TWI899680B - Method of operating secure programming system and secure programming system using the same - Google Patents

Abstract

A method of operating a secure programming system is disclosed. The method comprises: encrypting a work control packet with a payload by a programmable device, wherein the work control packet includes an authentication list; installing the programmable device into a programmer; verifying that an authentication ID of the authentication list matches a device ID of the programmable device; if the authentication ID matches the device ID, decrypting the encrypted work control packet to retrieve the payload; generating a first verification code calculated from the payload and burning the payload into the programmable device by the programmer; reading the burned payload to calculate a second verification code; verifying the first verification code and the second verification code, and if the verification is successful, classifying the programmable devices into a first output container according to the verification results.

Description

Method for operating a safety programming system and safety programming system

This case belongs to the technical field of secure programming systems, and in particular, refers to a method for operating a secure programming system and a secure programming system.

In existing burning operations and processes, data is burned into integrated circuits. When burning data into an integrated circuit, if the data to be burned is in plain text and not encrypted, it may lead to the possibility of data leakage.

Therefore, how to develop a method for operating a secure programming system and a secure programming system is an urgent issue that needs to be addressed in this field.

This case discloses a method for operating a secure programming system and a secure programming system. The method encrypts and protects a work control packet having an authentication list and a payload. When the authentication identifier of the authentication list matches the device identifier of the programmable device, the payload is burned into the programmable device. This prevents the payload from being leaked, thereby enhancing data security.

To achieve the above-mentioned objectives, one embodiment of the present invention provides a method for operating a secure programming system, the secure programming system including a programmer. The method comprises: the programmer, using a security control unit, encrypting a work control packet having an authentication list and a payload, wherein the authentication list includes an authentication identification code; S2. loading a programmable device into the programmer, wherein the programmable device includes a device identification code; S3. Verify whether the authentication identifier of the authentication list matches the device identifier of the programmable device; when the authentication identifier of the authentication list matches the device identifier of the programmable device, the programmer uses the security control unit key of the security control unit to decrypt the encrypted work control packet to extract the payload; the programmer generates a first authentication code calculated from the payload and burns the payload into the programmable device; after the payload is burned into the programmable device, the programmer reads the burned payload to calculate the second authentication code; and S7. The programmer verifies the first authentication code and the second authentication code, and when the authentication is successful, classifies the programmable device into a first output container defined as good.

To achieve the above-mentioned objectives, another embodiment of the present invention provides a secure programming system, comprising: a programmer, which is loaded with a programmable device and uses a security control unit to encrypt a work control packet having an authentication list and a payload, decrypts the encrypted work control packet using a security control unit key of the security control unit to extract the payload, generates a first verification code calculated from the payload, and burns the payload into the programmable device. After the payload is burned into the programmable device, the programmer reads the burned payload. The second verification code is calculated and the first verification code and the second verification code are verified, so that when the verification is successful, the programmable device is classified into a first output container defined as good; and the programming unit is connected to the programmer and is used to capture the work control packet having the authentication list and the valid payload, and verify whether the authentication identifier of the authentication list matches the device identifier of the programmable device. When the authentication identifier matches the device identifier, a successful authentication signal is generated to the programmer, so that the programmer will use the security control unit key to decrypt the encrypted work control packet to extract the valid payload.

Typical embodiments that embody the features and advantages of this invention will be described in detail in the following description. It should be understood that this invention is capable of various variations in different aspects without departing from the scope of this invention, and that the descriptions and illustrations herein are intended for illustrative purposes only and are not intended to limit this invention.

Please refer to Figures 1 and 2, wherein Figure 1 is a flowchart of the steps of a method for operating a secure programming system according to a preferred embodiment of the present invention, and Figure 2 is a schematic diagram of the structure of the secure programming system operated by the method shown in Figure 1. As shown in Figures 1 and 2, the method of the present invention can be applied to a secure programming system 1, wherein the secure programming system 1 can communicate with an original equipment manufacturer (OEM) device 9, and the secure programming system 1 can individually encrypt a target payload of data and code and then program the information into each programmable device 8, wherein the programmable device 8 can include an integrated circuit, a memory chip, a circuit board, or an electronic device, such as a smartphone, a media player, or other consumer and industrial electronic devices. The secure programming system 1 can create customized payload packets that can only be decrypted by systems or devices with the correct security key.

