Secure programming of one-time-programmable (OTP) memory
An electronic device may have a plurality of defined life cycle stages and a one-time-programmable (OTP) memory comprising a plurality of life cycle bits, wherein respective bit patterns of the life cycle bits may correspond with respective life cycle stages of the defined life cycle stages. The electronic device may also have a boot code stored in read only memory and executable by a processor to receive a request to transition from a current life cycle stage to a next life cycle stage and, in response to the received request, automatically generate a bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle stages and program the bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle stages in the OTP memory during a time when the OTP memory is not user-accessible.
1 . A system comprising:
an electronic device having a plurality of defined life cycle stages, the electronic device including a one-time-programmable (OTP) memory comprising a plurality of life cycle bits, wherein respective bit patterns of the plurality of life cycle bits correspond with respective life cycle stages of the plurality of defined life cycle stages;
a boot code stored in read only memory and executable by a processor to:
receive a request to transition from a current life cycle stage of the plurality of defined life cycle stages to a next life cycle stage of the plurality of defined life cycle stages; and
in response to the received request, automatically generate a bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle stages and program the bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle stages in the OTP memory during a subsequent reset of the electronic device.
2 . The system of claim 1 , wherein the subsequent reset of the electronic device comprises a device reset, a reboot, or a power cycle of the electronic device.
3 . The system of claim 1 , wherein the boot code programming the bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle states in the OTP memory causes a transition from the current life cycle stage of the plurality of defined life cycle stages to the next life cycle stage of the plurality of defined life cycle stages.
4 . The system of claim 1 , wherein the boot code is executable by the processor, in response to the received request, to automatically generate a device unique information and program the device unique information in the OTP memory during the time when the OTP memory is not user-accessible.
5 . The system of claim 1 , wherein for respective life cycle stages of the plurality of defined life cycle stages, the boot code makes available to the user a corresponding respective set of available functions performable during the respective life cycle stage of the plurality of defined life cycle stages.
6 . The system of claim 5 , wherein:
the respective set of available functions performable during a first life cycle stage of the plurality of defined life cycle stages includes a first function; and
the respective set of available functions that performable during a second life cycle stage of the plurality of defined life cycle stages excludes the first function.
7 . The system of claim 1 , wherein the request to transition from a current life cycle stage of the plurality of defined life cycle stages to a next life cycle stage of the plurality of defined life cycle stages is received via a physical port of the electronic device or via a firmware loaded onto the electronic device.
8 . The system of claim 1 , wherein the request to transition from a current life cycle stage of the plurality of defined life cycle stages to a next life cycle stage of the plurality of defined life cycle stages comprises a signed command.
9 . The system of claim 1 , wherein the electronic device comprises a server, a device associated with a server, or a computing platform, and wherein the system comprises a secure boot controller for the server, a device associated with the server, or a computing platform.
10 . The system of claim 1 , wherein the boot code is executable by the processor to transition the electronic device to the next life cycle stage of the plurality of defined life cycle stages by forcing a reset of the electronic device after programming the bit pattern corresponding to the next life cycle stage of the plurality of defined life cycle stages in the OTP memory.
11 . A system comprising:
an electronic device having a one-time-programmable (OTP) memory, the OTP memory including a plurality of life cycle OTP bits;
a life cycle bit map associated with a plurality of defined life cycle stages of the electronic device, the life cycle bit map specifying a plurality of life cycle OTP bit patterns, respective life cycle OTP bit patterns corresponding with respective life cycle stages of the electronic device;
a life cycle function data specifying a set of available functions for respective life cycle stages, wherein:
the specified set of available functions for respective life cycle stages defining functions performable during the respective life cycle stage of the electronic device; and
the specified set of available functions for a respective first life cycle stage differs from the specified set of available functions for a respective second life cycle stage; and
a boot code stored in read only memory and executable by a processor to manage the provisioning of the electronic device through a series of life cycle stages, including:
to receive a plurality of requests to advance the electronic device through the series of life cycle stages;
in response to respective received requests of the plurality of requests, to selectively program, during a subsequent reset of the electronic device, the plurality of life cycle OTP bits to advance the electronic device to a respective next stage of the series of life cycle stages; and
while the electronic device is operating in the respective first life cycle stage, to allow access to only the set of available functions for the respective first life cycle stage as specified by the life cycle function data.
