CLIENT AUTHENTICATION DEVICE AND METHODS THEREOF

• US 20090025073A1
• Filed: 07/17/2008
• Published: 01/22/2009
• Est. Priority Date: 07/20/2007
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Bigfoot Networks, Inc. (Qualcomm, Inc.)
• Inventors: Beverly, Harlan T.
• Granted Patent: US 8,499,169 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method of authenticating a data processing device includes receiving a request to authenticate the data processing device. In response, an authentication key is accessed an authenticated at an authentication module. The authentication key is stored at a storage module that is located within the same integrated circuit package as the authentication module, so that the authentication key can be communicated to the module without exposing the key to unauthorized probing. The integrated circuit package also includes a tamper detection module to determine whether a memory of the data processing device has been accessed. In response to determining the memory has been accessed, the tamper detection module instructs the authentication module to not authenticate the data processing device.

Claims

1. A method, comprising:

receiving a request to authenticate a client device via a network;

in response to receiving the request;

retrieving an authentication key from a storage module at the client device, the storage module located at a first integrated circuit package;

determining at a tamper detection module if a memory of the client device has been accessed;

in response to determining the memory of the client device has not been accessed, using the authentication key at an authentication module to determine an authentication result for the client device, the authentication module located at the first integrated circuit package; and

communicating the authentication result via the network.

2. The method of claim 1, wherein receiving the request to authenticate the client device comprises receiving the request at a processor of the client device, the processor located at a second integrated circuit package different from the first.

3. The method of claim 1, wherein the first integrated circuit package includes a plurality of external connectors, and wherein the storage module is inaccessible via the plurality of external connectors after storage of authentication key.

4. The method of claim 1, further comprising:

wherein authenticating the authentication key comprises setting the authentication result to indicate a denial of authentication in response to determining the memory has been accessed.

5. The method of claim 4, further comprising fixing a data bus of the memory at a predetermined value in response to determining the portion of memory has been accessed.

6. The method of claim 1, further comprising:

determining a portion of memory of the client device has been accessed; and

fixing a data bus of the memory at a predetermined voltage in response to determining the portion of memory has been accessed.

7. A method, comprising:

receiving a request to authenticate a client device via a network;

in response to receiving the request;

retrieving an authentication key from a storage module at the client device via an interconnect that is protected from external probing;

using the authentication key to determine an authentication result; and

communicating the authentication result via the network.

8. The method of claim 7, wherein receiving the authentication key to authenticate the client device comprises receiving the request at a processor of the client device, the processor coupled to the storage module via the interconnect.

9. The method of claim 7, further comprising:

receiving configuration information from a memory;

configuring the processor based on the configuration information; and

fixing a write-enable input of the memory at defined value so that data cannot be stored at the memory.

10. A device, comprising:

a network interface module configured to receive an authentication request from a network;

a processor;

a memory coupled to the processor via a bus, the memory comprising a write enable input configured to place the memory in a writeable state based on a signal at the write enable input; and

a first integrated circuit package, comprising;

a storage module configured to store an authentication key; and

an authentication module configured to access the authentication key and to determine an authentication result based on the authentication key in response to the authentication request; and

a tamper module coupled to the authentication module, the tamper module configured to detect tampering of the memory, and further configured to provide control information to the authentication module indicating if the memory has been tampered.

11. The device of claim 10, wherein the processor comprises a second integrated circuit package different from the first.

12. The device of claim 10, wherein the first integrated circuit package includes a plurality of external connectors, and wherein the storage module is inaccessible via the plurality of external connectors.

13. The device of claim 10, wherein the authentication module is configured to set setting the authentication result to indicate a denial of authentication in response to determining the control information indicates the memory has tampered.

14. The device of claim 10, wherein the tamper module is configured to fix the bus at a predetermined value in response to determining the memory has been tampered.

15. The device of claim 10, wherein the tamper module is configured to detect tampering of the memory by monitoring a voltage of the write enable input of the memory.

16. The device of claim 10, wherein the tamper module is configured to detect tampering of the memory by comparing data communicated via the bus with expected values.

17. The device of claim 16, wherein the tamper module is configured to compare data communicated via the bus by comparing a hash value based on the data to an expected hash value.

18. A device, comprising:

a network interface configured to receive an authentication request via a network;

a processor coupled to the network interface, the processor configured to execute authentication software in response to the authentication request, the authentication software configured to determine an authentication result based on an authentication key;

an interconnect coupled to the processor, the interconnect configured to be shielded from external probing; and

a storage module coupled to the interconnect, the storage module configured to store the authentication key.

19. The device of claim 18, wherein the interconnect comprises a hidden trace.

20. The device of claim 18, wherein the interconnect comprises a potted connection.