System and method for authenticating software using protected master key
View Patent ↗A processing unit includes a read-only encryption key. Software is loaded into a system memory area from a non-volatile storage device. Software code image that resides in the system storage area includes a prefix value and a suffix value. The prefix value is combined with the master key from the processing unit to create a random value that is the seed for a hashing algorithm. The hashing algorithm uses the seed value with a signature formed from the blocks of code to form a result. Finally, after the last block has been processed, a final result remains. The suffix value is combined with the master key, this hash result is compared with the result that was created using the hashing algorithm on the code. If the two results match, the code is authenticated and is executed. If the results do not match, the code is not loaded.
1. A method of providing a device adapted to authenticate software code, said method comprising:
generating a master key value;
writing the master key value to a nonvolatile memory, wherein the nonvolatile memory and one or more processors are included in a common semiconductor package within the device;
locking the nonvolatile memory;
recording the master key value and a device identifier in a database;
receiving an order for a software program from a customer, the order including the device identifier and a software program identifier corresponding to the software program;
retrieving the master key value from the database based upon the device identifier included in the received order;
creating a software image based upon the retrieved master key value and the software program corresponding to the software program identifier; and
delivering the software image to the customer.
2. The method of claim 1 wherein the device identifier is a serial number that uniquely identifies the device.
3. The method of claim 1 further comprising:
shipping the device to a customer.
4. The method of claim 1 wherein the creating the software image further comprises:
generating a random number;
creating a prefix value based upon the master key value and the random number;
seeding a hashing algorithm with the random number;
hashing the software program using the seeded hashing algorithm, the hashing algorithm resulting in a hash result;
creating a suffix value based upon the master key value and the hash result; and
including the prefix value, software program, and suffix value in the software image.
5. The method of claim 4 wherein the creation of the prefix value includes performing an XOR operation between the master key value and the random number.
6. The method of claim 4 wherein the creation of the suffix value includes performing an XOR operation between the master key value and the hash result.
7. A computer program product stored on a computer storage media, the computer storage media containing instructions for execution by a computer, which, when executed by the computer, cause the computer to implement a method to provide a device adapted to authenticate software code, said method comprising:
for generating a master key value;
writing the master key value to a nonvolatile memory, wherein the nonvolatile memory and one or more processors are included in a common semiconductor package within the device;
locking the nonvolatile memory;
recording the master key value and a device identifier in a database;
receiving an order for a software program from a customer, the order including the device identifier and a software program identifier corresponding to the software program;
retrieving the master key value from the database based upon the device identifier included in the received order;
creating a software image based upon the retrieved master key value and the software program corresponding to the software program identifier; and
delivering the software image to the customer.
8. The computer program product of claim 7 wherein the device identifier is a serial number that uniquely identifies the device.
9. The computer program product of claim 7 wherein the
creating the software image further comprises:
generating a random number;
creating a prefix value based upon the master key value and the random number;
seeding a hashing algorithm with the random number;
hashing the software program using the seeded hashing algorithm, the hashing algorithm resulting in a hash result;
creating a suffix value based upon the master key value and the hash result; and
including the prefix value, software program, and suffix value in the software image.
10. The computer program product of claim 9 wherein the creating the prefix value includes performing an XOR operation between the master key value and the random number.
11. The computer program product of claim 9 wherein the creating the suffix value includes performing an XOR operation between the master key value and the hash result.