FPGA Cryptographic Security via Segmentation and Intermediary Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Field programmable gate arrays (FPGAs) used in general-purpose computing systems are susceptible to attacks and insecure code execution, as data transfers and memory inspections can reveal cryptographic keys and algorithms, compromising security.
Innovation Solution
Implementing encryption and digital signing of data and code transferred between the FPGA and other components, using cryptographic keys stored within the FPGA, and reprogrammable cryptographic operations to enhance security and isolate components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the FPGA is used as a shared programmable co-processor resource in a general-purpose computing system, then the adaptability and versatility of the system is improved, but the security and reliability of cryptographic operations deteriorates due to susceptibility to attacks and insecure code execution
Solution Approach 1:
The patent segments the FPGA into isolated regions: a reconfigurable logic region for programmable operations and a fixed cryptographic region for secure operations. This physical segmentation prevents attacks from the reconfigurable portion from compromising the cryptographic functions, resolving the contradiction between adaptability and security by creating distinct security zones within the same device.
Solution Approach 2:
The patent introduces a trusted platform module (TPM) as an intermediary between the external environment and the FPGA's cryptographic functions. The TPM acts as a mediator that verifies and protects cryptographic keys and operations, allowing the FPGA to maintain both reconfigurability and cryptographic security by mediating all cryptographic access through this trusted intermediary.
2Ease of operation
If data transfers and memory inspections are allowed for debugging and monitoring purposes, then the ease of operation is improved, but the security deteriorates as cryptographic keys and algorithms can be revealed
Solution Approach 1:
The patent applies local quality by creating different access permissions for different regions of the FPGA. The isolated cryptographic region has restricted access that prevents debugging and monitoring tools from inspecting cryptographic keys and algorithms, while the reconfigurable logic region maintains full debugging capability. This regional differentiation of access rights resolves the contradiction between operational ease and security.
3Adaptability or versatility
If the FPGA is programmed with multiple cryptographic operations, then the adaptability is improved, but the device complexity increases making security management more difficult
Solution Approach 1:
The patent implements a universal cryptographic interface that can handle multiple cryptographic operations through a single standardized pathway. The isolated cryptographic region provides multi-functional support for various cryptographic algorithms while maintaining a unified security management model, reducing the complexity that would otherwise arise from managing multiple separate cryptographic implementations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Field programmable gate arrays can be used as a shared programmable co-processor resource in a general purpose computing system. Components of an FPGA are isolated to protect the FPGA and data transferred between the FPGA and other components of the computer system. Transferred data can be digitally signed by the FPGA or other component to provide authentication. Code for programming the FPGA can be encrypted and signed by the author, loaded into the FPGA in an encrypted state, and then decrypted and authenticated by the FPGA itself, before programming the FPGA with the code. This code can be used to change the cryptographic operations performed in the FPGA, including keys, or decryption and encryption algorithms, or both.