Granted Patent B2

US 10,365,908 · App. 15/468,573 · Granted Jul 30, 2019

Abstract

Claims (57)

1. A processor implemented method for secure reprogramming of programmable devices to alter device functionality, comprising:

obtaining license permissions for a target physical programmable device from a back-office system;

hard-coding a functionality of the target physical programmable device based on the license permissions into program code at program build time to restrict a flow of control through certain allowable sections of the program code, without requiring verification of the license permissions at a decision point during execution of the program code at the target physical programmable device, by only providing those sections of code in a final build of the program code, wherein only features, facilities, or capabilities allowed by the license permissions are implemented;

producing a firmware image from the program code, or selecting a pre-existing, pre-validated firmware image of the program code, which contains only the features, facilities, or capabilities allowed by the license permissions obtained from the back-office system and only for use on the target physical programmable device;

encrypting the firmware image; and

delivering the firmware image to the target physical programmable device;

with a bootloader on the target physical programmable device:

the target physical programmable device uniquely identifying itself;

the target physical programmable device decrypting the firmware image; and

the target physical programmable device installing the firmware image thereon to alter the functionality of the target physical programmable device to be consistent with the license permissions.

2. The method of claim 1 , further comprising:

the target physical programmable device using cryptography functions within the bootloader to decrypt the firmware image.

3. The method of claim 2 , further comprising:

the cryptography functions using cryptographic keys written into the target physical programmable device at a time of manufacture of the target physical programmable device.

4. The method of claim 1 , further comprising:

setting memory access control fuses on the target physical programmable device to prevent external inspection of the target physical programmable device.

5. The method of claim 1 , further comprising:

the back-office system linking a unique identifier of the target physical programmable device with a product SKU to record a licensing transaction.

6. The method of claim 1 , further comprising:

at the target physical programmable device, generating a cryptographic signature derived from the firmware image; and

comparing the generated cryptographic signature to an expected, matching value held in the back-office system to verify successful reprogramming of the target physical programmable device.

7. The method of claim 1 , further comprising:

the back-office system communicating with the bootloader to confirm the identity of the target physical programmable device and a version of a currently loaded firmware image on the programmable device to protect against unauthorized use on hardware-cloned, third-party devices.

8. A processor implemented method, comprising:

a license server interacting with a target physical programmable device via a bootloader on said target physical programmable device in which:

the license server queries the target physical programmable device for a unique ID and status;

the license server receives from the target physical programmable device the unique ID and an identifier for currently installed firmware on the target physical programmable device;

the license server sends an encrypted payload to the target physical programmable device that includes a replacement firmware image, the replacement firmware image including program code for hard-coding a functionality of the target physical programmable device based on license permissions associated with a particular SKU for the target physical programmable device, the program code generated at build time to restrict a flow of control through certain allowable sections of the program code, without requiring verification of the license permissions when executing the program code at the target physical programmable device, by only providing those sections of code in a final build of the program code;

the license server receives from the target physical programmable device a completion acknowledgement after the replacement firmware image is successfully installed on the target physical programmable device;

the license server queries the target physical programmable device for the unique ID and status to confirm that the replacement firmware image is installed and functioning properly; and

the license server receives from the target physical programmable device the unique ID of the target physical programmable device and a currently loaded firmware identifier;

wherein said target physical programmable device is securely reprogrammed with the replacement firmware image to implement the functionality at the target physical programmable device that is consistent with the license permissions associated with the particular SKU of the target physical programmable device.

9. A physical programmable device comprising:

a processor; and

a memory communicatively coupled to the processor, the memory including:

a bootloader; and

instructions executable by the processor to:

receive a query from a license server, the license server managing license permissions for the physical programmable device;

transmit, to the license server, in response to the query, a unique device identifier and a firmware identifier, the firmware identifier indicative of a firmware currently loaded at the physical programmable device;

receive, from the license server, a replacement firmware image, the replacement firmware image including program code for hard-coding a functionality at the physical programmable device based on the license permissions for the programmable device, the program code generated at build time to restrict a flow of control through certain allowable sections of the program code, without requiring verification of the license permissions when executing the program code at the physical programmable device, by only providing those sections of code in a final build of the program code, the replacement firmware image encrypted based on the unique device identifier such that the replacement firmware can only be decrypted and subsequently executed at the physical programmable device;

cause the bootloader to decrypt the received replacement firmware image based on a pre-defined communication protocol implemented by the bootloader and license server; and

cause the bootloader to install the replacement firmware after decryption to securely reprogram the functionality of the physical programmable device to be consistent with the license permissions for the physical programmable device.

10. The physical programmable device of claim 9 , wherein the bootloader uses a cryptographic key to decrypt the received replacement firmware image, the cryptographic key written into the memory of physical programmable device at a time of manufacture of the physical programmable device.

11. The physical programmable device of claim 9 , wherein the memory includes further instructions executable by the processor to further:

transmit, to the license server, a completion acknowledgement after the replacement firmware image is successfully decrypted and installed by the bootloader.

12. The physical programmable device of claim 9 , wherein the memory includes further instructions executable by the processor to further:

cause the bootloader to generate a cryptographic signature derived based on the decryption of the replacement firmware image; and

transmit, to the license server, the generated cryptographic signature for comparison against a known verification value held in a back-office system communicatively coupled to the license server.

13. The physical programmable device of claim 12 , wherein the memory includes further instructions executable by the processor to further:

receive, from the license server, a verification acknowledgment that the cryptographic signature matches the known verification value;

wherein reprogramming of the functionality of the physical programmable device by the bootloader occurs after receiving the verification acknowledgment from the license server.

14. The programmable device of claim 9 , wherein the replacement firmware image includes program code that:

removes functionality that is hard-coded by the firmware currently loaded at the physical programmable device and that is not included in the license permissions for the physical programmable device; and/or

adds functionality that is not hard-coded by the firmware currently loaded at the physical programmable device and that is included in the license permissions for the physical programmable device.

15. The physical programmable device of claim 9 , further comprising:

a memory access control fuse configured to prevent external inspection of the physical programmable device.

16. The physical programmable device of claim 9 , wherein the license permissions are associated, by the license server, with the programmable device based on a particular SKU for the physical programmable device.

Assignments (8)