12 . The system of claim 11 , comprising:
the boot code executable by the processor to automatically generate a device unique information and program the device unique information in the OTP memory during a time when the OTP memory is not user-accessible.
13 . The system of claim 11 , wherein the boot code executable by the processor to selectively program the plurality of life cycle OTP bits to advance the electronic device to a respective next stage of the series of life cycle stages comprises boot code executable by the processor to selectively program, in response to a signed command, the plurality of life cycle OTP bits to advance the electronic device to a respective next stage of the series of life cycle stages.
14 . A method comprising:
for an electronic device having a one-time-programmable (OTP) memory, a plurality of defined life cycle stages, and a plurality of defined functions, providing access to a first set of the plurality of defined functions while the electronic device is in a first life cycle stage of the plurality of defined life cycle stages;
receiving a request to transition the electronic device from the first life cycle stage of the plurality of defined life cycle stages to a second life cycle stage of the plurality of defined life cycle stages;
in response to the received request to transition the electronic device from the first life cycle stage of the plurality of defined life cycle stages to the second life cycle stage of the plurality of defined life cycle stages, transitioning the electronic device to the second life cycle stage of the plurality of defined life cycle stages by programming the OTP memory, during a first subsequent reset of the electronic device, with information corresponding to the second life cycle stage of the plurality of defined life cycle stages; and
providing access to a second set of the plurality of defined functions while the electronic device is in the second life cycle stage of the plurality of defined life cycle stages.
15 . The method of claim 14 , wherein the first subsequent reset of the electronic device comprises a device reset, a reboot, or a power cycle of the electronic device.
16 . The method of claim 14 , comprising:
in response to the received request to transition the electronic device from the first life cycle stage of the plurality of defined life cycle stages to the second life cycle stage of the plurality of defined life cycle stages, automatically generating and programming a device-unique information in the OTP memory during a time when the OTP memory is not user-accessible.
17 . The method of claim 14 , wherein:
the first set of the plurality of defined functions includes a first function; and
the second set of the plurality of defined functions excludes the first function.
18 . The method of claim 14 , comprising:
subsequent to transitioning the electronic device to the second life cycle stage of the plurality of defined life cycle stages, prohibiting transitioning the electronic device to the first life cycle stage of the plurality of defined life cycle stages.
19 . The method of claim 14 , wherein the request to transition the electronic device from the first life cycle stage of the plurality of defined life cycle stages to the second life cycle stage of the plurality of defined life cycle stages is received via a physical port of the electronic device or via a firmware loaded onto the electronic device.
20 . The method of claim 14 , wherein the request to transition the electronic device from the first life cycle stage of the plurality of defined life cycle stages to the second life cycle stage of the plurality of defined life cycle stages comprises a signed command.
21 . The method of claim 14 , comprising:
receiving a request to transition the electronic device from the second life cycle stage of the plurality of defined life cycle stages to a third life cycle stage of the plurality of defined life cycle stages;
in response to the received request to transition the electronic device from the second life cycle stage of the plurality of defined life cycle stages to the third life cycle stage of the plurality of defined life cycle stages, transitioning the electronic device to the third life cycle stage of the plurality of defined life cycle stages by programming the OTP memory, during a time when the OTP memory is not user-accessible, with information corresponding to the third life cycle stage of the plurality of defined life cycle stages; and
providing access to a third set of the plurality of defined functions while the electronic device is in the third life cycle stage of the plurality of defined life cycle stages.
22 . The method of claim 21 , comprising:
subsequent to transitioning the electronic device to the third life cycle stage of the plurality of defined life cycle stages, prohibiting transitioning the electronic device to the second life cycle stage of the plurality of defined life cycle stages.
23 . The method of claim 14 , comprising:
causing a transition of the electronic device from the first life cycle stage of the plurality of defined life cycle stages to a second life cycle stage of the plurality of defined life cycle stages by forcing a reset of the electronic device after programming the OTP memory with information corresponding to the second life cycle stage of the plurality of defined life cycle stages.