Authentication and identification of products

Abstract

An apparatus is disclosed, the apparatus comprising: a pin to connect to a resistor and a power source; the measuring circuit is used for measuring the voltage at the pin; and circuitry to determine a mapped identification value of the device based on the voltage at the pin, the mapped identification value coding the device as an instance of a product from a set of products; and an authentication circuit. The authentication circuit: calculates an authentication code using the mapped identification value; and providing the authentication code to an authentication host in response to a request of the authentication host.

Description

[0001] Related Cases

[0002] This application claims priority to commonly owned U.S. Patent Application No. 63 / 414,099, filed on October 7, 2022, the contents of which are hereby incorporated by reference for all purposes. Technical Field

[0003] The present disclosure relates to electronic identification of devices. Various examples include methods and / or apparatus for cryptographic authentication and identification using assembly-time configuration of identification characteristics. Background Art

[0004] Manufacturing, assembly, and packaging lines may assemble products, including consumer products, in unsecured locations. In addition, such lines may involve inventory management of multiple products with separate part numbers or stock keeping units (SKUs). Such lines may be used to identify and authenticate parts, but such lines may be located in untrusted factories or may not have access to trusted servers for identification and authentication. Summary of the invention

[0005] Devices and / or methods incorporating the teachings of the present disclosure may include authentication using an additional layer of key derivation based on an integer numeric identifier that can be configured by the creator of the device without pre-programming the device's integrated circuit (IC). For example, an example device may include: a pin that samples a voltage at a point between a resistor and a current source; an analog-to-digital (A / D) converter that converts a signal from the pin to a digital signal; a bit masking circuit that filters the digital signal and determines a mapped identification value of the device based on the filtered digital signal, the mapped identification value corresponding to a specific instance of a product from a group of products; and an authentication circuit that: calculates an authentication code using the mapped identification value; and provides the authentication code to an authentication host upon request of the authentication host.

[0006] Another example device may include: an integrated circuit (IC); a pin located on the IC, the pin connected to a resistor and a power supply; a measurement circuit located in the IC, the measurement circuit being used to determine a voltage at the pin; a calculation circuit located in the IC, the calculation circuit being used to determine a mapped identification value of the device based on the voltage at the pin, the mapped identification value decoding the device as a specific instance of a product from a group of products; and an authentication circuit located in the IC, the authentication circuit being used to: calculate an authentication code using the mapped identification value; and provide the authentication code to an authentication host upon request of the authentication host.

[0007] An example method incorporating the teachings of the present disclosure may include: receiving a voltage from a point between a resistor and a current source; determining a mapped identification value for a device based on the voltage, the mapped identification value decoding the device as a specific instance of a product from a group of products; calculating an authentication code using the mapped identification value; and providing the authentication code to an authentication host upon request of the authentication host.

[0008] Another example method may include: identifying a product type to be produced from a group of product types, the product type including an integrated circuit (IC) for identifying and authenticating an instance of the product type; and connecting a selected resistor to a pin of the product based on the type of product, the selected resistor indicating the product type. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The teachings of the present disclosure include apparatus and / or methods for authentication using an additional layer of key derivation based on an integer numeric identifier that can be configured by the creator of the device without pre-programming the device. Some examples of apparatus and methods are shown in the figure, where:

[0010] Figure 1 are schematic diagrams illustrating a number of example devices incorporating the teachings of the present disclosure;

[0011] Figure 2 It is shown for Figure 1 A diagram of a schematic diagram of an example circuit of the device shown in;

[0012] Figure 3 is a diagram illustrating an example data flow of a method incorporating the teachings of the present disclosure;

[0013] Figure 4 is a diagram showing a transaction diagram incorporating the teachings of the present disclosure; and

[0014] Figure 5 is a flow chart illustrating an example method incorporating the teachings of the present disclosure in a manufacturing process. DETAILED DESCRIPTION

[0015] Examples of the present disclosure may include authentication using an additional layer of key derivation based on an integer numeric identifier that can be configured by the creator of the device without pre-programming the IC of the device. Examples of the present disclosure may include a device that has a single chip implementation but can be used as one of multiple different products or stock keeping units (SKUs). Apparatus and / or methods incorporating the teachings of the present disclosure may reduce errors due to improper programming or mounting an incorrect chip on a board, and may simplify the creation of multiple configurations for various devices.

[0016] The apparatus and / or method may include using a discrete number as part of a key or other information for authentication, for the purpose of identifying different SKUs as part of the authentication process. The discrete number may be one of a set of possible numbers, and may be, for example, an integer value. The discrete number may be configurable at assembly time, for example, by selection of components (such as resistors) having different values.

