System and method for managing electronic assets
An asset management system is provided which comprises one or more controllers, which operate as main servers and can be located at the headquarters of an electronic device manufacturer to remotely control their operations at any global location. The controller can communicate remotely over the Internet or other network to control one or more secondary or remote servers, herein referred to as appliances. The appliances can be situated at different manufacturing, testing or distribution sites. The controller and appliances comprise hardware security modules (HSMs) to perform sensitive and high trust computations, store sensitive information such as private keys, perform other cryptographic operations, and establish secure connections between components. The HSMs are used to create secure end-points between the controller and the appliance and between the appliance and the secure point of trust in an asset control core embedded in a device.
1. A method for distributing electronic assets to devices, the method comprising:
defining, with a hardware processor, a first asset to be added to a device;
defining, with the hardware processor, a second asset to be added to the device;
defining, with the hardware processor, a product type and associating the first asset and the second asset with the product type; and
distributing via a secure communication channel, by the hardware processor, the first asset and the second asset together to an asset control core (ACC) of the device associated with the product type, wherein the hardware processor is external to the device, and wherein the ACC is a hardware core having an ACC functional microcontroller that is embedded on an integrated circuit (IC) of the device and the ACC:
provides a cryptographic security engine with self-contained generation of keys used to open up the secure communication channel with the hardware processor,
provides a self-contained generation of a device ID (UID) that identifies the IC, and
performs device feature activation or deactivation based on the first asset and the second asset that are received over the secure communication channel.
2. The method according to claim 1 , wherein the first asset is one of a first serial number, a first key, and a first feature set.
3. The method according to claim 2 , wherein the second asset is one of a second serial number, a second key, and a second feature set.
4. The method according to claim 1 , wherein the second asset is one of a serial number, a key, and a feature set.
5. A non-transitory computer readable medium comprising computer executable instructions that when executed cause a computing device to:
define, by executing with a hardware processor, a first asset to be added to a device;
define, by executing with the hardware processor, a second asset to be added to the device;
define, by executing with the hardware processor, a product type and associating the first asset and the second asset with the product type; and
distribute via a secure communication channel, by executing with the hardware processor, the first asset and the second asset together to an asset control core (ACC) of the device associated with the product type, wherein the hardware processor is external to the device, and wherein the ACC is a hardware core having an ACC functional microcontroller that is embedded on an integrated circuit (IC) of the device and the ACC:
provides a cryptographic security engine with self-contained generation of keys used to open up the secure communication channel with the hardware processor
provides a self-contained generation of a device ID (UID) that identifies the IC, and
performs device feature activation or deactivation based on the first asset and the second asset that are received over the secure communication channel.
6. The non-transitory computer readable medium according to claim 5 , wherein the first asset is one of a first serial number, a first key, and a first feature set.
7. The non-transitory computer readable medium according to claim 6 , wherein the second asset is one of a second serial number, a second key, and a second feature set.
8. The non-transitory computer readable medium according to claim 5 , wherein the second asset is one of a serial number, a key, and a feature set.
9. A computer with a hardware processor for executing computer executable instructions that when executed cause the computer to:
define, by executing with the hardware processor, a first asset to be added to a device;
define, by executing with the hardware processor, a second asset to be added to the device;
define, by executing with the hardware processor, a product type and associating the first asset and the second asset with the product type; and
distribute via a secure communication channel, by executing with the hardware processor, the first asset and the second asset together to an asset control core (ACC) of the device associated with the product type, wherein the hardware processor is external to the device, and wherein the ACC is a hardware core having an ACC functional microcontroller that is embedded on an integrated circuit (IC) of the device and the ACC:
provides a cryptographic security engine with self-contained generation of keys used to open up the secure communication channel with the hardware processor
provides a self-contained generation of a device ID (UID) that identifies the IC, and
performs device feature activation or deactivation based on the first asset and the second asset that are received over the secure communication channel.
10. The computer with the hardware processor to claim 9 , wherein the first asset is one of a first serial number, a first key, and a first feature set.
11. The computer with the hardware processor to claim 10 , wherein the second asset is one of a second serial number, a second key, and a second feature set.
12. The computer with the hardware processor to claim 9 , wherein the second asset is one of a serial number, a key, and a feature set.