FPGA Configuration Authentication Using Chained Integrity Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating configuration data records in field-programmable logic gate arrangements are inefficient, complex, and vulnerable to manipulation, particularly due to the need for additional identity parameters and increased complexity in verification processes.
Innovation Solution
The method involves dividing the configuration data record into two parts, generating integrity values using cryptographic checksums, and utilizing an authentication module to check the authenticity of these values, thereby ensuring the integrity and authenticity of the configuration without additional identity parameters, and protecting against manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional identity parameters (such as identity values or continuous counter values) are assigned to each subconfiguration record for authentication, then the authenticity verification capability is improved, but the size of each subconfiguration record increases and the FPGA complexity increases due to required verification calculations
Solution Approach 1:
The patent extracts the authentication function from the FPGA logic and implements it in an external authentication module. The FPGA only needs to calculate and output integrity values, while the external module performs the comparison and authentication verification. This separation removes complex verification logic from the FPGA, reducing its complexity while maintaining strong authentication capabilities.
Solution Approach 2:
The patent introduces an external authentication module as an intermediary between the FPGA and the verification process. This mediator handles the complex comparison operations between integrity values and reference values, allowing the FPGA to remain simple while still achieving reliable authentication through the intermediary's verification capabilities.
2Reliability
If additional identity parameters are assigned to each subconfiguration record, then the authenticity verification capability is improved, but the size of each subconfiguration record increases
Solution Approach 1:
The patent extracts the authentication function from the FPGA logic and implements it in an external authentication module. The FPGA only needs to calculate and output integrity values, while the external module performs the comparison and authentication verification. This separation removes complex verification logic from the FPGA, reducing its complexity while maintaining strong authentication capabilities.
Solution Approach 2:
The patent introduces an external authentication module as an intermediary between the FPGA and the verification process. This mediator handles the complex comparison operations between integrity values and reference values, allowing the FPGA to remain simple while still achieving reliable authentication through the intermediary's verification capabilities.
3Reliability
If verification logic is implemented in the FPGA, then the authenticity verification can be performed, but the verification process takes a relatively long time per subconfiguration record if the verification logic is poorly implemented
Solution Approach 1:
The patent extracts the authentication function from the FPGA logic and implements it in an external authentication module. The FPGA only needs to calculate and output integrity values, while the external module performs the comparison and authentication verification. This separation removes complex verification logic from the FPGA, reducing its complexity while maintaining strong authentication capabilities.
Solution Approach 2:
The patent introduces an external authentication module as an intermediary between the FPGA and the verification process. This mediator handles the complex comparison operations between integrity values and reference values, allowing the FPGA to remain simple while still achieving reliable authentication through the intermediary's verification capabilities.
4Reliability
If the configuration data record is authenticated using existing methods, then some level of security is provided, but the authentication process is vulnerable to manipulation and lacks efficiency
Solution Approach 1:
The patent divides the configuration data record into multiple subconfiguration records, each with its own integrity value. This segmentation allows for efficient parallel processing and verification of individual records while maintaining overall security. The chain-like connection between integrity values provides both security and efficiency in the authentication process.
Data Source
Figure 1~2
Figure 3
AI summary
The invention relates to a computer-implemented method for authenticating a configuration data set of a field-programmable logic gate array, comprising several steps. It also relates to an electronic circuit with a field-programmable logic gate array, a computer program product, and a computer-readable storage medium. First, the configuration data set for the field-programmable logic gate array is provided. The configuration data set is then split into at least two parts, the first part being stored in a first sub-configuration data set and the second part being stored in a second sub-configuration data set. At least one first integrity value of the first sub-configuration data set is generated.At least one second integrity value of the second subconfiguration record is generated by a cryptographic checksum dependent on the preceding subconfiguration records and/or the preceding integrity values. At least one of the subconfiguration records with the at least one assigned integrity value is transferred to an authentication module. Subsequently, a verification result for the authenticity of the at least one subconfiguration record is determined based on the assigned integrity value, with the verification result being determined by the authentication module.