The safety programming system 1 includes a programmer 2 and a programming unit 4. The programmer 2 may be a motor system for physically programming a programmable device 8, which may be loaded with the programmable device 8.

The programming unit 4 can capture the work control packet with the authentication list and the valid load, and verify whether the authentication identifier of the authentication list matches the device identifier of the programmable device 8, so as to generate a successful authentication message to the programmer 2 when the authentication identifier matches the device identifier. When the programmer 2 receives the successful authentication message, it allocates the valid load provided by the programming unit 4 to the programmable device 8.

In some embodiments, the secure programming system 1 includes a security control unit 6 configured to encrypt a payload using a programmer public key, an OEM public key, a security module public key, a silicon vendor public key, or a security control unit public key, and to form a work control packet containing the payload in an encrypted format. In some embodiments, the security control unit 6 is configured to be a computing device that processes secure information and may include specific cryptographic techniques and computing hardware to facilitate the processing of cryptographic information. For example, the security control unit 6 may include a quantum computer, a parallel computing circuit system, a field programmable gate array (FPGA) configured to process secure information, a coprocessor, an array logic unit, a microprocessor, or a combination thereof. In addition, the security control unit 6 may be a security device specifically configured to prevent unauthorized access to security information at the input, intermediate, or final stages of processing the security information.

The method of this embodiment includes the following steps.

In step S1, the programmer 2 uses the security control unit 6 to encrypt a work control packet containing a payload. The work control packet further includes an authentication list, and the authentication list includes an authentication identifier. In some embodiments, the original equipment manufacturer (OEM) device 9 places the programmer 2's serial number list and the payload into the work control packet, encrypts the work control packet using a randomly generated security control unit key by the security control unit 6, and also encrypts the security module public key by loading the key. Finally, the encrypted work control packet, the encrypted security control unit key, the authentication list, and the security module public key are transmitted to the programming unit 4.

In step S2, the programmable device 8 is loaded into the programmer 2, wherein the programmable device 8 has a device identification code.

Step S3, verify whether the authentication identification code in the authentication list matches the device identification code of the programmable device 8.

In step S4, when the authentication identification code of the authentication list verified in step S3 matches the device identification code of the programmable device 8, the programmer 2 uses the security control unit key of the security control unit 6 to decrypt the encrypted work control packet to extract the effective payload.

In step S5, the programmer 2 generates a first verification code calculated from the payload and burns the payload into the programmable device 8.

In step S6, after the payload is burned into the programmable device 8, the programmer 2 reads the burned payload to calculate the second verification code.

In step S7, the programmer 2 verifies the first verification code and the second verification code, and if the verification is successful, the programmer 2 classifies the programmable device 8 into the first output container defined as good.

As can be seen from the above content, the method of this case can encrypt and protect the work control packet with the authentication list and the valid payload, and only burn the valid payload to the programmable device 8 when the authentication identifier of the authentication list matches the device identifier of the programmable device 8. In this way, the leakage of the valid payload can be avoided, thereby improving data security.

In some embodiments, step S1 further includes: retrieving the payload from the secure storage unit 80.

In other embodiments, the method of the present invention may further include steps S8 and S9, which are executed before step S1. Step S8 comprises generating a work control packet, which includes a programmer identification list that lists at least one programmer 2 that can be burned. Step S9 comprises programming the payload in the work control packet into the programmable device 8 using the at least one programmer 2 listed in the programmer identification list.

In some embodiments, step S7 further includes: when the verification result is failure, classifying the programmable device 8 into a second output container defined as defective. In some embodiments, the first output container and the second output container are different carriers.

In other embodiments, step S7 further includes: using a device transfer unit (not shown) to transfer the programmable device 8 to the first output container or the second output container. The device transfer unit can be, but is not limited to, a robot arm of an automated device.

