TWI876643B - Method of operating secure programming system, computer readable recording medium and secure programming system using the same - Google Patents

Abstract

A method is disclosed. The method comprises: retrieving a payload from a work control packet; calculating a first verification code from the payload; after the payload is burned into a programmable device, reading the burned payload to calculate a second verification code; of the first verification code and the second verification code are verified successfully, performing a burning task; generating an OEM certificate signing request according to an identifiable information and a programmable device public key; if the OEM certificate signing request is verified successfully, generating an OEM device certificate; signing the OEM device certificate with an OEM private key; verifying the OEM device certificate by an OEM public key; if the OEM device certificate and the OEM public key are verified successfully, generating a third verification code from the OEM device certificate; burning the OEM device certificate into the programmable device; calculating a fourth verification code from the burned OEM device certificate; verifying the third verification code and the fourth verification code; classifying the programmable devices according to the verification results.

Description

Method for operating a secure programming system, computer-readable recording medium and secure programming system applicable thereto

This case belongs to the technical field of secure programming systems, and in particular refers to a method for operating a secure programming system and a computer-readable recording medium and secure programming system applicable thereto.

In the existing burning operation and process, in addition to the fact that the burned data is all in plain text and not encrypted, when burning this data into the integrated circuit, because the integrated circuit also does not have any encryption protection or identity verification process, unauthorized devices can operate or control the integrated circuit. What's worse, it may also allow unauthorized personnel to analyze, tamper, leak and plagiarize the burned data in the integrated circuit.

Therefore, how to develop a method for operating a secure programming system and a computer-readable recording medium and secure programming system applicable thereto is an urgent issue to be addressed in this field.

This case is a method for operating a secure programming system and a computer-readable recording medium and secure programming system applicable thereto. The method can ensure that the burned data can only be read by a device that holds a corresponding paired public key or private key and has passed timely identity verification during the burning process, so as to prevent the burned data from being tampered with, damaged, leaked, and plagiarized. In addition, the method of this case allows only devices that have passed identity verification to operate/control the firmware program in the securely burned integrated circuit.

To achieve the above-mentioned object, one embodiment of the present invention provides a method for operating a secure programming system, wherein the secure programming system includes a programmer, a programming unit, an authentication module, and a security module, and the method includes: S1. The programmer uses a security control unit key to decrypt an encrypted work control packet to extract a payload; S2. The programmer generates a first verification code calculated from the payload; S3. The programmer burns the payload into a programmable device; S4. After the payload is burned into the programmable device, the programmer reads the burned payload to calculate a second verification code; S5. The programmer verifies the first verification code and the second verification code, and when the verification is successful, performs a burning operation; S6. When the burning operation is executed, the programming unit generates an OEM certificate signing request using the identifiable information in the programmable device and the programmable device public key; S7. The authentication module verifies the OEM certificate signing request using the hash value, and generates an OEM device certificate when the verification is successful; S8. The security module signs the OEM device certificate using the OEM private key; S9. The programming unit verifies the OEM device certificate using the OEM public key; S10. When the verification result of step S9 is correct, the programmer generates a third verification code calculated from the OEM device certificate; S11. The programmer burns the OEM device certificate to the programmable device; S12. The programmer reads the burned OEM device certificate to calculate the fourth verification code; S13. The programmer verifies the third verification code and the fourth verification code; and S14. The programming unit classifies the programmable device according to the verification result of step S13, wherein when the verification result is successful, the programmable device is classified into a first output container defined as good.

To achieve the above-mentioned purpose, another embodiment of the present invention is to provide a computer-readable recording medium, storing at least one sequence of instructions, the at least one sequence of instructions being executed by at least one processor, and the computer-readable recording medium being applied to a secure programming system, the secure programming system comprising a programmer, a programming unit, an authentication module and a security module, the at least one sequence of instructions comprising the following: S1. The programmer decrypts the encrypted work control packet using a security control unit key to extract a payload; S2. The programmer generates a first verification code calculated from the payload; S3. The programmer burns the payload into a programmable device; S4. After the payload is burned into the programmable device, the programmer reads the burned payload to calculate the second verification code; S5. The programmer verifies the first verification code and the second verification code, and when the verification succeeds, executes the burning operation; S6. When the burning operation is executed, the programming unit generates an OEM certificate signing request using the identifiable information in the programmable device and the programmable device public key; S7. The authentication module verifies the OEM certificate signing request using the hash value, and generates an OEM device certificate when the verification succeeds; S8. The security module signs the OEM device certificate using the OEM private key; S9. The programming unit verifies the OEM device certificate using the OEM public key; S10. When the verification result of step S9 is correct, a third verification code calculated by the OEM device certificate is generated; S11. The programmer burns the OEM device certificate to the programmable device; S12. The programmer reads the burned OEM device certificate to calculate the fourth verification code; S13. The programmer verifies the third verification code and the fourth verification code; and S14. The programming unit classifies the programmable device according to the verification result of step S13, wherein when the verification result is successful, the programmable device is classified into the first output container defined as good.

