Method and apparatus for identifying FPGA configuration

Abstract

The invention relates to a method and a device for authenticating an FPGA configuration (2), comprising the following steps: at least partially reading (S1) the configuration (2) of the FPGA (1) by means of the FPGA (1) itself, and calculating a first checksum using the read configuration (2); and providing (S2) an authentication response (B) confirming that the FPGA configuration (2) is authentic if the first checksum matches a specified checksum, wherein the steps (S1) and (S2) are performed in an obfuscated manner, and if the first checksum does not match the specified checksum, no authentication response (B) confirming that the FPGA configuration (2) is authentic is provided or is provided only with a very low probability. In this respect, the FPGA can check its own configuration.

Description

Technical Field

[0001] FPGAs make it possible to approximate the speed of digital hardware using chips that are reprogrammable by software. Background Art

[0002] The name FPGA stands for Field Programmable Gate Array. On the FPGA chip there are multiple logic gates with variable assignable logic functions. The logic functions are usually implemented as a lookup table (LUT). The logic value of the combination is determined by looking up a bit in the table. For small n (e.g. n=6), any desired n-bit logic function can be represented by appropriately pre-assigning the table. In addition to logic functions and flip-flops, there are resources on the FPGA chip for directing logic signals. This is needed so that the input and output values ​​of the gates can reach other locations on the chip.

[0003] Logic circuits are usually defined in a high-level language, such as VHDL or Verilog. The manufacturer's development tools generate the assignments and boot settings of the LUTs from the high-level language and use this to generate a so-called bitstream, which then configures the FPGA.

[0004] However, the reprogrammability of FPGAs also poses a considerable security risk, since an attacker can use this high flexibility for himself. If an attacker can manipulate the bitstream or the configuration of the FPGA, security functions can be turned off, for example, or malicious hardware Trojans can be added to the FPGA system and reduce the security of the system. However, components of SoC systems (systems on a chip) can also be damaged by physical changes in the environment, for example due to undesired temperature changes. These can occur unintentionally (e.g. temperature fluctuations or radiation) as well as intentionally and deliberately in order to extract critical materials of the device, for example with the help of fault attacks.

[0005] Therefore, preventing FPGA manipulation is a high protection goal in both safety-related and security-related FPGA-based control devices. It aims to be able to prevent or at least detect manipulation. If manipulation of the device is detected, the system can handle the corresponding event. For example, the system can be blocked, or sensitive data can be deleted.

[0006] Therefore, a method for ensuring that a true configuration exists on the FPGA is needed. Since especially industrial applications remain in use for a long time, but safety requirements often increase in a short time, the method for ensuring a true FPGA configuration must be adaptable.

[0007] Security mechanisms that are permanently installed in FPGA chips by the manufacturer and are intended to ensure the authenticity of the bit stream are known. However, in many cases, their security has been compromised by side-channel attacks. For example, in the case of side-channel attacks, the cryptographic usage is not directly attacked, but rather its physical implementation is attacked.

[0008] Furthermore, the check is only performed during the operation of starting the FPGA and not during the runtime of the FPGA.In addition, the security mechanism used does not have any protection against attacks by quantum computers.

[0009] Obfuscation methods are also known for protecting FPGA contents.

[0010] Obfuscation of hardware and software involves presenting functions for processing digital information in such a way that the principles on which the processing is based cannot be discerned by human readers and analysis software. The purpose is to increase the efforts of reverse engineering in order to hinder targeted changes, or to distort the functions. In this case, all individual operations can be publicly discerned. The operations that are actually needed are often embedded in many operations that do not directly achieve the goal. In addition, hardware or software can be implemented for two different purposes in an interleaved and obfuscated manner so that an attacker cannot change one of the functions without changing the other.

[0011] Methods that combine PUF with self-reading of FPGA are also known. However, these methods only provide limited and discontinuous protection.

[0012] PUF stands for Physically Unclonable Function. It consists of hardware in which each copy behaves differently. Like a fingerprint, a PUF is used to make it possible to uniquely identify a chip or to create an encryption key. It is particularly advantageous in this case that this different behavior is achieved again and again in the same way in each hardware copy.

