System and method for commissioning cryptographic modules

Abstract

The integrated circuit includes a first cryptographic module that enables debugging of the first cryptographic module and a second cryptographic module that disables debugging of the second cryptographic module. Each of the first cryptographic module and the second cryptographic module has a logical cryptographic boundary that includes the first block. The logical cryptographic boundary of the first cryptographic module includes a second block not included within the logical cryptographic boundary of the second cryptographic module. The logical cryptographic boundary of the second cryptographic module includes a third block that is not included within the logical cryptographic boundary of the first cryptographic module.

Description

Technical Field

[0001] The present disclosure relates to electronic circuit systems and methods, and more particularly, to systems and methods for debugging cryptographic modules. Background Art

[0002] Federal Information Processing Standard (FIPS) version 140-3 defines the requirements for cryptographic modules to obtain FIPS certification. FIPS certification of a cryptographic module allows any U.S. government agency to purchase products that contain the cryptographic module. FIPS includes different security levels (SL) for cryptographic modules, ranging from SL1 to SL4. Security Level 1 (SL1) is the lowest security level, and Security Level 4 (SL4) is the highest security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Figure 1 is a flow chart illustrating an example of operations for powering on an integrated circuit device using one of two different firmware images that implement cryptographic modules having different FIPS security levels.

[0004] Figure 2 is a diagram illustrating an example of a logical cryptographic boundary for a FIPS SL2 cryptographic module in an integrated circuit (IC) device using dashed lines.

[0005] Figure 3 is a diagram illustrating an example of a logical cryptographic boundary for a FIPS SL1 cryptographic module in an IC device using dashed lines.

[0006] Figure 4 is a diagram of an illustrative example of a configurable integrated circuit (IC) that may include a cryptographic module disclosed herein. DETAILED DESCRIPTION

[0007] The Federal Information Processing Standard (FIPS) also includes Security Level 2 (SL2) for cryptographic modules. Requirement 5.16 in FIPS 140-3 (ISO 19790) states that for Security Level 2 (SL2) and higher, "No service or control settings shall be made available via the module interface to allow an operator to start or perform debugging techniques while operating." For FIPS, debugging techniques include starting / stopping program execution, single-stepping through instructions, and reading or writing memory or registers. The lack of debugging capabilities in SL2 FIPS modules is an issue faced by all vendors building FIPS modules.

[0008] The purpose of requirement 5.16 is to reduce the attack surface of cryptographic modules by denying a "back door" for attackers to steal information, such as sensitive security parameters (SSPs). SSPs can include, for example, private keys or seed values. However, end customers are limited in their ability to debug any FIPS-certified cryptographic module that uses SL2 or higher security levels. In addition, the lack of debugging capabilities of these cryptographic modules severely hinders product development and failure analysis of problems that arise in the field. Only FIPS140-3 modules that claim Security Level 1 (SL1) can allow debugging.

[0009] According to some examples disclosed herein, two different FIPS certified cryptographic modules with different security levels are included in a single product. The first cryptographic module complies with FIPS security level 1 (SL1), and therefore, debugging capabilities are enabled in the first cryptographic module. The second cryptographic module complies with FIPS security level 2 (SL2), and therefore, debugging capabilities are disabled in the second cryptographic module. The first cryptographic module and the second cryptographic module can be logically identical, except that debugging is disabled in the second cryptographic module. The first cryptographic module and the second cryptographic module can be, for example, FIPS certified.

[0010] The first cryptographic module and the second cryptographic module use different firmware images in the product. In response to an indication to enable debugging, execution of the first cryptographic module (SL1) and execution of the second cryptographic module (SL2) take different paths. This implementation complies with FIPS requirements that debugging techniques are not allowed when a cryptographic module that complies with a SL2 or higher security level is operating in a device. This implementation also allows a user to debug a first SL1-compatible cryptographic module that includes the same security functions implemented in a second SL2-compatible cryptographic module. Therefore, a user can identify the source of an error in a security function implemented by the second cryptographic module by performing a debugging function on the same security function implemented by the first cryptographic module. This implementation substantially reduces the cost and workload of debugging cryptographic modules.

