said product is an integrated circuit (IC).

7. A method according to claim 6 wherein said mask is used by said first one of said plurality of entities to produce a silicon wafer.

8. A method according to claim 1 wherein said mathematical transform is a cryptographic transform and said key is a cryptographic key.

9. A method according to claim 8 wherein said cryptographic transform uses at least one exclusive-or (XOR) operation.

10. A method for controlling operation of a product comprising:

intercepting data provided by a first portion of said product;

inputting said data into a mathematical transform;

applying said mathematical transform to said data using a key to generate an output, said mathematical transform requiring said key to be operable; and

providing said output to a second portion of said product;

wherein said product requires successful operation of said mathematical transform to be operable and said mathematical transform comprises a plurality of portions of sensitive data each of which are added during production of said product in a plurality of stages.

11. A method according to claim 10 wherein said data is a boot signal.

12. A method according to claim 10 wherein said mathematical transform is a cryptographic transform and said key is a cryptographic key.

13. A method according to claim 12 wherein said cryptographic transform uses at least one exclusive-or (XOR) operation.

14. A method according to claim 10 wherein said first portion comprises protected logic, and said second portion comprises unprotected logic.

15. A registration module included in a product for controlling operation of said product comprising a mathematical transform for intercepting and transforming data flow in said product;

and a key stored in a memory, said mathematical transform requiring said key to be operable, said product requiring successful operation of said mathematical transform to be operable;

wherein said key comprises a plurality of portions of sensitive data each of which are added during production of said product in a plurality of stages.

16. A module according to claim 15 wherein said data flow is a boot signal.

17. A method according to claim 15 wherein said mathematical transform is a cryptographic transform and said key is a cryptographic key.

18. A method according to claim 17 wherein said cryptographic transform uses at least one exclusive-or (XOR) operation.

19. A method according to claim 15 wherein said data flow is output by protected logic, and an output from said mathematical transform is provided to unprotected logic.

20. A system for controlling a production process for a product comprising a controller at a first entity, said first entity being responsible for said production process;

and a plurality of servers at a plurality of process stages, said plurality of servers being configured for receiving sensitive data from said controller in a secure manner and for sending log reports to said controller;

said controller being configured for distributing a mask for producing said product to a first one of said plurality of servers to enable said first one of said plurality of servers to add a first portion of sensitive data to a key in said product at a first process stage, said key being used to operate a mathematical transform in said product, said product requiring successful operation of said mathematical transform to be operable; and

wherein at least one other of said plurality of servers is configured for adding at least one other portion of sensitive data to said key in at least one other process stage.