ASIC SKU Licensing With Root-of-Trust Feature Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ASICs are vulnerable to tampering and unauthorized modifications, which can compromise their security and performance, particularly in critical network functions, and existing security measures require continuous power and are susceptible to hacking.
Innovation Solution
Implementing a hardware root-of-trust (RoT) within the ASIC to securely configure and enforce licensed SKU features using eFuses and PUFs, enabling secure boot and authentication without relying on external power, and allowing on-demand feature control based on licensed SKU codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private key is stored in nonvolatile memory (EEPROM or battery-backed SRAM) with active tamper detection circuitry, then security protection against invasive attacks is improved, but device complexity and continuous power requirements increase
Solution Approach 1:
The patent extracts the security-critical private key storage from vulnerable nonvolatile memory (EEPROM/SRAM) and places it within the isolated RoT CPU complex, which is physically separated and protected from external tampering attempts. This extraction removes the key from the attack surface while maintaining security functionality.
Solution Approach 2:
The system segments the device into two distinct parts: an isolated, protected RoT CPU complex that handles security-critical operations, and the main device functionality. This segmentation allows the security subsystem to operate independently with its own protected memory and processing resources, reducing overall system vulnerability.
2Reliability
If hardware cryptographic operations are used for digital signatures or encryption, then security against unauthorized access is improved, but vulnerability to invasive attacks on nonvolatile memory increases
Solution Approach 1:
The patent introduces an intermediary layer - the isolated RoT CPU complex - that mediates between the private key and external access requests. All cryptographic operations are performed within this isolated environment, preventing direct access to the key material while still enabling security functions. The RoT acts as a trusted intermediary that protects the key from invasive attacks.
3Reliability
If device authentication is implemented to prevent unauthorized modifications, then device authenticity and performance reliability are improved, but susceptibility to security intrusions in unauthenticated devices increases
Solution Approach 1:
The patent implements preliminary authentication through the RoT CPU complex before the device is allowed to operate. The RoT verifies cryptographic signatures and validates device identity during the boot process, preventing unauthorized or counterfeit devices from gaining operational status. This preliminary security check blocks potential intrusions before they can occur.
Data Source
AI summary
A method of operating a system-on-chip (SOC) including decrypting, by isolated Root of Trust (RoT) code, a Stock Keeping Unit (SKU) license code from a host during bootup of a device. Then validating, by the isolated RoT code, the SKU license code with firmware and at least one built-in key of a plurality of built-in keys from secure storage. Finally, enabling or disabling, by the isolated RoT code, at least one feature set of a plurality of feature sets comprising resources configured at the SOC based on at least one SKU license code which has been decrypted by isolated RoT code using at least one built-in key and authenticated by firmware.