License control using a memory device having a cryptographic key
In some aspects, the techniques described herein relate to a system including a memory device secure storage region, the secure storage region storing a first cryptographic key and a digital certificate associated with the first cryptographic key; and a computing device, the computing device communicatively coupled to the memory device and configured to: generate a challenge value; transmit the challenge value to the memory device; receive a digital signature from the memory device; validate the digital signature using a second cryptographic key; and continue processing after validating the digital signature.
1 . A system comprising:
a memory device comprising a secure storage region, the secure storage region storing a first cryptographic key, wherein the memory device further comprises a physically unclonable function (PUF), and the memory device is configured to generate the first cryptographic key using the PUF; and
a computing device, the computing device communicatively coupled to the memory device and configured to:
initiate execution of a software application;
generate a challenge value, wherein the challenge value comprises one of a nonce value or a function;
transmit a challenge value to the memory device;
receive a digital signature from the memory device, wherein the digital signature is generated by the memory device using the first cryptographic key and the challenge value;
validate the digital signature using a second cryptographic key associated with the software application;
continue the execution of the software application after validating the digital signature; and
halt processing upon determining that the digital signature is invalid.
2 . The system of claim 1 , wherein the first cryptographic key comprises a private key of an asymmetric key pair and the second cryptographic key comprises a public key of the asymmetric key pair.
3 . The system of claim 2 , wherein the asymmetric key pair comprises one of an Elliptic Curve Digital Signature Algorithm or Elliptic-curve Diffie-Hellman key pair.
4 . The system of claim 2 , wherein the memory device further comprises a Device Identity Composition Engine (DICE), and the memory device is configured to generate the asymmetric key pair using the DICE.
5 . The system of claim 1 , wherein the computing device is further configured to halt processing upon determining that the digital signature is invalid.
6 . The system of claim 1 , wherein the computing device receives the second cryptographic key embedded in or included with software to execute on the computing device.
7 . The system of claim 1 , wherein the challenge value comprises one of a nonce value or function.
8 . The system of claim 1 , wherein the memory device is further configured to sign the challenge value using the first cryptographic key.
9 . A method comprising:
initiating, by a computing device, execution of a software application;
generating a challenge value, wherein the challenge value comprises one of a nonce value or a function;
transmitting, by the computing device, a challenge value to a memory device, the memory device storing a private key, wherein the memory device further comprises a physically unclonable function (PUF) configured to generate the private key;
receiving, by the computing device, a digital signature from the memory device, wherein the digital signature is computed by the memory device using the private key and the challenge value;
validating, by the computing device, the digital signature using a public key associated with the software application and corresponding to the private key;
continuing, by the computing device, the execution of the software application after validating the digital signature; and
halting processing upon determining that the digital signature is invalid.
10 . The method of claim 9 , further comprising halting processing upon determining that the digital signature is invalid.
11 . The method of claim 9 , further comprising receiving the public key embedded in or included with the software application.
12 . The method of claim 9 , wherein generating the challenge value comprises generating a nonce value.
13 . The method of claim 9 , wherein generating the challenge value comprises generating a function.
14 . The method of claim 9 , further comprising reading the public key from a digital certificate issued by a manufacturer of the memory device.
15 . A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:
initiating, by a computer processor, execution of a software application;
generating a challenge value, wherein the challenge value comprises one of a nonce value or a function;
transmitting, by the computer processor, a challenge value to a memory device, the memory device storing a private key, wherein the memory device further comprises a physically unclonable function (PUF) configured to generate the private key;
receiving, by the computer processor, a digital signature from the memory device, wherein the digital signature is computed by the memory device using the private key and the challenge value;
validating, by the computer processor, the digital signature using a public key associated with the software application and corresponding to the private key;
continuing, by the computer processor, the execution of the software application after validating the digital signature; and
halting processing upon determining that the digital signature is invalid.
16 . The non-transitory computer-readable storage medium of claim 15 , the steps further comprising halting processing upon determining that the digital signature is invalid.
17 . The non-transitory computer-readable storage medium of claim 15 , the steps further comprising receiving the public key embedded in or included with the software application.
18 . The non-transitory computer-readable storage medium of claim 15 , wherein generating the challenge value comprises generating one of a nonce value and a function.
19 . The non-transitory computer-readable storage medium of claim 15 , the steps further comprising reading the public key from a digital certificate issued by a manufacturer of the memory device.