Electronic Device Ownership Transfer With Secure Owner Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices typically have a single owner configuration provisioned at manufacturing time, limiting the ability to support multiple owners over time and secure transfer of ownership.
Innovation Solution
Implementing a system with a one-time-programmable (OTP) memory and non-volatile memory to store owner containers, using boot code to authenticate and manage secure transfer of ownership between different owners, and employing a secure replay protected monotonic counter (RPMC) to ensure secure ownership transitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single owner configuration is provisioned in OTP memory at manufacturing time, then device security is simplified and manufacturing is easier, but the device cannot support multiple owners over time
Solution Approach 1:
The ownership management system is segmented into distinct owner containers, each storing cryptographic keys and configuration for a specific owner. The boot code can selectively authenticate and load code signed by different owners based on which owner container is active, enabling multiple owners without requiring a completely different system architecture for each owner.
Solution Approach 2:
The OTP memory and boot code are designed to be universal by supporting multiple owner configurations through a standardized owner container format. The same boot code infrastructure can authenticate code signed by any registered owner, making the system multi-functional for different owners while maintaining a single codebase.
2Reliability
If cryptographic keys are stored in OTP memory for secure boot authentication, then security is enhanced, but ownership transfer between different owners becomes difficult
Solution Approach 1:
Owner containers are pre-configured and stored in non-volatile memory during device provisioning, with cryptographic keys securely stored in OTP memory. When ownership transfer is needed, the system validates the transfer request against the current owner container, then activates a new owner container without requiring physical reconfiguration or complex key management operations at transfer time.
Solution Approach 2:
The owner container acts as an intermediary layer between the immutable OTP memory and the flexible ownership requirements. The container stores owner-specific cryptographic material that can be validated by the boot code, enabling secure authentication while allowing the logical ownership to change by simply switching which container is active, rather than modifying the OTP memory itself.
3Ease of manufacture
If owner configuration is fixed at manufacturing, then device provisioning is simpler, but flexibility in device management over time is reduced
Solution Approach 1:
The system transitions from a static ownership model to a dynamic one by introducing owner containers that can be activated or deactivated. The boot code dynamically selects which owner container to use based on current ownership state, allowing the device to adapt to different owners over time while maintaining a simple initial provisioning process where only the container structure needs to be prepared.
Data Source
AI summary
A device with one-time-programmable (OTP) memory, boot code, volatile memory, and non-volatile memory. Boot code may use information in OTP to authenticate code of an implicit owner of the electronic device; receive a first create owner container request; create a first owner container comprising a first signed data image; store the first owner container; and use the first signed data image to authenticate first executable code associated with the first owner. Boot code may transfer ownership from the first owner to a second owner, including authenticating a signed transfer of ownership command using a key stored in the first owner container and creating a second owner container comprising a second signed data image associated with the second owner; storing the second owner container; revoking the first owner container; and using the second signed data image to authenticate second executable code associated with the second owner of the electronic device.