intersil ISL9206 DATA SHEET

ISL9206

Data Sheet January 5, 2007

FlexiHash+™ For Battery Authentication

The ISL9206 is a highly cost-effective fixed-secret hash engine based on Intersil’s second generation FlexiHash™ technology. The device authentication is achieved through a challenge-response scheme customized for low-cost applications, where cloning via eavesdropping without knowledge of the device’s secret code is not economically viable. When used for its intended applications, the ISL9206 offers the same level of effecti v e ness as ot he r si gn i fi ca nt ly more expensive high-maintenance hash algorithm and authentication schemes.

The ISL9206 has a wide operating voltage range, and is suitable for direct powering from a 1-cell Li-Ion/Li-Poly or a 3-cell series NiMH battery pack. The ISL9206 can also be powered by the XSD bus when the bus pull-up voltage is

3.3V or higher. The device connects directly to the cell terminals of a battery pack, and includes on-chip voltage regulation circuit, POR, and a non-crystal based oscillator for bus timing reference.

Communication with the host is achieved through a singlewire XSD interface - a light-weight subset of Intersil’s ISD bus interface. The XSD bus is compatible for use with serial ports offered by all 8250 compatible UART’s or a single GPIO (general purpose input and output) pin of a microprocessor.

A clone prevention solution utilizing the ISL9206 offers safety and revenue protection at the lowest cost and power, and is suitable for protection against after-market replacement for a wide variety of low-cost applications.

Ordering Information

PART NUMBER

(Note)

ISL9206DHZ-T 206Z -20 to +85 5 Ld SOT-23

ISL9206DRZ-T 06Z -20 to +85 8 Ld 2x3 TDFN

NOTE: Intersil Pb-free plus anneal products employ special Pb-free material sets; molding compounds/die att ach materials and 100% matte tin plate termination finish, which are RoHS compliant and com patible with both SnPb and Pb-free soldering operations. Intersil Pb-free products are MSL classified at Pb-free peak reflow temperatures that meet or exceed the Pb-free requirements of IPC/JEDEC J STD-0 20.

PART

MARKING

TEMP.

RANGE (°C)

PACKAGE

(Pb-Free)

Tape and Reel

PKG.

DWG. #

P5.064

L8.2x3A

FN9260.2

Features

• Challenge-response based authentication scheme using 32-Bit challenge code and 8-Bit authentication code.

• Fast and flexible authentication process. Multi-pass authentication can be used to achieve the highest security level if necessary.

• 16x8 OTP ROM stores up to three sets of 32-Bit host-selectable secrets with additional programmable memory for storage of up to 48-Bits of ID code and/or pack information.

• FlexiHash+ engine uses two sets of 32-Bit secrets for authentication code generation.

• Non-unique mapping of the secret key to an 8-Bit authentication code maximizes hacking difficulty due to need for exhaustive key search (superior to SHA-1).

• Supports 1-cell Li-Ion/Li-Poly and 3-cell series NiMH battery packs (2.6V ~ 4.8V operation), or powered by the XSD bus.

• XSD single-wire host bus interface communicates with all 8250-compatible UART’s or a single GPIO. Supports CRC on read data and transfer bit-rate up to 23kbps.

• True “Zero Power” Sleep mode - automatically entered after a bus inactivity time-out period

• 5 Ld SOT-23 or 8 Ld TDFN (2mm x 3mm) packages

• -20°C to +85°C operating temperature range

• Pb-free plus anneal available (RoHS compliant)

Applications

• Battery Pack Authentication

• Printer Cartridges

• Add-on Accessories

• Other Non-Monetary Authentication Applications

Related Literature

• Application Note AN1165 “ISL6296 Evaluation Kit”

• Application Note AN1167 “Implementing XSD Host Using a GPIO”

Pinouts

ISL9206 (8 LD 2X3 TDFN)

TOP VIEW

VSS

VDD

• Technical Brief TB363 “Guidelines for Handling and

ISL9206 (5 LD SOT-23)

TOP VIEW

XSD

VSS

N/C

VDD

TIO

FlexiHash is a trademark of Intersil Americas Inc. All other trademarks mentioned are the property of their respective owners.

