US6233685B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Establishing and employing the provable untampered state of a device
Assignee: International Business Machines Corp
•
Filing: 1997-08-29
•
Granted: 2001-05-15
•
Expires: 2017-08-29
Abstract
Abstract A method and apparatus is presented for establishing provable integrity or untampered state in secure devices. It employs active tamper response; generating authentication secrets inside the device via real hardware randomness to minimize risk of compromised factory machines; activating tamper response at a trusted point of trust to protect against attacks and/or continually certify the integrity of the device along shipping channels and at user sites; and allowing for all keys to be regenerated so that in accordance with sound cryptographic practice no one needs to depend on permanent keys. The point of trust is a central authority that is trusted by all parties that need to trust the provable untampered state of the secure device. At any point the certifying authority authenticates the integrity and/or untampered state of the device, and re-issues a new certificate for that device. Alternate embodiments enable the device to be shipped without its tamper-response enabled, and/or to re-initialize and certify devices that have been erased or zeroized. Particular methods are used to restrict access of the device's central private key only to trustworthy code in the device. This invention minimizes the parties that one must trust in order to trust in the alleged integrity and/or untampered state of a device, while providing disaster protection with simplicity of device shipping, use and installation.
Inventors
- 👤 Sean William Smith
- 👤 Steve Harris Weingart
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 12:49
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/33; G06F21/34; G06F21/70; G06F21/86; G06F21/87; H; H04; H04L; H04L9/00; H04L9/32; H04L9/3263; H04L9/3265; G06F2211/00; G06F2211/007; G06F2211/008
Claims Analysis
Total Claims: 38
Claim 1
Independent Claim
186 words
A device having an input and an output, said device comprising: a memory; a tamper circuit coupled to said memory and being responsive to a tampering phenomenon, such that a certifying authority can determine an occurrence of said phenomenon, said certifying authority having an authority public key known to said device; a key pair generator which generates a device key pair for said device, said device key pair includes a device private key and a device public key which are stored in said memory, said device key pair generator is capable of exporting said device public key via said output to said certifying authority such that said certifying authority is enabled to perform a verification that said device public key emerged from said device, and that said device was not attacked by said tampering phenomenon, and whereupon said verification being successful said certifying authority is able to certify that said device is in an untampered state, wherein said device key pair generator regenerates a new key pair in response to a predetermined event; and a transition certificate which certifies an authenticity of said new key pair.
Claim 2
Independent Claim
186 words
A device having an input and an output, said device comprising: a memory; a tamper circuit coupled to said memory and being responsive to a tampering phenomenon, such that a certifying authority can determine an occurrence of said phenomenon, said certifying authority having an authority public key known to said device; a key pair generator which generates a device key pair for said device, said device key pair includes a device private key and a device public key which are stored in said memory, said device key pair generator is capable of exporting said device public key via said output to said certifying authority such that said certifying authority is enabled to perform a verification that said device public key emerged from said device, and that said device was not attacked by said tampering phenomenon, and whereupon said verification being successful said certifying authority is able to certify that said device is in an untampered state, wherein said device key pair generator regenerates a new key pair in response to a predetermined event; and a transition certificate which certifies an authenticity of said new key pair.
Claim 3
Dependent Claim
69 words
A device as recited in claim 1 , wherein said untampered state is certified by said certifying authority by: signing a first certificate with said authority private key, said first certificate includes said device public key and at least one identifying property of said device; and issuing said first certificate which becomes available to a third party for use in establishing that said device is in said untampered state.
Claim 4
Dependent Claim
18 words
A device as recited in claim 1 , wherein said certifying authority is a manufacturer of said device.
Claim 5
Dependent Claim
22 words
A device as recited in claim 1 , wherein said device key pair is generated using an internal source of non-deterministic randomness.
Claim 6
Dependent Claim
32 words
A device as recited in claim 1 , further comprising a verifier for outputting a proof of its being in said untampered state, by exhibiting a knowledge of said device key pair.
Claim 7
Dependent Claim
25 words
A device as recited in claim 1 , wherein said device key pair generator regenerates a new key pair in response to a predetermined event.
Claim 8
Dependent Claim
29 words
A device as recited in claim 1 , wherein said device has a chain of transition certificates, and said transition certificate is added to said chain of transition certificates.
Claim 9
Dependent Claim
18 words
A device as recited in claim 6 , wherein said predetermined event is a reload of cryptographic software.
