Protecting computing devices from malicious tampering

Abstract

In one example, a method performed by a processing system of a server includes sending an instruction to a controller installed on an integrated circuit chip of a remote computing device, wherein the instruction requests that the controller issue a challenge to the integrated circuit, receiving a first signature of the integrated circuit chip from the controller, wherein the first signature is derived by the controller from a response of the integrated circuit chip to the challenge, comparing the first signature to a second signature that is stored on the server, wherein the second signature was derived through testing of the integrated circuit chip prior to the integrated circuit chip being deployed in the remote computing device, and generating an alert when the first signature fails to match the second signature, wherein the alert indicates that the integrated circuit chip may have been tampered with.

What is claimed is: 
     
         1 . A method comprising:
 sending, by a processing system of a server, an instruction to a controller installed on an integrated circuit chip of a remote computing device, wherein the instruction requests that the controller issue a challenge to the integrated circuit chip;   receiving, by the processing system, a first signature of the integrated circuit chip from the controller, wherein the first signature is derived by the controller from a response of the integrated circuit chip to the challenge;   comparing, by the processing system, the first signature to a second signature that is stored on the server, wherein the second signature was derived through testing of the integrated circuit chip prior to the integrated circuit chip being deployed in the remote computing device; and   generating, by the processing system, an alert when the first signature fails to match the second signature, wherein the alert indicates that the integrated circuit chip may have been tampered with.   
     
     
         2 . The method of  claim 1 , wherein the instruction is sent in response to the remote computing device being powered on. 
     
     
         3 . The method of  claim 1 , wherein the instruction is sent periodically. 
     
     
         4 . The method of  claim 1 , wherein each of the first signature and the second comprises a physical unclonable function. 
     
     
         5 . The method of  claim 4 , wherein the challenge comprises simultaneously exciting two paths through the integrated circuit chip and comparing respective delays on the two paths. 
     
     
         6 . The method of  claim 1 , wherein the first signature is sent using a secure communications protocol. 
     
     
         7 . The method of  claim 1 , further comprising:
 sending, by the processing system, the alert to a human administrator.   
     
     
         8 . The method of  claim 1 , wherein the controller is in communication with a plurality of sensors on the integrated circuit chip, and the plurality of sensors comprises different types of sensors configured to monitor different physical conditions of the integrated circuit chip during the challenge. 
     
     
         9 . The method of  claim 8 , wherein at least one sensor of the plurality of sensors measures a temperature of the integrated circuit chip. 
     
     
         10 . The method of  claim 8 , wherein at least one sensor of the plurality of sensors measures a supply voltage of the integrated circuit chip. 
     
     
         11 . The method of  claim 8 , wherein at least one sensor of the plurality of sensors measures an electro-magnetic interference of the integrated circuit chip. 
     
     
         12 . A non-transitory computer-readable medium storing instructions which, when executed by a processing system of a server, cause the processing system to perform operations, the operations comprising:
 sending an instruction to a controller installed on an integrated circuit chip of a remote computing device, wherein the instruction requests that the controller issue a challenge to the integrated circuit chip;   receiving a first signature of the integrated circuit chip from the controller, wherein the first signature is derived by the controller from a response of the integrated circuit chip to the challenge;   comparing the first signature to a second signature that is stored on the server, wherein the second signature was derived through testing of the integrated circuit chip prior to the integrated circuit chip being deployed in the remote computing device; and   generating an alert when the first signature fails to match the second signature, wherein the alert indicates that the integrated circuit chip may have been tampered with.   
     
     
         13 . The non-transitory computer-readable medium of  claim 12 , wherein each of the first signature and the second comprises a physical unclonable function. 
     
     
         14 . The non-transitory computer-readable medium of  claim 13 , wherein the challenge comprises simultaneously exciting two paths through the integrated circuit chip and comparing respective delays on the two paths. 
     
     
         15 . A system deployed on an integrated circuit chip of a computing device, comprising:
 a plurality of sensors to monitor a plurality of physical conditions of the integrated circuit chip; and   a controller communicatively coupled to the plurality of sensors to issue a challenge to the integrated circuit chip and to derive a first signature for the integrated circuit chip from a response of the integrated circuit chip to the challenge, wherein the controller is further communicatively coupled to a remote server that stores a second signature for the integrated circuit chip, wherein the second signature was derived through testing of the integrated circuit chip prior to the integrated circuit chip being deployed in the computing device.   
     
     
         16 . The system of  claim 15 , wherein each of the first signature and the second signature comprises a physical unclonable function. 
     
     
         17 . The system of  claim 15 , wherein the controller is housed in a tamper-resistant enclosure. 
     
     
         18 . The system of  claim 15 , wherein at least one sensor of the plurality of sensors measures a temperature of the integrated circuit chip. 
     
     
         19 . The system of  claim 15 , wherein at least one sensor of the plurality of sensors measures a supply voltage of the integrated circuit chip. 
     
     
         20 . The system of  claim 15 , wherein at least one sensor of the plurality of sensors measures an electro-magnetic interference of the integrated circuit chip.