FPGA Cryptographic Circuit with Parallel Channels for Power and Resource Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Field programmable gate arrays (FPGAs) face challenges in implementing cryptography functions due to high resource consumption, leading to timing issues and increased power consumption, particularly in applications like MACsec, which require large quantities of look-up tables, flip-flops, and block random access memories.
Innovation Solution
The implementation of a circuit arrangement that combines hardwired cryptographic circuitry with a reconfigurable cryptographic shell, providing parallel channels for encryption and decryption, allowing for efficient and flexible cryptographic operations across various security applications like MACsec, IPsec, and bulk cryptography.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If extensive pipelining is employed to alleviate timing issues, then timing closure is achieved, but power consumption increases beyond desirable levels
Solution Approach 1:
The cryptographic function is divided into multiple pipeline stages, with each stage performing a specific operation (e.g., key expansion, state transformation, mixing). This segmentation allows the circuit to operate at higher clock speeds by reducing the critical path delay in each stage, while the modular structure enables selective activation of stages to manage power consumption.
Solution Approach 2:
The pipeline stages are designed to be dynamically controllable, allowing the system to adjust the number of active stages based on throughput requirements. When lower throughput is needed, fewer stages are activated, reducing power consumption while maintaining timing closure capability when high speed is required.
2Reliability
If a single MACsec function is implemented, then cryptographic security is provided, but FPGA resource consumption reaches approximately 100,000 LUTs, 100,000 FFs, and 100 BRAMs
Solution Approach 1:
The cryptographic circuit is designed with a universal structure that can perform multiple cryptographic functions (e.g., AES-128, AES-192, AES-256, different modes of operation) using the same hardware resources. The key expansion unit, state transformation blocks, and mixing functions are configured through control signals rather than dedicated hardware for each algorithm, reducing overall resource consumption while maintaining security requirements.
Solution Approach 2:
The circuit uses parameterized design where key size, block size, and operation mode are controlled by configuration parameters rather than fixed hardware. This allows the same physical circuit to adapt to different cryptographic standards by changing control parameters, significantly reducing the FPGA resources needed compared to implementing separate dedicated circuits for each standard.
3Ease of operation
If FPGAs are used for cryptography functions, then software control convenience and ease of adding functions are achieved, but resource consumption and timing closure challenges increase
Solution Approach 1:
The cryptographic function is implemented as a parameterized module where algorithm type, key size, and operation mode are controlled by configuration parameters. This allows software to easily reconfigure the hardware for different cryptographic needs by writing to configuration registers, maintaining ease of operation while reducing design complexity through reuse of the same structural template.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A circuit arrangement includes an encryption circuit and a decryption circuit. A cryptographic shell circuit has a transmit channel and a receive channel in parallel with the transmit channel. The transmit channel includes an encryption interface circuit coupled to the encryption circuit. The encryption interface circuit determines first cryptographic parameters based on data in a plaintext input packet and inputs the first cryptographic parameters and plaintext input packet to the encryption circuit. The receive channel includes a decryption interface circuit coupled to the decryption circuit. The decryption interface circuit determines second cryptographic parameters based on data in a ciphertext input packet and inputs the second cryptographic parameters and ciphertext input packet to the decryption circuit. The encryption circuit encrypts the plaintext input packet based on the first cryptographic parameters, and the decryption circuit decrypts the ciphertext input packet based on the second cryptographic parameters.