System and method for hardware based security
View Patent ↗An asset management system is provided, which includes a hardware module operating as an asset control core. The asset control core generally includes a small hardware core embedded in a target system on chip that establishes a hardware-based point of trust on the silicon die. The asset control core can be used as a root of trust on a consumer device by having features that make it difficult to tamper with. The asset control core is able to generate a unique identifier for one device and participate in the tracking and provisioning of the device through a secure communication channel with an appliance. The appliance generally includes a secure module that caches and distributes provisioning data to one of many agents that connect to the asset control core, e.g. on a manufacturing line or in an after-market programming session.
1. A hardware module for controlling assets to be applied to a device, said hardware module configured to be incorporated into said device, said hardware module comprising:
a cryptographic controller configured to decrypt feature data received from an agent connected to the hardware module;
a random number generator for generating a unique identifier to uniquely identify the hardware module;
non-volatile memory (NVM), at least a portion thereof being protected for storing feature activation information;
a register configured to populate the decrypted feature data, wherein the decrypted feature data indicates whether one or more features are enabled or disabled for said device; and
a provisioning interface configured to provide one or more outputs to said device to enable or disable the one or more features based on the decrypted feature data.
2. The hardware module according to claim 1 wherein said hardware module is integrated into a wafer, chip, printed circuit board or an electronic device through said provisioning interface.
3. The hardware module according to claim 1 wherein said cryptographic controller is configured to use the Elliptic Curve Menezes-Qu-Vanstone protocol.
4. The hardware module according to claim 1 wherein said NVM comprises a test state for allowing tests to be run on said hardware module, an initialization state for generating a static key and a unique identifier, and a functional state for participating in said secure session.
5. The hardware module according to claim 4 wherein upon detecting a threshold number of illegal commands, said cryptographic controller is configured to transition into a locked-out state to protect further access to said NVM.
6. A method of programming features on a device, the method comprising:
determining one or more features to be enabled or disabled on said device based on feature activation information stored at non-volatile memory (NVM) of the device;
preparing one or more feature control tickets, wherein the one or more feature control tickets include the feature activation information;
encrypting said one or more feature control tickets; and
providing said one or more encrypted feature control tickets to an appliance for delivery to one or more devices capable of being programmed with the one or more features.
7. The method according to claim 6 wherein said preparing is performed within a hardware security module.
8. The method according to claim 6 further comprising logging an event upon providing said feature control tickets, and obtaining logs from said appliance.
9. The method according to claim 8 further comprising storing said logs in a database.
10. A non-transitory computer readable storage medium comprising computer executable instructions that, when executed, cause a computing device to perform operations comprising:
determining one or more features to be enabled or disabled on a device based on feature activation information stored at non-volatile memory (NVM) of the device;
preparing one or more feature control tickets, wherein the one or more feature control tickets include the feature activation information;
encrypting said one or more feature control ticket; and
providing said one or more encrypted feature control tickets to an appliance for delivery to one or more devices capable of being programmed with the one or more features.
11. A controller server comprising a processor, memory, and a connection to an appliance server, said controller server being configured to perform operations comprising:
determining one or more features to be enabled or disabled on a device based on feature activation information stored at non-volatile memory (NVM) of the device;
preparing one or more feature control tickets, wherein the one or more feature control tickets include the feature activation information;
encrypting said one or more feature control ticket; and
providing said one or more encrypted feature control tickets to an appliance for delivery to one or more devices capable of being programmed with the one or more features.
12. A method of exchanging information with a device, the method comprising:
providing a hardware module embedded on said device;
providing an appliance in communication with said hardware module;
establishing a secure communication channel between said appliance and said hardware module; and
utilizing messages sent between the appliance and the hardware module over said secure communication channel to provide feature activation information, stored at non-volatile memory (NVM) of said device, indicating one or more features are to be enabled or disabled on said device.
13. The method according to claim 12 further comprising providing an agent between said appliance and said hardware module to distribute said messages on behalf of said appliance.
14. The method according to claim 12 wherein said messages comprise one or more assets to be associated with said device.
15. The method according to claim 14 wherein said assets are any one or more of serial numbers, keys, or feature sets.
16. A non-transitory computer readable storage medium comprising computer executable instructions that, when executed, cause a computing device to perform operations comprising:
establishing a secure communication channel between an appliance and a hardware module embedded on a device; and
utilizing messages sent between the appliance and the hardware module over said secure communication channel to provide feature activation information, stored at non-volatile memory (NVM) of said device, indicating one or more features are to be enabled or disabled on said device.
17. A system for exchanging information with a device, the system comprising:
a hardware module to be embedded on said device,
wherein said hardware module is configured to establish a secure communication channel with an appliance,
wherein said hardware module is further configured to exchange messages sent between said appliance and said hardware module over said secure communication channel to provide feature activation information, stored at non-volatile memory (NVM) of said device, indicating one or more features are to be enabled or disabled on said device; and
wherein said hardware module is further configured to utilize said messages to provision one or more features on said device.