Digital signature

Abstract

A logic circuit package includes an interface for communicating with a host and a logic circuit. The logic circuitry includes a memory arrangement that stores digitally signed metadata for facilitating verification of the associated signed data. The digital signature metadata comprises a mode identifier field, and the mode identifier field stores a mode version number; a key identifier field that stores an identifier of the signature key; a plurality of data block address fields, wherein each data block address field stores an address corresponding to the data block of which the digital signature is originally calculated in the plurality of data blocks; and a plurality of data block length fields corresponding to the plurality of data blocks, each data block length field storing data indicating a length of a corresponding data block. The logic circuitry is configured to receive a read request from the host and transmit the digitally signed metadata to the host in response to the read request.

Description

Background Art

[0001] The subcomponents of the device can communicate with each other in a variety of ways. For example, the serial peripheral interface (SPI) protocol, Bluetooth low energy (BLE), near field communication (NFC), or other types of digital or analog communication can be used.

[0002] Some two-dimensional (2D) and three-dimensional (3D) printing systems include one or more replaceable printing device components, such as printing material containers (e.g., inkjet cartridges, toner cartridges, ink supplies, 3D printing agent supplies, build material supplies, etc.), inkjet print head assemblies, etc. In some examples, logic circuitry associated with the replaceable printing device component(s) communicates with logic circuitry of the printing device in which the replaceable printing device components are installed, e.g., to communicate information such as their identification, capabilities, status, etc. Similarly, other communication systems use logic circuitry to connect to host logic circuitry, general examples of which include network communication systems, life science applications, automotive industry, Internet of Things, etc.

[0003] Many examples of logic circuits include a digital signature that includes signed data. The data may be generated and signed at the time of manufacture. The signature may be verified by a host or controller, whereby it may be assumed that the signed data represents trusted data originating from, for example, an OEM or other trusted / authorized party. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 An example of a printing system is illustrated.

[0005] Figure 2 One example of a replaceable printing device component is illustrated.

[0006] Figure 3 An example of a printing device is illustrated.

[0007] Figure 4 One example of a replaceable print cartridge is illustrated.

[0008] Figure 5A and Figure 5B An example memory arrangement is illustrated.

[0009] Fig. 6A and Figure 6B Example digital signature metadata is illustrated.

[0010] FIG. 7A to FIG. 7D is a flow chart illustrating an example method that may be performed by logic circuitry.

[0011] Fig. 8A and Figure 8B is a block diagram illustrating one example of a processing system for configuring a logic circuit package.

[0012] Fig. 9 is a block diagram illustrating one example of a signature hierarchy for a logic circuit package.

[0013] Fig.10 An example of a consumables cartridge is shown.

[0014] Fig.11A and Fig. 11B Other example memory arrangements are illustrated.

[0015] Fig. 12A and Fig. 12B Example attribute data for producing a digital signature is illustrated.

[0016] Fig.13 An example of instructing data for producing a digital signature is illustrated.

[0017] Fig.14 is a flow chart illustrating another example method that may be performed by logic circuitry.

[0018] Fig.15 is a flow chart illustrating another example method that may be performed by logic circuitry.

[0019] Fig.16 is a flow chart illustrating one example of a method for configuring a logic circuit package including a memory arrangement.

[0020] Fig.17A and Fig. 17B Other example memory arrangements are illustrated.

[0021] Fig.18A and Fig.18B Illustration of example part number signature metadata.

[0022] FIG. 19A to FIG. 19C is a flow chart illustrating other example methods that may be performed by logic circuitry.

[0023] Fig. 20A and Fig. 20B is a block diagram illustrating another example of a processing system for configuring a logic circuit package.

[0024] Fig.21A and Fig.21B Other example memory arrangements are illustrated.

[0025] Fig. 22 is a flow chart illustrating another example method that may be performed by logic circuitry. DETAILED DESCRIPTION

[0026] The following detailed description refers to the accompanying drawings, which form a part of the detailed description, and in which specific examples in which the present disclosure can be practiced are shown by way of illustration. It should be understood that other examples can be utilized and structural or logical changes can be made without departing from the scope of the present disclosure. Therefore, the following detailed description should not be understood as restrictive, and the scope of the present disclosure is defined by the appended claims. It should be understood that each individual feature or combination of features in the various examples described herein can be combined in part or in whole with each other individual feature or combination of features.

[0027] Some examples of applications are described herein in the context of a printing device. However, not all examples are limited to such applications, and at least some of the principles set forth herein may be used in other contexts, including but not limited to other communication systems, network communication systems, life science applications, automotive industry, Internet of Things, beverages, etc.

[0028] Certain unauthorized third parties attempt to reverse engineer parts from original equipment manufacturers (OEMs) or other authorized parties to connect to the OEM or other authorized party's devices. Authorized parties (also referred to as trusted parties) include parties in the authorization chain, which may include OEMs, suppliers, developers, etc., such as parties authorized by intellectual property or otherwise associated with these parts and devices, while unauthorized third parties can be third parties that attempt to at least partially copy the original logic circuits of these authorized parties to connect to the host devices of these authorized parties without any pre-authorized relationship with the authorized parties.

[0029] In one practical example, the logic circuit may include a microcontroller attached to or configured to be attached to a printing consumables box, wherein the host printing device logic circuit may include a printer controller and / or a printer microcontroller. In the present disclosure, the host logic circuit may be any host-side microcontroller, controller, application-specific integrated circuit (ASIC), etc. The host logic circuit may sometimes be simply referred to as a "host", while the "logic circuit" itself should refer to the component-side logic circuit, not the host. In addition, the principles set forth in the present disclosure can be applied to any two opposite communication devices without any hierarchical implications, for example, the relationship between the host and the component is not required. Therefore, throughout the present disclosure, "controller" can be used instead of "host". The controller may include a system component, a host, a supply device, a computer, a printer, etc. The host or controller may include an opposite microcontroller and / or firmware that communicates with the logic circuit of the present disclosure. In the host printing device, the host printing device logic circuit may command the logic circuit of the replaceable printing supply component. In other examples, it is not excluded that the logic circuit of the present disclosure may command the opposite controller or host. Therefore, the host may include any controller or other logic circuit.

[0030] The host or controller can be developed to only accept consumables (e.g., boxes, containers, etc.) containing keys, attributes, and data from a trusted party (e.g., OEM). To address this issue, as disclosed herein, digital signatures are provided on selected attributes and data. The digital signature is generated using a private key and written to the consumable. The firmware in the host can store (or access) the corresponding public key to confirm the digital signature. If the digital signature is successfully confirmed, the key, attribute, and data are authentic, and the consumable can be accepted and used by the host. If the digital signature is not successfully confirmed, the key, attribute, or data is not authentic, and the consumable may be rejected by the host. As used herein, the term "signature" refers to "digital signature", and "signature" and "digital signature" can be used interchangeably. A digital signature as disclosed herein can be signed directly on selected attributes and / or data, indirectly on selected attributes and / or data (such as signing a hash of selected attributes and / or data), or a combination thereof.

[0031] In order to enable the host to confirm the digital signature, the consumable can indicate which attributes and data are used to generate the digital signature. In one example, a flexible and extensible mode is disclosed herein for specifying data for calculating a digital signature. The data may include a certificate, such as a custom certificate format that does not otherwise contain a means of proof. The mode disclosed herein allows confirmation that the selected keys, attributes, and data on the consumable are authentic, or at least developed by a party that has access to a private key associated with the digital signature and / or mode. The private key may include trade secrets, etc., and the party that has access to the private key may be an authorized party. The digital signature can force unauthorized manufacturers to copy complete attributes and data sets from genuine consumables instead of using non-authentic attributes, data, or combinations. For example, a digital signature can make it easier to identify and / or remind customers of the existence of non-authentic consumables, such as through a host or server or other means. A flexible and extensible method for specifying the attributes and data included in the digital signature can save memory in the consumable and can allow a simpler and more efficient process for signature confirmation. For example, a single digital signature can be used to prove multiple OEM proprietary certificates. The digital signature schemes and aspects involved in the present disclosure can be applied to different types of digital circuits, including any computing or processing device, such as having some type of interconnect capability, directly, physically and / or through any type of network.

[0032] As described, the logic circuit package can be associated with a printing device component such as a box or a container, and the host logic circuit can be associated with the host printing device to which the component is to be connected. In other examples, the logic circuit does not need to be associated with the printing component or the host printing device, and the host can be replaced by any type of controller that is not necessarily in the relationship between the host and the component. The logic circuit and the controller can be used in combination with any electromechanical system, chip laboratory, mobile computing device and / or life science application. A wide range of applications require a logic circuit package (such as a microcontroller) to be physically and / or communicatively securely connected to the host. The logic circuit package can be connected to any type of host, for example, any computing system, server, automotive system, home use equipment, access control system, etc. Although many examples of the present disclosure relate to logic circuit packages and logic circuits for connecting printing device components to host printing device logic circuits, the features of the logic circuit package can be applied outside the printing field alone or in association with any component to connect to any type of host logic circuit (not necessarily associated with printing device components or printing devices, respectively). Therefore, in the case where the present disclosure relates to printing devices and printing device components (or boxes or containers), etc., the device can be any device, and the component can be any component. Examples of the present disclosure allow a host logic circuit to securely identify and authenticate the logic circuit.

[0033] In some examples, an inter-integrated circuit (I 2 The I2C or I2C, as used herein, protocol allows at least one 'leader' (commonly referred to as a 'master') integrated circuit (IC) to communicate with at least one 'follower' (commonly referred to as a 'slave') IC, for example via a bus, I2C and other communication protocols, to transmit data according to a clock cycle. For example, a voltage signal can be generated, wherein the value of the voltage is associated with the data. For example, a voltage value above X volts can indicate a logical "1", while a voltage value below Y volts can indicate a logical "0", wherein X and Y are predetermined values ​​and Y is less than or equal to X. By generating the appropriate voltage in each of a series of clock cycles, data can be transmitted via a bus or another communication link. Certain examples of the present disclosure relate to follower or slave logic. In other examples, there need not be a master-slave or leader-follower or host-component relationship, whereby two oppositely communicating logic circuits (e.g., microcontrollers) can both receive and respond to commands.

[0034] In at least some examples, multiple logic circuit packages (each of which may be associated with a different replaceable printing device component or container) may be connected to an I2C bus. Some example printing material containers have follower logic utilizing I2C communication, but in other examples, other forms of digital or analog communication may also be used. In examples of I2C communication, a guide IC may be provided as part of a printing device (which may be referred to as a 'host'), and replaceable printing device components may include a 'follower' IC, but not necessarily in all examples. There may be multiple follower ICs (e.g., containers of printing agents of different colors) connected to an I2C communication link or bus. The address of the logic circuit package may be, for example, an I2C compatible address (hereinafter referred to as an I2C address) according to an I2C protocol, to facilitate direct communication between the guide and the follower according to the I2C protocol. (Multiple) follower ICs may include a processor for performing data operations before responding to a request from a logic circuit of a printing system. In some examples, a follower IC or logic circuit package of the present disclosure may be connected to or integrated with any printing device component, which may be connected to or integrated with a printing device or connected to or integrated with a printing device. For example, a logic circuit package or follower IC of the present disclosure may be connected to a non-replaceable printing device component. In other examples, other forms of digital and / or analog communication besides I2C may be used.

[0035] Communication between a printing device and a replaceable printing device component (and / or its corresponding logic) installed in the device can facilitate various functions. The logic within the printing device can receive information from the logic associated with the replaceable printing device component via the communication interface and / or can send commands to the replaceable printing device component logic, which commands may include commands for writing data to or reading data from a memory associated therewith.

[0036] In at least some examples described below, a logic circuit package is described that can be associated with a replaceable printing device component (e.g., internally or externally attached to the replaceable printing device component, such as at least partially within a housing) and adapted to communicate data with a printing device controller via a bus provided as part of the printing device.

[0037] As used herein, the term 'logic circuit package' refers to one or more logic circuits that can be interconnected or communicatively linked to each other. Where more than one logic circuit is provided, these logic circuits can be packaged as a single unit, or can be packaged individually, or not packaged, or some combination thereof. The package can be arranged or disposed on a single substrate or multiple substrates. In some examples, the package can be directly attached to the box wall. In some examples, the package can include an interface, such as a pad or a pin. The package interface can be intended to be connected to a communication interface of a printing device component, which in turn is connected to the printing device logic circuit, or the package interface can be directly connected to the printing device logic circuit. The example package can be configured to communicate via a serial bus interface. Where more than one logic circuit is provided, these logic circuits can be connected to each other or to an interface to communicate through the same interface.