To achieve the above-mentioned purpose, another embodiment of the present invention is to provide a secure programming system, including: a programmer, using a security control unit key to decrypt an encrypted work control packet to extract a payload, and generate a first verification code calculated by the payload, and burn the payload to a programmable device, and after the payload is burned to the programmable device, the programmer reads the burned payload to calculate a second verification code and verify the first verification code. The programmable device is configured to receive the OEM certificate and the second verification code, and when the verification succeeds, the programmable device is configured to perform a burning operation, and when the burning operation is performed, the identifiable information and the programmable device public key in the programmable device are read and transmitted to the programming unit, so that the programming unit generates an OEM certificate signing request; the authentication module is connected to the security module, the authentication module uses the hash value to verify the OEM certificate signing request, and when the verification succeeds, the OEM device certificate is generated and transmitted to the security module, wherein the security module The module is configured to sign the OEM device certificate to generate a signed OEM device certificate; and the programming unit is connected to the programmer to verify the OEM device certificate using the OEM public key and transmit the OEM device certificate to the programmer when the verification is successful, wherein the programmer is configured to program the OEM device certificate and the valid load into the programmable device; wherein when the programming unit successfully verifies the OEM device certificate using the OEM public key, the programmer The programmer generates a third verification code calculated by the OEM device certificate, and the programmer burns the OEM device certificate to the programmable device, and the programmer reads the burned OEM device certificate to calculate a fourth verification code, and verifies the third verification code and the fourth verification code, and the programming unit classifies the programmable device according to the verification results of the third verification code and the fourth verification code, wherein when the verification result is successful, the programmable device is classified into a first output container defined as good.

Some typical embodiments that embody the features and advantages of the present invention will be described in detail in the following description. It should be understood that the present invention can have various variations in different aspects without departing from the scope of the present invention, and the descriptions and diagrams therein are essentially for illustrative purposes, rather than for limiting the present invention.

Please refer to Figures 1A, 1B and 2, wherein Figures 1A and 1B are step flow charts of the method for operating a security programming system of a preferred embodiment of the present invention, and Figure 2 is a structural schematic diagram of the security programming system operated by the method shown in Figures 1A and 1B. As shown in FIGS. 1A, 1B and 2, the method of the present invention may be applied to a secure programming system 1, wherein the secure programming system 1 may communicate with an original equipment manufacturer (OEM) device 9, the secure programming system 1 may individually encrypt a target payload of data and code, and then program the information into each programmable device 8, wherein the programmable device 8 may include an integrated circuit, a memory chip, a circuit board, or an electronic device, such as a smart phone, a media player, or other consumer and industrial electronic devices, and the programmable device 8 includes a secure storage unit 80. The secure programming system 1 may create a customized payload package that can only be decrypted by a system or device with the correct security key.

The secure programming system 1 includes a programmer 2, an authentication module 3, a programming unit 4, a security module (Hardware Security Module; HSM) 5 and a security control unit 6. The programmer 2 can be an electric machine system for physically programming a programmable device 8. The authentication module 3 can authenticate one or more properties of one of the programmable devices 8. The authentication module 3 is connected to the security module 5. The security control unit 6 is a computing device for processing secure information, and may include specific cryptographic techniques and computing hardware to facilitate the processing of cryptographic information. For example, the security control unit 6 may include a quantum computer, a parallel computing circuit system, a field programmable gate array (FPGA) configured to process secure information, a co-processor, an array logic unit, a microprocessor, or a combination thereof. In addition, the security control unit 6 may be a security device specially configured to prevent unauthorized access to security information at the input, intermediate, or final stages of processing the security information.

The method of this embodiment comprises the following steps.

In step S1, the programmer 2 uses the security control unit key to decrypt the encrypted work control packet to extract the payload. In some embodiments, the programmer 2 can use the security control unit key to decrypt the encrypted work control packet to extract the payload.

In some embodiments, step S1 may actually include the following steps.

