Methods, apparatus and system for authenticating a programmable hardware device and for authenticating commands received in the programmable hardware device from a secure processor

A method for authenticating a programmable hardware chip, wherein the programmable hardware chip has a verification key stored therein, comprising the steps of:

• generating a random number by a secure processor, wherein the secure processor has stored therein the verification key stored in the programmable hardware chip;
• transmitting by the secure processor a copy of a random number to the programmable hardware chip, wherein the programmable hardware chip is configured to process the random number received thereby using the verification key embedded therein to generate a first result;
• receiving by the secure processor the first result from the programmable hardware chip;
• processing by the secure processor the random number generated thereby using the verification key stored therein to generate a second result;
• and
• comparing by the secure processor the second result generated by the secure processor and the first result received from the programmable hardware chip,
• wherein, when the logic in the programmable hardware chip has not been modified since the verification key was stored therein and prior to the programmable hardware chip generating the first result, the first result will be the same as the second result and the programmable hardware chip is authenticated, and
• wherein, when the logic in the programmable hardware chip has been modified since the verification key was stored therein and prior to the programmable hardware chip generating the first result, the first result will not be the same as the second result and the programmable hardware chip is not authenticated,
• wherein the secure processor has a command authentication key stored therein, wherein the programmable hardware chip has stored therein the command authentication key stored in the secure processor, and wherein the method further comprises the steps of:
• generating by the secure processor a command verification token using the second result, the verification key and the command authentication key;
• transmitting by the secure processor the command verification token to the programmable hardware chip,
• wherein the programmable hardware chip is configured to generate a command verification result using the first result, the verification key stored therein and the command authentication key stored therein,
• wherein, when the command verification result is the same as the command verification token, the programmable hardware chip authenticates the command verification token and executes a command associated with the command authentication key and received by the programmable hardware chip, and
• wherein, when the command verification result is not the same as the command verification token, the programmable hardware chip does not authenticate the command authentication key and does not execute the command associated with the command authentication key and received by the programmable hardware chip.

A non-transitory computer readable medium storing the instructions that, when executed on a programmed processor, carry out a method for authenticating a programmable hardware chip, wherein the programmable hardware chip has a verification key stored therein, comprising:

• instructions for generating by the secure processor a copy of the random number to the programmable hardware chip, wherein the programmable hardware chip is configured to process the random number using the verification key stored therein to generate a first result;
• instructions for receiving by the secure processor the first result from the programmable hardware chip;
• instructions for processing by the secure processor the random number generated thereby using the verification key stored therein to generate a second result;
• instructions for generating by the secure processor the verification key stored therein, and further comprising instructions for transmitting the generated verification key to a host device configured to embed the verification key into an image and program the image into the programmable hardware chip in such a way that the verification key is embedded in the programmable hardware chip;
• and
• instructions for comparing by the secure processor the second result generated by the secure processor and the first result received from the programmable hardware chip,
• wherein, when the logic in the programmable hardware chip has not been modified since the verification key was stored therein and prior to the programmable hardware chip generating the first result, the first result will be the same as the second result and the programmable hardware chip is authenticated, and
• wherein, when the logic in the programmable hardware chip has been modified since the verification key was stored therein and prior to the programmable hardware chip generating the first result, the first result will not be the same as the second result and the programmable hardware chip is not authenticated,
• wherein the secure processor has a command authentication key stored therein, wherein the programmable hardware chip has stored therein the command authentication key stored in the secure processor, further comprising:
• instructions for generating by the secure processor a command verification token using the second result, the verification key and the command authentication key;
• instructions for transmitting by the secure processor the command verification token to the programmable hardware chip,
• wherein the programmable hardware chip is configured to generate a command verification result using the first result, the verification key stored therein and the command authentication key stored therein,
• wherein the programmable hardware chip is configured to compare the command verification token and the command verification result,
• wherein, when the command verification result is the same as the command verification token, the programmable hardware chip authenticates the command verification token and executes a command associated with the command authentication key and received by the programmable hardware chip, and
• wherein, when the command verification result is not the same as the command verification token, the programmable hardware chip does not authenticate the command authentication key and does not execute a command associated with the command authentication key and received by the programmable hardware chip.