Integrated Circuit Authentication via Embedded Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrated circuits with secure elements are vulnerable to attacks and counterfeiting during transit between fabrication and assembly facilities, leading to potential insertion of counterfeit circuits with weakened security or quality defects into the manufacturing flow.
Innovation Solution
An automated authentication method using a hardware security module (HSM) to generate and embed random encryption keys within the integrated circuit design, creating authentication vector pairs that are securely transmitted and verified at the assembly and test facility, ensuring only authentic circuits are provisioned with sensitive assets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the integrated circuit is delivered from fabrication facility to SAT facility without secure authentication, then the manufacturing flow remains simple and cost-effective, but the circuit becomes vulnerable to counterfeiting and security attacks during transit
Solution Approach 1:
The authentication key is embedded into the integrated circuit design before fabrication, and authentication vectors are pre-computed and transmitted to the SAT facility. This preliminary preparation ensures that authentication can be performed automatically during provisioning without adding complex runtime authentication logic, thus improving security while minimizing added complexity.
Solution Approach 2:
A secure communication channel acts as an intermediary between the fabrication facility and SAT facility to transmit authentication vectors. This intermediary mechanism enables secure authentication without requiring direct trust between the facilities, resolving the contradiction by providing security through a dedicated secure channel rather than complex mutual authentication protocols.
2Reliability
If automated authentication is implemented for all integrated circuits, then security against cloning attempts is improved, but the manufacturing cost and process time increase
Solution Approach 1:
The integrated circuit performs self-authentication by using its embedded key to verify authentication vectors during the provisioning process. This self-service mechanism eliminates the need for external authentication hardware or complex verification processes, allowing automated authentication to proceed at high speed without significantly impacting manufacturing throughput.
Solution Approach 2:
The patent replaces manual verification processes with automated cryptographic verification using authentication vectors. By substituting mechanical/manual inspection with automated cryptographic comparison, the system achieves high-speed authentication that maintains security while preserving manufacturing productivity.
3Ease of manufacture
If open sample integrated circuits are used for debugging and testing, then development cost is reduced and software development on actual silicon is enabled, but the circuits become more vulnerable to analysis and reverse engineering attacks
Solution Approach 1:
The authentication mechanism is embedded into the circuit before it is made available for open sampling. This preliminary security measure ensures that even though the circuit is open for debugging, the authentication functionality remains protected, countering reverse engineering attempts before they can compromise the security assets.
Solution Approach 2:
The patent separates the authentication functionality from the main circuit design by using dedicated authentication vectors and embedded keys. This segmentation allows the circuit to be opened for debugging while maintaining security boundaries, as the authentication components are isolated and protected by cryptographic measures.
Data Source
AI summary
A method for authenticating an integrated circuit is provided. At an intellectual property facility, a random encryption key and a number of random input vectors are generated. For each input vector, the input vector is encrypted, based on the encryption key, to generate a corresponding output vector, and the input vector and the corresponding output vector are formed into an authentication vector pair. The encryption key is embedded into hardware description language instructions that define an integrated circuit that includes a cryptography engine. A number of authentication vector pairs is transmitted, via a secure communication link, to a semiconductor assembly and test facility. An input vector of an authentication vector pair is presented to the integrated circuit, which encrypts the input vector using the embedded encryption key. If the result matches the output vector of the authentication vector pair, the integrated circuit is determined to be authentic.