
7
FN9260.2
January 5, 2007
It is recommended that device authentication be done once
in a while to maximize its effectiveness. Before a new
challenge code can be accepted by the device, the SESL
register must be re-written again to ensure that the original
seeds are re-loaded from the OTP ROM into the hash
engine prior to performing the next authentication code
calculation. Failure to follow the sequence will result is a bus
error, causing the sBER flag to be set in the STAT register.
SET-UP FOR DEVICE AUTHENTICATION SUPPORT
To configure the host and the ISL9206 to support device
authentication function, the pack manufacturer will need to
select at least 2 sets of 32-Bit secret codes. For greater
security, a third set of 32-Bit secret may be used. The
FlexiHash+ engine requires two sets of 32-Bit secrets for
use in its hash calculation: the first set to define its hash
function, and the second set to initialize its seed for hash
calculation. These two sets can be selected from the same
secret location. The chosen secret codes are to be kept by
the pack manufacturer and maintained at utmost
confidentiality.
After the secrets have been determined, they are written into
the device’s OTP ROM. After verification that the codes have
been written in correctly, the relevant secrets lock-out bits at
ROM address location 0-00 should be set. Once set, the
lock-out bits can no longer be cleared. Thereafter, read/write
access to the secret information will no longer be possible,
and the secret codes are made available only to the
FlexiHash+ engine for generation of authentication code
based on a challenge code input from the host.
On the host side, the same secret codes will need to be kept,
and the same FlexiHash+ engine will have to be
implemented in firmware. It is important that the secret
codes be stored scrambled in the host’s non-volatile memory
so that the secret information cannot be easily revealed by
monitoring signal transfer on the host PCB.
THE HASH ENGINE
The hash engine consists of a cascade of programmable
highly non-linear proprietry encoders. Details on the
proprietry encoder implementation will be made available to
users under NDA only.
FIGURE 5. AUTHENTICATION PROCESS FLOW DIAGRAM
+
FIGURE 6. FLOW CHART FOR AUTHENTICATION PROCESS
START
WAKE UP ISL9206 USING A
REGULAR
BREAK
SIGNAL
SELECT HASH FUNCTION AND SEED
BY WRITING TO SESL REGISTER
SEND A 32-BIT RANDOM
CHALLENGE TO CHLG REGISTER
READ THE AUTHENTICATION
RESULT FROM AUTH REGISTER,
AFTER WAITING FOR 1 BT
D
END
CALCULATE THE EXPECTED
AUTHENTICATION RESULT
BASED ON THE SAME SECRETS
THE TWO RESULTS MATCH
SHUT DOWN
THE SYSTEM
YES
NO
ISL9206