# US 12,602,469 B2 · Fuse based replay protection with aggressive fuse usage and countermeasures for fuse voltage cut attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,602,469 B2
- Document ID: US12602469B2
- Status: Granted
- Kind: B2
- Application number: 18/512,149
- Filed: 2023-11-17
- Published: 2024-06-13
- Granted: 2026-04-14
- Earliest claimed: 2021-03-31
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Ling Tony Chen; Felix Domke; Ankur Choudhary; Bradley Joseph Litterell
- Web page: https://patentgrep.com/patent/US12602469B2

## CPC

- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2135: Metering
- G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A TPM with programmable fuses in an SOC includes an on-die RAM storing a blown-fuse count and a TPM state including a PIN-attempt-failure count and a fuse count, read from off-die NV memory. During initialization, if the blown-fuse count is greater than TPM state fuse count, TPM state PIN-attempt-failure count is incremented, thereby thwarting a replay attack. A PIN is received for access, and if the TPM state PIN-attempt-failure count satisfies a policy, a fuse is blown and the blown-fuse count incremented. If the fuse blow fails, TPM activity is halted. If the fuse blow succeeds and the PIN is correct, the TPM state PIN-attempt-failure count is cleared, but if the PIN is incorrect the TPM state PIN-attempt-failure count is incremented. TPM state fuse count is set equal to the blown-fuse count, and the TPM state is saved to off-die NV memory.

## Claims

### Claim 1

A system on a chip (SOC) comprising:
a processor;
memory comprising executable instructions that, when executed, perform operations comprising:
accessing a trusted platform module (TPM) implemented in the SOC, the TPM comprising an on-die random access memory (RAM) storing:
a blown-fuse count comprising a count of blown fuses; and
a TPM state comprising:
a TPM state fuse count; and
a TPM state personal identification number (PIN)-attempt-failure count;
receiving a PIN in an attempt to access a system protected by the TPM;
determining the TPM state PIN-attempt-failure count for the PIN satisfies a PIN-attempt-failure count policy;
attempting to blow a fuse of the TPM based on the PIN satisfying the PIN-attempt-failure count policy, wherein attempting to blow the fuse comprises attempting to increase a magnitude of a voltage level provided to the fuse beyond a threshold value; and
in response to an unsuccessful attempt to blow the fuse of the TPM, halting activity of the TPM.

### Claim 2 (depends on 1)

The SOC of claim 1, the operations further comprising:
prior to receiving the PIN, reading a non-volatile (NV) state from an off-die NV memory;
writing the NV state into the TPM state; and
determining whether the blown-fuse count is greater than the TPM state fuse count.

### Claim 3 (depends on 1)

The SOC of claim 1, wherein halting activity of the TPM comprises placing the TPM into a failure state, the failure state preventing additional PIN attempts from being processed by the TPM.

### Claim 4 (depends on 1)

The SOC of claim 1, wherein the unsuccessful attempt to blow the fuse of the TPM indicates a fuse voltage cut attack has occurred.

### Claim 5 (depends on 1)

The SOC of claim 1, the operations further comprising:
prior to receiving the PIN, initializing the TPM, wherein initializing the TPM comprises:
reading non-volatile (NV) state from an off-die NV memory, the NV state corresponding to the TPM state; and
writing the NV state into the TPM state.

### Claim 6 (depends on 5)

The SOC of claim 5, the operations further comprising:
in response to initializing the TPM, incrementing the TPM state PIN-attempt-failure count based on the blown-fuse count being greater than the TPM state fuse count.

### Claim 7 (depends on 6)

The SOC of claim 6, wherein incrementing the TPM state PIN-attempt-failure count comprises:
incrementing the TPM state PIN-attempt-failure count based on a value representing a difference between the blown-fuse count and the TPM state fuse count.

### Claim 8 (depends on 1)

The SOC of claim 1, wherein the TPM state further comprises a TPM state PIN-key table populated with stored PINs authorized to access the system protected by the TPM.

### Claim 9 (depends on 8)

The SOC of claim 8, wherein the TPM state PIN-key table is further populated with respective cryptographic keys that are released when a correct PIN is entered.

### Claim 10

A method implemented in a system on a chip (SOC), the method comprising:
accessing a trusted platform module (TPM) implemented in the SOC, the TPM comprising an on-die random access memory (RAM) storing:
a blown-fuse count comprising a count of blown fuses; and
a TPM state comprising:
a TPM state fuse count; and
a TPM state personal identification number (PIN)-attempt-failure count;
receiving a PIN in an attempt to access a system protected by the TPM;
determining the TPM state PIN-attempt-failure count for the PIN satisfies a PIN-attempt-failure count policy;
attempting to blow a fuse of the TPM based on the PIN satisfying the PIN-attempt-failure count policy, wherein attempting to blow the fuse comprises attempting to increase a magnitude of a voltage level provided to the fuse beyond a threshold value; and
in response to an unsuccessful attempt to blow the fuse of the TPM, halting activity of the TPM.

### Claim 11 (depends on 10)

The method of claim 10, wherein halting activity of the TPM comprises preventing additional PIN attempts from being processed by the TPM.

### Claim 12 (depends on 10)

The method of claim 10, wherein incrementing the TPM state PIN-attempt-failure count comprises:
incrementing the TPM state PIN-attempt-failure count one unit.

### Claim 13 (depends on 10)

The method of claim 10, further comprising:
updating a non-volatile (NV) state of an off-die NV memory by saving the TPM state to the off-die NV memory.

### Claim 14 (depends on 13)

The method of claim 13, wherein the NV state comprises:
an NV state fuse count; and
an NV state PIN-attempt-failure count.

### Claim 15 (depends on 14)

The method of claim 14, wherein saving the TPM state to the off-die NV memory comprises:
saving the TPM state fuse count as the NV state fuse count; and
saving the TPM state PIN-attempt-failure count as the NV state PIN-attempt-failure count.

### Claim 16 (depends on 10)

The method of claim 10, wherein the TPM state further comprises a TPM state PIN-key table populated with stored PINs authorized to access the system protected by the TPM.

### Claim 17 (depends on 16)

The method of claim 16, wherein the TPM state PIN-key table is further populated with a cryptographic key for each of the stored PINs.

### Claim 18

A first system comprising:
a processor;
memory comprising executable instructions that, when executed, perform operations comprising:
accessing a trusted platform module (TPM) implemented by the first system, the TPM storing:
a blown-fuse count comprising a count of blown fuses; and
a TPM state comprising:
a TPM state fuse count; and
a TPM state personal identification number (PIN)-attempt-failure count;
receiving a PIN in an attempt to access a second system protected by the TPM;
determining the TPM state PIN-attempt-failure count for the PIN satisfies a PIN-attempt-failure count policy;
attempting to blow a fuse of the TPM based on the PIN satisfying the PIN-attempt-failure count policy, wherein attempting to blow the fuse comprises attempting to increase a magnitude of a voltage level provided to the fuse beyond a threshold value; and
in response to an unsuccessful attempt to blow the fuse of the TPM, halting activity of the TPM.

### Claim 19 (depends on 18)

The first system of claim 18, the operations further comprising:
prior to receiving the PIN, reading a non-volatile (NV) state from an off-die NV memory;
writing the NV state into the TPM state; and
determining whether the blown-fuse count is greater than the TPM state fuse count.

### Claim 20 (depends on 18)

The first system of claim 18, wherein halting activity of the TPM comprises placing the TPM into a failure state preventing additional PIN attempts from being processed by the TPM.