Secure boot process for an FPGA, and printed circuit board including an FPGA configured to perform the secure boot process
The secure FPGA priming process addresses vulnerabilities in existing methods by using a PUF key to temporarily store and then erase the sensitive key in BBRAM, thereby enhancing security and reducing exposure to attacks.
Patent Information
- Application Number
- FR2023002379
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2023-03-17
- Publication Date
- 2025-03-28
- Estimated Expiration
- 2043-03-17
AI Technical Summary
Existing FPGA priming processes are vulnerable to attacks due to the storage of sensitive keys in clear text within BBRAM, which can be easily recovered by attackers, especially during power-outage scenarios.
A secure priming process for FPGAs involves using a PUF key to decipher an encrypted key stored in non-volatile memory and temporarily copying it to BBRAM for nominal boot, followed by immediate erasure, thereby reducing exposure to physical attacks.
This approach enhances the security of FPGA priming by minimizing the duration of sensitive key storage in BBRAM, reducing vulnerability to physical attacks, and eliminating the need for an emergency battery.
Smart Images
Figure 00000014_0000 
Figure 00000014_0001
Abstract
Description
Title of the invention: Secure boot method for an FPGA, and printed circuit board comprising an FPGA configured to perform the secure boot method
[0001] The present invention relates to the field of cryptography, and in particular relates to a secure boot method for an FPGA and to a printed circuit board comprising an FPGA configured to carry out said secure boot method.
[0002] During their boot process, some types of field programmable gate arrays (FPGAs) use a sensitive plaintext key stored in a battery-backed volatile memory (BBRAM). This sensitive plaintext key is involved at the very beginning of a hardware root of trust (hardware root of trust) of the FPGA and provides the first step in the confidentiality decryption of the encrypted FPGA image which is stored in a non-volatile memory outside the FPGA and includes software or programmable logic bitstreams.
[0003] If the value of this sensitive cleartext key is known to an attacker, the bitstreams of the FPGA image can then be easily decrypted for reverse engineering.
[0004] This sensitive cleartext key is retained by a BBRAM backup battery, so as not to be lost when the FPGA is powered down. This sensitive cleartext key is thus vulnerable to attackers, particularly when only the backup power supply is active.
[0005] Some Xilinx® brand FPGAs may also use, during their boot process, either a plaintext key stored in BBRAM or a Physical Unclonable Function (PUF) key. Secure booting of the FPGA's hardware root of trust then begins by decrypting the FPGA image (stored encrypted in non-volatile memory external to the FPGA) using an initial internal key of the FPGA designated Key_0, this Key_0 being able to be either a PUF key or a BBRAM key, only one of these two keys being used during the boot step. The main function of Key_0 is to decrypt the first encrypted key, designated Key_1, of the encrypted FPGA image. The decrypted Key_l then allows the first encrypted partition, designated partition_l, of the image to be decrypted. encrypted FPGA and also allows to decrypt the second encrypted key, designated Key_2, of the encrypted FPGA image. The decrypted Key_2 subsequently allows to decrypt the second encrypted partition, designated partition_2, of the encrypted FPGA image and also allows to decrypt the third encrypted key, designated Key_3, of the encrypted FPGA image, and so on until the last encrypted partition, designated partition_N, of the encrypted FPGA image, such that at the end of the boot process, the decryption algorithm (for example, according to the Advanced Encryption Standard or AES standard) of the FPGA has fully decrypted the FPGA image.
[0006] Table 1 below describes the advantages and disadvantages for each of the PUF and BBRAM keys.
[0007] [Tables 1] Bootstrap Key Main Function Advantages Disadvantages PUF Key First key used to start decrypting the FPGA image - No external battery is needed. - Makes spoofing difficult (would require the device on the board to be replaced). Not readable. - Only a bitstream encrypted with this key can configure the FPGA. - Permanent, the key cannot be erased or updated. - Less secure than a BBRAM solution (i.e., device-level evidence remains) -> Property less suitable for sensitive / secure applications. BBRAM Key First key used to start decrypting the FPGA image - Volatile and reprogrammable. - Passive and active key erasure (i.e., evidence can be removed) -> Property more suitable for sensitive / secure applications. - Not readable except for the Xilinx® Zynq7000 FPGA. - Requires an external battery.- Many battery vendors do not specify high temperature operation and / or long cycle times (although some vendors are now starting to offer beta-voltaic batteries that help address these issues). - Readable for the Xilinx® Zynq7000 FPGA. - Some physical attacks are known.
