FPGA Key Forming Circuit for Runtime Cryptographic Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing programmable logic devices face challenges in securely generating and protecting cryptographic keys, as they can be vulnerable to reverse engineering and side channel attacks, especially when bit streams are not encrypted or are broken, leading to potential decryption of encrypted data streams.
Innovation Solution
A programmable logic device with a key generation circuit that generates security information for cryptographic keys using initialization data from the bitstream, implemented as a combination of stateless and stateful logic circuits, which are configured to produce security information only upon activation and can be masked, making it difficult to extract without significant effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If security information is stored directly in the bitstream, then configuration is simple, but security is compromised due to reverse engineering and side channel attacks
Solution Approach 1:
The patent extracts security information from the bitstream by using a hash function to generate it dynamically at runtime. The security information is derived from the bitstream content but not directly stored in it, preventing extraction through reverse engineering while maintaining configuration simplicity.
Solution Approach 2:
The patent introduces a hash function as an intermediary between the bitstream and the security information. This intermediary transforms the bitstream into security information that cannot be directly reverse-engineered, while still allowing the system to be configured using standard bitstream loading procedures.
2Reliability
If bitstream encryption is used, then security is improved, but compatibility is reduced as some FPGAs do not support encrypted bitstreams
Solution Approach 1:
Instead of encrypting the bitstream, the patent extracts security information from the bitstream content through hashing. This approach maintains compatibility with all FPGAs regardless of encryption support, while still providing security against reverse engineering and side channel attacks.
3Reliability
If key generation is implemented in hardware, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service key generation where the FPGA generates its own security information internally using a hash function applied to the bitstream. This eliminates the need for external key management infrastructure while maintaining security, and the implementation uses standard FPGA logic resources rather than complex dedicated hardware.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention relates to a programmable logic device(10), which is programmed by way of a bit stream (13) so as to have a key forming circuit (11). The key forming circuit (11) is configured so as to generate, at run time, security information (K) that relates to a crypto-graphic key, which can be made available to a crypto-graphic unit (12) as an input parameter.