Claim 10
Dependent Claim
32 words
A device as recited in claim 1 , further comprising a zeroizing circuit capable of erasing a portion of said memory upon said tamper circuit detecting an occurrence of said tampering phenomenon.
Claim 11
Dependent Claim
18 words
A device as recited in claim 9 , wherein said memory includes all non-volatile memory in said device.
Claim 12
Dependent Claim
35 words
A device as recited in claim 1 , further comprising a recertifier for enabling said certifying authority to authenticate said untampered state, provide a recertification of said untampered state, and attest to said public key.
Claim 13
Dependent Claim
32 words
A device as recited in claim 11 , wherein said first certificate has a finite life, and said recertification is performed at predetermined intervals prior to an end of said finite life.
Claim 14
Dependent Claim
34 words
A device as recited in claim 1 , wherein said device uses said device private key to sign said transition certificate which asserts a change from said public key to a new public key.
Claim 15
Dependent Claim
15 words
A device as recited in claim 13 , wherein said device private key is erased.
Claim 16
Dependent Claim
28 words
An apparatus as recited in claim 13 , wherein said transition certificates are shown to be rooted in said first certificate so as to maintain said untampered state.
Claim 17
Dependent Claim
21 words
A device as recited in claim 15 , further comprising a recertifier for enabling said certifying authority to recertify said device.
Claim 18
Dependent Claim
28 words
A device as recited in claim 16 , wherein said recertifier authenticates said untampered state, provides a recertification of said untampered state, and attests to said public key.
Claim 19
Dependent Claim
27 words
A device as recited in claim 1 , wherein said tampering phenomenon is such as to cause the device to undergo an action that triggers tamper-response zeroization.
Claim 20
Independent Claim
149 words
A device having a memory which includes data required to be erased upon a tampering attempt, said device comprising: a tamper responsive circuit having an enabling capability; a certifying authority; an initialization circuit wherein said certifying authority enables said tamper responsive circuit using said enabling capability; a first key pair generator for generating a public key made available to a plurality of third party users, and for generating a private key retained in said memory; a certification circuit for exporting said public key to said certifying authority such as to enable said certifying authority to verify said public key, to certify that said public key emerged from said device, and to certify that said device is untampered; and a key pair regenerator for forming a new key pair, upon an occurrence of a predetermined event, where said key pair includes a new public key and a new private key.
Claim 21
Independent Claim
149 words
A device having a memory which includes data required to be erased upon a tampering attempt, said device comprising: a tamper responsive circuit having an enabling capability; a certifying authority; an initialization circuit wherein said certifying authority enables said tamper responsive circuit using said enabling capability; a first key pair generator for generating a public key made available to a plurality of third party users, and for generating a private key retained in said memory; a certification circuit for exporting said public key to said certifying authority such as to enable said certifying authority to verify said public key, to certify that said public key emerged from said device, and to certify that said device is untampered; and a key pair regenerator for forming a new key pair, upon an occurrence of a predetermined event, where said key pair includes a new public key and a new private key.
Claim 22
Dependent Claim
51 words
A device as in claim 19 , further comprises a recertifier for exporting said new public key to said certifying authority such as to enable said certifying authority to verify said new public key and certify that said new public key emerged from said device and that said device is untampered.
Claim 23
Dependent Claim
26 words
A device as in claim 19 , wherein at least a portion of said memory is zeroized upon said tamper responsive circuit detecting a tampering event.
Claim 24
Dependent Claim
25 words
A device as in claim 21 , wherein said device further comprises a memory disaster protection circuit for stopping an attacker from impersonating said device.
Claim 25
Dependent Claim
31 words
A device as in claim 21 , further comprising a re-initialization circuit for reinitializing said device to an operative state following said device being zeroized in response to said tampering event.
Claim 26
Dependent Claim
15 words
A device as in claim 21 , wherein said reinitialization circuit employs hidden symmetric keys.
Claim 27
Dependent Claim
33 words
A device as in claim 23 , wherein said certification circuit marks a particular data field in a certificate verifying said device, to indicate that said device was initialized in a substandard manner.
