Secure device state apparatus and method and lifecycle management
A semiconductor chip device include device state fuses that may be used to configure various device states and corresponding security levels for the semiconductor chip as it transitions from wafer manufacturing to provisioned device. The device states and security levels prevent the semiconductor chip from being accessed and exploited, for example, during manufacturing testing. A secure boot flow process for a semiconductor chip over its lifecycle is also disclosed. The secure boot flow may start at the wafer manufacturing stage and continue on through the insertion of keys and firmware.
1. A method of securing a semiconductor chip device having a plurality of device state fuses, the method comprising:
changing a raw device bit pattern stored in the device state fuses to a test-mode-enabled bit pattern effective to change a device state from a raw device state to a test-mode-enabled device state, wherein the test-mode-enabled device state permits manufacturing testing to be performed on the semiconductor chip device;
in response to the semiconductor chip device passing manufacturing testing, changing the test-mode-enabled bit pattern to a test-mode-locked bit pattern effective to change the device state from the test-mode-enabled device state to a test-mode-locked device state;
in response to the device state fuses being changed to a bit pattern that does not match a known bit pattern corresponding to a known device state, modifying a current bit pattern of the device state fuses to a test-mode-disabled bit pattern effective to change a current device state to a test-mode-disabled device state; and
altering a security level of the semiconductor chip device based at least in part on the changes to the device state, the security level corresponding to the test-mode-disabled device state causing ports and memory in the semiconductor chip device to be permanently disabled or inaccessible.
2. The method according to claim 1 ,
wherein the security level corresponding to the raw device state causes test modes and the ports to be inaccessible from the outside.
3. The method according to claim 1 ,
wherein the security level corresponding to the test-mode-locked device state does not allow for manufacturing tests to be performed on the semiconductor chip device.
4. The method according to claim 3 , wherein the security level corresponding to the test-mode-locked device state allows for the semiconductor chip device to be transitioned back to the test-mode-enabled device state.
5. The method according to claim 1 , further comprising:
in response to the semiconductor chip device failing the manufacturing testing, changing the test-mode-enabled bit pattern to the test-mode-disabled bit pattern effective to change the device state from the test-mode-enabled device state to the test-mode-disabled device state.
6. The method of claim 1 , wherein the semiconductor chip device further comprises a boot loader; and
wherein the raw device bit pattern is changed to the test-mode-enabled bit pattern responsive to the boot loader verifying that a correct unlock password is received by the semiconductor chip device together with an unlock request.
7. The method according to claim 1 , wherein the security level corresponding to the test-mode-enabled device state allows for the manufacturing tests on the semiconductor chip device to be conducted via one or more of the ports.
8. A semiconductor chip device, comprising:
a plurality of device state fuses storing bit patterns indicative of device states of the semiconductor chip device;
ports and memory;
a processor operably connected to the device state fuses; and
a storage device storing instructions that, when executed by the processor, cause the processor to:
change a raw device bit pattern stored in the device state fuses to a test-mode-enabled bit pattern effective to change the device state from a raw device state to a test-mode-enabled device state, wherein the test-mode-enabled device state permits manufacturing testing to be performed on the semiconductor chip device;
in response to the semiconductor chip device passing manufacturing testing, change the test-mode-enabled bit pattern to a test-mode-locked bit pattern effective to change the device state from the test-mode-enabled device state to a test-mode-locked device state;
in response to the device state fuses being changed to a bit pattern that does not match a known bit pattern corresponding to a known device state, modify a current bit pattern of the device state fuses to a test-mode-disabled bit pattern effective to change a current device state to a test-mode-disabled device state; and
alter a security level of the semiconductor chip device based on changes to the device state, the security level corresponding to the test-mode-disabled device state causing the ports and memory in the semiconductor chip device to be permanently disabled or inaccessible.
9. The semiconductor chip device according to claim 8 ,
wherein the security level corresponding to the raw device state causes test modes and the ports to be inaccessible from the outside.
10. The semiconductor chip device according to claim 8 ,
wherein the security level corresponding to the test-mode-locked device state does not allow for manufacturing tests to be performed on the semiconductor chip device.
11. The semiconductor chip device according to claim 10 , wherein the security level corresponding to the test-mode-enabled device state allows for the manufacturing testing on the semiconductor chip device to be conducted via one or more of the ports.
12. The semiconductor chip device according to claim 8 ,
wherein the instructions further cause the processor to:
in response to the semiconductor chip device failing the manufacturing testing, change the test-mode-enabled bit pattern to the test-mode-disabled bit pattern effective to change the device state from the test-mode-enabled device state to the test-mode-disabled device state.
13. The semiconductor chip device according to claim 8 ,
wherein the raw device bit pattern is changed to the test-mode-enabled bit pattern responsive to a boot loader process verifying that a correct unlock password is received by the semiconductor chip device together with an unlock request.
14. The semiconductor chip device according to claim 8 , wherein the security level corresponding to the test-mode-enabled device state allows for the manufacturing tests on the semiconductor chip device to be conducted via one or more of the ports.
15. A non-transitory computer-readable medium, that, when executed by one or more processors, cause the processors to implement operations comprising:
changing a raw device bit pattern of a semiconductor chip device stored in a plurality of device state fuses within the semiconductor chip device to a test-mode-enabled bit pattern effective to change a device state from a raw device state to a test-mode-enabled device state, the test-mode-enabled device state permitting manufacturing testing to be performed on the semiconductor chip device;
in response to the semiconductor chip device passing manufacturing testing, changing the test-mode-enabled bit pattern to a test-mode-locked bit pattern effective to change the device state from the test-mode-enabled device state to a test-mode-locked device state;
in response to the device state fuses being changed to a bit pattern that does not match a known bit pattern corresponding to a known device state:
modifying a current bit pattern of the device state fuses to a test-mode-disabled bit pattern effective to change a current device state to a test-mode-disabled device state; and
setting a security level of the semiconductor chip device to a test-mode-disabled device state security level where ports and memory of the semiconductor chip device are permanently disabled or inaccessible.
16. The one or more non-transitory computer-readable storage media devices of claim 15 , wherein a raw device state security level does not allow the semiconductor chip device to enter test modes and does not allow the ports to be accessible from outside of the semiconductor chip device.
17. The one or more non-transitory computer-readable storage media devices of claim 15 , wherein the operations further comprise:
responsive to the changing to the test-mode-enabled device state, setting the security level of the semiconductor chip device to a test-mode-enabled device state security level wherein the manufacturing testing on the semiconductor chip device is allowed via one or more of the ports.
18. The one or more non-transitory computer-readable storage media devices of claim 15 , wherein the operations further comprise:
responsive to the changing to the test-mode-locked device state, setting the security level of the semiconductor chip device to a test-mode-locked device state security level wherein the manufacturing testing on the semiconductor chip device is not allowed.
19. The one or more non-transitory computer-readable storage media devices of claim 18 , wherein the test-mode-locked device state security level does allow for the semiconductor chip device to be transitioned back to the test-mode-enabled device state.
20. The one or more non-transitory computer-readable storage media devices of claim 15 , wherein the operations further comprise:
responsive to the semiconductor chip device failing the manufacturing testing, changing the test-mode-enabled bit pattern to the test-mode-disabled bit pattern effective to change the device state from the test-mode-enabled device state to the test-mode-disabled device state.