[0038] In some examples, each logic circuit package is provided with at least one processor and memory. In one example, the logic circuit package can be or can be used as a microcontroller or a secure microcontroller. In use, the logic circuit package can be adhered to or integrated with a replaceable printing device component (such as a replaceable printing consumable (e.g., ink, toner) cartridge). The logic circuit package can alternatively be referred to as a logic circuit assembly, or simply as a logic circuit or processing circuit.

[0039] In some examples of the present disclosure, a package or packaging refers to the final assembly result of a logic circuit or integrated circuit assembly process, that is, essentially the final form of the processing circuit hardware itself. The logic circuit package may be a final product for shipping and selling and for use with a host logic circuit on site, or the logic circuit package may be an intermediate product that may require further customization or personalization or writing steps, further assembly, and / or further attachment or connection to another (e.g., printing) component or circuit. In a relatively simplified form, the package may be a substrate with a thin film layer without further protection. In other examples, the package may include at least one circuit that is at least partially protected by an encapsulation or molding material, and / or supported by a board (e.g., PCB) and / or a flexible film and / or a molded plastic part such as a print box. In some instances, the logic circuit is substantially surrounded by protective and / or insulating materials, except for electrodes that connect the logic circuit to the host logic circuit and / or other logic circuits. All of these examples and others may refer to packaging. "Package" should not be confused with the industry term "packaging", although the package may include logic circuit packaging.

[0040] In some examples, the logic circuit package can respond to various types of requests (or commands) from the host (e.g., printing device) logic circuit. Requests include, for example: a read request for reading data from a general memory; a query attribute request for reading attributes from an attribute storage memory, and / or a start session request for starting an authenticated communication session using a key stored in a key storage memory. A request is a command.

[0041] Figure 1 An example of a printing system 100 is illustrated. Printing system 100 includes a printing device 102 that communicates with logic circuitry associated with a replaceable printing device component 104 via a communication link 106. In some examples, communication link 106 may include an I2C-capable bus or an I2C-compatible bus (hereinafter referred to as an I2C bus). Although replaceable printing device component 104 is shown as being external to printing device 102 for clarity, in some examples, replaceable printing device component 104 may be temporarily installed or permanently housed within the printing device.

[0042] The replaceable printing device component 104 may include, for example, a printing material container or box (which may be a building material container for 3D printing, a liquid or dry toner container for 2D printing, or an ink or liquid printing agent container for 2D or 3D printing), which may include a print head or other distribution or transfer components in some examples. The printing material may be a consumable printing material consumed by distribution or transfer. In the present disclosure, printing materials, printing consumables, or consumable printing materials may be the same thing, and examples thereof are indicated in brackets above. The replaceable printing device component 104 may, for example, contain consumable resources of the printing device 102, or a component whose life may be shorter (in some examples, significantly shorter) than the life of the printing device 102. In addition, although a single replaceable printing device component 104 is shown in this example, in other examples, there may be multiple replaceable printing device components, such as including printing agent containers of different colors, print heads (which may be integrated with the container), and the like. In other examples, the printing device component 104 may include a service component to be replaced, for example, by maintenance personnel, examples of which may include a printhead, a toner cartridge, or the logic circuit package itself to adhere to a corresponding printing device component and communicate with a compatible printing device logic circuit. In other examples, the logic circuit of the present disclosure may be communicatively connected to other devices besides a printing device.

[0043] Figure 2 An example of a replaceable printing device component 200 is shown, which may provide Figure 11. The replaceable printing device component 104 in FIG. The replaceable printing device component 200 includes a data interface 202 and a logic circuit package 204. When the replaceable printing device component 200 is used, the logic circuit package 204 decodes data received via the data interface 202. The logic circuit can perform other functions as described below. The data interface 202 can include an I2C or other interface. In some examples, the data interface 202 can be part of the same package as the logic circuit package 204.

[0044] In some examples, the logic circuit package 204 may be further configured to encode data for transmission via the data interface 202. In some examples, there may be more than one data interface 202 provided. In some examples, the logic circuit package 204 may be arranged to act as a 'follower' in an I2C communication.

[0045] Figure 3 An example of a printing device 300 is shown. The printing device 300 may provide Figure 1 1. The printing device 300 may be used as a host for replaceable components. The printing device 300 includes an interface 302 for communicating between replaceable printing device components and printing device logic 304 (eg, a controller). In some examples, the interface 302 is an I2C interface.

[0046] In some examples, the printing device logic circuit 304 can be configured to act as a host or 'bootstrap' in I2C communications. The printing device logic circuit 304 can generate commands and send these commands to at least one replaceable printing device component 200, and can receive and decode responses received therefrom. In other examples, the printing device logic circuit 304 can communicate with the logic circuit package 204 using any form of digital or analog communication.

[0047] Printing devices 102, 300 and replaceable printing device components 104, 200 and / or their logic can be manufactured and / or sold separately. In an example, a user can acquire a printing device 102, 300 and retain the device 102, 300 for many years. Even when the same version of the device 102, 300 is no longer available for purchase, the same device continues to be used for printing in homes and offices. In contrast, in the subsequent years when the device 102, 300 can no longer be purchased, replaceable printing device components 104, 200 can still be purchased to facilitate printing with the device 102, 300. Over the years, the printing device component logic is upgraded, for example, to be compatible with newer versions of printing devices. The same upgraded printing device component logic can remain backward compatible with older versions of printing devices to be compatible with a variety of printing devices including both older and newer versions. It may be advantageous for an original equipment manufacturer (OEM) to produce printing device component logic that is compatible with a wide variety of printing devices 102, 300, for example, to avoid the need to support multiple hardware versions and to avoid a proliferation of stock keeping units (SKUs) of printing device component logic. Thus, there may be at least some degree of forward and / or backward compatibility between the printing devices 102, 300 and the replaceable printing device components 104, 200.

[0048] Figure 4 An example of a replaceable print cartridge 400, such as a print consumable cartridge, is shown. The print cartridge 400 may provide Figure 1 Replaceable printing device component 104 or Figure 2 4. The print cartridge 400 includes a logic circuit package 402, which includes a logic circuit 404 and an interface 408. In some examples, the interface 408 is an I2C interface. The logic circuit 404 includes a memory arrangement 406. In addition, the print cartridge 400 includes a reservoir 410 for holding consumables and an output 412 for dispensing consumables. The consumables may include ink, dry toner, liquid toner, 3D printing agent (e.g., print enhancer, print inhibitor, build powder such as plastic powder or metal powder), or another suitable consumable outside the printing field.

[0049] Logic circuit package 402 may be associated with replaceable print cartridge 400, or in some examples, may be attached to and / or at least partially incorporated within the replaceable print cartridge. Logic circuit 404 is communicatively coupled to memory arrangement 406. Memory arrangement 406 may include a single or multiple memory devices, and may include any one or any combination of volatile memory (e.g., dynamic random access memory (DRAM), static random access memory (SRAM), registers, etc.) and non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory, erasable programmable read-only memory (EPROM), memristors, etc.). In some examples, as described below with reference to FIG. 5A to FIG. 6B As described in more detail, the memory arrangement 406 stores the digital signature and digital signature metadata corresponding to the digital signature. As described in more detail below, the logic circuit 402 can be configured to respond to a request from the host printing device logic circuit to verify the authenticity of selected data and / or attributes of the logic circuit. If the selected data and / or attributes of the logic circuit 402 are verified to be authentic, the host printing device can use the replaceable print cartridge 400.

[0050] The example logic circuit disclosed herein can provide a flexible digital signature mode, allowing manufacturers or suppliers to associate different amounts and types of selected data with the digital signature of the mode relative to the same controller or host that verifies the digital signature. Therefore, a single host controller can verify different digital signatures and different amounts and / or types of data associated with the digital signature. At the same time, it is difficult for unauthorized third parties to tamper with the signed data. In other examples, the specified data and digital signature metadata (described below) can take up a relatively small amount of data space. In yet other examples, the specified data, digital signature metadata, and digital signature can be copied by an unauthorized third party, which can give the appearance of authorized data to the copied specified data, metadata, and digital signature. In a practical example, the logic circuit may include a microcontroller attached to or configured to be attached to a printing consumables box, wherein the printing device logic circuit may include a printer controller and / or a printer microcontroller.

[0051] Figure 5A An example of a memory arrangement 406a is shown. In some examples, the memory arrangement 406a may be Figure 4 Memory arrangement 406a stores digital signature metadata 500 (also referred to herein as perso signature metadata) and digital signature 502 (also referred to herein as perso signature) corresponding to digital signature metadata 500. Fig.10In more detail, digital signature metadata 500 and digital signature 502 may be stored in a common memory portion of a memory arrangement that may be accessed by, for example, a controller of a host for read and write operations. Digital signature metadata 500 is used to facilitate verification of digital signature 502 (e.g., associated signed data) by the host. Digital signature metadata 500 may vary, and will be referred to below. Fig. 6A and Figure 6B The digital signature metadata 500 specifies data used to calculate the digital signature 502. The digital signature 502 is calculated using the data corresponding to the digital signature metadata 500 and a private key corresponding to a public key stored or accessible by the host. Fig. 8A and Figure 8B The calculation of digital signature 502 is described in more detail. To verify that the logic circuit is authentic, the host can read digital signature metadata 500 and digital signature 502. The host can then use the data specified by digital signature metadata 500 to confirm digital signature 502.

[0052] Figure 5B Another example of a memory arrangement 406b is shown. In some examples, the memory arrangement 406b may be Figure 4 Memory arrangement 406b stores digital signature metadata 500 and digital signature 502 corresponding to digital signature metadata 500, as previously described with reference to FIG. Figure 5A In addition, the memory arrangement 406b also stores a partition map 504, a logic circuit identifier 506, a specified data 508 (also referred to herein as perso signature specified data), and other data 510. Fig.10 In more detail, the partition map 504 and the logic circuit identifier 506 can be stored in an attribute memory portion of the memory arrangement, which can be configured to be accessed by the host for read operations, but not for write operations. An example of such a partition map 504 is disclosed in U.S. Patent No. US8205976B1 or International Patent Application No. PCT / US2021 / 020262. In addition, the designated data 508 and other data 510 can be stored in a general memory portion of the memory arrangement, which can be accessed by the host for read and write operations.

[0053] The partition map 504 includes metadata defining the partitions of the memory arrangement 406b (such as the partitions of the general memory portion of the memory arrangement). The digital signature metadata 500, the digital signature 502, the specified data 508 and other data 510 are stored in the partitions of the memory arrangement 406b defined by the partition map 504. The partition map 504 may include multiple partition lengths, read / write configurations and partition attribute identifiers, each of which defines each partition of the general memory portion of the memory arrangement. The read / write configuration can define how the corresponding partition is accessed, for example, for read-only (RO) operations, write-only (WO) operations, read and write (R / W) operations, or write-once read-only (W2RO) operations. The partition read / write configuration can also define other access modes, such as specifying whether authentication is required for partition access. The partition attribute identifier can define the type of data stored in the partition. For example, one attribute identifier value can indicate a partition storing a perso signature, and another attribute identifier value can indicate a partition storing perso signature metadata. The host can query the partition map and, based on the length and attribute identifier information, determine where the perso signature and perso signature metadata are stored and then construct an appropriate read command (which specifies the memory address and length). The partition map 504 can have a variable length and can define a single partition or multiple partitions. In some examples, the partition map 504 can have a length of four bytes times the number of partitions, where each partition length is two bytes, each read / write configuration is one byte, and each partition attribute identifier is one byte.

[0054] The logic circuit identifier 506 enables the host to identify the logic circuit package 402 ( Figure 4 ) from other logic circuit packages. In some examples, each logic circuit identifier 506 can be unique, i.e., different for different logic circuit packages. In instances where identifier 506 is copied by an unauthorized third party, logic circuit identifier 506 need not be universally unique, as two or more instances of the same identifier 506 may exist. In some examples, logic circuit identifier 506 has a length of 32 bytes.

[0055] Specified data 508 includes data stored in a plurality of data blocks of a general memory portion of a memory arrangement as specified by digital signature metadata 500. Specified data 508 includes data that is signed. Digital signature 502 is based at least in part on specified data 508. Digital signature 502 is not based on other data 510. In some examples, the specified data may be static (e.g., read-only data) over the life of the logic circuit package and / or the component to which the logic circuit package is attached. Specified data 508 may include any suitable data, such as a certificate and / or data specific to the logic circuit package. Specified data 508 may have a variable length between different logic circuit memory arrangements. In some examples, specified data 508 may include digital signature metadata 500, i.e., one of the data blocks that is part of specified data 508 may include digital signature metadata 500.