[0017] Figure 1 are illustrations of schematic diagrams showing different example devices that incorporate the teachings of the present disclosure. Figure 1 Four different devices with ICs for authentication are shown. The IC may include, but is not limited to, any suitable implementation, such as instructions stored by a processor, an ASIC, a die, a field programmable gate array, a programmable logic device, an analog circuit, a digital circuit, or any suitable combination thereof. The IC may have an interface to a host. The interface may be provided by any suitable communication format. The host may include, but is not limited to, any suitable implementation, such as a computer, a server, a test machine, or any other suitable electronic device. The authentication device or IC may include, but is not limited to, any suitable implementation, such as instructions for execution by a processor, an ASIC, a die, a field programmable gate array, a programmable logic device, an analog circuit, a digital circuit, or any suitable combination thereof.

[0018] Devices may include any suitable item, such as a computer, a consumer device, a consumer product, a printer cartridge, a toner cartridge, or a color ink cartridge. Devices may be categorized into different products represented by different SKU numbers. Devices may be identified by the SKU number. Figure 1 The external resistors are distinguished by external resistors denoted as R1, R2, R3, Rn in the figure. The resistance value of the external resistor can classify the device into a given product. The resistance value of the resistor can vary according to each SKU, so that a standardized IC with a symmetric parent key can be used to identify and authenticate itself.

[0019] In such examples, the symmetric key is known to both parties involved in the authentication process. Some methods use a single parent key in both the authenticator and the authenticated device. Alternatively, a more secure method utilizes the parent key in the authenticator and a derived key in the authenticated device. The derived key is the result of a cryptographic hash of the parent key and the serial number of the authenticated device. In these cases, a malicious actor who accesses the derived key will not obtain the parent key thereby. In some of the methods described herein, the derived key may be pre-placed in the authenticated device and also derived by cryptographic hashing with a mapped identification value. The authenticator can read the serial number and the identification value (from the value of the external resistor) and create a dual derived key to authenticate both the device and the device SKU.

[0020] Apparatus and / or methods incorporating the teachings of the present disclosure may be used to identify different items among different products, for example by SKU or configuration. The teachings of the present disclosure may be used and included in IC design. Some examples include, but are not limited to, analog and mixed signal building blocks to generate integer ID values ​​with sufficient resolution to identify N different configurations. The ID value may be included in a cryptographically generated message authentication code that may be generated by the device IC and verified by the host.

[0021] As an example, a given device including an IC can be used to implement eight different ink cartridges or scent cartridges without changing the IC or printed circuit board (PCB). That is, the same IC and PCB can be used for each color or scent of a given product (e.g., each SKU). The logistics of manufacturing may limit the use of automatic testing and programming. In addition, the manufacturer of the product may wish to purchase and use a single type of IC overall, rather than eight different factor-supplied parts. The teachings of the present disclosure can use a single component option to determine the ID value at the time of manufacturing.

[0022] This allows for one part number per item, including a custom supply and a confidential exchange with the host for multiple products. This facilitates consolidation of the total number of parts produced and stocked to better serve the consumable market. Figure 1 A group of four products is shown. Each specific product includes a specific instance of a product from a group of products. However, each specific product instance shares the same IC, as shown. The apparatus and methods described herein can be used with a much larger group of products. As described below with respect to Table 1, a group of 8 discrete products can use the same IC without separate programming or requiring separate provisioning for each product in the group.

[0023] The example device may only require a single pin, which reduces costs and reduces the attack surface. As used herein, the term pin includes any connector from an IC, including but not limited to solder balls or pads. In addition, the device can provide a security solution using an identifier as a part of password authentication. This can promote low-tech manufacturing lines without programming the equipment, because the device can be programmed using one SKU in a plurality or a group of SKUs by using an external resistor, thereby streamlining the production line operation when multiple SKUs are involved. The teachings of the present disclosure can be used for any suitable product, including but not limited to those products in medical and electronic cigarettes, battery swaps for electric vehicles, cosmetics, air fragrances and fresheners, soda water, or any other suitable equipment. In addition, the teachings of the present disclosure can be implemented to identify and authenticate the physical properties of insertable parts, exchangeable parts, or consumable parts (batteries or other storage devices), such as color, smell or fragrance, strength or capacity. In this case, the mapped identification value can correspond to the physical properties of the product.

