Secure boot method for an FPGA, and printed circuit board comprising an FPGA configured to carry out the secure boot method

Abstract

The invention relates to a secure boot method for an FPGA (2) connected to a start-up boot memory (3) that stores an encrypted first key (6) and to a nominal boot memory (4) that stores an FPGA image (7), the method comprising: a start-up booting step in which the FPGA (2) is configured to retrieve (S1) the encrypted first key (6) and decrypt it (S2) using a PUF key (8), and copy (S3) the decrypted first key (11) to a BBRAM (10); and then a nominal booting step (S4) in which the FPGA (2) is configured to decrypt the encrypted FPGA image (7) using the decrypted first key (11) stored in the BBRAM (10), and then erase the decrypted first key (11).

Description

Secure boot method for an FPGA, and printed circuit board comprising an FPGA configured to perform the secure boot method

[0001] The present invention relates to the field of cryptography, and in particular relates to a secure boot method for an FPGA and to a printed circuit board comprising an FPGA configured to carry out said secure boot method.

[0002] During their bootstrapping process, some types of field-programmable gate arrays (FPGAs) use a sensitive plaintext key stored in battery-backed random access memory (BBRAM). This sensitive plaintext key is involved at the very beginning of a hardware root of trust (HRT) of the FPGA and provides the first step in the confidentiality decryption of the encrypted FPGA image, which is stored in non-volatile memory outside the FPGA and includes software or programmable logic bitstreams.

[0003] If the value of this sensitive cleartext key is known to an attacker, then the bitstreams of the FPGA image can be easily decrypted for reverse engineering.

[0004] This sensitive cleartext key is stored by a BBRAM backup battery, so that it is not lost when the FPGA is powered down. This makes this sensitive cleartext key vulnerable to attackers, especially when only the backup power supply is active.

[0005] Some Xilinx® brand FPGAs can also use either a plaintext key stored in BBRAM or a Physical Unclonable Function (PUF) key during their boot process. Secure booting of the FPGA's hardware root of trust then begins by decrypting the FPGA image (stored encrypted in non-volatile memory external to the FPGA) using an initial internal FPGA key designated Key_0, where Key_0 can be either a PUF or a BBRAM key, with only one of these two keys being used during the boot step. The main function of Key_0 is to decrypt the first encrypted key, designated Key_1, from the encrypted FPGA image.The decrypted Key_1 then decrypts the first encrypted partition, designated partition_1, of the encrypted FPGA image and also decrypts the second encrypted key, designated Key_2, of the encrypted FPGA image. The decrypted Key_2 then decrypts the second encrypted partition, designated partition_2, of the encrypted FPGA image and also decrypts the third encrypted key, designated Key_3, of the encrypted FPGA image, and so on up to the last encrypted partition, designated partition_N, of the encrypted FPGA image, such that at the end of the boot process, the decryption algorithm (e.g., according to the Advanced Encryption Standard or AES standard) of the FPGA has fully decrypted the FPGA image.

[0006] Table 1 below describes the advantages and disadvantages for each of the PUF and BBRAM keys.

[0007] Bootstrap KeyMain FunctionAdvantagesDisadvantagesPUF KeyFirst key used to start decrypting the FPGA image- No external battery is required.- Makes it difficult to spoof (would require the device on the board to be replaced). Not readable.- Only a bitstream encrypted with this key can configure the FPGA.- Permanent, the key cannot be erased or updated.- Less secure than a BBRAM solution (i.e., device-level evidence remains) -> Property less suitable for sensitive / secure applications.BBRAM keyFirst key used to start decrypting the FPGA image- Volatile and reprogrammable.- Passive and active key erasure (i.e., evidence can be removed) -> Property more suitable for sensitive / secure applications.- Not readable except for the Xilinx® Zynq7000 FPGA.- Requires an external battery.- Many battery vendors do not specify high temperature operation and / or long lifetimes (although some vendors are now starting to offer betavoltaic batteries that help address these issues).- Readable for Xilinx® Zynq7000 FPGA.- Some physical attacks are known.