[0056] Other data 510 includes data not specified by digital signature metadata 500. Other data 510 may include data not related to digital signature 502 that is not signed, including print cartridge related characteristics (e.g., color, fill level, etc.) and / or other suitable data. In some examples, other data 510 may include data (e.g., read / write data or write-once read-only data) that is intended to be updated / changed by the host during the life of the logic circuit package or a component to which the logic circuit package is attached, such as dynamic data that is updated during the life of the logic circuit, including data in a usage counter field or printing material level data.

[0057] In some examples, digital signature 502 signs data including at least one of a device type identifier, a logic circuit identifier 506, a partition map 504, and specified data 508. The device type identifier not stored in memory arrangement 406b may correspond to logic circuit package 402 ( Figure 4 ) to identify that the logic circuit package is intended to be attached to or attached to a replaceable printing device component. In some examples, the value of the device type identifier is the same for all logic circuit packages that are intended to be attached to or attached to a replaceable printing device component. Other values ​​of the device type identifier may indicate that the logic circuit package is not intended to be attached to a replaceable printing device component.

[0058] As described in more detail below, to verify that the logic circuit is authentic, the host can read digital signature metadata 500, digital signature 502, partition map 504, and logic circuit identifier 506. The host can then use digital signature metadata 500 to read specified data 508. The host can then use partition map 504, logic circuit identifier 506, and specified data 508 to confirm digital signature 502. In one example, only portions of the partition map are verified for confirmation, such as the lengths of partitions in the partition map and / or other features in the partition map.

[0059] Fig. 6A An example of digital signature metadata 600a is shown. In one example, digital signature metadata 600a provides Figure 5A or Figure 5B 600a includes a mode identifier field 602, a key identifier field 604, (multiple) data block address fields 606, and (multiple) data block length fields 608. The mode identifier field 602 stores a mode version for the host to determine which mode to use. The mode identifier field 602 can have a length of one byte. The key identifier field 604 stores an identifier of the signing key for the host to verify using the correct key. The host can store (or have access to) multiple public keys for verifying various signatures. The key identifier field 604 can have a length of two bytes. The original digital signature 502 ( Figure 5A and Figure 5B ) can be computed using the key corresponding to the key identifier.

[0060] The (multiple) data block address fields 606 may include a single data block address field or multiple data block address fields. Each data block address field stores an address corresponding to the data block of the original calculated digital signature. The data block address may be the starting address of the data block. Each data block address field may have a length of two bytes. The (multiple) data block length fields 608 may include a single data block length field or multiple data block length fields. Each data block length field corresponds to the data block addressed by the corresponding data block address field. Each data block length field stores data indicating the length of the corresponding data block. Each data block length field may have a length of two bytes. Each data block address field and the corresponding data block length field may be in the digital signature metadata 600a from the first data block address (addr1) and data block length (len1) to the last data block address (addr N ) and data block length (len N ) are concatenated as follows: addr1||len1||addr2||len2||...||addr N ||len N In one example, one of the designated data blocks may store digital signature metadata.

[0061] Figure 6B Another example of digital signature metadata 600b is shown. In one example, digital signature metadata 600b provides Figure 5A or Figure 5BThe digital signature metadata 600b includes a mode identifier field 602, a key identifier field 604, (multiple) data block address fields 606, and (multiple) data block length fields 608, as previously described with reference to FIG. Fig. 6A As described and illustrated. In addition, the digital signature metadata 600b also includes a length field 610 and a data block count field 612. The data block count field 612 stores data indicating the total number of data blocks addressed by the (multiple) data block address field 606. The data block count field 612 may have a length of one byte. The length field 610 stores data indicating the total cumulative length of the key identifier field 604, the data block count field 612, the (multiple) data block address field 606, and the (multiple) data block length field 608. The length field 610 may have a length of two bytes. The host may use the data stored in the length field 610 to parse the digital signature metadata 600b. In some examples, instead of or in addition to the length field 610, the host may use the data stored in the data block count field 612 to parse the digital signature metadata 600b.

[0062] The digital signature metadata 600b may be concatenated and written to the memory arrangement 406 as follows ( Figure 4 ): mode identifier||length||key identifier||block count||addr1||len1||addr2||len2||...||addr N ||len N For example, given the value 02 000B 8C00 02 0000 00F0 0100 0001, the mode identifier field 602 (i.e., 02) indicates that the mode version number is 2, the length field 610 (i.e., 000B) indicates that the total cumulative length is 11 bytes, the key identifier field 604 (i.e., 8C00) indicates that the signature key identifier is 8C00, the data block count field 612 (i.e., 02) indicates two data blocks, the first data block address field 606 (i.e., 0000) and the first data block length field 608 (i.e., 00F0) indicate a first data block with a length of 240 bytes from 0x0000-0x00EF, and the second data block address field 606 (i.e., 0100) and the second data block length field 608 (i.e., 0001) indicate a second data block with a length of one byte from 0x0100-0x0100.

[0063] FIG. 7A to FIG. 7D It is a diagram that can be represented by a logic circuit (such as Figure 4 404 in the example method 700, 710, 720 and 730. The logic circuit can be a flowchart for a replaceable printing device component (e.g., Figure 4 400) of the logic circuit package (for example, Figure 4 402), the logic circuit package includes a portion for communicating with the printing device logic circuit as described above (for example, Figure 3 304) communication interface (for example, Figure 4 In this example, the memory arrangement stores digital signature metadata (e.g., Fig. 6A 600a or Figure 6B 600b in ). Fig. 7A As illustrated in method 700 at 702, logic circuitry is configured to receive a read request from a host. At 704, logic circuitry is configured to transmit digital signature metadata to the host in response to the read request.

[0064] In one example, the memory arrangement stores a digital signature corresponding to the digital signature metadata (e.g., Figure 5A or Figure 5B 502 in the example), the digital signature is used with a key identifier (e.g., Fig. 6A or Figure 6B In this example, Figure 7B As illustrated in method 710 at 712, logic circuitry is configured to receive a read request (or multiple read requests) from a host. At 714, logic circuitry is configured to transmit a digital signature and digital signature metadata (in any order) to the host in response to at least one read request.

[0065] In one example, the memory arrangement stores a logic circuit identifier (e.g., Figure 5B 506), partition map (e.g., Figure 5B 504 in), digital signature metadata (e.g., Figure 5B 500 in ), specify data (for example, Figure 5B 508 in ) and a digital signature (e.g., Figure 5B 502 in ). In this example, Figure 7C In method 720 illustrated at 722, the logic circuit is configured to receive a request (e.g., general memory read request(s) and / or attribute memory read request(s)) from a host. At 724, the logic circuit is configured to transmit to the host, in response to at least one request, a logic circuit identifier, a partition map, a digital signature, digital signature metadata, and / or other data, and specified data corresponding to the digital signature metadata.

[0066] In one example, as will be referred to below Fig.10 In more detail, the digital signature metadata and the digital signature are stored in a general purpose memory portion of the memory arrangement that is configured for general purpose read / write access. In addition, the memory arrangement includes at least one different memory portion that is not intended for general purpose read / write access, storing at least one cryptographic key and / or a plurality of attributes. In this case, as Fig.7D In the method 730 illustrated at 732, the logic circuit can be configured to perform a cryptographic operation using at least one cryptographic key. At 734, the logic circuit is configured to return an attribute from a plurality of attributes in response to an attribute request including an associated attribute tag, wherein the logic circuit is configured to associate the attribute with the attribute tag. The plurality of attributes may include, for example, a partition map, a logic circuit identifier, or a device address (e.g., for I2C communication). The logic circuit may be configured to implement one or both of blocks 732 and 734.

[0067] Fig. 8A and Figure 8B is a diagram for configuring a logic circuit package (e.g., Figure 4 402 in FIG. 404 ). In one example, processing system 800 may be part of a production line of logic circuit packages. Processing system 800 includes processor 802 and machine-readable storage medium 806. Processor 802 is communicatively coupled to machine-readable storage medium 806 via communication path 804. Although the following description relates to a single processor and a single machine-readable storage medium, the description may also be applied to systems with multiple processors and multiple machine-readable storage media. In such an example, instructions may be distributed (e.g., stored) across multiple machine-readable storage media, and instructions may be distributed (e.g., executed by) across multiple processors.

[0068] Processor 802 includes one (i.e., single) central processing unit (CPU) or microprocessor or more than one (i.e., multiple) CPUs or microprocessors, and / or other suitable hardware devices for fetching and executing instructions stored in machine-readable storage medium 806. Processor 802 may fetch, decode, and execute instructions 808-814 to configure a logic circuit package.

[0069] Processor 802 may fetch, decode, and execute instructions 808 for obtaining a signature key identifier and signature data. In one example, the signature data includes: a device type identifier corresponding to the logic circuit package; a logic circuit identifier of the logic circuit package, the logic circuit identifier used by the host to distinguish the logic circuit package from other logic circuit packages; a partition map for defining partitions of a common memory portion of a memory arrangement of the logic circuit package (e.g., including a partition length and a partition attribute identifier for each partition); and data to be stored in a plurality of data blocks of the common memory portion of the memory arrangement of the logic circuit package as specified by the digital signature metadata. The signature key identifier and signature data may be stored in machine-readable storage medium 806 and / or another machine-readable storage medium accessible to processing system 800.

[0070] Digital signature metadata is used to facilitate verification of the associated signed data. Digital signature metadata may include: a mode identifier field (e.g., Fig. 6A or Figure 6B 602), the mode identifier field stores a mode version number used by the host to determine which mode to use; the key identifier field (e.g., Fig. 6A or Figure 6B 604), the key identifier field stores the identifier of the signature key for the host to use the correct key for verification; multiple data block address fields (for example, Fig. 6A or Figure 6B 606), each of the plurality of data block address fields stores an address corresponding to a data block of the plurality of data blocks for which the digital signature was originally calculated; and a plurality of data block length fields corresponding to the plurality of data blocks (e.g., Fig. 6A or Figure 6B 608), each of the multiple data block length fields stores data indicating the length of the corresponding data block.

[0071] Processor 802 may fetch, decode, and execute instructions 810 for concatenating signature data. The signature data may be concatenated as follows: device type identifier||logic circuit identifier||partition map||data of data block 1||data of data block 2||...||data of data block N, where "N" is the number of data blocks. Processor 802 may fetch, decode, and execute instructions 812 for calculating a digital signature on the concatenated signature data using a signature private key corresponding to the signature key identifier. Processor 802 may fetch, decode, and execute instructions 812 for concatenating a digital signature (e.g., Figure 5A or Figure 5B 502) writes instructions 814 to the general memory portion of the memory arrangement of the logic circuit package.

[0072] like Figure 8B As shown, processor 802 can fetch, decode and execute the digital signature metadata (e.g., Figure 5A or Figure 5B 500) into a general memory portion of the memory arrangement of the logic circuit package. The processor 802 can fetch, decode and execute further instructions 816 for writing the logic circuit identifier (e.g., Figure 5B 506) and partition maps (e.g., Figure 5B The processor 802 may fetch, decode, and execute instructions for writing the data (e.g., Figure 5B 508) writes further instructions 820 to the general memory portion of the memory arrangement of the logic circuit package.

[0073] As an alternative to or in addition to fetching and executing instructions, the processor 802 may include one (i.e., a single) electronic circuit or more than one (i.e., multiple) electronic circuits including multiple electronic components for performing the functions of one instruction or more than one instructions in the machine-readable storage medium 806. With respect to the executable instructions, representations (e.g., blocks) described and illustrated herein, it should be understood that in alternative examples, some or all of the executable instructions and / or electronic circuits included in one block may be included in different blocks shown in the figures or different blocks not shown.

[0074] The machine-readable storage medium 806 is a non-transitory storage medium and may be any suitable electronic, magnetic, optical or other physical storage device that stores executable instructions. Thus, the machine-readable storage medium 806 may be, for example, a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a storage drive, an optical disk, etc. Fig. 8A and Figure 8B As shown, machine-readable storage medium 806 may be disposed within system 800. In this case, the executable instructions may be installed on system 800. Alternatively, machine-readable storage medium 806 may be a portable, external, or remote storage medium that allows system 800 to download instructions from a portable / external / remote storage medium. In this case, the executable instructions may be part of an installation package.

