FPGA Configuration Authentication Using Internal Identifier and Design Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting configuration data in programmable integrated circuits (ICs) are costly and inefficient, as they require additional hardware and logistical complexities, such as external batteries and secure devices, to prevent unauthorized duplication and reverse-engineering.
Innovation Solution
A method involving a unique identifier stored in non-volatile memory, combined with a data word from the user design, using a hash or shifting function to generate a key that is compared to an expected value, enabling or disabling the design without additional external hardware or hardwired circuitry, ensuring only authorized configurations are executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption/decryption functionality is provided in all FPGAs, then security against unauthorized duplication is improved, but device complexity and cost increase for all users
Solution Approach 1:
The patent implements authentication functionality selectively only in FPGAs that require security protection, rather than in all FPGAs. The authentication logic is integrated into the configuration data stream and executed by dedicated authentication logic within the FPGA, allowing users who need security to have it while keeping standard FPGAs simple and cost-effective.
Solution Approach 2:
The patent extracts the authentication functionality from the core FPGA fabric and implements it as separate authentication logic that processes configuration data independently. This allows the authentication mechanism to be optional and separable, enabling security only where needed without complicating the basic FPGA architecture for all users.
2Duration of action of stationary object
If external batteries are used to maintain encryption keys, then key persistence is improved, but device complexity and logistical complexity increase
Solution Approach 1:
The patent eliminates the need for external batteries by using the FPGA's internal volatile memory to store encryption keys. The keys are loaded into the FPGA during configuration and remain in memory during operation without requiring external power maintenance. This self-contained approach removes all logistical complexity associated with battery management while maintaining key persistence during device operation.
3Adaptability or versatility
If configuration data is transmitted over bus or wire, then programming flexibility is improved, but vulnerability to interception increases
Solution Approach 1:
The patent applies encryption to the configuration data stream before it is transmitted over the bus or wire. The encryption key is embedded within the configuration data itself, allowing the data to be transmitted in plaintext form while already being protected. This preliminary encryption prevents interception vulnerability without restricting programming flexibility, as the encrypted data can still be loaded and executed normally.
Solution Approach 2:
The patent uses encryption as an intermediary layer between the configuration data and the transmission medium. The encryption algorithm processes the configuration data to produce an encrypted stream that can be safely transmitted over unprotected buses or wires. This intermediary protection mechanism allows flexible transmission while preventing unauthorized access to the underlying design information.
4Ease of operation
If readback feature or JTAG is used to read configuration data, then debugging capability is improved, but risk of unauthorized duplication increases
Solution Approach 1:
The patent encrypts the configuration data stream before it can be read out through JTAG or readback features. The encryption key is embedded within the configuration data, making any readout operation produce encrypted output that cannot be used for unauthorized duplication. This preliminary encryption maintains full debugging capability while preventing the harmful effect of data theft through these interfaces.
Data Source
AI summary
Methods of authenticating a user design in a programmable integrated circuit. The methods utilize an identifier unique to the programmable IC and a data word taken from the user design. The data word can be unique to the design and can include a string of data taken from the configuration data for the design, or the values of circuit nodes read from selected points throughout the design. A function is performed on the identifier and the data word, producing a key specific to the user design as implemented in that programmable IC. The key is compared to an expected value. When the key matches the expected value, the user design is enabled. When the key does not match the expected value, at least a portion of the user design is disabled. Circuitry for performing the steps of the method can be implemented in the programmable resources of the programmable IC.