[0008] Generally, the BBRAM key is preferred over the PUF key during the boot process, since it is erasable and reprogrammable.
[0009] The BBRAM key, however, has the disadvantage of having to be stored by a backup power supply (for example, a backup battery), otherwise it would be lost as soon as the main power supply to the FPGA was cut off and the FPGA would then no longer be able to boot.
[0010] The BBRAM key is written at the factory into the FPGA's internal BBRAM using a JTAG (Joint Test Action Group) interface. For security reasons, the FPGA's JTAG interface is then disabled at the factory. Thus, if image decryption uses the BBRAM key, a backup battery must be connected once the JTAG interface is disabled.
[0011] Thus, the typical use of a BBRAM key in an FPGA is to keep it in memory using a backup battery even when the main power supply is off, with the power consumption then being a few micro amps (only a very small logic area being powered). An attacker can thus easily recover the BBRAM key in this very low power mode (no noise being present on the BBRAM power supply), since there is no active software or active programmable logic running on the FPGA.
[0012] The present invention aims to solve the drawbacks of the prior art, by proposing a secure booting method for an FPGA, comprising a boot boot step in which an encrypted key stored in an external non-volatile memory is decrypted using a PUF key and then copied into the BBRAM of the FPGA, then a nominal boot step in which the decrypted key temporarily stored in the BBRAM is used to decrypt the FPGA image and then erased immediately after.
[0013] The method according to the present invention thus makes it possible to improve the secure boot mechanisms of FPGAs by reducing the drawbacks linked to the use of a BBRAM key, given that the storage of the key in clear text in BBRAM is not permanent but temporary.
[0014] The present invention therefore relates to a secure boot method for a field programmable gate array (FPGA) connected to a non-volatile boot boot memory in which a first encrypted key is stored and to a non-volatile nominal boot memory in which an encrypted FPGA image is stored, characterized in that it comprises:
[0015] - a boot boot step in which the FPGA is configured to:
[0016] • retrieve the first encrypted key stored in the non-volatile boot memory starting;
[0017] • decrypt the first encrypted key using a second physical function key unclonable (PUF) stored in the FPGA; and
[0018] • copy the first decrypted key into battery-backed RAM (BBRAM) internal to the FPGA; then
[0019] - a nominal boot step in which the FPGA is configured to:
[0020] • decrypt the encrypted FPGA image stored in the non-volatile memory nominal boot using the first decrypted key stored in BBRAM; and
[0021] • as soon as the first decrypted key has been used for decrypting the image encrypted from FPGA, erase the first decrypted key from BBRAM.
[0022] Thus, no vulnerable plaintext keys are stored in the FPGA's BBRAM when the FPGA's main power supply is turned off.
[0023] The present invention thus enables an improvement in the secure boot process of the FPGA, by storing the sensitive key in an encrypted format (i.e., the first encrypted key) in the non-volatile boot boot memory, and decrypting it, during the first boot boot step, using a PUF key and then temporarily storing it in the BBRAM of the FPGA and using it for a very short time during the second nominal boot step before erasing it.
[0024] Temporary storage of the sensitive BBRAM key in clear text (e.g., for only a few hundred milliseconds) instead of always keeping it present in the FPGA's BBRAM thus reduces the exposure time to physical attacks.
[0025] The present invention thus eliminates the need for the backup battery to retain the sensitive key in clear text, and further allows the key to be easily reloaded even when the JTAG interface is permanently disabled at the factory for security applications by reloading the encrypted version of the key onto the non-volatile boot-up memory.
[0026] The method according to the invention is, for example, applicable to Xilinx® FPGA families such as Zynq-7000 SoC, Zynq Ultrascale+ MPSoC, and Zynq Ultrascale+ RFSoC, and by extension to any Xilinx® FPGA family using the same security mechanisms.