[0013] US 2015 / 012737 A1 relates to a method for securely booting a processor to execute trusted firmware / software.

[0014] US 2003 / 204743 A1 relates to authentication of integrated circuits. Designing an integrated circuit chip with a plurality of measurable physical properties that are difficult to replicate allows the chip to be authenticated by selectively measuring a subset of the physical properties and comparing the measurement results with stored measurements. Summary of the invention

[0015] It is therefore an object of the present invention to provide a method and a device for authenticating an FPGA configuration, with the result that the FPGA itself checks the authenticity of its configuration.

[0016] According to the invention, this object is achieved by means of a method for authenticating an FPGA configuration having the features specified in patent claim 1 .

[0017] Therefore, the present invention provides a method for identifying an FPGA configuration, which has the following steps:

[0018] The configuration of the FPGA is at least partially read with the aid of the FPGA itself, and a first checksum is calculated with respect to the configuration that has been read; and if the first checksum corresponds to a predefined checksum, an authentication response is provided that confirms that the FPGA configuration is authentic, wherein the steps are implemented in an obfuscated form, and wherein if the first checksum does not correspond to the predefined checksum, the authentication response that confirms that the FPGA configuration is authentic is not provided or is provided only with a very low probability.

[0019] It has been advantageously recognized that in methods that do not explicitly compare the first checksum with the predefined checksum, attacks and analysis of obfuscations are only possible with difficulty or not at all. In any case, the response is calculated using the first checksum and the predefined checksum. When the first checksum corresponds to the predefined checksum, the response is a correct authentication response. If the first checksum does not correspond to the predefined checksum, the response may constitute a correct authentication response only with a very low probability. For example, less than or equal to 2 -32 The probability is considered to be very low.

[0020] The method according to the invention can advantageously be used to check the plausibility of the FPGA configuration not only when starting the FPGA, but also during the runtime of the FPGA, in particular repeatedly.

[0021] Furthermore, changes in the FPGA configuration that occur, for example, due to manipulation attempts or due to random or intentional errors are detected in an improved manner. The authenticity can be detected and checked at any time, regardless of the security concept of the manufacturer of the FPGA.

[0022] If the FPGA supports the function of reading its configuration by itself, the method can be advantageously used or transplanted to all FPGAs.In addition, in contrast to the safety mechanisms permanently installed by the manufacturer, the method of the present invention can be updated.

[0023] The encryption methods used are advantageously interchangeable, so that the method according to the invention has a high encryption flexibility.

[0024] It is also advantageous that the method is also suitable for post-quantum methods and can be performed using the latter. It is therefore resistant to attacks from quantum computers. Post-quantum methods cannot be attacked using quantum computers.

[0025] Furthermore, the security level can be increased by appropriate selection of parameters, for example, for encryption.

[0026] In addition, the combination of self-reading of the FPGA configuration, obfuscation and PUF components creates the advantage that it is impossible to attack the obfuscation removal. In the case of a removal attack, the attacker removes a part of the obfuscated hardware or software and transfers it to his application unchanged. The attacker does not try to understand how the removed part works at all, but only relies on this part to still work correctly in his application, just as in its original environment. For example, the attacker can remove the obfuscation function of the device and can copy it in unchanged form to a new device in order to clone the original device. One possible way to avoid the removal attack involves linking the obfuscation function to a separate hardware, for example with the help of a PUF component.

[0027] The dependent claims and the exemplary embodiments described below relate to further advantageous configurations of the invention.

[0028] In one embodiment of the method, the first checksum is checked for a correspondence with a predefined checksum, and the authentication response is calculated only if a correspondence exists. The check may be performed, for example, by comparing the first checksum with a predefined checksum. The correspondence may preferably correspond to a real configuration of the FPGA.

[0029] In one advantageous embodiment, reading the FPGA configuration may include a complete read of the FPGA configuration.

[0030] In another advantageous embodiment, the predefined checksum can be formed with respect to a reference configuration of the FPGA.

[0031] In a possible embodiment of the method according to the invention, the predefined checksum comprises at least one hash value or at least one result of a cryptographic hash function or a one-way function.

