Generation of SW Encryption Key During Silicon Manufacturing Process
A method of generating an encryption key during the manufacturing process of a device includes randomly generating a seed, encrypting a unique identifier disposed in the device to obtain a first encryption key, encrypting the first encryption key using a public key to obtain a second encryption key, and sending the second encryption key and the seed to a software provider. The method further includes receiving the second encryption key and the seed by the software provider and decrypting the second encryption key using a private key to recover the first encryption key. The manufacturer then encrypts a program code using the recovered first encryption key and installs the seed in a certificate that is associated with the encrypted program code.
1 . A method of generating an encryption key during the manufacturing process of a device, the method comprising:
randomly generating a seed value;
encrypting a unique identifier disposed in the device using the seed value to obtain a first encryption key;
encrypting the first encryption key using a public key to obtain a second encryption key; and
sending the second encryption key and the seed value to a software provider.
2 . The method of claim 1 , wherein the seed value is randomly generated by the device.
3 . The method of claim 1 further comprising:
receiving the second encryption key and the seed value by the software provider; and
decrypting the second encryption key to obtain the first encryption key.
4 . The method of claim 3 , wherein the decrypting the second key comprises using a private key that forms with the public key a public/private key pair.
5 . The method of claim 3 , wherein the software provider encrypts a program code using the first encryption key and generates a certificate associated with the encrypted program code, the certificate including the seed value.
6 . The method of claim 5 further comprising:
receiving the encryption program code and the associated certificate by the device; and
reproducing the program code using the seed value stored in the certificate and the unique identifier.
7 . The method of claim 6 further comprising:
authenticating the certificate prior to reproducing the program code.
8 . The method of claim 1 , wherein the unique identifier is generated in the device.
9 . The method of claim 1 , wherein the unique identifier is not accessible to a user even in a test mode.
10 . A method of generating an encryption key during the manufacturing process of a device, the method comprising:
randomly generating a seed value;
randomly generating a unique identifier;
programming the unique identifier in a non-volatile register disposed in the device;
encrypting the unique identifier to generate a first encryption key;
encrypting the first encryption key using a public key to generate a second encryption key; and
sending the second encryption key and the seed value to a recipient.
11 . The method of claim 10 , wherein the seed value is randomly generated externally to the device.
12 . The method of claim 10 , wherein the unique identifier is generated externally to the device.
13 . The method of claim 10 further comprising:
receiving the second encryption key and the seed value by the manufacturer; and
decrypting the second encryption key to obtain the first encryption key.
14 . The method of claim 13 , wherein the decrypting the second key comprises using a private key that forms with the public key a public/private key pair.
15 . The method of claim 13 , wherein the recipient encrypts a program code using the first encryption key and generates a certificate associated with the encrypted program code, the certificate including the seed value.
16 . The method of claim 15 further comprising:
receiving the encryption program code and the associated certificate by the device; and
reproducing the program code using the seed value stored in the certificate and the unique identifier.
17 . The method of claim 16 further comprising authenticating the certificate prior to reproducing the program code.
18 . A system comprising:
a random number generator for generating a first seed;
a non-volatile register having a unique identifier;
an interface unit configured to receive a public key;
a processing unit operative to:
encrypt the unique identifier using the first seed to obtain a first key;
encrypt the first key using the public key to obtain a second key; and
output the second key and the seed value.
19 . The system of claim 18 further comprising a demodulator configured to receive an encrypted program code including a certificate, wherein the certificate contains a second seed.
20 . The system of claim 19 , wherein the processing unit is operative to:
generate an encryption key using the unique identifier and the second seed contained in the certificate; and
decipher the encrypted program code using the encryption key.