XSD

TIO

CAUTION: These devices are sensitive to electrostatic discharge; follow proper IC Handling Procedures.

1-888-INTERSIL or1-888-468-3774

Processing Moisture Sensitive Surface Mount Devices (SMDs)”

| Intersil (and design) is a registered trademark of Intersil Americas Inc.

ISL9206

Absolute Maximum Ratings (Reference to GND) Thermal Information

Supply Voltage (VDD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5V

All Other Pins. . . . . . . . . . . . . . . . . . . . . . . . . . . . . -0.5 to V

ESD Rating

+0.5V

Human Body Model (Per MIL-STD-883 Method 3015.7) . . .4000V

Machine Model (Per EIAJ ED-4701 Method C-111). . . . . . . .400V

CDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1000V

Recommended Operating Conditions

Ambient Temperature Range. . . . . . . . . . . . . . . . . . .-20°C to +85°C

CAUTION: Stresses above those listed in “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress only rating and operation of the device at these or any other conditions above those indicated in the operational sections of this specification is not implied.

NOTE:

is measured with the component mounted on a high effective thermal conductivity test board in free air. See Tech Brief TB379 for details.

1. θ

is measured in free air with the component mounted on a high effective thermal conductivity test board with “direct attach” features. See

2. θ

Tech Brief TB379.

3. For θ

, the “case temp” location is the center of the exposed metal pad on the package underside.

Electrical Specifications Unless otherwise noted, all parameters are guaranteed over the operational supply voltage and temperature

range of the device as follows: T

PARAMETER SYMBOL TEST CONDITIONS MIN TYP MAX UNITS

DC CHARACTERISTICS

Supply Voltage V

During normal operation 2.6 - 4.8 V

During OTP ROM programming 2.8 - 4.8 V

Run Mode Supply Current (exclude I/O current)

Sleep Mode Supply Current: I OTP Programming Mode Supply Current I Internal Regulated Supply Voltage V Internal OTP ROM Programming Voltage V POR Release Threshold V POR Assertion Threshold V

VDD = 4.2V - 110 140 μA

VDD = 4.8V - 120 160 μA

DDSVDD DDP

RG PP

POR+

POR-

= 4.2V, XSD pin floating - 0.15 0.5 μA For ~ 1.8ms duration per write operation - 250 500 μA Observable only in test mode 2.3 2.5 2.7 V Observable only in test mode 11 12 13 V

XSD PIN CHARACTERISTICS

XSD Input Low Voltage V XSD Input High Voltage V

XSD Input Hysteresis V XSD Internal Pull-Down Current I

XSD Output Low Voltage V XSD Input Transition Time t XSD Output Fall Time t XSD Pin Capacitance C

IL IH

HYS

VDD = 2.6V - 0.8 - μA

= 4.2V - 1.2 2.0 μA

= 4.8V - 1.8 2.5 μA

OLIOL

= 1mA - - 0.4 V 10% to 90% transition time - - 2 μs 90% to 10%, C

XSD BUS TIMING CHARACTERISTICS (Refer to XSD Bus Symbol Timing Definitions Tables) Programming Bit Rate x = 0.5 to 4 2.89 - 23.12 kHz XSD Input Deglitch Time T

Pulse width narrower than the deglitch time will not cause

WDG

the device to wake up

= -20°C to +85°C; VDD = 2.6V to 4.8V.

LOAD

Thermal Resistance (Typical) θ

(°C/W) θJC (°C/W)

SOT-23 Package (Note 1) . . . . . . . . . . 200 N/A

2x3 TDFN Package (Notes 2, 3) . . . . . 70 10.5

Maximum Junction Temperature (Plastic Package) . . . . . . .+125°C

Maximum Storage Temperature Range. . . . . . . . . .-40°C to +125°C

Maximum Lead Temperature (Soldering 10s) . . . . . . . . . . . .+300°C

1.9 2.2 2.4 V

1.5 1.8 2.1 V

-0.4 - 0.5 V

1.5 - VDD+

0.4V

- 400 - mV

= 12pF - - 50 ns

-6-pF

7-20μs

FN9260.2

January 5, 2007

ISL9206

Electrical Specifications Unless otherwise noted, all parameters are guaranteed over the operational supply voltage and temperature