[0008] Generally, BBRAM key is preferred over PUF key during the boot process, since it is erasable and reprogrammable.

[0009] The BBRAM key, however, has the disadvantage that it must be kept by a backup power supply (e.g., a backup battery), otherwise it would be lost as soon as the main power supply to the FPGA was cut off and the FPGA would then no longer be able to boot.

[0010] The BBRAM key is written at the factory to the FPGA's internal BBRAM using a JTAG (Joint Test Action Group) interface. For security reasons, the FPGA's JTAG interface is then disabled at the factory. Therefore, if image decryption uses the BBRAM key, a backup battery must be connected once the JTAG interface is disabled.

[0011] Thus, the typical use of a BBRAM key in an FPGA is to keep it in memory using a backup battery even when the main power supply is off, with the power consumption then being a few micro amps (only a very small logic area being powered). An attacker can thus easily recover the BBRAM key in this very low power mode (no noise being present on the BBRAM power supply), given that there is no active software or active programmable logic running on the FPGA.

[0012] The present invention aims to solve the drawbacks of the prior art, by proposing a secure booting method for an FPGA, comprising a boot boot step in which an encrypted key stored in an external non-volatile memory is decrypted using a PUF key and then copied into the BBRAM of the FPGA, then a nominal boot step in which the decrypted key temporarily stored in the BBRAM is used to decrypt the FPGA image and then erased immediately after.

[0013] The method according to the present invention thus makes it possible to improve the secure boot mechanisms of FPGAs by reducing the drawbacks linked to the use of a BBRAM key, given that the storage of the key in clear text in BBRAM is not permanent but temporary.

[0014] The present invention therefore relates to a secure boot method for a field programmable gate array (FPGA) connected to a non-volatile boot boot memory in which a first encrypted key is stored and to a non-volatile nominal boot memory in which an encrypted FPGA image is stored, characterized in that it comprises:

[0015] - a boot boot step in which the FPGA is configured to:

[0016] • retrieve the first encrypted key stored in the non-volatile boot memory;

[0017] • decrypt the first encrypted key using a second Physical Unclonable Function (PUF) key stored in the FPGA; and

[0018] • copy the first decrypted key into an internal battery-backed RAM (BBRAM) of the FPGA; then

[0019] - a nominal boot stage in which the FPGA is configured to:

[0020] • decrypt the encrypted FPGA image stored in the nominal boot non-volatile memory using the first decrypted key stored in the BBRAM; and

[0021] • as soon as the first decrypted key has been used for decryption of the encrypted FPGA image, erase the first decrypted key from the BBRAM.

[0022] Thus, no vulnerable plaintext keys are stored in the FPGA's BBRAM when the FPGA's main power supply is turned off.

[0023] The present invention thus enables an improvement in the secure boot process of the FPGA, by storing the sensitive key in an encrypted format (i.e., the first encrypted key) in the non-volatile boot boot memory, and decrypting it, during the first boot boot stage, using a PUF key and then temporarily storing it in the BBRAM of the FPGA and using it for a very short time during the second nominal boot stage before erasing it.

[0024] Temporary storage of the sensitive BBRAM key in cleartext (e.g., for only a few hundred milliseconds) instead of always keeping it present in the FPGA's BBRAM thus reduces the exposure time to physical attacks.

[0025] The present invention thus eliminates the need for the backup battery to retain the sensitive key in clear text, and further allows the key to be easily recharged even when the JTAG interface is permanently disabled at the factory for security applications by reloading the encrypted version of the key onto the non-volatile boot-boot memory.

[0026] The method according to the invention is, for example, applicable to Xilinx® FPGA families such as Zynq-7000 SoC, Zynq Ultrascale+ MPSoC, and Zynq Ultrascale+ RFSoC, and by extension to any Xilinx® FPGA family using the same security mechanisms.

[0027] The method according to the present invention is based on the use of two consecutive boot steps, in which the FPGA is forced to start booting by a boot boot step and then, at the end of the boot boot step, the FPGA is forced to boot in a nominal boot step.