[0032] In another possible embodiment of the method according to the invention, the providing of the authentication response comprises generating an asymmetric signature for a predefined authentication task.

[0033] In another possible embodiment of the method according to the invention, the authentication task comprises a random number. In this case, a random number (a number used only once) represents a value used only once. The random number can be implemented, for example, by means of a counter. It is also possible to use a random value as the random number. If the random number is taken from a sufficiently large set with a suitable distribution, the probability of a value repeating is so small that the security risk is negligible.

[0034] In this advantageous embodiment, the checking unit knows the public key and the signature checking method. The FPGA is provided with an assigned random number and the FPGA responds to the provided random number with a signature. The checking unit checks the authenticity of the signature using the public key of the asymmetric method it knows.

[0035] In another possible embodiment of the method according to the invention, the providing of the authentication response comprises decrypting an asymmetrically encrypted message.

[0036] In this advantageous embodiment, the public key and the encryption method are known to the checking unit.

[0037] In another possible embodiment of the method according to the invention, the asymmetrically encrypted message comprises a random number.

[0038] In another possible embodiment of the method according to the invention, the providing of the authentication response comprises decrypting a symmetrically encrypted message.

[0039] This embodiment is possible if the checking unit knows the secret key. In another embodiment, the checking unit does not know the secret key. In this embodiment, the obfuscation function for encryption is available to the checking unit in hardware and / or software form, wherein the secret key is hidden.

[0040] In another possible embodiment, the message includes a random number.

[0041] In another possible embodiment of the method according to the invention, the providing of the authentication response comprises symmetrically encrypting the message.

[0042] This embodiment is possible if the checking unit knows the secret key. In another embodiment, the checking unit does not know the key. In this embodiment, an obfuscation function for decryption is available to the checking unit in hardware and / or software form, wherein the secret key is hidden.

[0043] The authentication task with the obfuscation function is made available to the FPGA in encrypted form, and if the FPGA can provide a correct authentication response corresponding to the encrypted authentication task, the authenticity of the FPGA configuration can be assumed. Only then can the encrypted authentication task be decrypted and the correct authentication response provided.

[0044] In another embodiment, the message includes a random number.

[0045] In embodiments of the invention where the provision of the authentication response comprises symmetric encryption or decryption, it is advantageous to select an encryption method unknown to the public for the purpose of encrypting the message.Even if a commonly known method is used, it is also advantageous to appropriately modify parameters, such as constants.

[0046] If the encryption method is not known to an unknown third party (attacker), the encryption is advantageously improved.

[0047] In another embodiment of the method according to the invention the provision of the authentication response comprises a signal pattern in the form of one signal or a plurality of signals.

[0048] This has the advantage that no cryptographic calculations are required to check the authentication response.

[0049] In another possible embodiment of the method according to the invention, the obfuscated implementation of the steps according to claim 1 comprises data from a Physical Unclonable Function PUF.

[0050] This has the advantage that all or some of the data provided by the PUF component after error correction are included in the obfuscation calculation. The PUF component provides different data for each chip that is unknown to the attacker. The PUF component is provided with a PUF task and this provides a PUF response that depends on the chip used and is different from other chips. These data are unknown to the attacker and improve the obfuscation in the obfuscation calculation.

[0051] The PUF component advantageously provides protection against creating copies of the original firmware with no changes. In addition, the PUF data, which is unknown to the attacker, strengthens the effect of the obfuscation.

[0052] In another possible embodiment of the method according to the invention, the predefined checksum is stored in a memory unit external to the FPGA configuration.

[0053] This has the advantage that the predefined checksum is not stored in the bit stream or as part of the bit stream and / or the FPGA configuration. The bit stream can be stored separately in a memory unit.

[0054] In another possible embodiment of the method according to the invention, the predefined checksum is stored in cryptographically protected form and / or together with an additional cryptographic information item.

[0055] In this case, the circuit part of the FPGA configuration for processing the cryptographically protected form and / or the part for verifying the additional information is implemented in obfuscated form, which can only be separated from the obfuscated part with great difficulty. This has the advantage that the checksum stored in the memory cell cannot be manipulated.