[0027] The method according to the present invention is based on the use of two consecutive boot steps, in which the FPGA is forced to start booting by a boot boot step and then, at the end of the boot boot step, the FPGA is forced to boot in a nominal boot step.
[0028] The boot boot image (containing the first encrypted key) is encrypted and stored in the dedicated boot boot non-volatile memory. The boot boot uses a PUF key as Key_0 for decryption of the boot boot image. The main role of the boot boot is thus to decrypt the first encrypted key using a PUF key. This PUF key may be the FPGA's PUF key or, preferably, a dedicated PUF block in the FPGA. At the end of the boot boot, the first decrypted key is copied into BBRAM and the FPGA is then forced to boot into the nominal boot stage using the cleartext key temporarily stored in BBRAM, the cleartext key being erased (active erase) from BBRAM at a very early stage of the nominal boot (i.e., just after the decryption of the first encrypted key (Key_l) of the FPGA image stored in the nominal boot non-volatile memory). It can also be provided that the cleartext key is erased after a certain period of time, regardless of the outcome of the boot.
[0029] Table 2 below shows the improvements in the use of the BBRAM key of the present invention over Table 1 associated with the prior art.
[0030] [Tables2] Seed Key Main Function Advantages Disadvantages BBRAM Key First key used to start decryption of the nominal image (sensitive image) - Volatile and reprogrammable. - Present in the device for a few hundred milliseconds. - Passive and active key erasure (i.e., evidence can be deleted) -> Property more suitable for sensitive / secure applications. - Not readable except for Xilinx® Zynq7000 FPGA. - Readable for Xilinx® Zynq7000 FPGA. This disadvantage is reduced because the key is present for a few hundred milliseconds only. - Some physical attacks are known. This disadvantage is reduced because the key is present for a few hundred milliseconds only and during its presence the power supply is noisy due to the activity of the software running on the FPGA.- Additional components and boot time (a few seconds added due to boot boot).
[0031] According to a particular characteristic of the invention, once the first decrypted key is copied into the BBRAM, the FPGA is configured to erase the first decrypted key from the BBRAM after a duration of between 100 and 1500 milliseconds.
[0032] According to a particular characteristic of the invention, the non-volatile boot boot memory comprises a first non-removable non-volatile memory and a second removable external non-volatile memory, the first encrypted key comprising a first encrypted key portion stored in the first non-removable non-volatile memory and a second encrypted key portion stored in the second removable external non-volatile memory.
[0033] Thus, the first sensitive encrypted key is stored in
[0034] a split and encrypted format, such that the first key can only be decrypted if the second removable external non-volatile memory is connected to the FPGA.
[0035] According to a particular characteristic of the invention, in the boot-up step, the FPGA is configured to:
[0036] - check whether the second removable external non-volatile memory is or is not connected to the FPGA;
[0037] - when the second removable external non-volatile memory is connected to the FPGA, retrieving the first encrypted key portion stored in the first non-removable non-volatile memory, and retrieving the second encrypted key portion stored in the second removable external non-volatile memory;
[0038] - combine the first encrypted key part and the second encrypted key part to form an encrypted BBRAM key; and
[0039] - decrypt the encrypted BBRAM key using the second PUF key stored in the FPGA, and copy the decrypted BBRAM key into the FPGA's BBRAM.
[0040] Thus, during the boot boot step, if the second encrypted key part is present (i.e., if the second removable external non-volatile memory containing the second encrypted key part is connected to the FPGA), the boot boot step makes it possible to decrypt the combination of the first and second encrypted key parts so as to create the decrypted BBRAM key used for nominal boot.
[0041] The combination of the first encrypted key portion and the second encrypted key portion to form an encrypted BBRAM key may, for example, be a simple concatenation. Any other type of standard or proprietary combination algorithm could also be considered, without departing from the scope of the present invention, provided that the combination algorithm is reversible (i.e., the combination function must have a reciprocal "decombination" function).