[0075] Fig. 9 is a block diagram illustrating a logic circuit package (eg, Figure 4400). The signature hierarchy 900 includes a manufacturing signature 902 that is calculated over a (e.g., part-specific, static) digital signature 910, a part number signature 920, and part-specific manufacturing data 930. The part-specific manufacturing data 930 may include a manufacturing date / time of the component to which the logic circuit 400 is attached, a production line identifier that identifies the production line of the component to which the logic circuit 400 is attached, and the like.

[0076] As previously described above (e.g. with respect to Figure 5A and Figure 5B ), digital signature 910 (e.g., Figure 5A or Figure 5B 502 in, referred to elsewhere in this disclosure as a perso digital signature) is calculated on the signature data 912 to provide signed data. The first key identifier (e.g., Fig. 6A or Figure 6B In some examples, the digital signature 910 is unique to each logic circuit package. The original digital signature 910 and the signature data 912 may be written to the memory arrangement of the logic circuit package during configuration of the logic circuit package, as previously described with reference to Fig. 8A and Figure 8B The signature data 912 includes a device type identifier (in some examples, the device type identifier is not stored in the memory arrangement of the logic circuit package), a logic circuit identifier (e.g., Figure 5B 506), partition map (e.g., Figure 5B 504) and specify data (for example, Figure 5B 508 in ). The private key of the digital signature 910 may reside in a hardware security module (HSM). The public key of the digital signature 910 may reside in or be accessible by the host. The same private key / public key may be used for signature generation and / or verification of multiple logic circuits.

[0077] The part number signature 920 is calculated over the public manufacturing data 922. The part number signature 920 may be calculated using a second key identifier (e.g., Fig.18A or Fig.18BThe part number signature 920 is calculated using a second signature key corresponding to 1804 in 1804), which is different from the first signature key used to calculate the digital signature 910. In some examples, the part number signature 920 can be common to multiple logic circuit packages that share the same part number (for example, belonging to a combination of logic circuit packages, and / or the same series (such as a replaceable printing device component series), the same color or color combination, a certain fill level or certain fill levels, etc.). The part number signature 920 can be the same for multiple logic circuit packages with different digital signatures and different logic circuit identifiers (in some instances, if the logic circuit identifier is different, the digital signature is therefore different). The part number signature 920 can be pre-calculated. The part number signature 920 and the public manufacturing data 922 can be written to the memory arrangement of the logic circuit package during the final assembly of the replaceable printing device component. The public manufacturing data 922 may include color, fill level, region, etc.

[0078] Manufacturing signature 902 may be generated during final assembly of a replaceable printing device component by logic circuitry (e.g., Figure 4 404 in the calculation. The third key identifier (eg, Fig. 12B 1206) corresponding to the third signature key (for example, Fig. 11B 1106 in ), the third signature key is different from the first signature key used to calculate the digital signature 910 and different from the second signature key used to calculate the part number signature. The manufacturing signature 902 may include the manufacturing date and / or time, the production line ID, and more part-specific manufacturing data written during final assembly. As described in more detail below, the logic circuit may include: a dedicated function for calculating the manufacturing signature, including an elliptic curve cryptography (ECC) key that can be used to generate the manufacturing signature; a dedicated configurable attribute that defines which ECC key should be used for the signature and which data blocks should be signed; and dedicated commands for generating signatures, writing dedicated attributes during personalization, and reading dedicated attributes and signatures. The private key of the manufacturing signature 902 can be generated by the personalization system and written to the key storage memory of the logic circuit. The public key of the manufacturing signature 902 is contained in a certificate generated by the personalization system and written to the general memory of the logic circuit. A unique private key / public key can be used for signature generation and / or verification of each logic circuit.

[0079] Third parties and / or unauthorized parties may be able to copy digital signatures and metadata, including Fig. 9 signature and data to have the effect of imitating the original data and authorized data.

[0080] Fig.10 An example of a consumables box 1000 is shown. The consumables box 1000 may provide Figure 1 The replaceable printing device component 104, Figure 2 The replaceable printing device component 200, or Figure 4 The print cartridge 400 in FIG. The consumable cartridge 1000 includes a reservoir 1002 for accommodating consumables, a logic circuit interface 1004 for communicating with a host, and a logic circuit 1006. The consumables may include ink, dry toner, liquid toner, or 3D printing agent. The reservoir 1002 may be connected to an output terminal (not shown) to dispense consumables from the reservoir 1002. The interface 1004 may be an I2C interface or another suitable interface for communicating with a host.

[0081] Logic circuit 1006 includes processor 1008, other authentication logic 1010, and memory arrangement 1012. Memory arrangement 1012 may include attribute storage memory 1014, key storage memory 1024, general purpose memory 1030, and instructions 1040 and 1042. In one example, memory arrangement 1012 may include a single or multiple memory devices, and may include any one or any combination of volatile memory (e.g., DRAM, SRAM, registers, etc.) and non-volatile memory (e.g., ROM, EEPROM, flash memory, EPROM, memristor, etc.).

[0082] The attribute storage memory 1014 may store the logic circuit identifier 506, the partition map 504, and the manufacturing signature attribute data 1200 (hereinafter referred to as Fig. 12A and Fig. 12B1010). In some examples, the attribute storage memory 1014 is accessible for read and / or write access by the processor 1008 and / or other authentication logic 1010. The attribute storage memory 1014 is accessible for read access only by the host by sending a request to the processor 1008, which can perform the requested operation and return the requested data to the host. The key storage memory 1024 can store (multiple) cryptographic keys 1026 (e.g., (multiple) symmetric base keys and / or (multiple) asymmetric private keys). In some examples, the key storage memory 1024 is accessible for read and write access by the processor 1008 and / or other authentication logic 1010, and is not accessible to the host. (Multiple) cryptographic keys 1026 can be used to perform cryptographic operations such as authentication, signing, and / or other suitable operations. In some examples, the key storage memory 1024 stores multiple key identifiers and associated signing keys. Each signing key can be identified and selected based on its associated key identifier. In one example, multiple key identifiers and associated signing keys may be stored in a table or table-like format or any other format that facilitates identification and retrieval of keys based on corresponding identifiers. In another example, a single signing key may be stored with or without an associated identifier.

[0083] The general memory 1030 may store the personalized (perso) signature metadata 500 (e.g., Figure 5A and Figure 5B Digital signature metadata in 500 or Fig. 6A and Figure 6B The digital signature metadata 600a or 600b in the perso signature specification data 508 (e.g., Figure 5B The general memory 1030 may also store the certificate 1102 and the manufacturing signature specified data 1300 (also referred to herein as the indication data, which will be referred to below). Fig.11A and Fig. 11B In some examples, the certificate 1102 may be included in the perso signature designation data 508. The certificate 1102 may be of the type described in International Patent Application No. PCT / US2021 / 054017, which is incorporated herein by reference. The manufacturing signature designation data 1300 may include the perso signature 502 (e.g., Figure 5A and Figure 5B ), a part number signature 1304, and part-specific manufacturing data 1306 (e.g., corresponding to Fig. 9910, 920, and 930 in the figure). In addition, the general memory 1030 can also store part number signature metadata 1700 and part number signature designation data 1702 corresponding to the part number signature 1304. In some examples, the general memory 1030 can be accessed by the processor 1008, other authentication logic 1010, and / or the host via the processor 1008 for read and / or write access. The host can access the general memory 1030 by transmitting a general read and / or write request to the logic circuit 1006 via the interface 1004. The general read and / or write request from the host to access the general memory 1030 can be different from the request from the host to access the attribute storage memory 1014.

[0084] Instructions 1040 are instructions for conducting a secure communication session between logic circuit 1006 and a host based on cryptographic key(s) 1026. Instructions 1042 are instructions for performing signature calculations (e.g., Fig. 9 Instructions for manufacturing signature 902) in.

[0085] The processor 1008 executes instructions (including instructions 1040 and 1042) for controlling the operation of the logic circuit 1006 and instructions for accessing the memory arrangement 1012 for read and / or write operations. The processor 1008 can respond to external requests or commands from the host (e.g., through the interface 1004) to return data (e.g., logic circuit identifier 506, partition map 504, perso signature metadata 500, perso signature 502, perso signature specified data 508 and other data 510, etc.), update data and / or initiate functions (e.g., start a secure communication session, calculate signatures, etc.). The processor 1008 can also respond to internal requests or commands within the logic circuit 1006 to generate and / or update data stored in the memory arrangement 1012. Other authentication logic 1010 may include high-speed calculator logic for processing predetermined iterative calculations and / or other logic for processing authentication algorithms. In some examples, other authentication logic 1010 may execute instructions 1040 for a secure communication session and / or instructions 1042 for signature calculation or a portion of instructions 1040 for a secure communication session and / or instructions 1042 for signature calculation.

[0086] In order to avoid that the data stored on the compatible logic circuit is different from the original data and / or the authorized data, it is desirable to sign the critical data related to the identity or function stored on the consumable. The signed data is static during the remaining life of the consumable device. Therefore, in many instances, signatures are not suitable for data whose value may change, such as a printing consumable usage counter.

[0087] Generating a signature on part-specific data may be difficult in certain non-directly controlled environments. An example of a non-directly controlled environment may be a manufacturing location of a component (e.g., a replaceable printed component, such as reference numerals 1000, 104, 200) to which a logic circuit package (e.g., 1006, 402, 204) is attached. These manufacturing locations may not be owned or directly operated by the party (e.g., OEM) that designed and generated the architecture and content of the original data.

[0088] The logic circuit on certain components (such as printing consumables) can perform the signing operation by itself by calculating the manufacturing digital signature. For example, the manufacture of a component (e.g., a photoconductor) having a printing material or imaging function can occur after the personalization of the associated logic circuit. Logic circuit personalization and component manufacturing can be performed at different locations and / or by different parties or suppliers. According to an example of the present disclosure, during the manufacture of the component and / or after the personalization of the logic circuit, the manufacturing digital signature is calculated by the logic circuit and stored in the memory arrangement of the logic circuit for later retrieval by an authorized host device (e.g., a printer) that wants to read and authenticate the signature data. Promoting the logic circuit with a manufacturing signature function can facilitate the production line to be able to perform such a signing operation without the need for special equipment. Because the logic circuit is pre-configured to calculate the manufacturing digital signature, the manufacturing digital signature and the data for calculating it can be considered authentic, even if it is not necessarily signed in a directly controlled environment. OEMs may be interested in these advantages.

[0089] Note that third parties that are not OEMs of compatible host devices are still able to copy the data and signatures disclosed herein. According to examples disclosed herein, by storing the same or similar data and signatures, these third parties can be connected to host devices developed by other parties (e.g., the OEM), whereby the host device can treat the received data as original data. In this context, it should be noted that the manufacturing digital signature and other signatures disclosed herein (e.g., perso signatures, part number signatures) can be independent of the steps or parties associated with the authorized manufacturing process or location. In addition, an unauthorized third party can copy the signature in one step or action and write it into the memory arrangement of the consumable. Additionally or alternatively, a complete set of signatures (e.g., perso signatures, part number signatures, and manufacturing digital signatures) can be outsourced to a single supplier / manufacturer, not necessarily an unauthorized third party, and the consumables can follow the same pattern disclosed herein to be compatible with the installed host (e.g., printer). Components, patterns, data, and signatures can be manufactured and / or written in a single location. In other words, the different signatures and data features disclosed herein are not limited by the steps or sequence of the manufacturing process. In certain instances, the various names used to describe each digital signature disclosed herein (e.g., perso, make, part number, etc.) are used only to distinguish the signatures from one another, and the names do not imply that the signatures will be written during any particular process step. The principles described in this disclosure may be used for at least one of the following: (i) obtaining control of data of a large amount of logic circuitry passing through certain steps and / or locations of a manufacturing process, for example because one or some of these steps and / or locations may be difficult to fully control; and / or (ii) obtaining compatibility with pre-shipped / installed host controllers.

[0090] Note that some examples of the present disclosure (such as Fig.10 ) describes an instance of a logic circuit for which a manufacturing digital signature has been calculated, while an earlier instantiation of the logic circuit (e.g., prior to component fabrication) may also have to calculate a manufacturing digital signature.

[0091] Fig.11A Another example of a memory arrangement 406c is shown. In some examples, the memory arrangement 406c may be Figure 4 Memory arrangement 406c stores indication data 1100, certificate 1102, and manufacturing attribute data 1104. Indication data 1100 may be data for calculating a manufacturing digital signature, as indicated by a corresponding indication (e.g., 1202) in manufacturing attribute data 1104, such as Fig. 12A As shown in the figure. Fig.10As shown, indication data 1100 (e.g., referred to herein as manufacturing signature designation data 1300) can be stored in a general memory portion 1030 of a memory arrangement, which can be accessed by a controller such as a host for read and write operations. Certificate 1102 can also be stored in the general memory portion of the memory arrangement. Manufacturing attribute data 1104 (e.g., also referred to herein as manufacturing signature attribute data 1200) can be stored in an attribute memory portion 1014 of the memory arrangement.