[0024] The apparatus and / or methods described herein may utilize a single pin from an IC to interface with both an identification resistor and test equipment for verification. The teachings may be used to authenticate the identification value of a cartridge, consumable, or other device and the SKU of such device. This may allow the inventory of the same kind of IC to be reallocated to production of different inventory. In addition, some examples may utilize the option of determining and locking the mapped identification value of a product in a one-time programmable memory to protect the device from future modifications. This may be performed by a device IC or a host IC, device, or equipment.

[0025] The apparatus and / or method may facilitate the determination of the ID at assembly without programming and may include the ID in a message authentication code (MAC), thereby ensuring integrity and authenticity. This is in contrast to options that require unique programming and a separate authentication process for the integrated circuit. Other solutions may require the use of multiple pins or writing the ID code to a memory on the device. In some examples, computing circuitry in the IC uses the mapped identification value to decode the apparatus as a specific instance of a product from a group of products.

[0026] Figure 2 It is shown for Figure 1 A schematic diagram of an example circuit of the device shown in FIG. Power can be applied to a pin of the IC in communication with a resistor R. Figure 2 As shown in , the power supply may include a current source. If the alternative power supply is relatively constant (such as a regulated voltage source), then the alternative power supply can be used. The power supply is applied to a first lead of a resistor R. The second lead of the resistor R is coupled to a common potential or return of the power supply. A pin of the IC is coupled to the first lead of the resistor R.

[0027] like Figure 2 As shown in , the signal from the pin is fed to the analog-to-digital (A / D) converter of the IC to convert the voltage at the pin to a digital value. The digital value can be transformed or filtered into a mapped ID value, including bit masking or other schemes. Filtering the digital value reduces the number of finite discrete values ​​mapped to the input range and can eliminate the effects of small changes in the input voltage.

[0028] In the example shown, the filter includes an extraction filter of an IC, which may include, but is not limited to, instructions for execution by a processor, an application specific integrated circuit, a die, a field programmable gate array, a programmable logic device, an analog circuit, a digital circuit, or any suitable combination thereof. The mapped ID value may be used by other parts of the IC. An example conversion between voltage and resistor value may be given in Table 1. In this example, an 8-bit A / D converter output is obtained from various resistor values ​​to produce a voltage range between 0 volts and 2.5 volts. Filtering the result by masking off the lowest 5 bits gives 8 discrete output values:

[0029]

[0030]

[0031] Table 1

[0032] In practice, an authentication host may request authentication for a given product. In response, a voltage from a point between a resistor and a current source is determined. Based on the voltage, a mapped identification value may be determined. As described above, the mapped identification value decodes the device as a specific instance of a product from a set of products. The mapped identification code may be used to calculate a message authentication code. Finally, the message authentication code is returned to the requesting authentication host.

[0033] Figure 3 is a diagram illustrating an example data flow of a method incorporating the teachings of the present disclosure. The top arrow shows a mapped ID value, which may be Figure 2 The mapped ID value can be combined with other information (in Figure 3 The MAC is generated by hashing the mapped ID value, other information, and the secret key using the Secure Hash Algorithm (SHA) or Advanced Encryption Standard (AES) algorithm or another encryption algorithm. The MAC can be provided by the device to the host, which can then be used by the host to authenticate the MAC. In some options, a derived key can be formed using a secret key and a unique internal device serial number. This option allows for the use of diversified keys, which can improve the protection of the secret key, and authenticates the device's ID by the serial number in addition to authenticating the SKU by the ID value output. The example authentication process is shown in Figure 1. Figure 4 Shown in.

[0034] Figure 41 is a swim diagram illustrating an example authentication method in conjunction with the teachings of the present disclosure. The diagram illustrates steps and data for completing password authentication and identification by SKU and serial number. The process allows an authentication host to authenticate a device including one or more of the devices described herein. As shown, the host issues an authentication request and an identification request to the device. In response, the device reads a signal and generates a mapped identification value. The mapped identification value is sent from the device to the host. As shown, the host hashes the mapped identification value together with a secret key. Then, the host sends a serial number request to the device, and the device responds with the serial number of the device. After receiving the serial number, the host hashes the received serial number together with the previous hash value.

[0035] The host then requests a MAC from the device. The device calculates the MAC using the derived key hashed with the mapped identification value generated above and the serial number of the device, and then provides the calculated MAC back to the host as a response. Finally, the host checks the MAC against the device's MAC using the parent key, the received serial number, and the mapped identification value. If they match, then it is assumed that the device is authenticated, and the manufacturing process can continue. If they do not match, then an error message or flag may be generated indicating that the device is not authenticated. This allows the IC to calculate a message authentication code and provide the code to the requesting authentication host.