[0011] One or more specific examples are described below. In order to provide a concise description of these examples, not all features of actual implementations are described in the specification. It should be appreciated that in the development of any such actual implementation, as in any engineering or design project, many implementation-specific decisions must be made to achieve the developer's specific goals, such as complying with system-related and business-related constraints, which may vary from implementation to implementation. In addition, it should be appreciated that such development work can be complex and time consuming, but it is still a routine design, fabrication, and manufacturing effort for a person of ordinary skill having the benefit of this disclosure.

[0012] The present disclosure discusses integrated circuit devices, including programmable (configurable) integrated circuits, such as field programmable gate arrays (FPGAs). As described herein, an integrated circuit (IC) may include hard logic and / or soft logic. As used herein, "hard logic" generally refers to circuits in an integrated circuit device that are not programmable by an end user. Circuits in an integrated circuit device (e.g., in a programmable IC) that are programmable by an end user are referred to as "soft logic."

[0013] Figure 1 The flowchart shows an example of an operation in which an integrated circuit device can be powered on using one of two different firmware images that implement cryptographic modules with different FIPS security levels. Each of the two firmware images implements a different FIPS cryptographic module, as represented by different certification numbers N1 and N2. The firmware image with certification number N1 implements a cryptographic module that complies with FIPS SL1, wherein debugging capabilities are enabled. The firmware image with certification number N2 implements a cryptographic module that complies with FIPS SL2, wherein debugging capabilities are disabled. The two SL1 and SL2 cryptographic modules can be, for example, FIPS certified. The integrated circuit (IC) device can be any type of IC device, such as, for example, a configurable logic IC (e.g., a field programmable gate array (FPGA)), a microprocessor or central processing unit (CPU) IC, a graphics processing unit (GPU) IC, a memory IC, etc.

[0014] A user of an integrated circuit (IC) device may set a flag that is, for example, stored in a memory in the IC device or provided to the IC device during power-on of the IC device. The flag indicates which of two firmware images N1 or N2 the IC device boots into during power-on. The flag may, for example, reside in a basic input output system (BIOS), non-volatile memory (e.g., flash memory), or volatile memory in the IC device. Alternatively, the user may set the value of the flag during power-on of the IC device by pressing a button or by a jumper on a circuit board on which the IC device is mounted.

[0015] exist Figure 1 In operation 101 shown, the IC device begins to power on and begins to perform operations associated with booting the IC device. In decision operation 102 during IC device power on, the IC device detects a value of a flag (e.g., stored in a memory or in response to a user input) and determines which firmware image to load into the IC device during boot based on the value of the flag.

[0016] If the flag is set to a first value in operation 102, the IC device loads a firmware image of a FIPS SL2 cryptographic module having a certification (cert.) number N2 into hardware in the IC device in operation 103. In some implementations, the first value of the flag is a default value of the flag, such that the IC device boots to the FIPS SL2 cryptographic module having the certification number N2 by default, unless the flag is set to a second value. In these implementations, the IC device boots to the FIPS SL2 cryptographic module with debug functions disabled by default.

[0017] If the flag is set to the second value in operation 102, then in operation 104, the IC device loads the firmware image of the FIPS SL1 cryptographic module with the certification number N1 into the hardware in the IC device. Therefore, the user can set the flag to the second value to enable the IC device to boot (or restart) into the FIPS SL1 cryptographic module with the debugging function enabled, so as to debug the IC device. Then, the user can debug the IC device using the debugging function enabled in the FIPS SL1 cryptographic module. After operation 103 or operation 104, the IC device continues to boot execution in operation 105. The IC device can only switch between the firmware images for the FIPS SL1 and SL2 cryptographic modules by performing operations 101-105 again. Therefore, the IC device cannot switch between the firmware images for the FIPS SL1 and SL2 cryptographic modules unless a hard reset is performed or the IC device is powered off and then powered on and then different firmware images are loaded.

[0018] As an example, a firmware image may be implemented as a configuration data bitstream that is loaded into a configurable logic IC during IC power-up. As another example, a firmware image may be implemented as a software program that is loaded from a BIOS into a volatile memory in a processor IC during IC power-up. Having two cryptographic modules with different security levels in an IC device provides a substantial advantage to a user, allowing the user to debug the IC device using production versions of hardware and firmware.