In some embodiments, the programming unit 4 extracts a firmware image from the payload, where the firmware image may be, but is not limited to, an image file, a programming language code, or a data table, and decrypts the firmware image. The programmer 2 receives the decrypted firmware image from the programming unit 4 and copies the decrypted firmware image to the programmable device 8.

In some embodiments, the programming unit 4 can retrieve the unique serial numbers corresponding to more than one programmer 2, integrate the serial numbers into a serial number list, and transmit it to the original equipment manufacturer device 9.

In some embodiments, the secure programming system 1 includes a security module (Hardware Security Module; HSM) 5, which utilizes an asymmetric encryption algorithm to generate a matching security module public key and a security module private key, and sets a maximum number of burn times for the corresponding security module public key. The security module private key is stored in the security module 5, and the security module public key can be output via a security control unit 6 to be provided to an original equipment manufacturer device 9.

In some embodiments, in step S3, the programming unit 4 reads the device identification code of the programmable device 8 from the programmer 2 to verify it with the authentication identification code in the authentication list. When the authentication is successful, the programming unit 4 transmits the security module public key to the security module 5, and the security module 5 queries the corresponding number of available burn times and then returns the queried number of available burn times to the programming unit 4.

In some embodiments, the programming unit 4 determines whether the programmer 2 should continue the burn operation on the programmable device 8 based on the available production count. If the available production count is verified to be 0, the burn operation is terminated. Conversely, if the available production count is not 0, the programming unit 4 first deducts one or more times as a pre-withheld production count. However, if the pre-withheld production count exceeds the available production count, the programming unit 4 uses the upper limit of the available production count as the pre-withheld production count and stores the pre-withheld production count in the programming unit 4. At the same time, the programming unit 4 transmits the remaining available production count after deducting the pre-withheld production count to the security module 5 for storage. In other words, the programming unit 4 is set to confirm the stored production count and drive the programmer 2 to perform the burning operation when the number of burn times of the programmer 2 is less than the production count. Conversely, when the number of burn times of the programmer 2 is more than the production count, the programming unit 4 will also drive the programmer 2 to perform the burning operation, but the number of burn times of the programmer 2 will only reach the upper limit of the available production count.

In some embodiments, the programming unit 4 further transmits the encrypted operation control packet to the programmer 2 and stores it in the random access memory (not shown) of the programmer 2, and then immediately erases the encrypted operation control packet in the programming unit 4.

In some embodiments, the programming unit 4 obtains the programmer list from the authentication identifier and distributes the payload to the programmable device 8 upon successful verification of the programmer list (ie, the authentication identifier of the authentication list matches the device identifier of the programmable device 8).

In some embodiments, programmer 2 burns the decrypted payload temporarily stored in random access memory into programmable device 8. Furthermore, programming unit 4 transmits the encrypted security control unit key along with the security module public key to security module 5 for decryption. After receiving the decrypted security control unit key from security module 5, programming unit 4 transmits it to programmer 2's random access memory to decrypt the encrypted work control packet. Finally, programmer 2 extracts the payload from the decrypted work control packet, then extracts programmer 2's sequence number list and matches it with its own unique sequence number. If its own unique sequence number is not included in the sequence number list, the burning operation is aborted. If its own unique sequence number is included in the sequence number list, the burning operation continues.

In some embodiments, programmer 2 further reads the contents of programmable device 8 and verifies the contents of programmable device 8 using the decrypted payload stored in random access memory. Furthermore, programmer 2 transmits the verification result to programming unit 4, which then reads the payload stored in random access memory. Based on the verification result transmitted by programmer 2, programming unit 4 verifies whether the verification is successful. If the verification is successful, programming unit 4 decrements the stored pre-withheld production count by one. If the verification fails, the stored pre-withheld production count remains unchanged. If the pre-withheld production count of programming unit 4 is 0, programming unit 4 queries the corresponding production count through security module 5, so that security module 5 returns the production count to programming unit 4. If the production count is 0, the burning is terminated. If the production count is not 0, 1 or more times are deducted as the pre-withheld production count, and the pre-withheld production count is stored in programming unit 4. At the same time, programming unit 4 transmits the remaining usable production count after deducting the pre-withheld production count to security module 5 for storage.

