Secure programming system, operating method thereof and computer readable recording medium using such operating method
A method for operating a secure programming system is provided. Firstly, a first verification code is calculated according to a payload extracted from a job control package. Then, a second verification code is calculated according to the payload burnt into a programmable device. If the first verification code and the second verification code are verified successfully, a burning task is performed. Then, an OEM certificate signing request is generated according to an identifiable information and a programmable device public key. If the OEM certificate signing request is verified successfully, an OEM device certificate is generated and signed with an OEM private key. A third verification code is calculated according to the OEM device certificate. Then, a fourth verification code is calculated according to the OEM device certificate burnt into the programmable device.
1 . A method for operating a secure programming system, the secure programming system comprising a programmer, a programming unit, an authentication module and a hardware security module, the method comprising steps of:
a step (S1) the programmer using a security control unit key to decrypt an encrypted job control package so as to extract a payload;
a step (S2) the programmer calculating a first verification code according to the payload;
a step (S3) the programmer burning the payload into a programmable device;
a step (S4) reading the burnt payload from the programmable device, and calculating a second verification code according to the burnt payload;
a step (S5) the programmer verifying the first verification code and the second verification code, wherein when the first verification code and the second verification code are verified successfully, a burning task is performed;
a step (S6) while the burning task is performed, the programming unit generating an Original Equipment Manufacturer (OEM) certificate signing request according to an identifiable information and a programmable device public key in the programmable device;
a step (S7) the authentication module verifying the OEM certificate signing request according to a hash value, wherein when the OEM certificate signing request is verified successfully, an OEM device certificate is generated;
a step (S8) the hardware security module signing the OEM device certificate with an OEM private key;
a step (S9) the programming unit verifying the OEM device certificate with an OEM public key;
a step (S10) when a verification result of the step (S9) is correct, the programmer calculates a third verification code according to the OEM device certificate;
a step (S11) the programmer burning the OEM device certificate into the programmable device;
a step (S12) the programmer reading the burnt OEM device certificate from the programmable device and calculating a fourth verification code according to the burnt OEM device certificate;
a step (S13) the programmer verifying the third verification code and the fourth verification code; and
a step (S14) the programming unit categorizing the programmable device according to a verification result of the step (S13), wherein when the verification result is successful, the programmable device is categorized into a first output container representing a good output container.
2 . The method according to claim 1 , wherein in the step (S1), the payload is extracted from a secure storage unit of the programable device.
3 . The method according to claim 1 , wherein in the step (S12), the OEM device certificate is extracted from a secure storage unit of the programmable device.
4 . The method according to claim 1 , wherein in the step (S14), the programmable device is transferred into the first output container through a device transfer unit.
5 . The method according to claim 1 , wherein before the step (S1), the method further comprises steps of:
a step (S15) generating the job control package, wherein the control packet includes a programmer identification list, and the programmer identification list records at least one programmer capable of performing the burning task; and
a step (S16) using at least one programmer recorded in the programmer identification list to program the payload in the job control package into the programmable device.
6 . The method according to claim 1 , wherein in the step (S14), when the verification result is not successful, the programmable device is categorized into a second output container representing a bad output device.
7 . The method according to claim 5 , wherein the method further comprises a step (S17) of setting the programmer to program the encrypted payload into the programmable device.
8 . A computer-readable recording medium for use in a secure programming system to store at least one software instruction sequence, the at least one software instruction sequence being executed by at least one processor, the secure programming system comprising a programmer, a programming unit, an authentication module and a hardware security module, the at least one software instruction sequence being executed to perform a method comprising steps of:
a step (S1) the programmer using a security control unit key to decrypt an encrypted job control package so as to extract a payload;
a step (S2) the programmer calculating a first verification code according to the payload;
a step (S3) the programmer burning the payload into a programmable device;
a step (S4) reading the burnt payload from the programmable device, and calculating a second verification code according to the burnt payload;
a step (S5) the programmer verifying the first verification code and the second verification code, wherein when the first verification code and the second verification code are verified successfully, a burning task is performed;
a step (S6) while the burning task is performed, the programming unit generating an Original Equipment Manufacturer (OEM) certificate signing request according to an identifiable information and a programmable device public key in the programmable device;
a step (S7) the authentication module verifying the OEM certificate signing request according to a hash value, wherein when the OEM certificate signing request is verified successfully, an OEM device certificate is generated;
a step (S8) the hardware security module signing the OEM device certificate with an OEM private key;
a step (S9) the programming unit verifying the OEM device certificate with an OEM public key;
a step (S10) when a verification result of the step (S9) is correct, the programmer calculating a third verification code according to the OEM device certificate;
a step (S11) the programmer burning the OEM device certificate into the programmable device;
a step (S12) the programmer reading the burnt OEM device certificate from the programmable device and calculating a fourth verification code according to the burnt OEM device certificate;
a step (S13) the programmer verifying the third verification code and the fourth verification code; and
a step (S14) the programming unit categorizing the programmable device according to a verification result of the step (S13) wherein when the verification result is successful, the programmable device is categorized into a first output container representing a good output container.