[0019] Figure 2 and Figure 3 is a diagram using dashed lines to illustrate an example of a unique logical cryptographic boundary in an electronic integrated circuit device 200, the unique logical cryptographic boundary defining the Figure 1 The cryptographic module is implemented in two firmware images. Figure 21 is a diagram using dashed lines to illustrate an example of a logical cryptographic boundary 210 in an IC device 200, the logical cryptographic boundary 210 being used for a FIPS SL2 cryptographic module with certification number N2 implemented by a firmware image 206 and loaded into the IC device 200 in operation 103. The FIPS SL2 cryptographic module with certification number N2 includes function blocks 201 and 202 and a persistent storage block 204, which are located in Figure 2 210 is shown within the logical cryptographic boundary.

[0020] Figure 3 2 is a diagram using dashed lines to illustrate an example of a logical cryptographic boundary 220 in an IC device 200 for a FIPS SL1 cryptographic module with certification number N1 implemented by firmware image 207 and loaded into the IC device 200 in operation 104. The FIPS SL1 cryptographic module with certification number N1 includes Figure 3 2 , a debug interface 203, and a persistent storage block 205 are shown within the logical cryptographic boundary 220 in FIG. The functional blocks 201 and 202 may be logic circuit blocks (or logic blocks). As a more specific example, the functional blocks 201 and 202 may include configurable logic circuit blocks in a configurable logic IC or arithmetic logic unit (ALU) circuit blocks in a processor IC.

[0021] like Figure 2-Figure 3 As shown, the logical boundary 210 and the logical boundary 220 overlap, so that the cryptographic modules implemented by both the firmware image 206 and the firmware image 207 in the IC device 200 include the same functional blocks 201-202. Since the SL1 and SL2 cryptographic modules implemented by the firmware image 207 and the firmware image 206 include the same functional blocks 201-202, the SL1 and SL2 cryptographic modules having the certification numbers N1 and N2, respectively, can perform the same logically identical functions.

[0022] However, in order to comply with FIPS 140-3, debug interface block 203 is not included in logical boundary 210 of the FIPS SL2 cryptographic module having certification number N2 and implemented by firmware image 206, as shown in FIG. Figure 2 Thus, when firmware image 206 is loaded into IC device 200, all debug functions of the FIPS SL2 cryptographic module are disabled. For example, firmware image 206 may disable debug interface block 203 by shutting down or powering off debug interface block 203 and / or blocking all outputs and / or inputs of debug interface block 203.

[0023] The debug interface block 203 is included only in the logical boundary 220 of the FIPS SL1 cryptographic module with certification number N1, such as Figure 3When the firmware image 207 is loaded into the IC device 200, the debug interface block 203 allows the user of the IC device 200 to perform debug functions on the FIPS SL1 cryptographic module with the certification number N1. For example, the debug functions may include starting / stopping program execution, single-stepping instructions, and reading or writing memory or registers. As an example that is not intended to be limiting, the debug interface block 203 may include a JTAG (Joint Test Action Group) interface and / or a JTAG controller for debugging the FIPS SL1 cryptographic module loaded in the IC device 200.

[0024] As described above, the SL1 and SL2 cryptographic modules implemented by the firmware image 207 and the firmware image 206 can perform the same logically identical functions, because both the logical boundary 220 and the logical boundary 210 for the SL1 and SL2 cryptographic modules include the same functional blocks 201-202. Therefore, the user of the IC device 200 can restart the IC device 200, load the firmware image 207 for the SL1 cryptographic module into the IC device 200 (as described herein with respect to Figure 1 ), and then use the debugging function provided by the debug interface block 203 to debug the function blocks 201-function blocks 202 to debug errors in the logical functions performed by the function blocks 201-function blocks 202 within the SL2 cryptographic module implemented by the firmware image 206.

[0025] Additionally, the FIPS SL2 and SL1 cryptographic modules in IC device 200 include different non-overlapping persistent (eg, non-volatile) storage blocks, such as Figure 2-Figure 3 The FIPS SL2 cryptographic module with certification number N2 includes a persistent storage block 204, such as Figure 2 The FIPS SL1 cryptographic module with certification number N1 includes a persistent storage block 205, such as Figure 3 200. The persistent storage block 204-persistent storage block 205 may be used to store SSPs (e.g., private keys, seed values, etc.) and may be implemented by various storage devices, such as fuses, non-volatile memory circuits (e.g., flash memory), physically unclonable functions, etc. FIPS SL1 and SL2 cryptographic modules have separate storage blocks in IC device 200 because sharing SSP values ​​outside the logical boundaries of the cryptographic modules would violate FIPS requirements. When the firmware image 207 for the FIPS SL1 cryptographic module is loaded into IC device 200, the FIPS SL1 cryptographic module cannot access the persistent storage block 204 or any data stored in the persistent storage block 204.