range of the device as follows: T

PARAMETER SYMBOL TEST CONDITIONS MIN TYP MAX UNITS

Device Wake-Up Time T

Device Sleep Wait Time T

Auto-Sleep Time-Out Period T

OTP ROM Write Time T

Hash Calculation Time T

Soft-Reset Time T

AC CHARACTERISTICS

Oscillator Clock Frequency f Charge Pump Clock Frequency f

From falling-edge of break command issued by host to

WKE

falling-edge of break command returned by device From when the ‘11’ Opcode is detected to the shut-off of

SLP

the internal regulator From the last transition detected on the XSD bus to the

ASLP

device going into sleep mode From the last BT of the 2nd write data frame to when

EEW

device is ready to accept the next instruction From the last BT of the Challenge Code Word from the

HASH

host to the Authentication Code being available for read From the last BT of the Soft-Reset instruction issued by

SRST

the host to the falling-edge of break command returned by device

Internal bus reference clock 505 532 560 kHz

OSC

Internal high speed clock (observable only in test mode)

= -20°C to +85°C; VDD = 2.6V to 4.8V. (Continued)

35 60 100 μs

4--μs

0.9 - 1.1 s

-1.81.9ms

-1-BT

--30μs

Low-speed mode 3.6 5 6 MHz High-speed mode 16 20 24 MHz

Pin Descriptions

SOT-23

PIN NUMBER

1 1 VSS System ground. 2 2, 3, 6, 7 NC No connection. 3 4 VDD Supply voltage. 4 5 TIO Production test I/O pin. Used only during production testing. Must be left floating during

5 8 XSD Communication bus with weak internal pull-down to VSS. This pin is a Schmitt-trigger input

PIN NUMBER PIN NAME DESCRIPTION

TDFN

normal operation.

and an open-drain output. An appropriate pull-up resistor is required on the host side.

FN9260.2

January 5, 2007

Typical Applications

FIGURE 1. TYPICAL APPLICATION WITH THE ISL9206 POWERED BY THE BATTERY

FIGURE 2. TYPICAL APPLICATION WITH THE ISL9206 POWERED BY THE XSD BUS

PACK+

XSD

PACK-

PACK+

XSD

PACK-

100Ω

5.1V

100Ω

5.1V

ISL9206

VDDXSD

VSS

VDDXSD

VSS

100Ω

0.1µF

PROTECTIONISL9206

Block Diagram

XSD

VDD

ESD DIODE

COMM

INTERFACE

AUTH

SESL

CHLG

FLEXIHASH+

ENGINE

ESD DIODE

MSCR STAT

POR/2.5V

REGULATOR

XSD

OSCILLATOR

DCFG (1 BYTE)

DTRM (1 BYTE)

SECRET #1

(4 BYTES)

SECRET #2

(4 BYTES)

SECRET #3

(4 BYTES)

GENERAL PURPOSE

(2 BYTES)

16 BYTES

OTPROM

CONTROL/STATUS/

TEST INTERFACE

ANALOG

DIGITAL

TIO

VSS

FIGURE 3. FUNCTIONAL BLOCK DIAGRAM

FN9260.2

January 5, 2007

ISL9206

Theory of Operation

The ISL9206 contains all circuitry required to support battery pack authentication based on a challenge-response scheme. It provides a 16-Byte One-Time Programmable Read-Only Memory (OTPROM) space for the storage of up to 96-Bit of secret for the authentication and other user information. A 32-Bit hash engine (FlexiHash+™) calculates the authentication result immediately after receiving a 32-Bit random challenge code. The communication between the ISL9206 and the host is implemented through the XSD single-wire communication bus.

Major functions within the ISL9206 include the following, as shown in Figure 3.

• Power-on reset (POR) and a 2.5V regulator to power all internal logic circuits.

• 16 x 8-Bit (16-Byte) OTP ROM as shown in Table 8. The first part (two bytes) contains the device default configuration (DCFG) information (such as the device address and the XSD communication speed) and the default trimming (DTRM) information (such as the internal oscillator frequency trimming). The second part contains two groups (12-Byte) of memory that can be independently locked out for the storage of up to three sets of secret. The last part provides two additional bytes of space for general-purpose information.