[0028] The boot boot image (containing the first encrypted key) is encrypted and stored in the dedicated boot boot non-volatile memory. The boot boot uses a PUF key as Key_0 for decrypting the boot boot image. The main role of the boot boot is thus to decrypt the first encrypted key using a PUF key. This PUF key can be the FPGA's PUF key or, preferably, a dedicated PUF block in the FPGA. At the end of the boot boot, the first decrypted key is copied into BBRAM and the FPGA is then forced to boot into the nominal boot stage using the cleartext key temporarily stored in BBRAM, the cleartext key being erased (active erase) from BBRAM at a very early stage of the nominal boot (i.e., just after the first encrypted key (Key_1) is decrypted from the FPGA image stored in the nominal boot non-volatile memory).It can also be provided that the cleartext key is erased after a certain period of time, regardless of the outcome of the boot.

[0029] Table 2 below shows the improvements in using the BBRAM key of the present invention over Table 1 associated with the prior art.

[0030] Seed KeyMain FunctionAdvantagesDisadvantagesBBRAM KeyFirst key used to start decryption of the nominal image (sensitive image)- Volatile and reprogrammable.- Present in the device for a few hundred milliseconds.- Passive and active key erasure (i.e. evidence can be deleted) -> Property more suitable for sensitive / secure applications.- Not readable except for Xilinx® Zynq7000 FPGA.- Readable for Xilinx® Zynq7000 FPGA. This disadvantage is reduced because the key is present for a few hundred milliseconds only.- Some physical attacks are known. This disadvantage is reduced because the key is present for only a few hundred milliseconds and during its presence the power supply is noisy due to the activity of the software running on the FPGA.- Additional components and boot time (a few seconds added due to boot boot).

[0031] According to a particular feature of the invention, once the first decrypted key is copied into the BBRAM, the FPGA is configured to erase the first decrypted key from the BBRAM after a period of between 100 and 1500 milliseconds.

[0032] According to a particular characteristic of the invention, the non-volatile boot boot memory comprises a first non-removable non-volatile memory and a second removable external non-volatile memory, the first encrypted key comprising a first encrypted key portion stored in the first non-removable non-volatile memory and a second encrypted key portion stored in the second removable external non-volatile memory.

[0033] So the first sensitive encrypted key is stored in

[0034] a split and encrypted format, such that the first key can only be decrypted if the second removable external non-volatile memory is connected to the FPGA.

[0035] According to a particular characteristic of the invention, in the boot boot step, the FPGA is configured to:

[0036] - check whether the second removable external non-volatile memory is or is not connected to the FPGA;

[0037] - when the second removable external non-volatile memory is connected to the FPGA, recovering the first encrypted key portion stored in the first non-removable non-volatile memory, and recovering the second encrypted key portion stored in the second removable external non-volatile memory;

[0038] - combining the first encrypted key portion and the second encrypted key portion to form an encrypted BBRAM key; and

[0039] - decrypt the encrypted BBRAM key using the second PUF key stored in the FPGA, and copy the decrypted BBRAM key into the FPGA's BBRAM.

[0040] Thus, during the boot boot step, if the second encrypted key portion is present (i.e., if the second removable external non-volatile memory containing the second encrypted key portion is connected to the FPGA), the boot boot step decrypts the combination of the first and second encrypted key portions to create the decrypted BBRAM key used for nominal boot.

[0041] The combination of the first encrypted key portion and the second encrypted key portion to form an encrypted BBRAM key may, for example, be a simple concatenation. Any other type of standard or proprietary combining algorithm could also be considered, without departing from the scope of the present invention, provided that the combining algorithm is reversible (i.e., the combining function must have a reciprocal "decombining" function).

[0042] In the present invention, the removal of the second removable external non-volatile memory containing the second encrypted key portion thus makes it possible to make the product incorporating the controlled cryptographic article (CCI) of the FPGA declassified for cryptographic applications. Indeed, when the second external non-volatile memory is removed, the FPGA can no longer boot in the nominal mode. In this case, attacks are not possible. Furthermore, physical attacks related to power supply analysis are also not possible.