[0092] As will be described in more detail below, the indication data 1100 is data for which a manufacturing digital signature is calculated or to be calculated. The certificate 1102 is used by a controller (e.g., of a host) to verify the manufacturing digital signature. The certificate 1102 includes a public key corresponding to a private key used to calculate the manufacturing digital signature. The certificate 1102 is signed with a certificate authority private key and verified by a controller (e.g., a host) with a certificate authority public key. As will be described in more detail below, the manufacturing attribute data 1104 includes at least one indication indicating (e.g., identifying) the indication data 1100 and the manufacturing digital signature.

[0093] Fig. 11B Another example of a memory arrangement 406d is shown. In some examples, the memory arrangement 406d may be Figure 4 Another example of a memory arrangement 406. The memory arrangement 406d stores the indication data 1100, the certificate 1102 and the manufacturing attribute data 1104, as previously described with reference to Fig.11A In addition, the memory arrangement 406d stores a signature key (e.g., a private key) 1106 for calculating a manufacturing digital signature. In this example, the indication data 1100 includes data blocks 11100 to 11107. Although in this example, the indication data 1100 includes 8 data blocks 11100 to 11107, in other examples, the indication data 1100 may include less than 8 data blocks, and in other examples, more than 8 data blocks may be used.

[0094] In some instances, at least one length and / or address of the indication data 1100 to be written in a subsequent manufacturing process step is known in advance. For example, the address and length of each data block 11100 to 11107 of the indication data may be predefined. However, all actual indication data values ​​to be written may not be known in advance. Prior to calculating the manufacturing digital signature, during provisioning or personalization of the logic circuit package, the certificate 1102, the manufacturing attribute data 1104 (except the manufacturing signature), and the signature key 1106 may be written to the memory arrangement 406d. The manufacturing attribute data 1104 may be as described below with reference to Fig. 12A and Fig. 12B Configure as described.

[0095] Fig. 12A An example of attribute data 1200a for making a digital signature is shown. In one example, the attribute data 1200a provides Fig.11A and Fig. 11B The attribute data 1200a includes an indication field 1202 storing at least one indication of data for calculating the manufacturing digital signature (e.g., Fig.11A or Fig. 11B The manufacturing digital signature field 1204 stores the manufacturing digital signature. In one example, the manufacturing digital signature field 1204 has a length of 64 bytes. The manufacturing digital signature field 1204 can remain empty until the logic circuit 1006 calculates the manufacturing digital signature and stores it in the field 1204.

[0096] Fig. 12B Another example of attribute data 1200b for making a digital signature is shown. In one example, attribute data 1200b provides Fig.11A and Fig. 11B The manufacturing attribute data 1104 in the manufacturing attribute data 1200b includes an indication field 1202 storing at least one indication of data for calculating a manufacturing digital signature and a manufacturing digital signature field 1204 storing a manufacturing digital signature, as previously described, for example, with reference to Fig. 12A In addition, the attribute data 1200b includes a signature key identifier field 1206 that stores a signature key identifier. The signature key identifier identifies (eg, corresponds to) a signature key (eg, Fig. 11B The signing key identifier also corresponds to a certificate (e.g., a certificate used by a controller (e.g., a host) to verify the manufacturing digital signature (e.g., Fig. 11B In particular, the signature key identifier corresponds to the public key in the certificate. The certificate may also include a signature key identifier so that the controller can confirm that the controller is using the correct certificate to verify the manufacturing digital signature. In one example, the signature key identifier field 1206 has a length of 2 bytes.

[0097] The indication field 1202 storing at least one indication of the data for calculating the digital signature includes data block address fields 12120 to 12127 and corresponding data block length fields 12140 to 12147. Each data block address field 12120 to 12127 stores the starting address of the corresponding data block 11100 to 11107 ( Fig. 11BEach data block length field 12140 to 12147 stores the length of the corresponding data block 11100 to 11107 ( Fig. 11B ). Therefore, the data block address fields 12120 to 12127 and the corresponding data block length fields 12140 to 12147 identify the corresponding data blocks 11100 to 11107. In one example, each data block address field 12120 to 12127 has a length of 2 bytes, and each data block length field 12140 to 12147 has a length of 2 bytes.

[0098] In one example, manufacturing attribute data 1200b is configured by transmitting a put attribute manufacturing signature command to the logic circuit. The command may specify 1 to 8 data blocks. If fewer than 8 data blocks are specified, addresses and length values ​​of 0 are stored for unspecified data blocks. The command may include the following command parameters: attr_tag||rk_id||dblk0||...||dblk N-1 , where 1≤N≤8. attr_tag is a manufacturing signature attribute tag and may have a length of 1 byte. The manufacturing signature attribute tag indicates that the command is used to configure the manufacturing signature attribute data 1200b. rk_id is a key identifier that identifies a signature key used to calculate a manufacturing signature and may have a length of 2 bytes. The key identifier is stored in the signature key identifier field 1206. dblk n Identifies data block n and may have a length of 4 bytes, including a 2-byte address of the data block and a 2-byte length of the data block. The address and length of each data block n are stored in corresponding data block address fields 12120 to 12127 and data block length fields 12140 to 12147, respectively.

[0099] The writing of manufacturing data and the generation of manufacturing signatures may occur during a post-personalization manufacturing or configuration process, which may occur in an environment that is not fully controlled by the original data authority, such as a manufacturing site not operated by the OEM. During the manufacturing process, manufacturing data may be written as part of the indication data 1100 in a general memory portion of the memory arrangement (e.g., data is written to Fig. 11B After the manufacturing data is written to the memory arrangement, a manufacturing signature may be calculated and stored in the manufacturing digital signature field 1204. In one example, the manufacturing signature may be calculated in response to the logic circuit receiving a generate manufacturing signature command.

[0100] Generate manufacturing signature command can be used to generate (e.g., calculate) manufacturing signature on one or more data blocks of memory arrangement. The data block of signature key and calculation manufacturing signature is specified in manufacturing signature attribute data 1200b. Once generated, the manufacturing signature can be queried via manufacturing signature attribute. In some examples, generating manufacturing signature can cause a transition to the operational life cycle state of consumables (i.e., from manufacturing state to state ready for use by host). In one example, the signature key can be used only once, so that once the manufacturing signature is calculated, the manufacturing signature will never be calculated again. In some examples, once the manufacturing signature has been calculated, the signature key can be deleted.

[0101] The manufacturing signature can be calculated as follows: Signature = ED25519-Sign((signature key), const||SHA-512(mfg_data)), where:

[0102] The signing key corresponds to the key identifier specified in the manufacturing signature attribute data;

[0103] ·mfg_data=dblk0||data0||...||dblk N-1 ||data N-1 ;

[0104] ·dblk n is the data block n specified in the manufacturing signature attribute data; note that unused data blocks (i.e., data blocks of length 0) are not included; and

[0105] ·data n It is the general memory data corresponding to data block n.

[0106] It should be noted that the dblk n ) and indicating data (e.g., data n ) is computed on a hash (e.g., SHA-512) of at least one indication of ).

[0107] Fig.13 An example of manufacturing digitally signed indication data 1300 is illustrated. In this example, indication data 1300 includes a (part-specific) digital signature 502 (also referred to as a perso digital signature 502), a part number digital signature 1304, and part-specific manufacturing data 1306. As previously described, the (part-specific) digital signature 502 is signed on data including at least one of the following: a device type identifier corresponding to a logic circuit package, a logic circuit identifier for a host to distinguish the logic circuit package from other logic circuit packages (e.g., Figure 5B506 in), a partition map (e.g., Figure 5B 504) and specified data stored in a general memory portion of the memory arrangement (e.g., Figure 5B 508 in the ).

[0108] The part number digital signature 1304 is included in the public manufacturing data (e.g., Fig. 9 The common manufacturing data 1306 may be common to multiple logic circuit packages, i.e., not part-specific. The part-specific manufacturing data 1306 includes a manufacturing date, manufacturing time, and a production line identifier (e.g., Fig. 9 The (part-specific) digital signature 502, the part number digital signature 1304, and the part-specific manufacturing data 1306 may be stored in Fig. 11B The indication data 1100 is in data blocks 11100 to 11107.

[0109] Fig.14 It is a diagram that can be composed of a logic circuit (such as Figure 4 404 in the example method 1400. The logic circuit may be a flowchart for a replaceable printing device component (e.g., Figure 4 400) of the logic circuit package (for example, Figure 4 402), the logic circuit package includes a controller as described above (for example, Figure 3 An interface (e.g., Figure 4 In this example, the memory arrangement stores the indication data (e.g., Fig.11A 1100 in), certificates (e.g. Fig.11A 1102) and manufacturing attribute data (e.g., Fig.11A 1104 in ).

[0110] At 1402, logic circuitry is configured to transmit manufacturing attribute data to a controller in response to at least one first request from the controller. The manufacturing attribute data includes a key identifier (e.g., Fig. 12B 1206), at least one indication of the data for computing the digital signature (e.g., Fig. 12B 1202) and creating a digital signature (e.g., Fig. 12BAt 1204 in the example. At 1404, the logic circuit is configured to transmit the certificate and the indication data to the controller in response to at least one second request from the controller. In one example, at least one first request and at least one second request have differently encoded command type fields and / or include different opcodes, indicating different command types. For example, at least one first request may be configured to query an attribute memory (e.g., Fig.10 1014 in ), and at least one second request may be configured to read a general purpose memory (e.g., Fig.10 1030 in ). For example, depending on certain technical limitations or for other reasons, multiple transmissions may be required to transmit the requested data to the controller, so accordingly, multiple requests may also be transmitted from the controller to the logic circuit. At least one first request may include multiple first requests, and / or at least one second request may include multiple second requests. Accordingly, multiple responses may be transmitted, for example, 32 bytes each, to transmit a complete data set, for example, 64 bytes.

[0111] Fig.15 It is a diagram that can be composed of a logic circuit (such as Figure 4 404 in the example method 1500. The logic circuit may be a flowchart for a replaceable printing device component (e.g., Figure 4 400) of the logic circuit package (for example, Figure 4 402), the logic circuit package includes a portion for communicating with a host as described above (e.g., Figure 3 An interface (e.g., Figure 4 In this example, the memory arrangement stores the signing key (e.g., Fig. 11B 1106) and a key identifier (e.g., Fig. 12B 1206 in ).

[0112] At 1502, logic circuitry is configured to calculate a manufacturing digital signature. Fig. 12B 1200b) to calculate the digital signature. Fig. 12B The signature key identifier 1206 identifies Fig. 11B The signing key 1106 is stored in Fig. 11B The manufacturing digital signature is calculated on the data in data blocks 11100 to 11107. At 1504, the logic circuit is configured to store the manufacturing digital signature in the memory arrangement. The manufacturing digital signature is stored in Fig. 12A Attribute data 1200a or Fig. 12B The digital signature field 1204 of 1200b is stored in Fig.10The attributes are stored in memory 1014.

[0113] Fig.16 is a diagram for configuring a device including a memory arrangement (e.g., Figure 4 406) of the logic circuit package (for example, Figure 4 At 1602, the method 1600 includes receiving, by a logic circuit of a logic circuit package (e.g., 404), a command for generating a manufacturing digital signature. At 1604, the method 1600 includes reading, by the logic circuit in response to the command, a signature key identifier (e.g., Fig. 12B 1206) and indication data (e.g., Fig.11A or Fig. 11B 1100) at least one indication (e.g., Fig. 12B At 1606, method 1600 includes reading, by logic circuitry, a signing key (e.g., Fig. 11B 1106 in ).

[0114] At 1608, method 1600 includes reading, by logic circuitry, indication data based on at least one indication. In one example, the indication data is stored in a general memory portion of a memory arrangement configured for general read / write access (e.g., Fig.10 The indication data may include a part-specific digital signature (e.g., Figure 5B 502 in the example): a device type identifier corresponding to the logic circuit package, a logic circuit identifier for distinguishing the logic circuit package from other logic circuit packages (e.g., Figure 5B 506 in), a partition map (e.g., Figure 5B 504) and specified data stored in a general memory portion of the memory arrangement (e.g., Figure 5B 508 in the ).

