Abstract: A provisioning control apparatus configured to be coupled to a provisioning equipment server, wherein the provisioning equipment server is electrically connectable with at least one electronic device for provisioning the electronic device with security sensitive provisioning data. The provisioning control apparatus includes a communication interface configured to receive information about one or more provisioning capabilities of the provisioning equipment server for provisioning the electronic device with the security sensitive provisioning data. The provisioning control apparatus further includes a processing circuitry configured to generate, based on a product configuration of the electronic device and the information about the one or more provisioning capabilities of the provisioning equipment server, a provisioning script, wherein the provisioning script defines one or more provisioning operations for provisioning the electronic device with the security sensitive provisioning data.

Abstract: A provisioning control apparatus coupled to a provisioning equipment server electrically connectable with electronic components each including a security enclave and a non-volatile memory. The provisioning control apparatus includes a processor configured to encrypt the security sensitive provisioning data using a secure vault encryption key for obtaining encrypted security sensitive provisioning data. The provisioning control apparatus has a communication interface configured to securely provide the secure vault encryption key to the provisioning equipment server for storing the secure vault encryption key in the security enclave of the electronic component.

Abstract: A provisioning system is provided for provisioning a plurality of electronic devices with provisioning data. Each of the plurality of electronic devices is associated with an electronic device type. The provisioning system includes a provisioning control apparatus, and a provisioning equipment configured to be electrically connected with at least one of the plurality of electronic devices for provisioning the at least one electronic device. The provisioning system includes a provisioning security module configured to receive the device type information from the provisioning control apparatus and to generate provisioning data on the basis of the device type information. The provisioning security module transmits the provisioning data to the provisioning equipment for provisioning the at least one electronic device with provisioning data.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of the operating system when executed by the processor, performs a cryptographic operation when processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory stores the operating system. A communication interface receives data over a communication network. The processor retrieves the boot program code from the first memory area and executes the boot program code to start execution of the operating system. The processor terminates execution of the boot program code. The processor is configured to re-execute the boot program code while the operating system is executed to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of an operating system when executed by the processor, and performs a cryptographic operation when the processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory area stores the operating system. The processor retrieves the boot program code from the first memory area and executes the boot program code to start the execution of the operating system. The processor re-executes the boot program code to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.

Abstract: A provisioning control apparatus is configured for coupling to a provisioning equipment server electrically connectable with an electronic device(s) for provisioning the electronic device(s) with a program code. The apparatus comprises: a communication interface configured to receive an electronic provisioning token including a provisioning counter indicating a total of transmissions of the program code towards the provisioning equipment server; and a processor configured to retrieve the provisioning counter from the received token. The interface can transmit the program code towards server; the processor can update a value of the counter for each transmission of the program code towards the server for an updated counter. The processor prohibits transmission of the program code towards the server if the updated counter indicates a total number of transmissions has been reached.

Abstract: An electronic chip for assembly into electronic equipment includes a communication interface configured to receive a plurality of blocks of provisioning data from a provisioning apparatus in encrypted form. The electronic chip has a non-volatile memory configured to store the plurality of blocks of provisioning data. The electronic chip further includes a processing circuitry configured to perform a plurality of operations substantially in parallel, such that the plurality of operations includes a first operation of decrypting a first encrypted block of the plurality of blocks of provisioning data and a second operation of writing a second decrypted block of the plurality of blocks of provisioning data in the non-volatile memory.

Abstract: A provisioning control apparatus coupled to a provisioning equipment server electrically connectable with electronic components each comprising a security enclave and a non-volatile memory. The provisioning control apparatus includes a processor configured to encrypt the security sensitive provisioning data using a secure vault encryption key for obtaining encrypted security sensitive provisioning data. The provisioning control apparatus has a communication interface configured to securely provide the secure vault encryption key to the provisioning equipment server for storing the secure vault encryption key in the security enclave of the electronic component.

Abstract: A provisioning control apparatus is arranged to be coupled to a provisioning equipment server electrically connectable with at least one electronic device for provisioning the electronic device with security sensitive provisioning data. The electronic device includes a processor, a volatile memory and a non-volatile memory. The provisioning control apparatus has a communication interface configured to securely provide a provisioning application code to the provisioning equipment server for storing the provisioning application code in the volatile memory of the electronic device. The provisioning control apparatus includes a processor configured to trigger the processor of the electronic device to execute the provisioning application code. The provisioning application code is arranged, when being executed by the processor of the electronic device, to store the security sensitive provisioning data in the non-volatile memory of the electronic device.