[0043] According to a particular characteristic of the invention, the second encrypted key part comprises at least one validity factor, and in which the step of combining the first encrypted key part and the second encrypted key part is carried out only in the case where the FGPA has previously authenticated the at least one validity factor of the second encrypted key part.

[0044] Thus, during the boot-up stage, decryption of the encrypted BBRAM key takes place only if the second encrypted key part is valid (i.e., authenticated by the FPGA using the at least one validity factor).

[0045] It is noted that the first encrypted key portion could also include one or more validity factors allowing the FPGA to authenticate the first encrypted key portion, without departing from the scope of the present invention.

[0046] The key authentication mechanisms used can be, for example: cyclic and header redundancy check, validity date check, number of bits, etc.

[0047] The present invention also relates to a printed circuit board comprising an FPGA in which a second PUF key is stored, a non-volatile boot boot memory in which a first encrypted key is stored, and a non-volatile nominal boot memory in which an encrypted FPGA image is stored, the FPGA being configured to carry out the secure boot method as described above.

[0048] According to a particular characteristic of the invention, the non-volatile boot boot memory comprises a first non-removable non-volatile memory integrated into the printed circuit board and a second removable non-volatile memory external to the printed circuit board, the first encrypted key comprising a first encrypted key portion stored in the first non-removable non-volatile memory and a second encrypted key portion stored in the second external removable non-volatile memory.

[0049] To better illustrate the object of the present invention, preferred embodiments will be described below, by way of illustration and not limitation, with reference to the appended drawings.

[0050] On these drawings:

[0051] is a block diagram of a printed circuit board according to a first embodiment of the present invention; and

[0052] is a block diagram of a printed circuit board according to a second embodiment of the present invention.

[0053] Referring to the, it can be seen that there is shown a printed circuit board 1 according to a first embodiment of the present invention.

[0054] The printed circuit board 1 includes a field-programmable gate array (FPGA) 2, a boot-up non-volatile memory 3, and a nominal boot-up non-volatile memory 4.

[0055] The printed circuit board 1 further comprises a main power supply 5 configured to supply power to the FPGA 2, the boot boot non-volatile memory 3 and the nominal boot non-volatile memory 4.

[0056] A first encrypted key 6 is stored in the non-volatile boot memory 3.

[0057] An encrypted image of FPGA 7 is stored in the nominal boot non-volatile memory 4.

[0058] The FPGA 2 is configured to perform a secure boot process comprising the following steps:

[0059] - a boot boot step in which the FPGA 2 is configured to:

[0060] • retrieve S1 the first encrypted key 6 stored in the non-volatile boot memory 3;

[0061] • decrypt S2, using a decryption algorithm module 9 (for example, AES standard) of the FPGA 2, the first encrypted key 6 using a second physical unclonable function (PUF) key 8 stored in memory in the FPGA 2; and

[0062] • copy S3 the first decrypted key 11 into an internal battery-backed RAM (BBRAM) 10 of the FPGA 2; then

[0063] - a nominal boot step S4 in which the FPGA 2 is configured to:

[0064] • decrypt, using the decryption algorithm module 9 of the FPGA 2, the encrypted image of FPGA 7 stored in the nominal boot non-volatile memory 4 using the first decrypted key 11 stored in the BBRAM 10; and

[0065] • as soon as the first decrypted key 11 has been used for decrypting the encrypted image of FPGA 7, erase the first decrypted key 11 from the BBRAM 10.

[0066] The second PUF key 8 can be the PUF key of FPGA 2 or, preferably, a dedicated PUF block in FPGA 2.

[0067] No vulnerable plaintext keys are thus stored in the BBRAM 10 of the FPGA 2 when the main power supply 5 is switched off, so that physical attacks related to power analysis are not possible.