First, the security control unit 6 generates a matching security module public key (HSM Pb.key) and a security module private key (HSM Pr.key) in the security module 5 using an asymmetric encryption algorithm, and sets a production count that can be used for the corresponding security module public key. The security module public key can be output by the security control unit 6 to be provided to the original equipment manufacturer device 9, while the security module private key is stored in the security module 5.

Next, the programming unit 4 takes out the unique serial number from one or more programmers 2, and integrates the one or more unique serial numbers into an identification list and transmits it to the OEM device 9.

Next, the OEM device 9 generates a matching OEM public key and OEM private key using an asymmetric encryption algorithm.

Next, the OEM device 9 puts the identification list and valid load of the programmer 2 into the work control packet, and encrypts the work control packet through the security control unit key randomly generated by the security control unit 6. It also loads the security module public key and encrypts the security control unit key and the OEM private key respectively. Finally, the encrypted work control packet, the encrypted security control unit key, the encrypted OEM private key, the OEM public key, the authentication list and the security module public key are transmitted to the programming unit 4.

Next, the programming unit 4 reads the device identification code of the programmable device 8 through the programmer 2 and verifies the device identification code according to the authentication list.

Then, when the device identification code is successfully verified according to the authentication list, the programming unit 4 transmits the security module public key to the security module 5 and requests the security module 5 to provide the corresponding usable production count, and the security module 5 returns the usable production count to the programming unit 4.

Then, the programming unit 4 determines whether to continue the burning operation based on the available production count. If the available production count is 0, the burning operation is terminated; on the contrary, if the available production count is not 0, the programming unit 4 first deducts more than one time as the pre-withheld production count, but when the pre-withheld production count exceeds the available production count, the programming unit 4 uses the upper limit of the available production count as the pre-withheld production count, and stores the pre-withheld production count in the programming unit 4. At the same time, the programming unit 4 transmits the remaining available production count after deducting the pre-withheld production count to the security module 5 for storage. In other words, the programming unit 4 is set to confirm the stored production count, and drive the programmer 2 to perform the burning operation when the number of burn times of the programmer 2 is less than the production count. On the contrary, when the number of burn times of the programmer 2 is more than the production count, the programming unit 4 will still drive the programmer 2 to perform the burning operation, but the number of burn times of the programmer 2 will only reach the upper limit of the available production count.

Then, the programming unit 4 transmits the encrypted work control packet to the programmer 2 and stores it in the random access memory (not shown) of the programmer 2, and then immediately erases the encrypted work control packet in the programming unit 4.

Then, the programming unit 4 transmits the encrypted security control unit key, the encrypted OEM private key and the security module public key to the security module 5 for decryption. The security module 5 stores the decrypted OEM private key. Then, after receiving the decrypted security control unit key sent back by the security module 5, the programming unit 4 transmits it to the random access memory of the programmer 2 to decrypt the encrypted work control packet. Finally, the programmer 2 first takes out the effective load from the decrypted work control packet, and then takes out the identification list of the programmer 2 and matches it with its own serial number. If its own serial number is not included in the identification list, the burning operation is terminated. If its own serial number is included in the identification list, the burning operation continues.

After step S1, the method of the present invention further comprises: step S2, the programmer 2 generates a first verification code calculated from the effective load. To further explain, the programmer 2 first calculates the first verification code using the effective load in the decrypted work control packet temporarily stored in the random access memory, and temporarily stores the first verification code in the random access memory.

In step S3, the programmer 2 burns the valid load into the programmable device 8.

In step S4, after the effective load is burned into the programmable device 8, the programmer 2 calculates the second verification code according to the burned effective load.

In step S5, the programmer 2 verifies the first verification code and the second verification code, and when the verification succeeds, performs the burning operation. In steps S4 and S5, the programmer 2 reads the effective load that has been burned into the programmable device 8 to calculate the second verification code, and verifies it with the first verification code temporarily stored in the random access memory, and the programmer 2 transmits the verification result to the programming unit 4, and the programmer 2 immediately erases the read effective load and the second verification code.

In step S6, when the burning operation is executed, the programming unit 4 uses the identifiable information in the programmable device 8 and the programmable device public key to generate an OEM certificate signing request.

In some embodiments, step S6 may actually include the following steps.

First, the programmer 2 reads the identification information and the programmable device public key in the programmable device 8 and transmits them to the programming unit 4. Then, the programming unit 4 generates an OEM certificate signing request using the identification information and the programmable device public key.