• Control functions, including master control (MSCR) and status (STAT) registers (as shown in Table 9), interrupt generation, and the test-related interface.

• FlexiHash+™ engine that includes the 32-Bit highly nonlinear proprietry hash engine, secret selection register, challenge code register, and the authentication result register. Table 10 shows all the registers.

• XSD communication bus Interface. The XSD device address and the communication speed are configured in the DCFG address in the OTPROM, as given in Table 8.

• Time Base Reference.

The following explain in detail the operation of the ISL9206.

Power-On Reset (POR)

The ISL9206 powers up in Sleep mode. It remains in Sleep mode until a power-on ‘break’ command is received from the host through the XSD bus. The initial power-on ’break’ can be of any pulse width as long as it is wider than the XSD input deglitch time (20μs). Once the ‘break’ command is received, the internal regulator is powered up. About 20μs after the falling edge of the power-on ‘break’, an internal POR circuit releases the reset to the digital block, and a POR sequence is started. During the POR sequence, the ISL9206 initializes itself by loading the default device configuration information from pre-assigned locations within the OTP ROM memory. After initialization, a ‘break’ command is returned to the host to indicate that the ISL9206 is ready and waiting for a bus transaction from the host.

HOST BREAK

DEVICE BREAK

XSD BUS

WAVEFORM

(A) WHEN THE HOST POWER-ON BREAK IS WIDER THAN 60µs.

HOST BREAK

DEVICE BREAK

XSD BUS

WAVEFORM

(B) WHEN THE HOST POWER-ON BREAK IS NARROWER THAN 60µs.

FIGURE 4. POWER-ON BREAK SIGNAL TO WAKE-UP THE

ISL9206 FROM SLEEP MODE

60µs

TYP

1.391 BT

Note that the ISL9206 will initiate the power-on sequence without waiting for the power-on ‘break’ signal to return to the high state. If the host sends an initial ‘break’ pulse wider than 60μs, the device-ready ‘break’ returned by the ISL9206 will likely be merged with the pulse sent by the host and, therefore, may not be detectable. Figure 4 illustrates the waveforms during the Power-on Reset. Figure 4 (A) represents the case when the power-on ‘break’ rising edge occurs after the device starts sending the ‘break’. Figure 4 (B) represents the case when the power-on ‘break’ finishes before the device sends its ‘break’. The device break signal is always 1.391 times of the device bit-time (BT, see XSD Bus Interface section for more details). Either case in Figure 4 will wake up the device successfully if the device is in the sleep mode.

It is important to keep in mind that a narrow ‘break’ signal will be taken as a normal bit signal and cause errors, if the device is not in the sleep mode. For this reason, the narrow

power-on ‘break’ signal should be used only if the user has to see the returned ‘break’ signal.

Auto-Sleep

While the ISL9206 is powered up and there is no bus activity for more than about 1 second, the device will automatically return to Sleep mode. Sleep mode can be entered independent of whether the XSD bus is held high or low. While the ISL9206 is in Sleep mode, it is recommended that the XSD bus be held low to eliminate current drain through the XSD-pin internal pull-down current.

Auto-Sleep mode can be disabled by clearing the ASLP bit in the MSCR register. By default, Auto-Sleep is always enabled at power-up and after a soft reset. Auto-sleep function can be permanently disabled by clearing the 0-00[2] bit (the ASLP bit in DCFG) during OTP ROM programming.

FN9260.2

January 5, 2007

ISL9206

OTP ROM

The 16-Byte OTP ROM memory is based on EEPROM technology and is incorporated into the ISL9206 for storage of non-volatile information. OTP ROM contents (refer to Table 8) can include but not limited to:

1) Device default settings (address 0-00)

2) Factory programmed trim parameters (address 0-01)

3) Device authentication secrets (address 0-02 to 0-0D)

4) Pack information and ID (address 0-0E and 0-0F) The memory can be written multiple times before two lock-

out bits (SLO[1:0] in DCFG, see Table 8) being set. The SLO[1] (bit 1) locks out the memory between 0-02 and 0-09 and the SLO[0] (bit 0) locks out the memory between 0-0A to 0-0D. These two bits can be set independently. Prior to lockout, the memory can be written and read directly through the XSD bus interface. After lock-out, writing to all ROM addresses and reading from secret code locations will be permanently disabled after performing a reset cycle.

