A method of performing an initial authentication process of a board assembly, the method comprising:
- obtaining information regarding authentic and unique codes of devices delivered to populate the board assembly, wherein one or more of the devices are configured with:
- a scan or boundary scan component adapted to shift in and shift out test scans of device circuitry,
- a unique code adapted to uniquely identify the device,
- an interrogation code component adapted to interact with interrogation information applied to the device,
- a unique hidden seed element used in a signature generation process for the device and hardcoded into the device, wherein the hidden seed is of unique value per device of a given type, unreadable via test/scan procedures and initially known only to an IC fabricator that fabricated the device, and the hidden seed is unrelated to the unique code and is unrelated to the interrogation information, and
- a signature encryption component that provides an output signature code that is unique to the device, for a given interrogation, as a function of algorithmic interaction with at least both of the hidden seed and the interrogation information, wherein the hidden seed is not discernable from the output signature code;
- verifying that the delivered devices are authentic devices;
- performing an initial authentication process that utilizes information regarding the authentic and unique codes and/or known associated positions of devices delivered to populate the board assembly to obtain a reference record of the completed scannable board assembly;
- storing or processing the reference record for later use;
- communicating with an entity that wishes to test the board assembly, including provision of the reference record for comparison against new test/scan information regarding the board assembly to re-authenticate the board assembly;
- and
- verifying that the devices are authentic via application of a signature generation process including an interrogation code to the one or more devices as part of the initial authentication process and/or the re-authentication process, wherein the output signature code provided by the signature generation process cannot be practically replicated even with knowledge of the interrogation code, the encryption algorithm or ECID information.