FPGA Computation Circuit Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud systems using FPGAs as processors face challenges in securing computation circuits generated by users, as malicious IPs can access and manipulate memory addresses, leading to potential data theft and increased security risks.
Innovation Solution
An information-processing system is configured with a computation circuit that performs computations, an encryption circuit to encrypt results, and a management apparatus that manages encryption keys and notifies them to the client, allowing only authorized decryption of encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users can freely configure computation circuits in FPGA, then adaptability and versatility are improved, but security risk increases due to potential malicious access and data theft
Solution Approach 1:
The system segments the FPGA into multiple isolated computation circuits, each with dedicated encryption keys. This segmentation prevents malicious circuits from accessing other circuits' data while maintaining the ability to configure multiple different computation circuits for various user needs.
Solution Approach 2:
An encryption circuit acts as an intermediary between computation circuits and memory, automatically encrypting computation results with circuit-specific keys before storage. This intermediary mechanism protects against data theft while allowing flexible configuration of computation circuits.
2Reliability
If encryption is applied to computation results, then security is improved, but device complexity increases due to additional encryption circuits and key management
Solution Approach 1:
The encryption circuit is merged with the FPGA fabric, sharing hardware resources with computation circuits. This integration reduces overall device complexity compared to separate encryption hardware while maintaining strong security through circuit-specific encryption keys.
3Stability of the object's composition
If computation results are encrypted before storage, then data integrity is improved, but processing time increases due to encryption and decryption operations
Solution Approach 1:
Encryption occurs continuously in the background as computation results are generated, without interrupting the computation flow. The encryption circuit operates in parallel with computation circuits, minimizing time loss while ensuring data integrity through automatic encryption before memory storage.
Data Source
AI summary
An apparatus includes a first-processor, and a programmable integrated circuit coupled to the first-processor; a second-processor, and a memory coupled to the second-processor, the second-processor being configured to access the first-processor; and a third-processor to manage the first-processor, wherein the first-processor is configured to write, to the rewritable-integrated circuit, a computation circuit to perform computation according to information from the second-processor, and an encryption circuit to generate encrypted data by encrypting a computation result computed by the computation circuit, by using an encryption key for the computation circuit, the third-processor is configured to manage the encryption key in association with the computation circuit and notify the second-processor of the encryption key for the computation circuit, and the second-processor is configured to read out the encrypted data from the memory for storing the encrypted data, and decrypt the read encrypted data by using the encryption key notified from the third-processor.