In summary, this case provides a method for operating a secure programming system and a secure programming system. The method and secure programming system can encrypt and protect the work control packet of a payload. The work control packet further includes an authentication list. The payload is only burned into the programmable device when the authentication identifier in the authentication list matches the device identifier of the programmable device. This prevents the payload from being leaked, thereby enhancing data security.

1: Safety Programming System 9: Original Equipment Manufacturer Device 2: Programmer 4: Programming Unit 5: Safety Module 6: Safety Control Unit 8: Programmable Device S1-S7: Methods for Operating a Safety Programming System

Figure 1 is a flowchart of the steps of a method for operating a secure programming system according to a preferred embodiment of the present invention. Figure 2 is a schematic diagram of the structure of the secure programming system operated by the method shown in Figure 1.

S1~S7: Methods for operating a safety programming system

Claims (9)

A method for operating a secure programming system, the secure programming system including a programmer, the method comprising: S1. The programmer encrypts a work control packet having a payload using a security control unit, wherein the work control packet further includes an authentication list, and the authentication list has an authentication identification code; S2. Loads a programmable device into the programmer, wherein the programmable device has a device identification code; S3. Verifies whether the authentication identification code in the authentication list matches the device identification code of the programmable device; S4. When it is verified that the authentication identification code in the authentication list matches the device identification code of the programmable device, the programmer decrypts the encrypted work control packet using a security control unit key of the security control unit to extract the payload; S5. The programmer generates a first verification code calculated from the payload and burns the payload into the programmable device. S6. After the payload is burned into the programmable device, the programmer reads the burned payload to calculate a second verification code. S7. The programmer verifies the first verification code and the second verification code and, if verification is successful, classifies the programmable device into a first output container defined as good. The method of claim 1, wherein step S1 comprises: Retrieving the payload from a secure storage unit of the programmable device. The method of claim 1, wherein step S7 includes: When the verification result is failure, classifying the programmable device into a second output container defined as defective. The method of claim 1, wherein, before executing step S1, the method further comprises: S8. generating the operation control packet, the operation control packet being accompanied by a programmer identification list, the programmer identification list recording at least one programmer capable of performing programming; and S9. programming the payload in the operation control packet into the programmable device using the at least one programmer recorded in the programmer identification list. A secure programming system comprises: A programmer, loaded with a programmable device, and utilizing a security control unit to encrypt a work control packet containing a payload, wherein the work control packet further includes an authentication list. The programmer decrypts the encrypted work control packet using a security control unit key of the security control unit to extract the payload, generates a first authentication code calculated from the payload, and burns the payload into a programmable device. After the payload is burned into the programmable device, the programmer reads the burned payload to calculate a second authentication code, and verifies the first authentication code and the second authentication code. If the authentication succeeds, the programmer classifies the programmable device into a first output container defined as good. A programming unit, connected to the programmer, is configured to capture the operation control packet containing the authentication list and the payload and verify whether an authentication identifier in the authentication list matches a device identifier of the programmable device. When the authentication identifier matches the device identifier, a successful authentication signal is generated to the programmer, causing the programmer to decrypt the encrypted operation control packet using the security control unit key to retrieve the payload. The secure programming system of claim 5, wherein the programmer is configured to retrieve the payload from a secure storage unit of the programmable device. A secure programming system as described in claim 5, wherein the programmer is configured to move the programmable device to the first output container using a device moving unit. A secure programming system as described in claim 5, wherein the security control unit is configured to generate the work control packet with a programmer identification list attached, the programmer identification list records at least one programmer that can be burned, and the security control unit uses the at least one programmer recorded in the programmer identification list to program the valid load in the work control packet into the programmable device. A secure programming system as described in claim 5, wherein the programming unit is configured to confirm a stored production count, wherein when the number of burns of the programmer is less than the production count, the programming unit drives the programmer to perform the burn operation, and when the number of burns of the programmer is more than the production count, the programming unit drives the programmer to perform the burn operation, and the number of burns of the programmer is at most up to the upper limit of the production count.