[0115] In some examples, the logic circuit package can be attached to a replaceable print cartridge (e.g., Figure 4 In this example, the indication data may include common manufacturing data (e.g., Fig. 9 922) in the part number digital signature (for example, Fig.13 1304 in ). Also in this example, the indicative data may include part-specific manufacturing data (e.g., Fig.131306 in the example, the part-specific manufacturing data includes at least one of the following: a manufacturing date of the replaceable print cartridge, a manufacturing time of the replaceable print cartridge, and a production line identifier that identifies a production line of the replaceable print cartridge (e.g., Fig. 9 930).

[0116] At 1610, method 1600 includes calculating, by logic circuitry, a manufacturing digital signature based on the indicative data using a signature key. At 1612, method 1600 includes writing, by logic circuitry, the manufacturing digital signature to a memory arrangement (e.g., to a Fig. 12A or Fig. 12B In one example, writing the manufacturing digital signature may include writing the manufacturing digital signature to a property memory portion of the memory arrangement (e.g., Fig.10 1014 in). The logic circuitry may be configured to provide the host with read-only access to some attributes (eg, manufacturing signature attributes) stored in the attribute memory portion.

[0117] The above-described manufacturing digital signature architecture and its generation process can allow authentication of public manufacturing data and / or part-specific manufacturing data written to consumables in a semi-trusted or at least not fully controlled environment. The process and architecture can support the ability to generate digital signatures without having to establish a complex infrastructure to create / support on-site or off-site signing services. The process allows for a flexible method for specifying data to be included in the manufacturing digital signature, and allows, for example, the manufacturing data to be bound to other data previously written to the memory arrangement during configuration or personalization of the logic circuit package before the manufacturing digital signature is calculated. In addition, the process forces aftermarket consumables to use a copy of the complete data set from the genuine consumables, rather than using non-authentic data, making it easier to identify and alert customers to the presence of non-genuine consumables.

[0118] Fig.17A An example of a memory arrangement 406e is shown. In some examples, the memory arrangement 406e may be Figure 4 Memory arrangement 406e stores part number signature metadata 1700 and part number signature 1304 corresponding to part number signature metadata 1700. Fig.10 As described, part number signature metadata 1700 and part number signature 1304 may be stored in a common memory portion 1030 of a memory arrangement that may be accessed by a controller, such as a host, for read and write operations. Part number signature metadata 1700 is used to facilitate verification of part number signature 1304 (e.g., associated signed data) by the host. Part number signature metadata 1700 may vary, and will be referred to below. Fig.18A and Fig.18BThe part number signature metadata 1700 specifies data used to calculate the part number signature 1304. The part number signature 1304 is calculated using the data corresponding to the part number signature metadata 1700 and a private key corresponding to a public key stored or accessible by the host. Fig. 20A and Fig. 20B The calculation of part number signature 1304 is described in more detail. To verify that the logic circuit is authentic, the host can read part number signature metadata 1700 and part number signature 1304. The host can then confirm part number signature 1304 using the data specified by part number signature metadata 1700.

[0119] Fig. 17B Another example of a memory arrangement 406f is shown. In some examples, the memory arrangement 406f may be Figure 4 Memory arrangement 406f stores part number signature metadata 1700 and part number signature 1304 corresponding to part number signature metadata 1700, as previously described with reference to FIG. Fig.17A In addition, the memory arrangement 406f also stores part number signature designation data 1702. As described above with reference to Fig.10 As depicted, part number signature designation data 1702 may be stored in a general purpose memory portion 1030 of a memory arrangement that may be accessed by a host for read and write operations.

[0120] Part number signature specifying data 1702 includes data stored in a plurality of data blocks of a general memory portion of a memory arrangement as specified by part number signature metadata 1700. Part number signature specifying data 1702 includes data that is signed. Part number signature 1304 is based at least in part on part number signature specifying data 1702. In some examples, part number signature specifying data may be static (e.g., read-only data) for the life of the logic circuit package and / or a component to which the logic circuit package is attached. Part number signature specifying data 1702 may include common manufacturing data (e.g., common to multiple replaceable print cartridges (e.g., print cartridges having the same SKU) as previously described. Fig. 9 922 in). Part number signature specifying data 1702 may have variable lengths between different logical memory arrangements. In some examples, part number signature specifying data 1702 may include part number signature metadata 1700, i.e., one of the data blocks that is part of part number signature specifying data 1702 may include part number signature metadata 1700.

[0121] In some examples, part number signature 1304 is signed on data including at least one of a device type identifier and part number signature specifying data 1702. The device type identifier not stored in memory arrangement 406f may correspond to logic circuit package 402 ( Figure 4 ) to identify that the logic circuit package is intended to be attached to or attached to a replaceable printing device component. In some examples, the value of the device type identifier is the same for all logic circuit packages that are intended to be attached to or attached to a replaceable printing device component. The device type identifier signed when calculating the part number signature can be the same or different from the device type identifier signed when calculating the perso signature.

[0122] As described in more detail below, to verify that the logic circuit is authentic, the host can read part number signature metadata 1700 and part number signature 1304. The host can then use part number signature metadata 1700 to read part number signature designation data 1702. The host can then use part number signature designation data 1702 to confirm part number signature 1304. In some examples, part number signature 1304 and part number signature metadata 1700 can be based on a pattern similar to that used for digital signatures (e.g., perso signatures) and digital signature metadata (e.g., perso signature metadata) (as previously described in reference to FIG. FIG. 5A to FIG. 5B and FIG. 6A to FIG. 6B configured in a similar manner to that described and illustrated).

[0123] Fig.18A An example of part number signature metadata 1800a is shown. In one example, part number signature metadata 1800a is Fig.17A or Fig. 17B 1800a. The part number signature metadata 1800a includes a mode identifier field 1802, a key identifier field 1804, (multiple) data block address fields 1806, and (multiple) data block length fields 1808. The mode identifier field 1802 stores a mode version for the host to determine which mode to use. The mode identifier field 1802 can have a length of one byte. The key identifier field 1804 stores an identifier of the signing key for the host to verify using the correct key. The key identifier field 1804 can have a length of two bytes. The original part number signature 1304 ( Fig.17A and Fig. 17B ) can be computed using the key corresponding to the key identifier.

[0124] (Multiple) data block address fields 1806 may include a single data block address field or multiple data block address fields. Each data block address field stores a starting address corresponding to a data block of the original calculated part number signature. Each data block address field may have a length of two bytes. (Multiple) data block length fields 1808 may include a single data block length field or multiple data block length fields. Each data block length field corresponds to a data block addressed by the corresponding data block address field 1806. Each data block length field stores data indicating the length of the corresponding data block. Each data block length field may have a length of two bytes. Each data block address field and the corresponding data block length field may be in the part number signature metadata 1800a from the first data block address (addr1) and data block length (len1) to the last data block address (addr N ) and data block length (len N ) are concatenated as follows: addr1||len1||addr2||len2||...||addr N ||len N In one example, one of the designated data blocks may store part number signature metadata.

[0125] Fig.18B Another example of part number signature metadata 1800b is shown. In one example, part number signature metadata 1800b is Fig.17A or Fig. 17B The part number signature metadata 1700 in FIG. The part number signature metadata 1800b includes a mode identifier field 1802, a key identifier field 1804, (multiple) data block address fields 1806, and (multiple) data block length fields 1808, as previously described with reference to FIG. Fig.18A As described and illustrated. In addition, the part number signature metadata 1800b also includes a length field 1810 and a data block count field 1812. The data block count field 1812 stores data indicating the total number of data blocks addressed by the (multiple) data block address field 1806. The data block count field 1812 may have a length of one byte. The length field 1810 stores data indicating the total cumulative length of the key identifier field 1804, the data block count field 1812, the (multiple) data block address field 1806, and the (multiple) data block length field 1808. The length field 1810 may have a length of two bytes. The host may use the data stored in the length field 1810 to parse the part number signature metadata 1800b. In some examples, instead of or in addition to the length field 1810, the host may use the data stored in the data block count field 1812 to parse the part number signature metadata 1800b. The part number signature metadata 1800b may be concatenated and written to the memory arrangement 406 as follows ( Figure 4): mode identifier||length||key identifier||block count||addr1||len1||addr2||len2||...||addr N ||len N .

[0126] FIG. 19A to FIG. 19C It is a diagram that can be composed of a logic circuit (such as Figure 4 404 in the example method 1900, 1910 and 1920. The logic circuit can be a flowchart for a replaceable printing device component (e.g., Figure 4 400) of the logic circuit package (for example, Figure 4 402), the logic circuit package includes a portion for communicating with the printing device logic circuit as described above (for example, Figure 3 304) communication interface (for example, Figure 4 In this example, the memory arrangement stores part number signature metadata (e.g., Fig.18A 1800a or Fig.18B 1800b). Fig.19A As illustrated in method 1900 at 1902, logic circuitry is configured to receive a read request from a host. At 1904, logic circuitry is configured to transmit part number signature metadata to the host in response to the read request.

[0127] In one example, a memory arrangement stores a part number signature corresponding to part number signature metadata (e.g., Fig.17A or Fig. 17B 1304), the part number signature is used with the key identifier (e.g., Fig.18A or Fig.18B In this example, Fig.19B As illustrated in method 1910 at 1912, logic circuitry is configured to receive a read request (or multiple read requests) from a host. At 1914, logic circuitry is configured to transmit a part number signature and part number signature metadata (in any order) to the host in response to at least one read request.

[0128] In one example, a memory arrangement stores part number signature metadata (e.g., Fig. 17B 1700 in), part number signature specifying data (e.g. Fig. 17B 1702 in ) and a part number signature (e.g., Fig. 17B 1304 in ). In this example, if Fig.19CIn method 1920 illustrated at 1922, logic circuitry is configured to receive a request (e.g., general memory read request(s)) from a host. At 1924, logic circuitry is configured to transmit to the host, in response to at least one request, a part number signature, part number signature metadata, and / or other data, and part number signature-specified data corresponding to the part number signature metadata.

[0129] Fig. 20A and Fig. 20B is a diagram for configuring a logic circuit package (e.g., Figure 4 402 in ). In some examples, the processing system 2000 can be distributed across at least two locations. For example, at a first location, the processing system 2000 can pre-compute a set of part number signatures corresponding to data for a plurality of predefined part numbers. These data sets (i.e., part number signature data and part number signatures) can then be sent to a second (e.g., manufacturing) location where the manufacturing data is written to a logic circuit package on a production line. When the production line is configured to run a certain part number, the appropriate data set can be selected by the processing system 2000 and written to the memory arrangement of the logic circuit package, as further described below. In one example, the processing system 2000 can be different from the previously referenced Fig. 8A and Figure 8B The processing system 800 described and illustrated. The processing system 2000 includes a processor 2002 and a machine-readable storage medium 2006. The processor 2002 is communicatively coupled to the machine-readable storage medium 2006 via a communication path 2004. Although the following description refers to a single processor and a single machine-readable storage medium, the description may also apply to systems with multiple processors and multiple machine-readable storage media. In such examples, instructions may be distributed (e.g., stored) across multiple machine-readable storage media, and instructions may be distributed (e.g., executed by) across multiple processors.

[0130] Processor 2002 includes one (i.e., single) central processing unit (CPU) or microprocessor or more than one (i.e., multiple) CPUs or microprocessors, and / or other suitable hardware devices for fetching and executing instructions stored in machine-readable storage medium 2006. Processor 2002 may fetch, decode, and execute instructions 2008-2014 to configure a logic circuit package.

[0131] Processor 2002 may fetch, decode, and execute instructions 2008 for obtaining a signature key identifier and signature data (e.g., at a first location). In one example, the signature data includes a device type identifier corresponding to the logic circuit package and data to be stored in a plurality of data blocks of a general memory portion of a memory arrangement of the logic circuit package as specified by the part number signature metadata. The signature key identifier and signature data may be stored in machine-readable storage medium 2006 and / or another machine-readable storage medium accessible to processing system 2000.

[0132] The part number signature metadata is used to facilitate verification of the associated signed data. The part number signature metadata may include: a mode identifier field (e.g., Fig.18A or Fig.18B 1802 in the example), the mode identifier field stores a mode version number used by the host to determine which mode to use; a key identifier field (e.g., Fig.18A or Fig.18B 1804 in the example), the key identifier field stores the identifier of the signature key so that the host can use the correct key for verification; multiple data block address fields (for example, Fig.18A or Fig.18B 1806), each of the plurality of data block address fields storing an address corresponding to a data block of the original calculated part number signature in the plurality of data blocks; and a plurality of data block length fields corresponding to the plurality of data blocks (e.g., Fig.18A or Fig.18B 1808), each data block length field in the multiple data block length fields stores data indicating the length of the corresponding data block.

