IC Provisioning Security Controller Circuit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Configurable integrated circuits lack a built-in mechanism to prevent unauthorized provisioning, making them vulnerable to ransom attacks and key management complexities, especially with increased platform connectivity and physical access risks.
Innovation Solution
Implementing a password protection security feature that stores an enable bit and a hashed version of the password in secure storage, requiring the correct password for access to the provisioning flow, thereby preventing unauthorized provisioning and providing resistance against brute-force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If configurable integrated circuits are made accessible for programming, then ease of operation is improved, but security against unauthorized provisioning deteriorates
Solution Approach 1:
A security controller circuit is introduced as an intermediary between the external programming interface and the configuration memory. This mediator verifies authentication credentials before allowing any provisioning operations, thus maintaining ease of operation for authorized users while preventing unauthorized access.
Solution Approach 2:
The system performs preliminary authentication before allowing any provisioning flow. The security controller circuit checks authentication credentials at the very beginning of the provisioning process, ensuring that only authorized operations can proceed. This preliminary action prevents unauthorized provisioning before it can occur.
2Object-affected harmful factors
If password protection is implemented, then security against brute-force attacks is improved, but device complexity increases
Solution Approach 1:
Instead of storing the actual password in the IC device, the system stores only a hashed copy of the password in non-volatile memory. The security controller circuit generates a hash of the provided password and compares it with the stored hash. This copying approach provides strong security against brute-force attacks while minimizing the complexity increase, as only the hashed version needs to be stored rather than the full password.
Solution Approach 2:
The system replaces complex physical security measures with cryptographic hashing mechanisms. Instead of relying on physical security or complex access control systems, the patent uses password hashing to provide security. This substitution simplifies the overall system while maintaining strong protection against unauthorized access.
3Reliability
If key management complexities are introduced, then reliability of provisioning is improved, but ease of operation deteriorates
Solution Approach 1:
The security controller circuit performs self-service authentication by automatically verifying the authentication credential against the stored hashed password. The system handles the security verification autonomously without requiring manual key management or complex user intervention. This self-service approach maintains high reliability while preserving ease of operation for the end user.
Data Source
AI summary
An integrated circuit includes a cryptographic engine that generates a cryptographic version of a password, a secure storage area, and a security controller circuit that stores an enable bit and at least a portion of the cryptographic version of the password in the secure storage area to enable a security feature. The security controller circuit enables provisioning of the integrated circuit in response to receiving the password from a user if the enable bit stored in the secure storage area indicates that the security feature is enabled.