[0042] In the present invention, the removal of the second removable external non-volatile memory containing the second encrypted key portion thus makes it possible to make the product incorporating the controlled cryptographic article (CCI) of the FPGA declassified for cryptographic applications. Indeed, when the second external non-volatile memory is removed, the FPGA can no longer boot in the nominal mode. In this case, attacks are not possible. In addition, physical attacks related to power analysis are also not possible.
[0043] According to a particular characteristic of the invention, the second encrypted key part comprises at least one validity factor, and in which the step of combining the first encrypted key part and the second encrypted key part is carried out only in the case where the FGPA has previously authenticated the at least one validity factor of the second encrypted key part.
[0044] Thus, during the boot-up step, decryption of the encrypted BBRAM key takes place only if the second encrypted key part is valid (i.e., authenticated by the FPGA using the at least one validity factor).
[0045] It is noted that the first encrypted key portion could also include one or more validity factors allowing the FPGA to authenticate the first encrypted key portion, without departing from the scope of the present invention.
[0046] The key authentication mechanisms used may, for example, be: cyclic and header redundancy check, validity date check, number of bits, etc.
[0047] The present invention also relates to a printed circuit board comprising an FPGA in which a second PUF key is stored, a non-volatile boot boot memory in which a first encrypted key is stored, and a non-volatile nominal boot memory in which an encrypted FPGA image is stored, the FPGA being configured to carry out the secure boot method as described above.
[0048] According to a particular characteristic of the invention, the non-volatile boot boot memory comprises a first non-removable non-volatile memory integrated into the printed circuit board and a second removable non-volatile memory external to the printed circuit board, the first encrypted key comprising a first encrypted key portion stored in the first non-removable non-volatile memory and a second encrypted key portion stored in the second external removable non-volatile memory.
[0049] To better illustrate the object of the present invention, preferred embodiments will be described below, by way of illustration and not limitation, with reference to the appended drawings.
[0050] In these drawings:
[0051] [Fig. 1] is a block diagram of a printed circuit board according to a first embodiment of the present invention; and
[0052] [Fig.2] is a block diagram of a printed circuit board according to a second embodiment of the present invention.
[0053] Referring to [Fig. 1], it can be seen that a circuit board is shown therein printed 1 according to a first embodiment of the present invention.
[0054] The printed circuit board 1 comprises a field-programmable gate array (FPGA) 2, a boot-up non-volatile memory 3 and a nominal boot-up non-volatile memory 4.
[0055] The printed circuit board 1 further comprises a main power supply 5 configured to supply power to the FPGA 2, the non-volatile boot memory 3 and the non-volatile nominal boot memory 4.
[0056] A first encrypted key 6 is stored in the non-volatile boot boot memory 3.
[0057] An encrypted image of FPGA 7 is stored in the nominal boot non-volatile memory 4.
[0058] The FPGA 2 is configured to perform a secure boot process comprising the following steps:
[0059] - a boot boot step in which the FPGA 2 is configured to:
[0060] • recover IF the first encrypted key 6 stored in the non-volatile memory boot boot 3;
[0061] • decrypt S2, using a decryption algorithm module 9 (for example, AES standard) of the FPGA 2, the first encrypted key 6 using a second Physical Unclonable Function (PUF) key 8 stored in memory in the FPGA 2; and
[0062] • copy S3 the first decrypted key 11 into a RAM saved by internal battery (BBRAM) 10 of the FPGA 2; then
[0063] - a nominal boot step S4 in which the FPGA 2 is configured to:
[0064] • decrypt, using the decryption algorithm module 9 of the FPGA 2, the image encrypted FPGA 7 stored in the nominal boot non-volatile memory 4 using the first decrypted key 11 stored in the BBRAM 10; and
[0065] • as soon as the first decrypted key 11 has been used for decrypting the image encrypted from FPGA 7, erase the first decrypted key 11 from BBRAM 10.
[0066] The second PUF key 8 may be the PUF key of the FPGA 2 or, preferably, a dedicated PUF block in the FPGA 2.
[0067] No vulnerable plaintext key is thus stored in the BBRAM 10 of the FPGA 2 when the main power supply 5 is switched off, so that physical attacks linked to power supply analysis are not possible.
