# US 10,872,154 B2 · Secure device state apparatus and method and lifecycle management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,872,154 B2
- Document ID: US10872154B2
- Status: Granted
- Kind: B2
- Application number: 16/262,179
- Filed: 2019-01-30
- Published: 2019-05-30
- Granted: 2020-12-22
- Earliest claimed: 2016-12-30
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: Marius Schilder; Timothy Chen; Scott Johnson; Harrison Pham; Derek Martin
- Web page: https://patentgrep.com/patent/US10872154B2

## CPC

- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G01R 31/31719: {Security aspects, e.g. preventing unauthorised access during test}
- G01R 31/318588: {Security aspects}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/575: {Secure boot}
- G06F 21/73: by creating or determining hardware identification, e.g. serial numbers
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- G06F 21/75: by inhibiting the analysis of circuitry or operation
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G11C 7/24: Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
- G11C 16/22: Safety or protection circuits preventing unauthorised or accidental access to memory cells
- G11C 29/36: Data generation devices, e.g. data inverters
- G11C 29/40: using compression techniques
- G11C 29/46: Test trigger logic
- H04L 9/0822: {using key encryption key}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- G11C 17/14: in which contents are determined by selectively establishing, breaking or modifying connecting links by permanently altering the state of coupling elements, e.g. PROM
- G11C 17/18: Auxiliary circuits, e.g. for writing into memory
- G11C 2029/0401: {in embedded memories}
- G11C 2029/0403: {during or with feedback to manufacture}
- G11C 2029/4402: {Internal storage of test result, quality data, chip identification, repair information}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G01R: MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES (indicating correct tuning of resonant circuits H03J3/12)
- G11C: STATIC STORES (semiconductor memory devices H10B)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A semiconductor chip device include device state fuses that may be used to configure various device states and corresponding security levels for the semiconductor chip as it transitions from wafer manufacturing to provisioned device. The device states and security levels prevent the semiconductor chip from being accessed and exploited, for example, during manufacturing testing. A secure boot flow process for a semiconductor chip over its lifecycle is also disclosed. The secure boot flow may start at the wafer manufacturing stage and continue on through the insertion of keys and firmware.

## Claims

### Claim 1

A method of provisioning a semiconductor chip device, the method comprising:
determining that the semiconductor chip device is ready for provisioning based on a bit pattern stored in device fuses within the semiconductor chip device;
writing boot processing code to non-volatile memory of the semiconductor chip device;
verifying an authenticity of the boot processing code;
creating, using a certificate, a device initialization key for generating a plurality of provisioning keys;
disabling the certificate used to create the device initialization key for generating the provisioning keys by blowing device fuses associated with the certificate, the blowing of the device fuses associated with the certificate preventing an embedded processor of the semiconductor chip device or an external device from accessing the certificate or recreating the device initialization key;
exporting the device initialization key to a key management server;
deriving the provisioning keys using the device initialization key and the boot processing code;
proving identity to the key management server by providing a device ID and one of the provisioning keys;
decrypting provisioning data using another of the provisioning keys; and
verifying that the provisioning data is valid.

### Claim 2 (depends on 1)

The method of claim 1, wherein the non-volatile memory is flash memory.

### Claim 3 (depends on 1)

The method of claim 1, wherein the device initialization key is stored in a firmware readable register.

### Claim 4 (depends on 1)

The method of claim 1, wherein the provisioning data includes application-specific flash firmware; and
wherein the method further comprises allowing, by the boot processing code, storage of the application-specific flash firmware in the non-volatile memory.

### Claim 5 (depends on 1)

The method of claim 1, wherein the certificate is contained within the boot processing code.

### Claim 6 (depends on 1)

The method of claim 1, further comprising, responsive to determining that the bit pattern corresponds to an unknown pattern, locking the semiconductor device such that ports and memory of the device are permanently disabled.

### Claim 7 (depends on 1)

The method of claim 1, wherein the boot processing code and the provisioning data are received via a serial peripheral interface.

### Claim 8 (depends on 1)

The method of claim 1, wherein the one of the provisioning keys is a device attestation key.

### Claim 9 (depends on 8)

The method of claim 8, wherein the identity is proven by providing the device ID and the device attestation key to the key-management server and receiving confirmation from the key-management server.

### Claim 10 (depends on 1)

The method of claim 1, wherein the device ID is stored within the device fuses.

### Claim 11 (depends on 1)

The method of claim 1, wherein the provisioning keys are derived by a security coprocessor.

### Claim 12

A semiconductor chip device, comprising:
device fuses;
a non-volatile memory;
a processor;
a storage device storing instructions, when executed by the processor, cause the semiconductor chip device to:
determine that the semiconductor chip device is ready for provisioning based on a bit pattern stored in the device fuses;
write boot processing code to the non-volatile memory;
verify an authenticity of the boot processing code;
create, using a certificate, a device initialization key for generating a plurality of provisioning keys;
disable the certificate used to create the device initialization key for generating the provisioning keys by blowing device fuses associated with the certificate, the blowing of the device fuses associated with the certificate preventing the processor or an external device from accessing the certificate or recreating the device initialization key;
export the device initialization key to a key management server;
derive the provisioning keys using the device initialization key and the boot processing code;
prove identity to the key management server by providing a device ID and one of the provisioning keys;
decrypt provisioning data using another of the provisioning keys; and
verify that the provisioning data is valid.

### Claim 13 (depends on 12)

The semiconductor chip device of claim 12, wherein the non-volatile memory is a flash memory.

### Claim 14 (depends on 12)

The semiconductor chip device of claim 12, wherein the device ID is maintained in the device fuses.

### Claim 15 (depends on 12)

The semiconductor chip device of claim 12, wherein the provisioning data includes application-specific flash firmware and the boot processing code allows storage of the application-specific flash firmware in the non-volatile memory.

### Claim 16 (depends on 12)

The semiconductor chip device of claim 12, wherein the boot processing code is a boot loader.

### Claim 17 (depends on 12)

The semiconductor chip device of claim 12, wherein the identity is proven by providing the device ID and a device attestation key to the key-management server and receiving confirmation from the key management server.

### Claim 18 (depends on 12)

The semiconductor chip device of claim 12, wherein the processor is further configured to, responsive to detecting an unknown pattern of the device fuses, lock the semiconductor chip device such that ports and memory of the semiconductor chip device are inaccessible.

### Claim 19 (depends on 12)

The semiconductor chip device of claim 12, wherein the bit pattern is spread across fuse-macros of the semiconductor chip device.

### Claim 20 (depends on 12)

The semiconductor chip device of claim 12, further comprising a security coprocessor, wherein the provisioning keys are derived by the security coprocessor.