[0056] In another possible embodiment of the method according to the invention, the predefined checksum is encrypted using PUF data. A PUF response is generated based on the PUF task. Protection of the predefined checksum used to check the FPGA configuration is increased.

[0057] This has the advantage that a plurality of secret test values ​​can be stored in a device-specific manner together with different response values ​​of the PUF component.If a checksum is already used, this is reconstructed with the aid of the stored data and the device-specific PUF response.

[0058] In another possible embodiment of the method according to the invention, a first checksum is provided if the specific information item is transmitted to the FPGA.

[0059] In one embodiment, the specific information includes, for example, specific signal patterns at multiple inputs of the FPGA configuration.

[0060] Advantageously, only the developer of the system knows this signal pattern to be created. This signal pattern can be protected from access by attackers in different ways, wherein the protection mechanism can advantageously be implemented in obfuscated form.

[0061] The checksum value of the FPGA configuration can only be read by the system developer who knows the specific information. This advantageously prevents the checksum from being read by an attacker for manipulation purposes, increasing security against manipulation.

[0062] In another possible embodiment of the method according to the invention, the specific information is encrypted or signed asymmetrically, encrypted symmetrically, or encrypted with data from the PUF.

[0063] In the case of asymmetric encryption, only the public key is present in the FPGA, while the developer of the system knows the private key.

[0064] In another possible embodiment of the method according to the invention, data from the PUF are provided if the specific information item is transmitted to the FPGA.

[0065] In one embodiment, the specific information includes, for example, specific signal patterns at multiple inputs of the FPGA configuration.

[0066] This has the advantage that only the developer of the system knows the specific signal pattern. Security is increased because access by unknown third parties is blocked.

[0067] In another possible embodiment of the method according to the present invention, the specific information is encrypted or signed asymmetrically or encrypted symmetrically.

[0068] Asymmetric encryption has the advantage that access by unknown third parties is blocked. The signal pattern is protected from access because only the public key is stored on the FPGA, while the developer knows the associated private key.

[0069] Symmetric encryption has the advantage that access by unknown third parties is blocked. The signal pattern is protected from access because only the developer knows the inverse representation of the representation stored on the FPGA.

[0070] In another possible embodiment of the method according to the invention, the identification is performed during the configuration of the FPGA and / or during runtime of the FPGA.

[0071] In another possible embodiment of the method according to the invention, the identification is performed repeatedly. For example, a safety mechanism is available which triggers an alarm and thus starts a repeated check of the FPGA configuration. In addition, the identification can be performed in a periodically repeated manner.

[0072] This has the advantage that changes in the FPGA configuration, for example due to manipulation attempts or due to randomly or intentionally caused errors, can be detected and corresponding measures can be taken.

[0073] The invention also provides a device for authenticating an FPGA configuration having the features specified in claim 14 .

[0074] Therefore, the present invention provides a device for identifying FPGA configuration, which is configured as follows:

[0075] at least partially reading the configuration of the FPGA by the FPGA itself and calculating a first checksum with respect to the configuration that has been read;

[0076] If the first checksum corresponds to a predefined checksum, an authentication response is provided, which confirms that the FPGA configuration is authentic, wherein at least part of the reading and calculation of the first checksum and the provision of the authentication response are implemented in an obfuscated form, and wherein if the first checksum does not correspond to the predefined checksum, an authentication response confirming that the FPGA configuration is authentic is not provided or is provided only with a very low probability.

[0077] In one embodiment, the system includes a computing system.

[0078] In an embodiment of the device of the invention, the part used to determine said checksum is validated to be genuine.

[0079] The invention also relates to a computer program product causing the method for identifying an FPGA configuration to be implemented on a physical device. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] The present invention is explained in more detail below based on exemplary embodiments with reference to the accompanying drawings.

[0081] In the attached picture:

[0082] Figure 1 shows a block diagram for illustrating an exemplary embodiment of an apparatus according to the present invention for identifying an FPGA configuration;

[0083] Figure 2 A flow chart is shown for illustrating a possible exemplary embodiment of the method according to the invention for identifying an FPGA configuration. DETAILED DESCRIPTION

[0084] Figure 1 A block diagram is shown for illustrating a possible exemplary embodiment of the device according to the invention. Figure 1 In the exemplary embodiment shown in , FPGA 1 contains FPGA configuration 2 .