[0068] Once the first decrypted key 11 is copied into BBRAM 10, the FPGA 2 can erase the first decrypted key 11 from BBRAM 10 after a period of time between 100 and 1500 milliseconds, thereby reducing the exposure time to physical attacks.

[0069] The secure boot method described above is, for example, applicable to Xilinx® FPGA families such as Zynq-7000 SoC, Zynq Ultrascale+ MPSoC, and Zynq Ultrascale+ RFSoC, and by extension to any Xilinx® FPGA family using the same security mechanisms. Similarly, the invention is not limited to Xilinx® FPGAs and may be applicable to any existing or future FPGA family using a boot as described in the present application.

[0070] Referring to the, it can be seen that there is shown a printed circuit board 12 according to a second embodiment of the present invention.

[0071] The common elements between the first embodiment of the invention and this second embodiment of the invention bear the same reference number, and will not be described in more detail here when they are of identical structures.

[0072] The printed circuit board 12 according to the second embodiment is identical to the printed circuit board 1 according to the first embodiment, except that the printed circuit board 12 comprises, instead of the non-volatile memory 3 of the, a first non-removable non-volatile memory 3a which is integrated into the printed circuit board 12 and in which a first encrypted key part 6a is stored.

[0073] Further, a second removable non-volatile memory 3b is external to the printed circuit board 12 and stores a second encrypted key portion 6b.

[0074] Advantageously, the second external memory 3b is a small serial memory connected to a connector. The detection of its physical connection is done by a discrete signal when the second external memory 3b is physically connected. Authentication can be done by several possible methods: for example, a unique identifier (ID) stored in the second external non-volatile memory 3b and in the first non-removable non-volatile memory 3a, this ID would be unique per pair external memory 3b, non-removable memory 3a; a list of authorized IDs and or other identification fields stored both in the external memory 3b and in the non-removable memory 3a could also be envisaged. Furthermore, the decryption algorithm can also be of the type with authentication such as AES-GCM.

[0075] In this second embodiment, at the boot boot step of the secure boot method described above, the FPGA 2 is configured to:

[0076] - checking whether or not the second removable external non-volatile memory 3b is connected to the FPGA 2 of the printed circuit board 12;

[0077] - when the second removable external non-volatile memory 3b is well connected to the FPGA 2, recover S1a the first part of encrypted key 6a stored in the first non-removable non-volatile memory 3a, and recover S1b the second part of encrypted key 6b stored in the second removable external non-volatile memory 3b;

[0078] - combining the first encrypted key part 6a and the second encrypted key part 6b to form an encrypted BBRAM key (or first combined encrypted key); and

[0079] - decrypt S2, using the decryption algorithm module 9 of the FPGA 2, the BBRAM key encrypted using the second PUF key 8 stored in the FPGA 2, and copy S3 the decrypted BBRAM key (or first decrypted key) 11 into the BBRAM 10 of the FPGA 2.

[0080] It is thus possible to combine the first encrypted key part 6a and the second encrypted key part 6b, for example by concatenating the two, to form the encrypted BBRAM key. It should be noted that any other type of standard or proprietary combination algorithm could be used, without departing from the scope of the present invention, the combination algorithm however having to be reversible (i.e., the combination function having to have a reciprocal "decombination" function).

[0081] Thus, when the second removable external non-volatile memory 3b containing the second encrypted key portion 6b is not physically connected to the printed circuit board 12, the product incorporating the controlled cryptographic article (CCI) of the FPGA 2 is then declassified for cryptographic applications, such that the FPGA 2 can no longer boot in the nominal mode, attacks are then no longer possible.

[0082] Advantageously, the second encrypted key part 6b comprises at least one validity factor, and, in the secure boot method described above, the step of combining the first encrypted key part 6a and the second encrypted key part 6b is carried out only in the case where the FGPA 2 has previously authenticated the at least one validity factor of the second encrypted key part 6b, which makes it possible to guarantee the validity of the second encrypted key part 6b.

[0083] It should be noted that the first encrypted key part 6a could also include one or more validity factors allowing the FPGA 2 to authenticate it, without departing from the scope of the present invention.