Claim 28
Independent Claim
154 words
A method for a certifying authority to certify an untampered state of a device, said method comprising: providing a tamper circuit being responsive to a tampering phenomenon; a certifying authority determining an occurrence of said phenomenon, said certifying authority having an authority public key known to said device; generating a device key pair for said device, said device key pair including a device private key and a device public key which are stored in said memory; exporting said device public key to said certifying authority; enabling said certifying authority to perform a verification that said device public key emerged from said device, and that said device was not attacked by said tampering phenomenon, and whereupon said verification being successful said certifying authority certifying that said device is in an untampered state; regenerating a new key pair in response to a predetermined event; and generating a transition certificate certifying authenticity of said new key pair.
Claim 29
Independent Claim
154 words
A method for a certifying authority to certify an untampered state of a device, said method comprising: providing a tamper circuit being responsive to a tampering phenomenon; a certifying authority determining an occurrence of said phenomenon, said certifying authority having an authority public key known to said device; generating a device key pair for said device, said device key pair including a device private key and a device public key which are stored in said memory; exporting said device public key to said certifying authority; enabling said certifying authority to perform a verification that said device public key emerged from said device, and that said device was not attacked by said tampering phenomenon, and whereupon said verification being successful said certifying authority certifying that said device is in an untampered state; regenerating a new key pair in response to a predetermined event; and generating a transition certificate certifying authenticity of said new key pair.
Claim 30
Dependent Claim
17 words
A method as in claim 26 , wherein said certifying authority is a manufacture of the device.
Claim 31
Dependent Claim
18 words
A method as in claim 26 , wherein said step of generating is performed internal to said device.
Claim 32
Dependent Claim
20 words
A method as in claim 28 , wherein said step of generating is performed by a random key pair generator.
Claim 33
Dependent Claim
27 words
A method as in claim 26 , further comprising ensuring that said device certificate is available to a user to whom the device wishes to be authenticated.
Claim 34
Dependent Claim
24 words
A method as in claim 30 , wherein said step of ensuring is implemented by the certifying authority sending said certificate to the device.
Claim 35
Dependent Claim
20 words
A method as in claim 31 , further comprising said device authenticating that said certificate came from said certifying authority.
Claim 36
Dependent Claim
20 words
A method as in claim 32 , wherein said step of authenticating is implemented using a secret key authenticating technique.
Claim 37
Independent Claim
185 words
A device having a memory which includes data required to be erased upon a tampering attempt, said device comprising: a tamper responsive circuit having an enabling capability; a certifying authority; an initialization circuit wherein said certifying authority enables said tamper responsive circuit using said enabling capability; a first key pair generator for generating a public key made available to a plurality of third party users, and for generating a private key retained in said memory; and a certification circuit for exporting said public key to said certifying authority such as to enable said certifying authority to verify said public key, to certify that said public key emerged from said device, and to certify that said device is untampered, wherein at least a portion of said memory is zeroized upon said tamper responsive circuit detecting a tampering event; a re-initialization circuit for reinitializing said device to an operative state following said device being zeroized in response to said tampering event, wherein said certification circuit marks a particular data field in a certificate verifying said device, to indicate that said device was initialized in a substandard manner.
Claim 38
Independent Claim
185 words
A device having a memory which includes data required to be erased upon a tampering attempt, said device comprising: a tamper responsive circuit having an enabling capability; a certifying authority; an initialization circuit wherein said certifying authority enables said tamper responsive circuit using said enabling capability; a first key pair generator for generating a public key made available to a plurality of third party users, and for generating a private key retained in said memory; and a certification circuit for exporting said public key to said certifying authority such as to enable said certifying authority to verify said public key, to certify that said public key emerged from said device, and to certify that said device is untampered, wherein at least a portion of said memory is zeroized upon said tamper responsive circuit detecting a tampering event; a re-initialization circuit for reinitializing said device to an operative state following said device being zeroized in response to said tampering event, wherein said certification circuit marks a particular data field in a certificate verifying said device, to indicate that said device was initialized in a substandard manner.
References Cited (Backward Citations)
US4218582A
Cited
US4860351A
Cited
US5159629A
Cited
US5689243A
Cited
US5233505A
Cited
US5557518A
Cited
US6088797A
Cited
US5805712A
Cited
US5799085A
Cited
US5774552A
Cited
US5781723A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-05-14 | 2004-11-13 | 2005-05-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-05-14 | 2008-11-13 | 2009-05-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-05-14 | 2012-11-13 | 2013-05-15 | $7700.00 | Window Closed / Lapsed |