[0026] FIPS140-3 allows cryptographic modules to exceed the requirements of any security level. For example, if a cryptographic module complies with SL2, it is allowed to implement some components of the cryptographic module as security level SL3 or SL4, but the overall security level of the cryptographic module is still SL2. Table 1 below shows an example of the security level of a FIPS SL2 cryptographic module.

[0027] Table 1

[0028]

[0029]

[0030] Table 2 below shows an example of a FIPS SL1 cryptographic module that has the same security level as the SL2 cryptographic module in Table 1 in terms of the security features in every row of Table 2 except row 5. Because the SL1 cryptographic module in Table 2 allows debugging, that portion of the cryptographic module must be at SL1, which means that the overall security level of the cryptographic module in Table 2 can only be at SL1.

[0031] Table 2

[0032]

[0033] Figure 4 4 is a diagram of an illustrative example of a configurable integrated circuit (IC) 400. Configurable IC 400 is an example of an IC (eg, IC device 200) that may include any of the cryptographic modules disclosed herein. Figure 4 As shown, the configurable integrated circuit 400 includes a two-dimensional array of functional blocks, including a logic array block (LAB) 410 and other functional blocks, such as, for example, a random access memory (RAM) block 430 and a digital signal processing (DSP) block 420. The functional block (e.g., LAB 410) may include a smaller programmable area (e.g., a logic element, a configurable logic block, or an adaptive logic module) that receives an input signal and performs a customized function on the input signal to generate an output signal. LAB 410 and DSP block 420 are examples of functional blocks in a cryptographic module, such as functional blocks 201-202.

[0034] In addition, the configurable integrated circuit 400 may have an input / output element (IOE) 402 for driving the signal of the configurable integrated circuit 400 and for receiving signals from other devices. The input / output element 402 may include a parallel input / output circuit system, a serial data transceiver circuit system, a differential receiver and transmitter circuit system, or other circuit systems for connecting an integrated circuit to another integrated circuit. As shown, the input / output element 402 may be located around the periphery of the IC. If desired, the configurable integrated circuit 400 may have input / output elements 402 arranged in different ways. For example, the input / output element 402 may form one or more columns of input / output elements, which may be located at any position on the configurable integrated circuit 400 (e.g., evenly distributed across the width of the configurable integrated circuit). If desired, the input / output element 402 may form one or more rows of input / output elements (e.g., distributed across the height of the configurable integrated circuit). Alternatively, the input / output elements 402 may form islands of input / output elements that may be distributed across the surface of the configurable integrated circuit 400 or clustered in selected areas.

[0035] The configurable integrated circuit 400 may also include a programmable interconnect circuit system in the form of vertical wiring channels 440 (i.e., interconnects formed along the vertical axis of the configurable integrated circuit 400) and horizontal wiring channels 450 (i.e., interconnects formed along the horizontal axis of the configurable integrated circuit 400), each wiring channel including at least one track to route at least one conductor.

[0036] Note that except Figure 4 In addition to the topology of the interconnect circuit system depicted in , other routing topologies can also be used. For example, the routing topology can include wires that run diagonally or wires that run horizontally and vertically along different parts of their range and wires that are perpendicular to the device plane in the case of a three-dimensional integrated circuit, and the driver of the wire can be located at a different point than one end of the wire. The routing topology can include global wires that span substantially all of the configurable integrated circuit 400, partial global wires (e.g., wires that span a portion of the configurable integrated circuit 400), staggered wires of a specific length, smaller local wires, or any other suitable interconnect resource arrangement.

[0037] In addition, it should be understood that the examples disclosed herein can be implemented in any type of integrated circuit. If desired, the functional blocks of such an integrated circuit can be arranged in more levels or layers, where multiple functional blocks are interconnected to form larger blocks. Other device arrangements can use functional blocks that are not arranged in rows and columns.