[0068] Once the first decrypted key 11 is copied into the BBRAM 10, the FPGA 2 can erase the first decrypted key 11 from the BBRAM 10 after a period of time between 100 and 1500 milliseconds, thereby reducing the exposure time to physical attacks.
[0069] The secure boot method described above is, for example, applicable to Xilinx® FPGA families such as Zynq-7000 SoC, Zynq Ultrascale+ MPSoC, and Zynq Ultrascale+ RFSoC, and by extension to any Xilinx® FPGA family using the same security mechanisms. Similarly, the invention is not limited to Xilinx® FPGAs and may be applied to any existing or future FPGA family using a bootstrap as described in the present application.
[0070] Referring to [Fig.2], it can be seen that there is shown a printed circuit board 12 according to a second embodiment of the present invention.
[0071] The elements common to the first embodiment of the invention in [Fig.l] and this second embodiment of the invention bear the same reference number, and will not be described in more detail here when they are of identical structures.
[0072] The printed circuit board 12 according to the second embodiment is identical to the printed circuit board 1 according to the first embodiment, except that the printed circuit board 12 comprises, instead of the non-volatile memory 3 of [Fig.l], a first non-removable non-volatile memory 3a which is integrated into the printed circuit board 12 and in which a first encrypted key part 6a is stored.
[0073] Further, a second removable non-volatile memory 3b is external to the printed circuit board 12 and stores a second encrypted key portion 6b.
[0074] Advantageously, the second external memory 3b is a small serial memory connected to a connector. The detection of its physical connection is done by a discrete signal when the second external memory 3b is physically connected. Authentication can be done by several possible methods: for example, a unique identifier (ID) stored in the second external non-volatile memory 3b and in the first non-removable non-volatile memory 3a, this ID would be unique per pair external memory 3b, non-removable memory 3a; a list of authorized IDs and or other identification fields stored both in the external memory 3b and in the non-removable memory 3a could also be envisaged. Furthermore, the decryption algorithm can also be of the type with authentication such as AES-GCM.
[0075] In this second embodiment, at the boot boot step of the secure boot method described above, the FPGA 2 is configured to:
[0076] - check whether the second removable external non-volatile memory 3b is or is not connected to the FPGA 2 of the printed circuit board 12;
[0077] - when the second removable external non-volatile memory 3b is properly connected to the FPGA 2, recover Sla the first encrypted key part 6a stored in the first non-removable non-volatile memory 3a, and recover Slb the second encrypted key part 6b stored in the second removable external non-volatile memory 3b;
[0078] - combine the first part of encrypted key 6a and the second part of encrypted key 6b to form an encrypted BBRAM key (or first combined encrypted key); and
[0079] - decrypt S2, using the decryption algorithm module 9 of the FPGA 2, the encrypted BBRAM key using the second PUF key 8 stored in FPGA 2, and copy S3 the decrypted BBRAM key (or first decrypted key) 11 into BBRAM 10 of FPGA 2.
[0080] It is thus possible to combine the first encrypted key part 6a and the second encrypted key part 6b, for example by concatenating the two, to form the encrypted BBRAM key. It should be noted that any other type of standard or proprietary combination algorithm could be used, without departing from the scope of the present invention, the combination algorithm however having to be reversible (i.e., the combination function having to have a reciprocal "decombination" function).
[0081] Thus, when the second removable external non-volatile memory 3b containing the second encrypted key part 6b is not physically connected to the printed circuit board 12, the product integrating the controlled cryptographic article (CCI) of the FPGA 2 is then declassified for cryptographic applications, such that the FPGA 2 can no longer boot in the nominal mode, attacks are then no longer possible.
[0082] Advantageously, the second encrypted key part 6b comprises at least one validity factor, and, in the secure boot method described above, the step of combining the first encrypted key part 6a and the second encrypted key part 6b is carried out only in the case where the FGPA 2 has previously authenticated the at least one validity factor of the second encrypted key part 6b, which makes it possible to guarantee the validity of the second encrypted key part 6b.