After step S6, the method of the present invention further comprises: step S7, the authentication module verifies the OEM certificate signing request using the hash value, and generates an OEM device certificate when the verification is successful. In some embodiments, the authentication module 3 verifies the OEM certificate signing request using the hash value, and generates an OEM device certificate when the verification is successful and transmits it to the security module 5. The security module is configured to sign the OEM device certificate to generate a signed OEM device certificate.

In some embodiments, step S7 may actually include the following steps.

The programming unit 4 generates a hash value using the OEM certificate signing request, and the hash value is transmitted to the programmable device 8 via the programmer 2. After receiving the hash value, the programmable device 8 signs it using the programmable device private key, and then transmits the signed hash value to the programming unit 4 via the programmer 2. Then, the programming unit 4 transmits the signed hash value and the OEM certificate signing request to the authentication module 3. Then, the authentication module verifies whether the signed hash value matches the OEM certificate signing request. When the verification result matches, an OEM device certificate is generated and transmitted to the security module 5.

After step S7, the method of the present invention further comprises: step S8, the security module signs the OEM device certificate with the OEM private key. In some embodiments, in step S8, upon receiving the OEM device certificate, the security module 5 signs the certificate with the OEM private key stored therein, and transmits the signed OEM device certificate to the programming unit 4 via the authentication module 3.

In step S9, the programming unit 4 verifies the OEM device certificate using the OEM public key. In some embodiments, the programming unit 4 verifies the OEM device certificate using the OEM public key and transmits the OEM device certificate to the programmer 2 after the verification is correct.

In step S10, the programmer generates a third verification code calculated from the OEM device certificate when the verification result of step S9 is correct. In some embodiments, the programmer 2 calculates the third verification code using the received OEM device certificate and temporarily stores the verification code in the random access memory.

In step S11, the programmer burns the OEM device certificate to the programmable device 8.

In step S12, the programmer 2 reads the burned OEM device certificate to calculate the fourth verification code. In some embodiments, the programmer 2 reads the OEM device certificate burned into the programmable device 8 to calculate the fourth verification code.

Step S13, verifying the third verification code and the fourth verification code. In some embodiments, the programmer 2 verifies the third verification code and the fourth verification code temporarily stored in the random access memory. In addition, when the third verification code and the fourth verification code are verified, the programmer 2 immediately erases the fourth verification code and the OEM device certificate read out.

In step S14, the programmable device 8 is classified according to the verification result of step S13, wherein when the verification result is successful, the programmable device 8 is classified into a first output container defined as good.

In some embodiments, step S1 further includes: retrieving the payload from the secure storage unit 80. In some embodiments, step S1 further includes: retrieving the OEM device certificate from the secure storage unit 80 of the programmable device 8.

In other embodiments, step S14 further includes: using a device transfer unit (not shown) to transfer the programmable device 8 to the first output container. The device transfer unit may be, but is not limited to, a robot arm of an automated device.

In addition, in other embodiments, the method of the present invention may further include steps S15 and S16, which are executed before step S1, wherein step S15 is: generating a work control packet, the work control packet is attached with a programmer identification list, and the programmer identification list records at least one programmer 2 that can be burned. Step S16 is: using at least one programmer 2 recorded in the programmer identification list to program the valid load in the work control packet into the programmable device 8.

In some embodiments, step S14 further includes: When the verification result is a failure, classifying the programmable device 8 into a second output container defined as bad. In some embodiments, the first output container and the second output container are different carrier trays.

In other embodiments, the method of the present invention may further include step S17: configuring the programmer 2 to program the encrypted valid load to the programmable device 8.

In some embodiments, the programming unit 4 is connected to the programmer 2 to verify the OEM device certificate using the OEM public key, and transmit the OEM device certificate to the programmer 2 when the verification is successful, wherein the programmer 2 is configured to program the OEM device certificate and the valid load into the programmable device 8.

In some embodiments, the method shown in Figures 1A and 1B may be stored in a computer-readable recording medium, and the computer-readable recording medium may store at least one sequence of software instructions, the sequence of software instructions may include the method shown in Figures 1A and 1B, and the sequence of software instructions may be executed by one or more processors (not shown). In some embodiments, the computer-readable recording medium may include non-volatile media and/or volatile media. Non-volatile media include, for example, optical disks or magnetic disks. Volatile media include dynamic memory, such as main memory. Common forms of computer-readable recording media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, magnetic tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a hole pattern, RAM, PROM, and EPROM, FLASH-EPROM, NVRAM, any other memory chip or cartridge.

