FPGA Key Forming Circuit for Runtime Cryptographic Key Protection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing programmable logic devices face challenges in securely generating and protecting cryptographic keys, as they can be vulnerable to reverse engineering and side channel attacks, especially when bit streams are not encrypted or are broken, leading to potential decryption of encrypted data streams.

Innovation Solution

A programmable logic device with a key generation circuit that generates security information for cryptographic keys using initialization data from the bitstream, implemented as a combination of stateless and stateful logic circuits, which are configured to produce security information only upon activation and can be masked, making it difficult to extract without significant effort.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If security information is stored directly in the bitstream, then configuration is simple, but security is compromised due to reverse engineering and side channel attacks

Engineering Contradiction:
Improveconfiguration simplicityVSAvoidsecurity
Core Design Contradiction:
Ease of manufactureVSReliability

Solution Approach 1:

The patent extracts security information from the bitstream by using a hash function to generate it dynamically at runtime. The security information is derived from the bitstream content but not directly stored in it, preventing extraction through reverse engineering while maintaining configuration simplicity.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a hash function as an intermediary between the bitstream and the security information. This intermediary transforms the bitstream into security information that cannot be directly reverse-engineered, while still allowing the system to be configured using standard bitstream loading procedures.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If bitstream encryption is used, then security is improved, but compatibility is reduced as some FPGAs do not support encrypted bitstreams

Engineering Contradiction:
ImprovesecurityVSAvoidFPGA compatibility
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

Instead of encrypting the bitstream, the patent extracts security information from the bitstream content through hashing. This approach maintains compatibility with all FPGAs regardless of encryption support, while still providing security against reverse engineering and side channel attacks.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If key generation is implemented in hardware, then security is improved, but device complexity increases

Engineering Contradiction:
ImprovesecurityVSAvoidcircuit complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements self-service key generation where the FPGA generates its own security information internally using a hash function applied to the bitstream. This eliminates the need for external key management infrastructure while maintaining security, and the implementation uses standard FPGA logic resources rather than complex dedicated hardware.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3146520B1Programmable logic device, key forming circuit, and method for providing a security information
Publication Date: 2019.12.11 SIEMENS AG
  • EP3146520B1 patent drawingFigure 1~2
  • EP3146520B1 patent drawingFigure 3~4
  • EP3146520B1 patent drawingFigure 5~6

AI summary

The invention relates to a programmable logic device(10), which is programmed by way of a bit stream (13) so as to have a key forming circuit (11). The key forming circuit (11) is configured so as to generate, at run time, security information (K) that relates to a crypto-graphic key, which can be made available to a crypto-graphic unit (12) as an input parameter.