Writing to the EEPROM requires the supply voltage at the VDD pin be maintained at a minimum of 2.8V. Failure to do so may result in unreliable ROM programming or total write failure.

The OTP ROM must be written two bytes at a time, but 2, 4 or 16-Bytes of data can be read by the host in a single bus transaction. Only even addresses are allowed in OTP ROM read/write. A 16-Byte read with CRC allows the entire ROM content to be quickly verified by simply checking the CRC byte. The DTRM address stores the default trimming parameters and is a read-only address. The DCFG and DTRM (0-00 and 0-01 addresses) need be written simultaneously but the data to the DRTM address is ignored.

The OTP ROM writing process takes approximately 1.8ms per two-byte. While the write process is taking place, no bus transaction is allowed. Attempt to access the ISL9206 during an on-going write process will result in the device ignoring the access instruction and issuing an interrupt to the host. The OTP ROM programming is register-based, and may be performed at the pack manufacturer’s facility.

Device Control and Status

The ISL9206 has a control and a status register. The control register can be read and written by the host but the status register is read only. Both registers contain the device configuration information (see Table 9). The status register also contains the device status information that may lead to an interrupt signal to the host.

Following a host-initiated power-on ‘break’ signal or soft reset command, the ISL9206 will configure its default mode of operation based on information stored within DCFG address of the OTP ROM. The default configuration is loaded into the master control (MSCR) and the status

(ST AT) registers. Functions that are configured by OTP ROM settings include:

a) device address (DAB[1:0]) b) XSD bus speed (SPD[1:0]) c) register default settings (eINT and ASLP) d) ROM read/write lock-out (SLO[1:0])

The ISL9206 incorporates interrupt functions to allow the host to be quickly informed of device status and error conditions. Available interrupts are summarized in T able 1.

When an interrupt enable bit is set, a ’break’ command is sent to the host whenever its corresponding interrupt status bit is set. After this, the host should read the STAT register immediately. If the following instruction frame from the host does not access the STAT register, another ‘break’ will be sent immediately after receiving the full instruction frame. This process is repeated until the host reads from the STAT register. Upon reading of the ST AT register, all status bits will be cleared.

Refer to the MSCR and STAT register descriptions for detailed explanation of the interrupt functions.

FlexiHash+™ Engine

The FlexiHash+™ engine contains a 32-Bit highly non-linear proprietry hash engine and three registers. T able 10 lists the three registers. The 1-Byte secret selection (SESL) register select two sets of secret (32-Bit each) from the OTP ROM to program the hash engine. The 4-Byte challenge code register (CHLG) receives the challenge code from the host through the XSD bus. Once the challenge code is received, the hash engine generates a 1-Byte authentication result code and stores in the AUTH register for the host to read. Figure 5 shows the data flow of the authentication process. The following sections describe the authentication process and FlexiHash+™ encoding scheme in detail.

THE DEVICE AUTHENTICATION PROCESS

To start an authentication process, the host sends a ‘break’ command to wake up the ISL9206. Then host writes to the SESL register to select the two sets of secrets to be used for authentication code generation. After that, the host generates a pseudo-random 4-Byte challenge code to input into the CHLG register to initiate the authentication process. Upon receiving the fourth byte of the challenge code, the ISL9206 immediately starts computing the authentication code. Once the computation is completed, the 8-Bit authentication code is made available at the AUTH register for the host to read out. The host reads this code and, concurrently, calculates the correct authentication code based on the challenge code it generated and the same secrets chosen, and finally compares the result with the authentication code read from the device. If the codes do not match up, the device is a fake device and the host may shut itself down. The flow chart in Figure 6 summarizes the above process that the host needs to execute.

FN9260.2

January 5, 2007

+ 11 hidden pages