In summary, the present invention provides a method for operating a secure programming system and a computer-readable recording medium and a secure programming system applicable thereto, thereby ensuring that the burned data can only be read by a device that holds a corresponding paired public key or private key and has passed timely identity verification during the burning process, so as to prevent the burned data from being tampered with, damaged, leaked, and plagiarized. In addition, the method for operating a secure programming system and a computer-readable recording medium and a secure programming system applicable thereto in the present invention allow only a device that has passed identity verification to operate/control the firmware program in the securely burned integrated circuit.

1: Safety programming system 9: OEM device 2: Programmer 3: Authentication module 4: Programming unit 5: Security module 6: Safety control unit 8: Programmable device 80: Safety storage unit S1~S14: Safety burning method

Figures 1A and 1B are step flow charts of the method for operating a safety programming system in a preferred embodiment of the present invention; Figure 2 is a structural schematic diagram of the safety programming system operated by the method shown in Figures 1A and 1B.

S1~S14: Methods of operating a safety programming system

Claims (24)

A method for operating a secure programming system, the secure programming system comprising a programmer, a programming unit, an authentication module and a security module, the method comprising: S1. The programmer uses a security control unit key to decrypt an encrypted work control packet to extract a valid load; S2. The programmer generates a first verification code calculated by the valid load; S3. The programmer burns the valid load to a programmable device; S4. After the valid load is burned to the programmable device, the programmer reads the burned valid load to calculate a second verification code; S5. The programmer verifies the first verification code and the second verification code, and when the verification is successful, executes a burning operation; S6. When the burning operation is executed, the programming unit generates an OEM certificate signing request using an identifiable information in the programmable device and a programmable device public key; S7. The authentication module verifies the OEM certificate signing request using a hash value, and generates an OEM device certificate when the verification is successful; S8. The security module signs the OEM device certificate with an OEM private key; S9. The programming unit verifies the OEM device certificate using an OEM public key; S10. When the verification result of step S9 is correct, the programmer generates a third verification code calculated from the OEM device certificate; S11. The programmer burns the OEM device certificate to the programmable device; S12. The programmer reads the burned OEM device certificate to calculate a fourth verification code; S13. The programmer verifies the third verification code and the fourth verification code; and S14. The programming unit classifies the programmable device according to the verification result of step S13, wherein when the verification result is successful, the programmable device is classified into a first output container defined as good. The method as claimed in claim 1, wherein the step S1 comprises: Retrieving the effective load from a secure storage unit of the programmable device. The method as claimed in claim 1, wherein the step S12 comprises: Retrieving the OEM device certificate from a secure storage unit of the programmable device. The method as described in claim 1, wherein step S14 comprises: Using a device transfer unit to transfer the programmable device to the first output container. The method as claimed in claim 1, wherein the method further comprises before the execution of step S1: S15. generating the work control packet, the work control packet being accompanied by a programmer identification list, the programmer identification list recording at least one programmer that can be burned; and S16. programming the effective load in the work control packet into the programmable device using the at least one programmer recorded in the programmer identification list. The method as claimed in claim 1, wherein step S14 comprises: When the verification result is a failure, classifying the programmable device into a second output container defined as bad. The method as claimed in claim 5, wherein the method comprises: S17. Setting the programmer to program the encrypted payload to the programmable device. A computer-readable recording medium stores a sequence of at least one instruction, the sequence of at least one instruction is executed by at least one processor, and the computer-readable recording medium is applied to a secure programming system, the secure programming system includes a programmer, a programming unit, an authentication module and a security module, the sequence of at least one instruction includes the following, the sequence of at least one instruction is executed to perform a method, the method includes the following steps: S1. The programmer uses a security control unit key to decrypt an encrypted work control packet to extract a valid load; S2. The programmer generates a first verification code calculated by the valid load; S3. The programmer burns the valid load to a programmable device; S4. After the payload is burned into the programmable device, the programmer reads the burned payload to calculate a second verification code; S5. The programmer verifies the first verification code and the second verification code, and when the verification succeeds, executes a burning operation; S6. When the burning operation is executed, the programming unit generates an OEM certificate signing request using an identifiable information in the programmable device and a programmable device public key; S7. The authentication module verifies the OEM certificate signing request using a hash value, and generates an OEM device certificate when the verification succeeds; S8. The security module signs the OEM device certificate with an OEM private key; S9. The programming unit verifies the OEM device certificate using an OEM public key; S10. The programmer generates a third verification code calculated from the OEM device certificate when the verification result of step S9 is correct; S11. The programmer burns the OEM device certificate to the programmable device; S12. The programmer reads the burned OEM device certificate to calculate a fourth verification code; S13. The programmer verifies the third