[0085] The FPGA configuration 2 is loaded into the SRAM (Static Random Access Memory) of the FPGA 1 , for example, when the FPGA 1 is started and configured.

[0086] This installed FPGA configuration 2 is checked during runtime using the present invention and the authenticity or manipulation of the FPGA configuration 2 is determined.

[0087] The first component 6 and the second component 7 as well as the checking component 3 and the PUF component 5 are instantiated E via the FPGA configuration 2. For example, the first component 6 and the second component 7 may include a cryptographic accelerator or a processor. The FPGA configuration 2 may instantiate E other components. The checking component 3 and the PUF component are instantiated E by means of the FPGA configuration 2.

[0088] The checking component 3 checks the FPGA configuration 2. The PUF component 5 receives the PUF task and provides a PUF response according to the PUF task to the checking component 3. The PUF response remains on the FPGA 1 and is advantageously not used for further calculations.

[0089] The check component 3 receives the PUF response from the PUF component 5. The check component 3 also reads the FPGA configuration 2 from the SRAM and receives an encrypted check for checking the FPGA configuration 2. An authentication response B is provided according to the check result.

[0090] The authentication response B may be used to determine whether the FPGA configuration 2 running on the FPGA 1 has been compromised. In another embodiment, the authentication response B includes an alarm output in case of a negative check (eg, in case the FPGA configuration 2 has been compromised).

[0091] The FPGA 1 is also coupled to a memory unit 4, preferably to an external memory unit 4. The memory unit 4 is coupled to the FPGA 1 via an interface (not shown). The memory unit 4 is preferably in the form of a non-volatile memory, such as a flash memory.

[0092] The exemplary list does not exclude other storage elements known from the prior art that are used as storage unit 4. The predefined checksum is stored in encrypted form in storage unit 4. The predefined checksum is available to checking component 3 via the interface. In a first step S1, the first checksum is calculated using checking component 3. For this purpose, FPGA configuration 2 of F FPGA 1 is at least partially self-read by FPGA 1.

[0093] The checksum is calculated with respect to the FPGA configuration 2 that has been read. The calculated checksum may, for example, comprise a hash value. The calculated checksum is compared with the checksum stored in the storage unit 4. If the calculated checksum corresponds to a predefined checksum stored in the storage unit 4, the phase of authenticating the FPGA configuration 2 begins and an authentication response B is provided.

[0094] The authentication response B obfuscates the self-read FPGA configuration 2. The at least partial reading and calculation of the first checksum as well as the comparison of the first checksum with the predefined checksum and the provision of the authentication response B are carried out in an obfuscated form. Thus, it is advantageously not possible to clearly distinguish between the self-check of the FPGA 1 and the authentication response B.

[0095] Figure 2 A flow chart is shown for illustrating an exemplary embodiment of a method according to the invention for identifying an FPGA configuration.

[0096] In the exemplary embodiment shown, the method comprises a number of steps. In a first step S1 , the configuration 2 of the FPGA 1 is at least partially read S1 by the FPGA 1 itself and a first checksum is calculated with respect to the configuration 2 that has been read.

[0097] In a further step S2, if the first checksum corresponds to a predefined checksum, an authentication response B is provided, which confirms the authenticity of the FPGA configuration 2. Steps S1 and S2 are implemented in an obfuscated form. If the first checksum does not correspond to the predefined checksum, an authentication response B confirming the authenticity of the FPGA configuration 2 is not provided or is provided only with a very low probability.

[0098] The predefined checksum corresponds to the actual configuration of the FPGA 1 .

[0099] As a result of the FPGA configuration 2, said configuration is thus reported to the outside as true and calculations are performed which have no additional items of additional information, such as secret additional information items stored in the FPGA configuration 2, which can only be performed in an extremely complex manner.

[0100] In order to prevent the FPGA configuration 2 from being changed by an attacker in such a way that the authentication response B is provided even when the FPGA configuration 2 is not authentic, the circuit for reading and hashing the FPGA configuration must be obfuscated with the authentication response B. Therefore, advantageously, it is not clear to the attacker which circuit parts are used for self-checking and which parts are used for providing the authentication response B based on the obfuscated network list.

