Secure provisioning in an untrusted environment
Embodiments include methods for securely provisioning copies of an electronic circuit. A first entity (e.g., a chip manufacturer) embeds one or more secret values into copies of the electronic circuit. A second entity (e.g., an OEM): 1) embeds a trust anchor in a first copy of the electronic circuit; 2) causes the electronic circuit to generate a message signing key pair using the trust anchor and the embedded secret value(s); 3) signs provisioning code using a code signing private key; and 4) sends a corresponding code signing public key, the trust anchor, and the signed provisioning code to a third entity (e.g., a product manufacturer). The third entity embeds the trust anchor in a second copy of the electronic circuit and causes the electronic circuit to: 1) generate the message signing private key; 2) verify the signature of the signed provisioning code using the code signing public key; and 3) launch the provisioning code on the electronic circuit. The electronic circuit can authenticate itself to the OEM using the message signing key pair.
1. A method performed by a first entity, a second entity, and a third entity, the method comprising:
embedding, by the first entity, one or more secret values in first and second electronic circuits, wherein each of the first and second electronic circuits includes private key derivation logic, public key derivation logic, and secure boot code;
generating, by the second entity, a code signing public key, a code signing private key, and a trust anchor derived from the code signing public key;
embedding, by the second entity, the trust anchor in the first electronic circuit;
activating, by the second entity, the secure boot code, wherein the secure boot code causes the private key derivation logic of the first electronic circuit to generate a message signing private key using a combination of the trust anchor and the one or more embedded secret values, causes the public key derivation logic of the first electronic circuit to generate a message signing public key that corresponds to the message signing private key, and stores the message signing private key in the first electronic circuit;
signing, by the second entity, provisioning code using the code signing private key, resulting in signed provisioning code that includes the provisioning code and a signature;
sending, by the second entity, the code signing public key, the trust anchor, and the signed provisioning code to the third entity;
embedding, by the third entity, the trust anchor in the second electronic circuit;
activating, by the third entity, the secure boot code in the second electronic circuit, wherein the secure boot code causes the private key derivation logic of the second electronic circuit to generate a message signing private key that is the same as the message signing private key generated by the first electronic circuit using a combination of the trust anchor and the one or more embedded secret values, stores the message signing private key in the protected register of the second electronic circuit, derives a value from the code signing public key, and compares the value derived from the code signing public key with the trust anchor embedded in the second electronic circuit, verifies the signature of the signed provisioning code using the code signing public key, and when the signature of the signed provisioning code is verified, launches the provisioning code on the second electronic circuit;
receiving, by the provisioning code, a challenge message from a first computer system associated with the second entity;
preparing, by the provisioning code, a signed response message that includes the challenge message signed using the message signing private key;
sending, by the second electronic circuit, the signed response message to the first computer system;
receiving, by the second electronic circuit over a secure channel between the first computer system and the second electronic circuit, sensitive provisioning information from the first computer system; and
storing the sensitive provisioning information on the second electronic circuit.
2. The method of claim 1 , wherein embedding the one or more secret values in the first electronic circuit comprises embedding one or more secret values selected from a value embedded in logic gates of the first electronic circuit, a value burned into a set of fuses of the first electronic circuit, and a value embedded in masked read only memory (ROM) of the first electronic circuit.
3. The method of claim 1 , further comprising:
embedding, by the first entity, the secure boot code in the first and second electronic circuits; and
storing, by the first entity, unique identifiers in the first and second electronic circuits.
4. The method of claim 1 , further comprising:
providing, by the first entity, the first electronic circuit to the second entity; and
providing, by the first entity, the second electronic circuit to the third entity.
5. The method of claim 1 , wherein generating the trust anchor comprises generating a hash of the code signing public key.
6. The method of claim 1 , wherein embedding the trust anchor comprises burning the trust anchor into a set of fuses of the first electronic circuit.
7. The method of claim 1 , wherein storing the message signing private key comprises storing the message signing private key in protected registers of the first and second electronic circuits.
8. The method of claim 1 , wherein code running on the first electronic circuit provides the message signing public key to the first computer system associated with the second entity.
9. The method of claim 1 , wherein preparing the signed response message comprises:
concatenating together the challenge message a unique identifier of the second electronic circuit; and
signing the concatenated message using the message signing private key to produce the signed response message.
10. The method of claim 9 , further comprising:
determining, by the first computer system, whether the unique identifier matches any previously-stored unique identifiers maintained by the first computer system in a log of electronic circuits that have been previously provisioned; and
when the unique identifier matches a unique identifier in the log, the first computer system refraining from providing the sensitive provisioning information to the second electronic circuit.
11. The method of claim 9 , further comprising:
determining, by the first computer system, whether a maximum number of electronic circuits have been previously provisioned; and
when the maximum number of electronic circuits have been previously provisioned, the first computer system refraining from providing the sensitive provisioning information to the second electronic circuit.