[0036] Figure 5 is a flow chart illustrating an example method for incorporating the teachings of the present disclosure during manufacturing. The example method illustrates an example use case scenario for using the examples of the present disclosure. The illustrated method can be used to categorize a customer's inventory into multiple SKUs. When combined with a PCB or universal ink cartridge assembly, the application of the supplied authentication device categorizes the universal inventory into the various SKUs shown by adding appropriate resistors to each device without the need for uniquely programming and individually handling the ICs. Other solutions may require the use of multiple pins or digitally writing to memory on the device.

[0037] In practice, customers can mark their inventory by adding corresponding resistors to products. Methods for marking inventory may include identifying products as specific product types from a set of product types (or a list of product types). The specific product type may include an IC for identifying and authenticating an instance of the product type. Based on the specific product type, the corresponding resistor is identified. The resistor is then connected to the appropriate pins on the IC, allowing one or more of the identification methods described herein. In some cases, each product type in the set of product types includes a matching IC as described herein, allowing a single version of the IC to identify all product types in the set of product types. In some cases, the selection of the resistor corresponds to the physical properties of the product.

[0038] Although example apparatus and methods have been described above, other modifications may be made from the teachings of this disclosure without departing from the spirit and scope of this disclosure.

Claims

1. A device, the device include: A pin for sampling a voltage at a point between the resistor and the current source; an analog-to-digital (A / D) converter, the analog-to-digital (A / D) converter being used to convert the sampled voltage from the pin into a digital signal; a bit masking circuit to filter the digital signal and determine a mapped identification value for the device based on the filtered digital signal, the mapped identification value corresponding to a particular instance of a product from a group of products; and An authentication circuit, the authentication circuit being used to: computing a message authentication code using the mapped identification value; as well as The message authentication code is provided to the authentication host upon request of the authentication host.

2. The device of claim 1, wherein the mapped identification value corresponds to a physical characteristic of the device. 3 . The device according to claim 1 , wherein the bit masking circuit is used to determine the mapped identification value according to data on the pin.

4. The apparatus according to any one of claims 1 to 3, wherein the bit masking circuit is used to permanently write the mapped identification value when the mapped identification value is determined for the first time.

5. A device, wherein the device include: Integrated Circuit (IC); a pin on the IC, the pin being connected to a resistor and a power source; a computation circuit in the IC to determine a mapped identification value for the device based on the voltage at the pin, the mapped identification value decoding the device as a specific instance of one product from a group of products; and An authentication circuit in the IC, the authentication circuit being configured to: computing a message authentication code using the mapped identification value; as well as The message authentication code is provided to the authentication host upon request of the authentication host.

6. The device of claim 5, wherein the mapped identification value corresponds to a stock keeping unit (SKU) of the device.

7. The apparatus of claim 6, wherein each product type within a set of product types comprises a matching IC.

8. The device of claim 7, wherein the calculation circuit determines the mapped identification value of the device based on data on the pin.

9. The apparatus of any one of claims 7 to 8, wherein the IC permanently writes the mapped identification value when the mapped identification value is determined for the first time.

10. A method, the method comprising: include: receiving a voltage from a point between the resistor and the current source; determining a mapped identification value for the device based on the voltage, the mapped identification value decoding the device as a specific instance of a product from a group of products; computing a message authentication code using the mapped identification value; as well as The message authentication code is provided to the authentication host upon request of the authentication host. The method of claim 10 , wherein the mapped identification value identifies a physical characteristic of the device.

12. A method according to any one of claims 10 to 11, wherein providing the mapped identification value to the authentication host supports verification of the authentication code.

13. The method according to any one of claims 10 to 12, further comprising determining the mapped identification value of the device based on data on a pin of the device.

14. The method of any one of claims 10 to 13, further comprising permanently writing the value of the mapped identification value when the mapped identification value is determined for the first time.

15. A method, the method comprising: include: identifying a product type to be produced from a set of product types, the product type including an integrated circuit (IC) for identifying and authenticating instances of the product type; and Based on the type of product, a resistor is connected to a pin of the product, the resistor corresponding to the product type.

16. The method of claim 15, wherein each product in the set of products comprises an instance of the IC.

17. A method according to any one of claims 15 to 16, wherein the resistor is selected to correspond to a physical characteristic of the product.

18. The method according to any one of claims 15 to 17, further comprising: include: applying a current to the pin; Allowing the product to identify the product type; as well as The product is caused to permanently write the value of the product type into the IC.

Images