[0038] Configurable integrated circuit 400 may include programmable memory elements. The memory elements may be loaded with configuration data (also referred to as programming data) using input / output elements (IOEs) 402. Once loaded, each memory element provides a corresponding static control signal that controls the operation of an associated functional block (e.g., LAB 410, DSP 420, RAM 430, or input / output element 402).

[0039] In a typical scenario, the output of the loaded memory element is applied to the gate of a field effect transistor in a functional block to turn on or off a particular transistor, thereby configuring the logic (including a wiring path) in the functional block. Programmable logic circuit elements that can be controlled in this manner include portions of multiplexers (e.g., multiplexers used to form wiring paths in interconnect circuits), lookup tables, logic arrays, AND, OR, NAND, and NOR logic gates, pass gates, and the like.

[0040] The memory elements may use any suitable volatile and / or nonvolatile memory structures, such as random access memory (RAM) cells, fuses, antifuses, programmable read-only memory cells, mask-programmed and laser-programmed structures, combinations of these structures, etc. Because the memory elements are loaded with configuration data during programming, the memory elements are sometimes referred to as configuration memories or programmable memory elements.

[0041] Programmable memory elements can be organized in a configuration memory array consisting of rows and columns. Data registers across all columns and address registers across all rows can receive configuration data. Configuration data can be shifted onto the data registers. When the appropriate address register is asserted, the data registers write the configuration data to the configuration memory element of the row specified by the address register.

[0042] Configurable integrated circuit 400 may include configuration memory organized into sectors, whereby a sector may include configuration RAM bits that specify the functionality and / or interconnections of subcomponents and conductors in or across the sector. Each sector may include separate data registers and address registers.

[0043] Figure 4The configurable IC is only an example of an IC that can be used with the embodiments disclosed herein. The embodiments disclosed herein can be used with any suitable integrated circuit or system. For example, the embodiments disclosed herein can be used with various types of devices, such as processor integrated circuits, central processing units, memory integrated circuits, graphics processing unit integrated circuits, application-specific standard products (ASSPs), application-specific integrated circuits (ASICs), and configurable logic integrated circuits. Examples of configurable logic integrated circuits include programmable array logic (PAL), programmable logic arrays (PLA), field programmable logic arrays (FPLA), electrically programmable logic devices (EPLDs), electrically erasable programmable logic devices (EEPLDs), logic cell arrays (LCAs), complex programmable logic devices (CPLDs), and field programmable gate arrays (FPGAs), to name a few.

[0044] The integrated circuit disclosed in one or more embodiments herein may be part of a data processing system that includes one or more of the following components: a processor; a memory; an input / output circuit system; and peripheral devices. The data processing system may be used in a variety of applications, such as computer networks, data networks, instrumentation, video processing, digital signal processing, or any other suitable application. The integrated circuit may be used to perform a variety of different logic functions.

[0045] Typically, software and data for performing any function disclosed herein can be stored in a non-transitory computer-readable storage medium. A non-transitory computer-readable storage medium is a tangible computer-readable storage medium that stores data for later access, in contrast to a medium (e.g., wire) that only transmits a propagation electrical signal. Software code may sometimes be referred to as software, data, program instructions, instructions, or code. For example, a non-transitory computer-readable storage medium may include a computer memory chip, a non-volatile memory (e.g., a non-volatile random access memory (NVRAM)), one or more hard disk drives (e.g., a magnetic drive or a solid-state drive), one or more removable flash drives or other removable media, a compact disk (CD), a digital versatile disk (DVD), a blue disc (BD), other optical media, and a floppy disk, a tape, or any other suitable memory or storage device.

[0046] Additional examples are now described. Example 1 is an integrated circuit comprising: a first cryptographic module for enabling debugging of the first cryptographic module, wherein the first cryptographic module comprises a first logic block; and a second cryptographic module for disabling all debugging of the second cryptographic module, wherein the second cryptographic module comprises the first logic block.

[0047] In Example 2, the integrated circuit according to Example 1 may optionally include, wherein the first cryptographic module also includes a first persistent storage block in the integrated circuit, and wherein the second cryptographic module also includes a second persistent storage block in the integrated circuit that does not overlap with the first persistent storage block.

[0048] In Example 3, the integrated circuit according to any of Examples 1-2 may optionally include, wherein the first cryptographic module further includes a second logic block, and wherein the second cryptographic module further includes a second logic block.