verification code and the fourth verification code; and S14. The programming unit classifies the programmable device according to the verification result of step S13, wherein when the verification result is successful, the programmable device is classified into a first output container defined as good. The computer-readable recording medium as described in claim 8, wherein the step S1 comprises: Retrieving the effective load from a secure storage unit of the programmable device. The computer-readable recording medium as described in claim 8, wherein the step S12 comprises: Retrieving the OEM device certificate from a secure storage unit of the programmable device. The computer-readable recording medium as described in claim 8, wherein the step S14 comprises: Using a device transfer unit to transfer the programmable device to the first output container. The computer-readable recording medium as described in claim 8, wherein the method further comprises before the execution of step S1: S15. Generate the work control packet, the work control packet is attached with a programmer identification list, the programmer identification list records at least one programmer that can be burned; and S16. Use the at least one programmer recorded in the programmer identification list to program the effective load in the work control packet into the programmable device. The computer-readable recording medium as described in claim 8, wherein step S14 comprises: When the verification result is a failure, classifying the programmable device into a second output container defined as bad. A computer-readable recording medium as described in claim 12, wherein the sequence of at least one instruction includes the following: S17. Setting the programmer to program the encrypted payload to the programmable device. A secure programming system comprising: A programmer uses a security control unit key to decrypt an encrypted work control packet to extract a payload, and generates a first verification code calculated by the payload, and burns the payload to a programmable device. After the payload is burned to the programmable device, the programmer reads the burned payload to calculate a second verification code, and verifies the first verification code and the second verification code. When the verification is successful, a burning operation is performed, and when the burning operation is performed, an identifiable information and a programmable device public key in the programmable device are read and transmitted to a programming unit, so that the programming unit generates an OEM certificate signing request; An authentication module connected to a security module, the authentication module verifies an OEM certificate signing request using a hash value, and generates an OEM device certificate and transmits it to the security module when the verification is successful, wherein the security module is configured to sign the OEM device certificate to generate a signed OEM device certificate; and A programming unit connected to the programmer, for verifying the OEM device certificate using an OEM public key, and transmitting the OEM device certificate to the programmer when the verification is successful, wherein the programmer is configured to program the OEM device certificate and the payload into the programmable device; When the programming unit successfully verifies the OEM device certificate using the OEM public key, the programmer generates a third verification code calculated from the OEM device certificate, and burns the OEM device certificate to the programmable device, and the programmer reads the burned OEM device certificate to calculate a fourth verification code, and verifies the third verification code and the fourth verification code, and the programming unit classifies the programmable device according to the verification results of the third verification code and the fourth verification code, wherein when the verification result is successful, the programmable device is classified into a first output container defined as good. A secure programming system as described in claim 15, wherein the programmer is configured to retrieve the payload from a secure storage unit of the programmable device. A secure programming system as described in claim 15, wherein the security module is configured to generate the OEM device certificate when verification between the hash value and the OEM certificate signing request is successful and signed by an OEM private key. A secure programming system as described in claim 15, wherein the programmer is configured to retrieve the OEM device certificate from a secure storage unit of the programmable device. A secure programming system as described in claim 15, wherein the programmer is configured to move the programmable device to the first output container using a device moving unit. A secure programming system as described in claim 15, wherein the security control unit is configured to generate the work control packet with a programmer identification list attached, the programmer identification list records at least one programmer that can be burned, and the security control unit uses the at least one programmer recorded in the programmer identification list to program the valid load in the work control packet into the programmable device. A secure programming system as described in claim 15, wherein the programmer is configured to program the encrypted payload into the programmable device. A secure programming system as described in claim 20, wherein the programming unit is configured to verify the identifiable information of at least one programmer that can be burned and stored in the programmer identification list and the secure programming system, and to program the OEM device certificate into the programmable device when the verification is successful. A secure programming system as described in claim 15, wherein the programming unit is configured to confirm a stored production count, wherein when the number of burn times of the programmer is less than the production count, the programming unit drives the programmer to perform the burning operation, and when the number of burn times of the programmer is more than the production count, the programming unit drives the programmer to perform the burning operation, and the number of burn times of the programmer is at most up to the upper limit of the production count. A secure programming system as described in claim 15, wherein when the verification result of the third verification code and the fourth verification code is failure, the programmable device is classified into a second output container defined as bad.

Images