[0084] Key authentication mechanisms used by FPGA 2 can be, for example: cyclic and header redundancy check, validity date check, number of bits, etc.

[0085] It is understood that the particular embodiments which have just been described have been given for informational and non-limiting purposes, and that modifications may be made without departing from the present invention.

Claims

A secure boot method for a field programmable gate array, FPGA, (2) connected to a non-volatile boot boot memory (3; 3a, 3b) in which a first encrypted key (6; 6a, 6b) is stored and to a non-volatile nominal boot memory (4) in which an encrypted FPGA image (7) is stored, characterized in that it comprises:- a boot boot step in which the FPGA (2) is configured to:• retrieve (S1) the first encrypted key (6; 6a, 6b) stored in the non-volatile boot boot memory (3; 3a, 3b);• decrypt (S2) the first encrypted key (6; 6a, 6b) using a second unclonable physical function key, PUF, (8) stored in the FPGA (2); and• copying (S3) the first decrypted key (11) into a battery-backed RAM, BBRAM, (10) internal to the FPGA (2);then- a nominal boot step (S4) in which the FPGA (2) is configured to:• decrypt the encrypted FPGA image (7) stored in the nominal boot non-volatile memory (4) using the first decrypted key (11) stored in the BBRAM (10); and• as soon as the first decrypted key (11) has been used for decrypting the encrypted FPGA image (7), erase the first decrypted key (11) from the BBRAM (10).; Secure boot method according to claim 1, characterized in that, once the first decrypted key (11) is copied into the BBRAM (10), the FPGA (2) is configured to erase the first decrypted key (11) from the BBRAM (10) after a period of between 100 and 1500 milliseconds. Secure boot method according to claim 1 or 2, characterized in that the non-volatile boot memory comprises a first non-removable non-volatile memory (3a) and a second removable external non-volatile memory (3b), the first encrypted key comprising a first encrypted key part (6a) stored in the first non-removable non-volatile memory (3a) and a second encrypted key part (6b) stored in the second removable external non-volatile memory (3b). Secure boot method according to claim 3, characterized in that, in the boot boot step, the FPGA (2) is configured to:- check whether the second removable external non-volatile memory (3b) is or is not connected to the FPGA (2);- when the second removable external non-volatile memory (3b) is connected to the FPGA (2), retrieve (S1a) the first encrypted key part (6a) stored in the first non-removable non-volatile memory (3a), and retrieve (S1b) the second encrypted key part (6b) stored in the second removable external non-volatile memory (3b);- combine the first encrypted key part (6a) and the second encrypted key part (6b) to form an encrypted BBRAM key; and- decrypting (S2) the encrypted BBRAM key using the second PUF key (8) stored in the FPGA (2), and copying the decrypted BBRAM key into the BBRAM (10) of the FPGA (2). Secure boot method according to claim 4, characterized in that the second encrypted key part (6b) comprises at least one validity factor, and in which the step of combining the first encrypted key part (6a) and the second encrypted key part (6b) is carried out only in the case where the FGPA (2) has previously authenticated the at least one validity factor of the second encrypted key part (6b). Printed circuit board (1; 12) comprising an FPGA (2) in which a second PUF key (8) is stored, a non-volatile boot boot memory (3; 3a, 3b) in which a first encrypted key (6; 6a, 6b) is stored, and a non-volatile nominal boot memory (4) in which an encrypted FPGA image (7) is stored, the FPGA (2) being configured to carry out the secure boot method according to one of claims 1 to 5. Printed circuit board (12) according to claim 6 in dependence on claim 4, characterized in that the non-volatile boot memory comprises a first non-removable non-volatile memory (3a) integrated into the printed circuit board (12) and a second removable non-volatile memory (3b) external to the printed circuit board (12), the first encrypted key comprising a first encrypted key portion (6a) stored in the first non-removable non-volatile memory (3a) and a second encrypted key portion (6b) stored in the second external removable non-volatile memory (3b).

Images