[0083] It should be noted that the first encrypted key part 6a could also include one or more validity factors allowing the FPGA 2 to authenticate it, without departing from the scope of the present invention.
[0084] The key authentication mechanisms used by the FPGA 2 can, for example, be: cyclic and header redundancy check, validity date verification, number of bits, etc.
[0085] It is understood that the particular embodiments which have just been described have been given for informational and non-limiting purposes, and that modifications may be made without departing from the present invention.
Claims
Claims
1. Secure boot method for a field programmable gate array, FPGA, (2) connected to a non-volatile boot boot memory (3; 3a, 3b) in which a first encrypted key (6; 6a, 6b) is stored and to a non-volatile nominal boot memory (4) in which an encrypted FPGA image (7) is stored, characterized in that it comprises: - a boot boot step in which the FPGA (2) is configured to: • retrieve (SI) the first encrypted key (6; 6a, 6b) stored in the non-volatile boot boot memory (3; 3a, 3b); • decrypt (S2) the first encrypted key (6; 6a, 6b) using a second unclonable physical function key, PUF, (8) stored in the FPGA (2); and • copy (S3) the first decrypted key (11) into a battery-backed random access memory, BBRAM, (10) internal to the FPGA (2);then - a nominal boot step (S4) in which the FPGA (2) is configured to: • decrypt the encrypted FPGA image (7) stored in the nominal boot non-volatile memory (4) using the first decrypted key (11) stored in the BBRAM (10); and • as soon as the first decrypted key (11) has been used for decrypting the encrypted FPGA image (7), erase the first decrypted key (11) from the BBRAM (10).;
2. A secure boot method according to claim 1, characterized in that, once the first decrypted key (11) is copied into the BBRAM (10), the FPGA (2) is configured to erase the first decrypted key (11) from the BBRAM (10) after a period of between 100 and 1500 milliseconds.
3. A secure boot method according to claim 1 or 2, characterized in that the boot boot non-volatile memory comprises a first non-removable non-volatile memory (3a) and a second removable external non-volatile memory (3b), the first encrypted key comprising a first encrypted key portion (6a) stored in the first non-removable non-volatile memory (3a) and a second encrypted key portion (6b) stored in the second removable external non-volatile memory (3b).
4. A secure boot method according to claim 3, characterized in that, in the boot boot step, the FPGA (2) is configured to: - check whether the second removable external non-volatile memory (3b) is or is not connected to the FPGA (2); - when the second removable external non-volatile memory (3b) is connected to the FPGA (2), retrieve (Sla) the first encrypted key part (6a) stored in the first non-removable non-volatile memory (3a), and retrieve (Slb) the second encrypted key part (6b) stored in the second removable external non-volatile memory (3b); - combine the first encrypted key part (6a) and the second encrypted key part (6b) to form an encrypted BBRAM key; and - decrypting (S2) the encrypted BBRAM key using the second PUF key (8) stored in the FPGA (2), and copying the decrypted BBRAM key into the BBRAM (10) of the FPGA (2).
5. A secure boot method according to claim 4, characterized in that the second encrypted key part (6b) comprises at least one validity factor, and wherein the step of combining the first encrypted key part (6a) and the second encrypted key part (6b) is performed only in the case where the FGPA (2) has previously authenticated the at least one validity factor of the second encrypted key part (6b).
6. Printed circuit board (1; 12) comprising an FPGA (2) in which a second PUF key (8) is stored, a non-volatile boot boot memory (3; 3a, 3b) in which a first encrypted key (6; 6a, 6b) is stored, and a non-volatile nominal boot memory (4) in which an encrypted FPGA image (7) is stored, the FPGA (2) being configured to carry out the secure boot method according to one of claims 1 to 5.
7. A printed circuit board (12) according to claim 6 in dependence on claim 4, characterized in that the boot boot non-volatile memory comprises a first non-removable non-volatile memory (3a) integrated with the printed circuit board (12) and a second removable non-volatile memory (3b) external to the printed circuit board (12), the first encrypted key comprising a first encrypted key portion (6a) stored in the first non-removable non-volatile memory (3a) and a second encrypted key portion (6b) stored in the second external removable non-volatile memory (3b).