System for secure provisioning and enforcement of system-on-chip (soc) features

Abstract

A system and method are disclosed for provisioning IP features in a system-on-chip. A plurality of identical chips are fabricated, each of which is capable of have a number of features enabled or disabled. As a default, all features are disabled. A production process is later carried out, in which the chip is installed in a greater device. During this process, the manufacturer requests a license the IP owner for enablement of various features. Using secure communications, a license is granted identifying the features to be enabled, and a volume of units permitted to be manufactured. The license information is encrypted using a key already known to the chip, and sent to the manufacturer. The chip receives the license information during provisioning, extracts relevant provisioning information using the key, and a secure processing system provisions the relevant features. Log information is generated to allow the IP owner to verify license compliance.

1 - 6 . (canceled) 
     
     
         7 . A server for managing licenses between an owner of a functional feature within a chip and a device manufacturer, the server comprising:
 a database;   a communication interface configured to receive a license request from a manufacturer for a license to enable a functional feature within an integrated circuit chip, and to transmit a notification to an IP owner associated with the functional feature as to receipt of the license request;   a license generator configured to generate a license contract in response to receiving a license approval, the license contract including a listing of features for enablement and a license date range; and   a license manager configured to store a copy of the license contract in the database in association with the manufacturer and IP owner, and to forward the license contract to the manufacturer.   
     
     
         8 . The server of  claim 7 , further comprising a user interface configured to display contents of the license request to an authorized approver, and to receive the license approval and the license date range from the authorized approver. 
     
     
         9 . The server of  claim 7 , wherein the license contract further includes an identifier of the manufacturer and an identifier of the IP owner. 
     
     
         10 . The server of  claim 7 , further comprising a secure server configured to encrypt the license contract. 
     
     
         11 . The server of  claim 10 , wherein the secure server encrypts the license contract using an encryption key preprogrammed on the integrated circuit chip, and specifically associated with the IP owner. 
     
     
         12 . The server of  claim 7 , further comprising:
 a log importer configured to receive a log from the manufacturer, the log including information regarding a used license;   a log manager configured to compare the information within the received log to stored license information, and to identify the log as being compliant with or in violation of the license.   
     
     
         13 . The server of  claim 12 , further comprising a beacon processor configured to receive a beacon signal from the manufacturer and to respond with an acknowledgement signal,
 wherein, in response to detecting that a log is in violation of the license, the beacon processor is configured to not respond to the beacon signal.   
     
     
         14 . A server for carrying out a provisioning process with respect to an integrated circuit chip, the server comprising:
 a transceiver configured to receive a license contract from a license management server, the license contract including a chip identifier and an encrypted payload;   a memory that stores the license contract;   a processor configured to detect a device undergoing provisioning, and to identify the license contract in the memory based on the detected device;   a secure communicator configured to transmit the encrypted payload to the device for provisioning via a secure communication channel, and to receive a log file upon completion of the provisioning,   wherein the transceiver is further configured to transmit the log file to the license management server.   
     
     
         15 . The server of  claim 14 , further comprising a license manager configured to verify the license contract prior to provisioning, the license manager configured to:
 verify a validity of the license contract based on information included within the license contract;   cause a beacon signal to be transmitted to the license management server;   and receive an acknowledgement signal from the license management server.   
     
     
         16 . The server of  claim 15 , wherein the license manager is configured to verify the validity of the license contract by:
 determining whether a current date is within a date range specified in the license contract; and   determining whether a number of units already provisioned exceeds a number of licenses granted by the license contract.   
     
     
         17 . The server of  claim 14 , further comprising a configuration file generator configured to generate a configuration file that includes the encrypted payload, wherein the encrypted payload is not decrypted by the server. 
     
     
         18 . The server of  claim 17 , wherein the processor identifies a plurality of license contracts associated with more than one IP owner in the memory based on the detected device, and
 wherein the configuration file generator is configured to generate the configuration file to include each of the encrypted payloads of the plurality of identified license contracts.   
     
     
         19 . The server of  claim 14 , further comprising a log manager configured to:
 receive an encrypted log file from the device;   store the encrypted log file in a database; and   store, in association with the encrypted log file, an indication that the integrated circuit chip has been provisioned.   
     
     
         20 . The server of  claim 19 , wherein the log manager is further configured to:
 retrieve from the database, log reporting rules associated with an IP owner associated with the license contract;   and transmit the encrypted log file to the license management server in accordance with the log reporting rules.   
     
     
         21 . The server of  claim 20 , wherein the server is distinct from the device and the license management server. 
     
     
         22 . The server of  claim 17 , wherein the configuration file includes a listing of functional features to be enabled on the device and an identification associated with an owner of the listed functional features. 
     
     
         23 . A method comprising:
 receiving, by a server, a license request from a manufacturer for a license to enable a functional feature within an integrated circuit chip;   transmitting a notification to an IP owner associated with the functional feature as to receipt of the license request;   generating a license contract in response to receiving a license approval, the license contract including a listing of features for enablement and a license date range;   storing a copy of the license contract in in association with the manufacturer and an IP owner corresponding to the listing of features; and   forwarding the license contract to the manufacturer.   
     
     
         24 . The method of  claim 23 , further comprising:
 displaying contents of the license request to an authorized approver; and   receiving the license approval and the license date range from the authorized approver.   
     
     
         25 . The method of  claim 23 , wherein the license contract further includes an identifier of the manufacturer and an identifier of the IP owner. 
     
     
         26 . The method of  claim 23 , further comprising:
 encrypting the license contract.