[0049] In Example 4, the integrated circuit according to any of Examples 1-3 may optionally include, wherein the first cryptographic module is implemented by a first firmware image, and wherein the second cryptographic module is implemented by a second firmware image.

[0050] In Example 5, the integrated circuit according to any one of Examples 1-4 may optionally include, wherein the integrated circuit loads a firmware image for only one of the first cryptographic module or the second cryptographic module into the integrated circuit in response to the flag.

[0051] In Example 6, the integrated circuit according to any one of Examples 1-5 may optionally include, wherein the first cryptographic module permits a user to debug the first logic block using a debug interface located within a first logical boundary of the first cryptographic module, and wherein a second logical boundary of the second cryptographic module excludes the debug interface.

[0052] In Example 7, the integrated circuit of any of Examples 1-6 may optionally include, wherein the first cryptographic module complies with security level 1 of the Federal Information Processing Standard.

[0053] In Example 8, the integrated circuit of any of Examples 1-7 may optionally include, wherein the second cryptographic module complies with security level 2 of the Federal Information Processing Standard.

[0054] In Example 9, the integrated circuit of any of Examples 1-8 may optionally include, wherein the integrated circuit is a configurable logic integrated circuit, and wherein the first logic block includes a configurable logic circuit.

[0055] Example 10 is a method comprising: loading a first firmware image of a first cryptographic module in an electronic device, the first firmware image allowing the first cryptographic module to be debugged in response to a flag having a first value; and loading a second firmware image of a second cryptographic module in the electronic device, the second firmware image preventing the second cryptographic module from being debugged in response to a flag having a second value.

[0056] In Example 11, the method according to Example 10 may optionally include, wherein the first cryptographic module includes a first functional block in the electronic device, and wherein the second cryptographic module includes the first functional block.

[0057] In Example 12, the method according to Example 11 may optionally include, wherein the first cryptographic module further includes a second functional block in the electronic device, and wherein the second cryptographic module further includes the second functional block.

[0058] In Example 13, the method according to any one of Examples 10-12 may optionally include, wherein the first cryptographic module also includes a first persistent storage block in the electronic device, and wherein the second cryptographic module also includes a second persistent storage block in the electronic device.

[0059] In Example 14, the method according to any one of Examples 10-13 also includes: if the first firmware image has been loaded into the electronic device, storing the first sensitive security parameter in a first non-volatile storage block for the first cryptographic module in the electronic device; if the second firmware image has been loaded into the electronic device, storing the second sensitive security parameter in a second non-volatile storage block for the second cryptographic module in the electronic device.

[0060] In Example 15, the method according to any one of Examples 10-14 may optionally include, wherein the second cryptographic module performs the same set of logical functions as performed by the first cryptographic module.

[0061] In Example 16, the method according to any one of Examples 10-15 may optionally include, wherein the first firmware image or the second firmware image is loaded into the electronic device only during startup of the electronic device.

[0062] Example 17 A non-transitory computer-readable storage medium comprising computer-readable instructions stored thereon, the computer-readable instructions being used to cause an integrated circuit to perform the following operations: load a first firmware image for a first cryptographic module to permit a user of the integrated circuit to debug the first cryptographic module; and load a second firmware image for a second cryptographic module to prevent the user from performing any debugging functions on the second cryptographic module, wherein a logical boundary of each of the first cryptographic module and the second cryptographic module includes a functional block in the integrated circuit.

[0063] In Example 18, the non-transitory computer readable storage medium according to Example 17 may optionally include, wherein the computer readable instructions further cause the integrated circuit to load only one of the first firmware image or the second firmware image selected based on a value of a flag in the integrated circuit.

[0064] In Example 19, the non-transitory computer-readable storage medium according to any one of Examples 17-18 may optionally include, wherein the first cryptographic module includes a first persistent memory in the integrated circuit, and wherein the second cryptographic module includes a second persistent memory in the integrated circuit that does not overlap with the first persistent memory.

[0065] In Example 20, the non-transitory computer readable storage medium according to any one of Examples 17-19 may optionally include, wherein the first cryptographic module includes a debug interface block.

[0066] The description of the foregoing examples is presented for illustration. The foregoing description is not intended to be exhaustive or to limit the examples disclosed herein. In some instances, features of the examples may be used without correspondingly using other features described. In view of the above teachings, many modifications, substitutions, and variations may be made.