[0101] Overview

[0102] In summary, the present invention relates to a method and device for authenticating an FPGA configuration 2, which comprises the following steps: at least partially reading S1 the configuration 2 of the FPGA 1 with the aid of the FPGA 1 itself, and calculating a first checksum with respect to the already read configuration 2; if the first checksum corresponds to a predefined checksum, providing S3 an authentication response B confirming the authenticity of the FPGA configuration 2, wherein steps S1 and S2 are implemented in an obfuscated form, and wherein if the first checksum does not correspond to the predefined checksum, the authentication response B confirming the authenticity of the FPGA configuration 2 is not provided or is provided only with a very low probability.

[0103] In this regard, the FPGA can check its configuration itself.

Claims

1. A method for identifying an FPGA configuration (2), comprising the following method steps: - at least partially reading (S1) the configuration (2) of the FPGA (1) by means of the FPGA (1) itself and calculating a first checksum with respect to the configuration (2) that has been read; - if said first checksum corresponds to a predefined checksum, providing (S2) an authentication response (B) confirming that said FPGA configuration (2) is authentic, in, carrying out said steps (S1, S2) in an obfuscated form, wherein, if the first checksum does not correspond to the predefined checksum, then no authentication response (B) is provided to confirm that the FPGA configuration (2) is authentic, or is provided only with a very low probability, wherein the first checksum is provided if a specific information item is transmitted to the FPGA (1), and wherein the specific information comprises a signal pattern applied to a plurality of inputs of the FPGA configuration, Among other things, only the developer of the system knows about this signal pattern to be created.

2. The method according to claim 1, wherein: The predefined checksum comprises at least one hash value or a result of a cryptographic hash function.

3. The method according to claim 1 or 2, wherein: Providing the authentication response (B) comprises generating an asymmetric signature for a predefined authentication task (A).

4. The method according to claim 1 or 2, wherein: Providing the authentication response (B) includes decrypting the asymmetrically encrypted message.

5. The method according to claim 1 or 2, wherein: Providing the authentication response (B) includes decrypting the symmetrically encrypted message.

6. The method according to claim 1 or 2, wherein: Providing the authentication response (B) includes symmetrically encrypting the message.

7. The method according to claim 1 or 2, wherein: The obfuscated implementation of the steps according to claim 1 includes data from a Physical Unclonable Function (PUF) (5).

8. The method according to claim 1 or 2, wherein: The predefined checksum is stored in a storage unit (4) external to the FPGA configuration (2).

9. The method according to claim 7, wherein: The specific information is encrypted or signed asymmetrically, encrypted symmetrically, or encrypted with data from the PUF (5).

10. The method according to claim 7, wherein: If a specific information item is transmitted to the FPGA (1), data from the PUF (5) is provided.

11. The method according to claim 10, wherein: The specific information is encrypted or signed asymmetrically or encrypted symmetrically.

12. The method according to claim 1 or 2, wherein: Authentication is performed during configuration of the FPGA (1) and / or during runtime of the FPGA (1).

13. A device for identifying an FPGA configuration (2), configured as follows: - the FPGA (1) at least partially reads the configuration (2) of the FPGA (1) and calculates a first checksum with respect to the FPGA configuration (2) that has been read; - if said first checksum corresponds to a predefined checksum, providing an authentication response (B), said response confirming that said FPGA configuration (2) is authentic, in, performing at least part of the reading and calculation of said first checksum and the providing of said authentication response (B) in obfuscated form, wherein, if the first checksum does not correspond to the predefined checksum, then no authentication response (B) is provided to confirm that the FPGA configuration (2) is authentic, or is provided only with a very low probability, wherein the first checksum is provided if a specific information item is transmitted to the FPGA (1), and wherein the specific information comprises a signal pattern applied to a plurality of inputs of the FPGA configuration, Among other things, only the developer of the system knows about this signal pattern to be created.

14. A computer program product for executing the method according to any one of claims 1 to 12 on a device according to claim 13.

Images