[0133] Processor 2002 may fetch, decode, and execute instructions 2010 (e.g., at a first location) for concatenating signature data. The signature data may be concatenated as follows: device type identifier||data of data block 1||data of data block 2||...||data of data block N, where "N" is the number of data blocks. Processor 2002 may fetch, decode, and execute instructions 2012 (e.g., at a first location) for calculating a part number signature on the concatenated signature data using a private signing key corresponding to a signature key identifier. In one example, calculating the part number signature includes calculating the part number signature on a hash of data to be stored in multiple data blocks. Processor 2002 may fetch, decode, and execute instructions 2012 (e.g., at a first location) for concatenating the part number signature (e.g., Fig.17A or Fig. 17B 1304) writes instructions 2014 (e.g., at a second location) to a general memory portion of a memory arrangement of the logic circuit package.

[0134] like Fig. 20BAs shown, processor 2002 can fetch, decode, and execute instructions for signing part number metadata (e.g., Fig.17A or Fig. 17B The processor 2002 may fetch, decode, and execute instructions for writing further instructions 2016 (e.g., at a second location) to a general memory portion of a memory arrangement of a logic circuit package as described in 1700 of the embodiment of the present invention. The processor 2002 may fetch, decode, and execute instructions for writing data to be stored in a plurality of data blocks as specified by the part number signature metadata (e.g., Fig. 17B 1702) writes further instructions 2018 (e.g., at a second location) to a general memory portion of the memory arrangement of the logic circuit package.

[0135] As an alternative to or in addition to fetching and executing instructions, the processor 2002 may include one (i.e., a single) electronic circuit or more than one (i.e., multiple) electronic circuits including multiple electronic components for performing the functions of one instruction or more than one instructions in the machine-readable storage medium 2006. With respect to the executable instructions, representations (e.g., blocks) described and illustrated herein, it should be understood that, in alternative examples, some or all of the executable instructions and / or electronic circuits included in one block may be included in different blocks shown in the figures or in different blocks not shown.

[0136] The machine-readable storage medium 2006 is a non-transitory storage medium and may be any suitable electronic, magnetic, optical or other physical storage device that stores executable instructions. Thus, the machine-readable storage medium 2006 may be, for example, a RAM, an EEPROM, a storage drive, an optical disk, etc. Fig. 20A and Fig. 20B As shown, machine-readable storage medium 2006 may be disposed within system 2000. In this case, the executable instructions may be installed on system 2000. Alternatively, machine-readable storage medium 2006 may be a portable, external, or remote storage medium that allows system 2000 to download instructions from a portable / external / remote storage medium. In this case, the executable instructions may be part of an installation package.

[0137] Fig.21A Another example of a memory arrangement 406g is shown. In some examples, the memory arrangement 406g may be Figure 4 Memory arrangement 406g includes a first digital signature 2100, a second digital signature 2102, and a third digital signature 2104. In one example, the third digital signature 2104 signs the first digital signature 2100 and the second digital signature 2102. In one example, the first digital signature is a perso signature (e.g., Figure 5A , Figure 5B or Fig.10502), the second digital signature is a part number signature (e.g., Fig.10 , Fig.17A or Fig. 17B 1304 in ), and the third digital signature is a manufacturing signature (e.g., Fig. 12A or Fig. 12B In one example, the first digital signature 2100 and the second digital signature 2102 are stored in a general memory portion of the memory arrangement configured for general read / write access (e.g., Fig.10 1030 in ), and the third digital signature 2104 is stored in a property memory portion of the memory arrangement that is not configured for general read / write access (e.g., Fig.10 1014).

[0138] The example memory arrangement 406g may provide a multiple digital signature architecture that may be suitable for improving data integrity when multiple stages and / or parties are involved in writing data to the memory arrangement. Fig.10 , Fig.21A and Fig.21B Examples of can simultaneously include different embodiments of digital signatures disclosed herein (such as a perso digital signature, a manufacturing digital signature, and a part number digital signature) and corresponding metadata. However, other examples of memory arrangement 406g can provide an architecture for multiple digital signatures that can be used for other undescribed technical functions in addition to specific manufacturing-related stages between different suppliers as described herein. Examples of memory arrangement 406g can be suitable for connecting to a host device that requires the presence of a digital signature to pass an integrity check of the same host device.

[0139] In some examples, the first digital signature is included in data (e.g., Fig. 9 912 in the figure): a device type identifier corresponding to the logic circuit package, a logic circuit identifier for a controller to distinguish the logic circuit package from other logic circuit packages, a partition map for defining partitions of a common memory portion of the memory arrangement, and first digital signature specifying data stored in the common memory portion of the memory arrangement. In some examples, the second digital signature is signed on public manufacturing data (e.g., Fig. 9 In some examples, the third digital signature is signed on the first digital signature, the second digital signature, and part-specific manufacturing data (e.g., Fig. 9 At least one of the first digital signature, the second digital signature, and the third digital signature may be signed on a hash of at least a portion of the above identification data.

[0140] Fig.21B Another example of a memory arrangement 406h is shown. In some examples, the memory arrangement 406h may be Figure 4 Memory arrangement 406h stores first digital signature 2100, second digital signature 2102, and third digital signature 2104, as previously described with reference to FIG. Fig.21A Additionally, the memory arrangement 406h stores first digital signature metadata 2106 and second digital signature metadata 2108. The first digital signature metadata 2106 facilitates verification of the first digital signature 2100, and the second digital signature metadata 2108 facilitates verification of the second digital signature 2102. In some examples, the first digital signature metadata 2106 is previously referenced. Fig. 6A and Figure 6B The perso signature metadata 600a or 600b described and illustrated, and the second digital signature metadata 2108 are previously referenced Fig.18A and Fig.18B Described and illustrated part number signature metadata 1800a or 1800b. In some examples, first digital signature metadata 2106 and second digital signature metadata 2108 are configured based on the same schema.

[0141] Fig. 22 is a flow chart illustrating another example method 2200 that may be performed by logic circuitry. The logic circuitry may be for use with replaceable printing device components (e.g., Figure 4 400) of the logic circuit package (for example, Figure 4 402), the logic circuit package includes a controller as described above (for example, Figure 3 304) communication interface (for example, Figure 4 In this example, the memory arrangement stores the first digital signature (eg, Fig.21A or Fig.21B 2100 in), the second digital signature (for example, Fig.21A or Fig.21B 2102 in ) and a third digital signature signed on the first digital signature and the second digital signature (e.g., Fig.21A or Fig.21B 2104 in). Fig. 22 As illustrated in method 2200 at 2202, logic circuitry is configured to receive at least one request from a controller. At 2204, logic circuitry is configured to transmit a first digital signature, a second digital signature, and a third digital signature (in any order) to the controller in response to the at least one request.

[0142] Examples in the present disclosure may be provided as methods, systems, or machine-readable instructions (such as any combination of software, hardware, firmware, etc.). Such machine-readable instructions may be included on a machine-readable storage medium (including but not limited to EEPROM, PROM, flash memory, magnetic disk storage device, CD-ROM, optical storage device, etc.) having a machine-readable program code therein or thereon.

[0143] The present disclosure is described with reference to the flowcharts and block diagrams of the methods, devices and systems according to the examples of the present disclosure. Although the flowcharts described above show a specific execution order, the execution order may be different from the depicted order. The boxes described in one flowchart may be combined with the boxes of another flowchart. It should be understood that at least some of the boxes in the flowcharts and block diagrams and their combinations may be implemented by machine-readable instructions.

[0144] The functions described in the specification and the drawings can be implemented, for example, by executing machine-readable instructions by a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device. Specifically, a processor or a processing circuit can execute machine-readable instructions. Therefore, the functional modules (e.g., logic circuits and / or controllers) of the device and the apparatus can be implemented by a processor that executes machine-readable instructions stored in a memory or a processor that operates according to instructions embedded in a logic circuit. The term 'processor' should be broadly interpreted to include a CPU, a processing unit, an ASIC, a logic unit, or a programmable gate array, etc. The methods and functional modules can all be executed by a single processor, or divided between several processors.

[0145] Such machine-readable instructions may also be stored in a machine-readable storage device (eg, a tangible machine-readable medium) which may direct a computer or other programmable data processing apparatus to operate in a particular mode.

[0146] Such machine-readable instructions may also be loaded onto a computer or other programmable data processing device, causing the computer or other programmable data processing device to perform a series of operations to produce a computer-implemented process. Thus, the instructions executed on the computer or other programmable device implement the functions specified by the (multiple) boxes in the flowchart and / or block diagram.

[0147] Furthermore, the teachings herein may be implemented in the form of a computer software product that is stored in a storage medium and includes a plurality of instructions for causing a computer device to implement the methods recited in the examples of the present disclosure.

[0148] The word "comprising" does not exclude the presence of elements other than those listed in the claims and "a" or "an" does not exclude a plurality.

[0149] Although specific examples have been illustrated and described herein, various alternative and / or equivalent embodiments may replace the specific examples shown and described without departing from the scope of the present disclosure. This application is intended to cover any modifications or variations of the specific examples discussed herein. Therefore, the present disclosure is intended to be limited only by the claims and their equivalents.

[0150] The present disclosure relates to a logic circuit including an interface for communicating with a host logic circuit. The logic circuit may be part of a package. The logic circuit may be a dedicated circuit, such as a microcontroller, such as a security microcontroller. The logic circuit may be configured to communicate with a printing device controller. The logic circuit (package) may be attached or embedded or attachable to a replaceable print cartridge or component. The host logic circuit may include or be part of a printing device logic circuit (such as a printer controller). The logic circuit and its features may be used in other applications, such as security applications.

