Unified programming environment for programmable devices
A secure programming system can receive a job control package having a security kernel and a target payload of content for programming into a pre-defined set of trusted devices. A device programmer can install a security kernel on the trusted devices and reboot the trusted devices using the security kernel to validate the proper operation of the security kernel. The target payload can then be securely installed on the trusted devices and validated.
1. A method of operation of a secure programming system comprising:
retrieving a job control package having a security kernel, an authentication list, and a target payload;
loading a programmable device into a programmer;
authenticating a device identifier of the programmable device by matching with an authentication identifier of the authentication list;
installing the security kernel in the programmable device based on the authentication of the device identifier;
rebooting the programmable device in the programmer to generate a validation code of the security kernel by activating the security kernel;
validating the security kernel of the programmable device by matching a signing code to the validation code; and
provisioning the programmable device with the target payload based on a successful validation of the security kernel.
2. The method as claimed in claim 1 , wherein rebooting the programmable device includes sending a reboot command to the programmable device mounted in the programmer.
3. The method as claimed in claim 1 , further comprising:
retrieving a silicon vendor device certificate from the programmable device;
extracting a silicon vendor public key from the target payload;
generating the validation code by authenticating the silicon vendor device certificate with the silicon vendor public key;
extracting an identification token from the silicon vendor device certificate, the identification token encrypted by the silicon vendor device public key; and
authenticating the identification token using a silicon vendor device private key.
4. An apparatus comprising:
a programming unit configured to retrieve a job control package having a security kernel, an authentication list, and a target payload and to authenticate a device identifier of a programmable device by matching with an authentication identifier of the authentication list;
a programmer of the programming unit configured to load a programmable device into the programmer, install the security kernel in the programmable device based on the authentication of the device identifier, reboot the programmable device in the programmer to generate a validation code of the security kernel by activating the security kernel, and provision the programmable device with the target payload based on a successful validation of the security kernel; and
a security controller of the programming unit configured to validate the security kernel of the programmable device by matching a signing code to the validation code retrieved from the security kernel after rebooting.
5. The apparatus as claimed in claim 4 , wherein the programmer is configured to send a reboot command to the programmable device mounted in the programmer.
6. The apparatus as claimed in claim 4 , wherein the programming unit includes:
the programmer configured to retrieve a silicon vendor device certificate from the programmable device; and
the security controller configured to extract a silicon vendor public key from the target payload, to generate the validation code by authenticating the silicon vendor device certificate with the silicon vendor public key, to extract an identification token from the silicon vendor device certificate, the identification token encrypted by the silicon vendor device public key, and to authenticate the identification token using a silicon vendor device private key.
7. The apparatus as claimed in claim 4 , wherein the programming unit includes:
the security controller configured to extract a firmware image from the target payload and to decrypt the firmware image; and
the programmer configured to copy the firmware image to the programmable device.
8. The apparatus as claimed in claim 4 , wherein the programming unit includes the security controller configured to calculate a device validation status based on a module list of the programmable device matching another module list of the target payload and configured to insert the device validation status into a validation report.
9. The apparatus as claimed in claim 4 , wherein:
the programming unit configured to retrieve the security kernel in an encrypted format in the job control package;
the security controller configured to decrypt the security kernel with a public key pre-loaded in a programming unit; and
the programmer configured to install the security kernel in an unencrypted format into the programmable device.
10. The apparatus as claimed in claim 4 , further comprising a hardware security module outside the programming unit configured to encrypt the security kernel with a programmer public key, an OEM public key, or a silicon vendor public key and to form the job control package with the security kernel in an encrypted format.
11. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause:
retrieving a job control package having a security kernel and a target payload;
loading a programmable device into a programmer;
authenticating a device identifier of the programmable device by matching with an authentication identifier of the authentication list;
installing the security kernel in the programmable device based on the authentication of the device identifier;
rebooting the programmable device in the programmer to generate a validation code of the security kernel by activating the security kernel;
validating the security kernel of the programmable device by matching a signing code to the validation code; and
provisioning the programmable device with the target payload based on a successful validation of the security kernel.
12. The one or more non-transitory computer-readable media of claim 11 , wherein rebooting the programmable device includes sending a reboot command to the programmable device mounted in the programmer.
13. The one or more non-transitory computer-readable media of claim 11 , wherein the instruction when executed by the one or more computing devices, further cause:
retrieving a silicon vendor device certificate from the programmable device;
extracting a silicon vendor public key from the target payload;
generating the validation code by authenticating the silicon vendor device certificate with the silicon vendor public key;
extracting an identification token from the silicon vendor device certificate, the identification token encrypted by the silicon vendor device public key; and
authenticating the identification token using a silicon vendor device private key.
14. The one or more non-transitory computer-readable media of claim 11 , wherein provisioning the programmable device includes:
extracting a firmware image from the target payload;
decrypting the firmware image; and
copying the firmware image to the programmable device.
15. The one or more non-transitory computer-readable media of claim 11 , wherein the instruction when executed by the one or more computing devices, further cause:
calculating a device validation status based on a module list of the programmable device matching another module list of the target payload; and
inserting the device validation status into a validation report.
16. The one or more non-transitory computer-readable media of claim 11 , wherein retrieving the job control package includes:
retrieving the security kernel in an encrypted format in the job control package;
decrypting the security kernel with a public key pre-loaded in a programming unit; and
installing the security kernel in an unencrypted format into the programmable device.