Abstract: A provisioning system includes a provisioning apparatus configured to be electrically connected with at least one of a plurality of electronic devices for provisioning at least one electronic device. The provisioning apparatus is configured to obtain device type information about the electronic device type of the plurality of electronic devices and to issue a request for provisioning data based on the device type information. The provisioning system has a provisioning security module configured to receive the request for provisioning data from the provisioning apparatus and generate provisioning data in response to the request. The provisioning security module is configured to transmit the provisioning data to the provisioning apparatus to provide at least one electronic device with provisioning data. The provisioning security module is configured to maintain a provisioning counter indicative of a remaining number of the plurality of electronic devices that can be provisioned with provisioning data.

Abstract: A provisioning system is provided for provisioning a plurality of electronic devices with provisioning data. Each of the plurality of electronic devices is associated with an electronic device type. The provisioning system includes a provisioning control apparatus, and a provisioning equipment configured to be electrically connected with at least one of the plurality of electronic devices for provisioning the at least one electronic device. The provisioning system includes a provisioning security module configured to receive the device type information from the provisioning control apparatus and to generate provisioning data on the basis of the device type information. The provisioning security module transmits the provisioning data to the provisioning equipment for provisioning the at least one electronic device with provisioning data.

Abstract: A method is provided for provisioning a plurality of electronic devices with a respective provisioning data set. The respective provisioning data set includes at least one respective cryptographic key. In a development provisioning stage, the method involves provisioning one or more of the plurality of electronic devices with the respective provisioning data set, wherein in the development provisioning stage, at least one respective cryptographic key has a first key entropy. In a production provisioning stage, the method also includes provisioning one or more of the plurality of electronic devices with the respective provisioning data set. In the previsioning production stage, the at least one respective cryptographic key has a second key entropy, wherein the first key entropy is smaller than the second key entropy.

Abstract: A provisioning apparatus for performing a provisioning procedure with an electronic component for an electronic device. The provisioning procedure includes providing provisioning data to the electronic component and processing the provisioning data by the electronic component. The provisioning apparatus has a provisioning and sensing unit electrically connected with the electronic component for performing the provisioning procedure. The provisioning and sensing unit detects a power profile of the electronic component, which represents the electric power consumed by the electronic component and/or the electromagnetic power. The provisioning apparatus has a provisioning control unit configured to receive the power profile from the provisioning and sensing unit and to compare the power profile with a reference power profile for the electronic component.

Abstract: A provisioning control apparatus is configured to be coupled to a provisioning equipment server, which is electrically connectable with one or more electronic devices for provisioning the one or more electronic devices with first or second program codes. The provisioning control apparatus comprises: a communication interface configured to receive an electronic credit token having a credit counter; and a processor. The communication interface is configured to transmit the first and second program codes towards the provisioning equipment server. The processor is configured to update a value of the credit counter for each transmission of the first and second program codes to obtain an updated credit counter, and to prohibit a further transmission of the first or second program codes if the updated credit counter indicates that a number of transmissions is reached. A provisioning control system comprises the apparatus and a corresponding method for provisioning one or more electronic devices.

Abstract: A provisioning control apparatus is configured for coupling to a provisioning equipment server electrically connectable with electronic device(s) for provisioning the electronic device(s) with a program code according to a first provisioning service tier of provisioning service tiers. The provisioning control apparatus comprises a communication interface for receiving an electronic provisioning token and a processor for determining the basis of the electronic provisioning token a second provisioning service tier afforded by the electronic provisioning token. The communication interface can transmit the program code towards the provisioning equipment server; the processor prohibits a transmission of the program code towards the provisioning equipment server if the second provisioning service tier afforded by the electronic provisioning token is insufficient for provisioning of the electronic device(s) by the provisioning equipment server in accordance with the first provisioning service tier.

Abstract: A provisioning control apparatus is configured for coupling to a provisioning equipment server electrically connectable with an electronic device(s) for provisioning the electronic device(s) with a program code. The apparatus comprises: a communication interface configured to receive an electronic provisioning token including a provisioning counter indicating a total of transmissions of the program code towards the provisioning equipment server; and a processor configured to retrieve the provisioning counter from the received token. The interface can transmit the program code towards server; the processor can update a value of the counter for each transmission of the program code towards the server for an updated counter. The processor prohibits transmission of the program code towards the server if the updated counter indicates a total number of transmissions has been reached.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of an operating system when executed by the processor, and performs a cryptographic operation when the processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory area stores the operating system. The processor retrieves the boot program code from the first memory area and executes the boot program code to start the execution of the operating system. The processor re-executes the boot program code to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.

Abstract: A processor system includes a processor and a first memory area storing a boot program code. The boot program code starts execution of the operating system when executed by the processor, performs a cryptographic operation when processor executes the boot program code. A second memory area stores one or more cryptographic keys and is only accessible to the boot program code. A third memory stores the operating system. A communication interface receives data over a communication network. The processor retrieves the boot program code from the first memory area and executes the boot program code to start execution of the operating system. The processor terminates execution of the boot program code. The processor is configured to re-execute the boot program code while the operating system is executed to cryptographically encrypt data upon the basis of the cryptographic keys stored in the second memory area.