[0151] The logic circuit includes a memory arrangement including any of the following features, any combination of any feasible selections, or all of the features. The memory arrangement may store digital signature metadata for facilitating verification of associated signed data. The digital signature metadata may include a mode identifier field storing a mode version number for a host to determine which mode to use. The digital signature metadata may include a key identifier field storing an identifier of a signing key for the host to verify using the correct key. The digital signature metadata may include a plurality of data block address fields, each of which stores an address corresponding to a data block of a plurality of data blocks for which a digital signature was originally calculated. The digital signature metadata may include a plurality of data block length fields corresponding to the plurality of data blocks, each of which stores data indicating the length of the corresponding data block. The memory arrangement may store a logic circuit identifier for a controller to distinguish a logic circuit package from other logic circuit packages. The memory arrangement may store a partition map for defining partitions of a general memory portion of the memory arrangement. The memory arrangement may store digital signature metadata for facilitating verification of associated signed data and specified data corresponding to the digital signature metadata. The memory arrangement may store a digital signature signed on data including a device type identifier, a logic circuit identifier, a partition map, and designated data corresponding to a logic circuit package. The memory arrangement may store indicative data for calculating a manufacturing digital signature. The memory arrangement may store a certificate for a controller to verify a manufacturing digital signature. The memory arrangement may store manufacturing attribute data. The manufacturing attribute data may include at least one indication indicating the indicative data. The manufacturing attribute data may include a manufacturing digital signature. The memory arrangement may store a signature key for calculating a manufacturing digital signature. The memory arrangement may store a key identifier for identifying a signature key for calculating a manufacturing digital signature and for a host to verify the associated signed data using the correct key. The logic circuit may be configured to transmit the key identifier to the host in response to a request from the host. The memory arrangement may store a first digital signature, a second digital signature, and a third digital signature signed on the first digital signature and the second digital signature. The memory arrangement may store part number signature metadata for facilitating verification of the associated signed data. The part number signature metadata may include a mode identifier field storing a mode version number for the host to determine which mode to use. The part number signature metadata may include a key identifier field that stores an identifier of the signing key for the host to verify that the correct key is used.The part number signature metadata may include a plurality of data block address fields, each of which stores an address corresponding to a data block of the original calculated part number signature in the plurality of data blocks. The part number signature metadata may include a plurality of data block length fields corresponding to the plurality of data blocks, each of which stores data indicating the length of the corresponding data block. The memory arrangement may store a part number signature signed on data including a device type identifier corresponding to a logic circuit package and / or part number signature designation data. A logic circuit provided with a memory arrangement including any of the above features, any combination of any feasible selections, or all of the features may be configured according to any of the following features, any combination of any feasible selections, or all of the features. The logic circuit may be configured to transmit digital signature metadata to a host in response to a read request. The logic circuit may be configured to transmit a logic circuit identifier, a partition map, a digital signature, digital signature metadata, and / or other data and designated data corresponding to the digital signature metadata to a controller in response to at least one request from a controller. The logic circuit may be configured to transmit manufacturing attribute data to a controller in response to at least one first request from a controller. The logic circuit may be configured to transmit the certificate and the indication data to the controller in response to at least one second request from the controller. The logic circuit may be configured to transmit the first digital signature, the second digital signature, and the third digital signature to the controller in response to at least one request. The logic circuit may be configured to transmit the part number signature metadata to the host in response to the read request. The memory arrangement may store part number signature specified data corresponding to the part number signature metadata. The logic circuit may be configured to transmit the part number signature, part number signature metadata and / or other data and / or part number signature specified data corresponding to the part number signature metadata to the controller. Any of the above-described available example logic circuits and / or example memory arrangements may be combined with any of the following example features, any feasible options, or all of the features. The digital signature metadata may include a data block count field storing data indicating the total number of multiple data blocks. The digital signature metadata may include a length field storing data indicating the total cumulative length of a key identifier field, a data block count field, multiple data block address fields, and multiple data block length fields for the host to parse the digital signature metadata. The memory arrangement may store a digital signature corresponding to the digital signature metadata, which is signed with a key corresponding to the key identifier. The logic circuitry may be configured to transmit the digital signature and the digital signature metadata to the host in response to at least one read request.The digital signature metadata and the digital signature may be stored in a general purpose memory portion of the memory arrangement configured for general purpose read / write access.The memory arrangement may include at least one different memory portion that is not intended for general read / write access, storing at least one cryptographic key and / or multiple attributes. The logic circuit may be configured to perform a cryptographic operation using the at least one cryptographic key. The logic circuit may be configured to (i) return an attribute from a plurality of attributes in response to an attribute request including an associated attribute tag, and (ii) associate the attribute with the attribute tag. The memory arrangement may store digital signatures, digital signature metadata, specified data, and other data within a partition defined by a partition map. The memory arrangement may store other data unrelated to the digital signature, including print cartridge related characteristics. The manufacturing attribute data may include a key identifier corresponding to a certificate for the controller to verify the manufacturing digital signature. The at least one indication may include multiple data block addresses of the indication data stored in the memory arrangement, and / or multiple data block length fields indicating the length of each corresponding data block. At least one first request and at least one second request may have a differently encoded command type field and / or include different operation codes, indicating different command types. At least one first request may be configured to query the attribute memory. At least one second request may be configured to read the general memory. The indication data for calculating the manufacturing digital signature includes at least one other digital signature. The indication data may include part-specific manufacturing data. The manufacturing attribute data may include a key identifier. The key identifier may identify a private key used to calculate a manufacturing digital signature. The certificate may include a public key corresponding to the private key. The certificate may be signed with a certificate authority private key and verified by the controller with a certificate authority public key. The memory arrangement may store a plurality of key identifiers and associated signing keys. The memory arrangement may store a private key used to calculate a manufacturing digital signature. The memory arrangement may store the private key, and the key identifier may correspond to a public key in the certificate, and the certificate may further include a key identifier for the controller to confirm that the correct certificate is used to verify the manufacturing digital signature using the public key. The logic circuit may be configured to calculate the manufacturing digital signature. The logic circuit may be configured to calculate the manufacturing digital signature and store the manufacturing digital signature in the memory arrangement upon or after completion. The memory arrangement may store attribute data for calculating the manufacturing digital signature and facilitating verification of the associated signed data. The attribute data may include a key identifier. The attribute data may include the at least one indication. The logic circuit may be configured to transmit the at least one indication to the host in response to a request from the host. The logic circuit may be configured to: calculate the manufacturing digital signature based on the attribute data; and store the manufacturing digital signature in the attribute data.The indicative data for calculating the manufacturing digital signature may include a part-specific digital signature signed on data including at least one of the following: a device type identifier corresponding to the logic circuit package; a logic circuit identifier for the host to distinguish the logic circuit package from other logic circuit packages; a partition map for defining partitions of the common memory portion of the memory arrangement; and / or specified data stored in the common memory portion of the memory arrangement. The indicative data for calculating the manufacturing digital signature may include: a part number digital signature signed on public manufacturing data including at least one of the following: color; fill level; and / or area. The indicative data for calculating the manufacturing digital signature may include: part-specific manufacturing data, the part-specific manufacturing data including at least one of the following: manufacturing date; manufacturing time; and / or production line identifier. The first digital signature may be a perso signature. The second digital signature may be a part number signature. The third digital signature may be a manufacturing signature. The first digital signature may be signed on data including at least one of the following: a device type identifier corresponding to a logic circuit package; a logic circuit identifier for a controller to distinguish a logic circuit package from other logic circuit packages; a partition map for defining partitions of a general memory portion of a memory arrangement; and / or first digital signature designation data stored in a general memory portion of a memory arrangement. The second digital signature may be signed on public manufacturing data including at least one of the following: color; fill level; and / or region. The third digital signature may be signed on part-specific manufacturing data including at least one of the following: manufacturing date; manufacturing time; and / or production line identifier. The memory arrangement may store first digital signature metadata for facilitating verification of the first digital signature and / or second digital signature metadata for facilitating verification of the second digital signature. The first digital signature metadata and the second digital signature metadata may be configured based on the same mode and / or mode version. The first digital signature and the second digital signature may be stored in a general memory portion of a memory arrangement configured for general read / write access. The third digital signature may be stored in an attribute memory portion of a memory arrangement. The attribute memory portion may not be configured for general read / write access. The part number signature metadata may include a data block count field storing data indicating a total number of multiple data blocks. The part number signature metadata may include a length field storing data indicating a total cumulative length of a key identifier field, a data block count field, multiple data block address fields, and / or multiple data block length fields for a host to parse the part number signature metadata. The memory arrangement may store a part number signature corresponding to the part number signature metadata, the part number signature being signed with a key corresponding to the key identifier. The logic circuit may be configured to transmit the part number signature and / or part number signature metadata to the host in response to at least one read request.Part number signature metadata and / or part number signature may be stored in a general purpose memory portion of the memory arrangement configured for general purpose read / write access. The memory arrangement may store other data not related to the part number signature, including print cartridge related data that may be updated over the life of the logic circuit.

Claims

1. A logic circuit package, comprising an interface for communicating with a host and a logic circuit, wherein the logic circuit comprises: A memory arrangement storing digital signature metadata for facilitating verification of associated signed data, the digital signature metadata comprising: a mode identifier field storing a mode version number used by the host to determine which mode to use; A key identifier field, wherein the key identifier field stores an identifier of a signature key so that the host can use a correct key to perform the verification; a plurality of data block address fields, each of the plurality of data block address fields storing an address corresponding to a data block of the plurality of data blocks used to originally calculate the digital signature; and a plurality of data block length fields corresponding to the plurality of data blocks, each of the plurality of data block length fields storing data indicating a length of a corresponding data block, Wherein, the logic circuit is configured as: receiving a read request from the host; and The digitally signed metadata is transmitted to the host in response to the read request.

2. The logic circuit package according to claim 1, wherein: The digital signature metadata further includes a data block count field storing data indicating a total number of the plurality of data blocks.

3. The logic circuit package according to claim 2, wherein: The digital signature metadata further includes a length field, which stores data indicating the total cumulative length of the key identifier field, the data block count field, the multiple data block address fields and the multiple data block length fields for the host to parse the digital signature metadata.

4. The logic circuit package according to any one of claims 1 to 3, wherein: The memory arrangement stores a digital signature corresponding to the digital signature metadata, the digital signature being signed with a key corresponding to the key identifier, and The logic circuit is configured to transmit the digital signature and the digital signature metadata to the host in response to at least one read request.

5. The logic circuit package according to claim 4, wherein: The digital signature metadata and the digital signature are stored in a general purpose memory portion of the memory arrangement configured for general purpose read / write access, and wherein the memory arrangement comprises at least one distinct memory portion, the memory portion not intended for general purpose read / write access, storing at least one cryptographic key and / or a plurality of attributes, wherein the logic circuit is configured to: performing a cryptographic operation using the at least one cryptographic key, and / or An attribute of the plurality of attributes is returned in response to an attribute request including an associated attribute tag, wherein the logic circuit is configured to associate the attribute with the attribute tag.

6. The logic circuit package according to claim 4 or 5, wherein: The memory arrangement stores a partition map defining partitions of the memory arrangement, and stores the digital signatures, the digital signature metadata, designated data, and other data within the partitions.

7. The logic circuit package according to any one of claims 4 to 6, wherein: The digital signature signs data including at least one of a device type identifier, a logic circuit identifier, a partition map, and specified data.

8. A logic circuit package for a printer cartridge as claimed in any preceding claim, wherein: The memory arrangement stores other data unrelated to the digital signature, including print cartridge related characteristics.

9. A replaceable printer cartridge comprising a logic circuit package as claimed in any preceding claim.

10. A method for configuring a logic circuit package including a memory arrangement, the method comprising: Obtained through the processing system: Signing key identifier; as well as Signature data, the signature data comprising: a device type identifier corresponding to the logic circuit package; A logic circuit identifier of the logic circuit package, wherein the logic circuit identifier is used by a host to distinguish the logic circuit package from other logic circuit packages; a partition map for defining partitions of a common memory portion of the memory arrangement of the logic circuit package; and data to be stored in a plurality of data blocks of the general purpose memory portion of the memory arrangement of the logic circuit package as specified by the digital signature metadata; concatenating the signature data via the processing system; computing, via the processing system, a digital signature on the concatenated signature data using a private signing key corresponding to the signing key identifier; and The digital signature is written, via the processing system, to the general memory portion of the memory arrangement of the logic circuit package.

11. The method of claim 10, wherein: The digital signature metadata is used to facilitate verification of the associated signed data, the digital signature metadata comprising: a mode identifier field storing a mode version number used by the host to determine which mode to use; A key identifier field, wherein the key identifier field stores an identifier of a signature key so that the host can use a correct key to perform the verification; a plurality of data block address fields, each of the plurality of data block address fields storing an address corresponding to a data block in the plurality of data blocks used to originally calculate the digital signature; and A plurality of data block length fields corresponding to the plurality of data blocks, each of the plurality of data block length fields storing data indicating a length of a corresponding data block.

12. The method according to claim 10 or 11, wherein: The partition map includes a partition length and a partition attribute identifier defining each partition of the common memory portion of the memory arrangement.

13. The method of any one of claims 10 to 12, further comprising: The digital signature metadata is written, via the processing system, to the general memory portion of the memory arrangement of the logic circuit package.

14. The method of any one of claims 10 to 13, further comprising: The logic circuit identifier and the partition map are written, via the processing system, to an attribute memory portion of the memory arrangement of the logic circuit package.

15. The method of any one of claims 10 to 14, further comprising: The data to be stored in the plurality of data blocks as specified by the digital signature metadata is written, via the processing system, to the general memory portion of the memory arrangement of the logic circuit package.

16. A logic circuit package, comprising an interface for communicating with a controller and a logic circuit, wherein the logic circuit comprises: A memory arrangement storing: a logic circuit identifier for the controller to distinguish the logic circuit package from other logic circuit packages, a partition map for defining partitions of a common memory portion of the memory arrangement, digital signature metadata for facilitating verification of the associated signed data, specified data corresponding to the digital signature metadata, and a digital signature signed on data including a device type identifier corresponding to the logic circuit package, the logic circuit identifier, the partition map, and the designated data; The logic circuit is configured to transmit the logic circuit identifier, the partition map, the digital signature, the digital signature metadata and / or other data, and the specified data corresponding to the digital signature metadata to the controller in response to at least one request from the controller.

17. The logic circuit package of claim 16, wherein: The digital signature metadata includes: A key identifier field, wherein the key identifier field stores an identifier of a signature key so that the controller can use a correct key to perform the verification; a plurality of data block address fields, each of the plurality of data block address fields storing an address corresponding to a data block in the plurality of data blocks used to originally calculate the digital signature; and A plurality of data block length fields corresponding to the plurality of data blocks, each of the plurality of data block length fields storing data indicating a length of a corresponding data block.

18. The logic circuit package of claim 17, wherein: The digital signature metadata further includes: a data block count field storing data indicating a total number of the plurality of data blocks; and A length field storing data indicating a total cumulative length of the key identifier field, the data block count field, the plurality of data block address fields, and the plurality of data block length fields for the controller to parse the digital signature metadata.

19. The logic circuit package according to claim 17 or 18, wherein: The digital signature metadata further includes: A mode identifier field stores a mode version number used by the controller to determine which mode to use.

20. A replaceable printer cartridge comprising a logic circuit package as claimed in any one of claims 16 to 19.

Images