9 . The computer-readable recording medium according to claim 8 , wherein in the step (S1), the payload is extracted from a secure storage unit of the programable device.
10 . The computer-readable recording medium according to claim 8 , wherein in the step (S12), the OEM device certificate is extracted from a secure storage unit of the programmable device.
11 . The computer-readable recording medium according to claim 8 , wherein in the step (S14), the programmable device is transferred into the first output container through a device transfer unit.
12 . The computer-readable recording medium according to claim 8 , wherein before the step (S1), the method further comprises steps of:
a step (S15) generating the job control package, wherein the control packet includes a programmer identification list, and the programmer identification list records at least one programmer capable of performing the burning task; and
a step (S16) using at least one programmer recorded in the programmer identification list to program the payload in the job control package into the programmable device.
13 . The computer-readable recording medium according to claim 8 , wherein in the step (S14), when the verification result is not successful, the programmable device is categorized into a second output container representing a bad output device.
14 . The computer-readable recording medium according to claim 12 , wherein the method further comprises a step (S17) of setting the programmer to program the encrypted payload into the programmable device.
15 . A secure programming system, comprising:
a programmer using a security control unit key to decrypt an encrypted job control package to extract a payload, calculating a first verification code according to the payload, and burning the payload into a programmable device, wherein after the payload is burnt into the programmable device, the programmer reads the burnt payload from the programmable device, calculates a second verification code according to the burnt payload, and verifies the first verification code and the second verification code, wherein when the first verification code and the second verification code are verified successfully, a burning task is performed, wherein while the burning task is performed, the programmer reads an identifiable information and a programmable device public key from the programmable device and transmits the identifiable information and the programmable device public key to a programming unit, so that the programming unit generates an Original Equipment Manufacturer (OEM) certificate signing request;
an authentication module connected with the hardware security module, and verifying an OEM certificate signing request according to a hash value, wherein when the OEM certificate signing request is verified successfully, the authentication module generates an OEM device certificate to the hardware security module, wherein the hardware security module is configured to sign the OEM device certificate and generate a signed OEM device certificate; and
a programming unit connected with the programmer, and verifying the OEM device certificate with an OEM public key, wherein when the OEM device certificate is verified successfully, the OEM device certificate is transmitted to the programmer, wherein the programmer programs both of the OEM device certificate and the payload into the programmable device,
wherein when the OEM device certificate is successfully verified with the OEM public key by the programming unit, the programmer calculates a third verification code according to the OEM device certificate, and the programmer burns the OEM device certificate into the programmable device, wherein after the programmer reads the burnt OEM device certificate and calculates a fourth verification code according to the burnt OEM device certificate, the programmer verifies the third verification code and the fourth verification code, wherein the programming unit categorizes the programmable device according to a result of verifying the third verification code and the fourth verification code, wherein when the third verification code and the fourth verification code are verified successfully, the programmable device is categorized into a first output container representing a good output container.
16 . The secure programming system according to claim 15 , wherein the programmer extracts the payload from a secure storage unit of the programmable device.
17 . The secure programming system according to claim 15 , wherein when the OEM certificate signing request is verified successfully according to the hash value, the hardware security module signs the OEM device certificate with an OEM private key.
18 . The secure programming system according to claim 15 , wherein the programmer extracts the OEM device certificate from a secure storage unit of the programmable device.
19 . The secure programming system according to claim 15 , wherein the programmer transfers the programmable device into the first output container through a device transfer unit.
20 . The secure programming system according to claim 15 , wherein the security control unit generates the job control package including a programmer identification list, wherein the programmer identification list records at least one programmer capable of performing the burning task, and the at least one programmer recorded in the programmer identification list is used to program the payload in the job control package into the programmable device.
21 . The secure programming system according to claim 15 , wherein the encrypted payload is programmed into the programmable device by the programmer.
22 . The secure programming system according to claim 20 , wherein the programming unit is configured to verify the at least one programmer recorded in the programmer identification list and capable of performing the burning task and verify the identifiable information of the programmer of the secure programming system, wherein if the at least one programmer recorded in the programmer identification list and the identifiable information of the programmer of the secure programming system are verified successfully, the OEM device certificate is programmed into the programmable device by the programming unit.
23 . The secure programming system according to claim 15 , wherein the programming unit acquires a production count, wherein when a burn count in the programmer is less than the production count, the programming unit drives the programmer to perform the burning task, wherein when the burn count in the programmer exceeds the production count, the programming unit drives the programmer to perform the burning task, wherein the burn count in the programmer is smaller than or equal to an upper limit of the production count.
24 . The secure programming system according to claim 15 , wherein when the third verification code and the fourth verification code are not verified successfully, the programmable device is categorized into a second output container representing a bad output container.