Claims

1. An integrated circuit, comprising: a first cryptographic module, the first cryptographic module enabling debugging of the first cryptographic module, wherein the first cryptographic module includes a first logic block; and A second cryptographic module, wherein the second cryptographic module disables all debugging of the second cryptographic module, wherein the second cryptographic module includes the first logic block.

2. The integrated circuit according to claim 1, wherein: The first cryptographic module further includes a first persistent storage block in the integrated circuit, and wherein the second cryptographic module further includes a second persistent storage block in the integrated circuit that does not overlap with the first persistent storage block.

3. The integrated circuit according to any one of claims 1 to 2, wherein: The first cryptographic module further includes a second logic block, and wherein the second cryptographic module further includes the second logic block.

4. The integrated circuit according to any one of claims 1 to 2, wherein: The first cryptographic module is implemented by a first firmware image, and wherein the second cryptographic module is implemented by a second firmware image.

5. The integrated circuit according to any one of claims 1 to 2, wherein: The integrated circuit loads a firmware image for only one of the first cryptographic module or the second cryptographic module into the integrated circuit in response to a flag.

6. The integrated circuit according to any one of claims 1 to 2, wherein: The first cryptographic module permits a user to debug the first logic block using a debug interface located within a first logical boundary of the first cryptographic module, and wherein a second logical boundary of the second cryptographic module excludes the debug interface.

7. The integrated circuit according to any one of claims 1 to 2, wherein: The first cryptographic module complies with Federal Information Processing Standard Security Level 1.

8. The integrated circuit according to any one of claims 1 to 2, wherein: The second cryptographic module complies with Federal Information Processing Standard Security Level 2.

9. The integrated circuit according to any one of claims 1 to 2, wherein: The integrated circuit is a configurable logic integrated circuit, and wherein the first logic block includes a configurable logic circuit.

10. A method comprising: loading a first firmware image of a first cryptographic module in the electronic device, allowing debugging of the first cryptographic module in response to a flag having a first value; as well as A second firmware image of a second cryptographic module is loaded in the electronic device, and debugging of the second cryptographic module is prevented in response to the flag having a second value.

11. The method according to claim 10, wherein: The first cryptographic module includes a first functional block in the electronic device, and wherein the second cryptographic module includes the first functional block.

12. The method according to claim 11, wherein: The first cryptographic module further includes a second functional block in the electronic device, and wherein the second cryptographic module further includes the second functional block.

13. The method according to any one of claims 10 to 12, wherein: The first cryptographic module further comprises a first persistent storage block in the electronic device, and wherein the second cryptographic module further comprises a second persistent storage block in the electronic device.

14. The method according to any one of claims 10 to 12, further comprising: If the first firmware image has been loaded into the electronic device, storing a first sensitive security parameter in a first non-volatile storage block for the first cryptographic module in the electronic device; as well as If the second firmware image has been loaded into the electronic device, a second sensitive security parameter is stored in a second non-volatile storage block for the second cryptographic module in the electronic device.

15. The method according to any one of claims 10 to 12, wherein: The second cryptographic module performs the same set of logical functions as performed by the first cryptographic module.

16. The method according to any one of claims 10 to 12, wherein: The first firmware image or the second firmware image is loaded into the electronic device only during boot-up of the electronic device.

17. A non-transitory computer-readable storage medium comprising computer-readable instructions stored thereon for causing an integrated circuit to perform the following operations: loading a first firmware image for a first cryptographic module, permitting a user of the integrated circuit to debug the first cryptographic module; and loading a second firmware image for a second cryptographic module to prevent the user from performing any debugging functions on the second cryptographic module, wherein: A logical boundary of each of the first cryptographic module and the second cryptographic module includes a functional block in the integrated circuit.

18. The non-transitory computer-readable storage medium of claim 17, wherein: The computer-readable instructions also cause the integrated circuit to load only one of the first firmware image or the second firmware image selected based on a value of a flag.

19. The non-transitory computer-readable storage medium according to any one of claims 17-18, wherein: The first cryptographic module includes a first persistent memory in the integrated circuit, and wherein the second cryptographic module includes a second persistent memory in the integrated circuit that does not overlap with the first persistent memory.

20. The non-transitory computer-readable storage medium according to any one of claims 17-18, wherein: The first cryptographic module includes a debug interface block.

Images