12. A method performed by a first entity and a first computer system associated with the first entity, the method comprising the steps of:
generating a code signing public key and a code signing private key;
generating a trust anchor based on the code signing public key;
signing provisioning code using the code signing private key, resulting in signed provisioning code that includes the provisioning code and a signature;
embedding the trust anchor in a first electronic circuit, wherein the first electronic circuit includes private key derivation logic, public key derivation logic, secure boot code, and one or more embedded secret values;
activating the secure boot code, wherein the secure boot code causes the private key derivation logic to generate a message signing private key using a combination of the trust anchor and the one or more embedded secret values, causes the public key derivation logic of the first electronic circuit to generate a message signing public key that corresponds to the message signing private key, and stores the message signing private key in the first electronic circuit;
sending a challenge message to a second electronic circuit that is connected to a second computer system associated with a second entity;
receiving, from a second electronic circuit, a signed response message generated by the second electronic circuit, wherein the signed response message was generated using a message signing private key that was generated using the trust anchor and the one or more embedded secret values, which also are stored in the second electronic circuit, wherein the message signing private key used by the second electronic circuit is the same as the message signing private key generated by the first electronic circuit; and
verifying, by the first computer system, the signed response message using a message signing public key that was derived from the message signing private key.
13. The method of claim 12 , wherein the one or more secret values are selected from a value embedded in logic gates of the first electronic circuit, a value burned into a set of fuses of the first electronic circuit, and a value embedded in masked read only memory (ROM) of the first electronic circuit.
14. The method of claim 12 , wherein generating the trust anchor comprises generating a hash of the code signing public key.
15. The method of claim 12 , wherein embedding the trust anchor comprises burning the trust anchor into a set of fuses of the first electronic circuit.
16. The method of claim 12 , further comprising:
providing, by the first electronic circuit, the message signing public key to the first computer system;
sending, by the first entity, the code signing public key, the trust anchor, and the signed provisioning code to a second entity;
when the signed response message is verified, the first computer system downloading sensitive provisioning information to the second electronic device over a secure channel between the first computer system and the second computer system; and
when the signed response message is not verified, the first computer system refraining from downloading the sensitive provisioning information to the second electronic device.
17. The method of claim 16 , wherein the signed response message includes a unique identifier of the second electronic circuit, and the method further comprises:
determining, by the first computer system, whether the unique identifier matches any previously-stored unique identifiers maintained by the first computer system in a log of electronic circuits that have been previously provisioned; and
when the unique identifier matches a unique identifier in the log, the first computer system refraining from downloading the sensitive provisioning information to the second electronic circuit.
18. The method of claim 16 , wherein the method further comprises:
determining, by the first computer system, whether a maximum number of electronic circuits have been previously provisioned; and
when the maximum number of electronic circuits have been previously provisioned, the first computer system refraining from downloading the sensitive provisioning information to the second electronic circuit.
19. A method performed by a first entity and a first computer system associated with the first entity, the method comprising the steps of:
receiving, from a second entity, a code signing public key, a trust anchor, and signed provisioning code that includes provisioning code and a signature;
embedding the trust anchor in a first electronic circuit that includes private key derivation logic, public key derivation logic, secure boot code, and one or more embedded secret values;
activating the secure boot code, wherein the secure boot code causes the private key derivation logic to generate a message signing private key using a combination of the trust anchor and the one or more embedded secret values, stores the message signing private key in the first electronic circuit, derives a value from the code signing public key, compares the value derived from the code signing public key with the trust anchor embedded in the electronic circuit, and verifies the signature of the signed provisioning code using the code signing public key;
receiving a challenge message from a second computer system associated with a second entity, wherein the second computer system has a message signing public key that was generated by a second electronic circuit, wherein the message signing public key was generated by the second electronic circuit using a message signing private key that was generated using the trust anchor and the one or more embedded secret values, which also are stored in the second electronic circuit, wherein the message signing private key used by the second electronic circuit is the same as the message signing private key generated by the first electronic circuit;
preparing, by the provisioning code, a signed response message that includes the challenge message signed using the message signing private key;
sending the signed response message to the second computer system; and
receiving, by the first electronic circuit, sensitive provisioning information from the second computer system when the second computer system is able to verify the signed response message using the message signing public key.
20. The method of claim 19 , wherein the one or more secret values are selected from a value embedded in logic gates of the first electronic circuit, a value burned into a set of fuses of the first electronic circuit, and a value embedded in masked random access memory of the first electronic circuit.
21. The method of claim 19 , wherein embedding the trust anchor comprises burning the trust anchor into a set of fuses of the first electronic circuit.
22. The method of claim 19 , further comprising:
storing the sensitive provisioning information on the first electronic circuit.
23. The method of claim 19 , wherein preparing the signed response message comprises:
concatenating together the challenge message and a unique identifier of the first electronic circuit; and
signing the concatenated message using the message signing private key to produce the signed response message.