FPGA Lockstep Root of Trust for Fault-Tolerant Flight Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current root of trust architectures lack fault-tolerant functionality, making them unsuitable for flight-critical and safety-critical systems, as they can introduce single-point failures and violate safety guarantees when used with fault-tolerant processors.
Innovation Solution
An embedded fault-tolerant root of trust architecture on an FPGA featuring a lock-step fault-tolerant processor with two or more soft lock-step cores that provide command and control for an integrated cryptography processing core, ensuring redundancy and reliability through parallel operation and comparison of outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional root of trust architecture is used in flight-critical systems, then the system can perform trusted boot procedures and cryptographic functions, but the system introduces single-point failures and violates safety guarantees
Solution Approach 1:
The root of trust architecture is segmented into multiple independent processing cores (primary and secondary) that operate in parallel. Each core independently executes the same instructions and maintains separate state, allowing the system to divide the critical functionality across multiple units rather than relying on a single point of failure.
Solution Approach 2:
Each processing core is given identical functional capabilities and executes the same root of trust algorithms independently. The primary and secondary cores both perform cryptographic operations, key management, and boot verification, ensuring that each local unit has the quality and capability to handle critical functions autonomously.
2Reliability
If redundant systems are provided for fault tolerance, then system reliability improves, but the device complexity and resource requirements increase
Solution Approach 1:
A secondary copy of the processing core is created and configured to execute identical instructions to the primary core. This copy includes duplicate cryptographic function blocks, memory structures, and execution logic, providing redundancy without requiring entirely separate systems. The secondary core serves as both a functional duplicate and a fault-tolerance mechanism.
Solution Approach 2:
The primary and secondary cores are merged into a single integrated architecture that shares common resources such as the FPGA substrate, interconnect structures, and external interfaces. This combining approach provides redundancy while reducing overall system complexity compared to completely separate redundant systems.
3Measurement precision
If lock-step processing with multiple cores is implemented, then fault detection capability improves, but the processing speed and execution time may be reduced
Solution Approach 1:
The system skips detailed step-by-step comparison of every internal state change and rushes through the critical path by comparing only the essential output results and key state variables. This allows the lock-step verification to proceed quickly without sacrificing fault detection capability, maintaining processing speed while ensuring accuracy.
Solution Approach 2:
Instead of performing complete and exhaustive comparison of all internal registers and states at every clock cycle, the system performs partial verification by comparing critical output values and key execution states. This partial action approach maintains adequate fault detection while reducing the overhead that would otherwise slow down processing.
Data Source
AI summary
A field programmable gate array (FPGA) including a root of trust architecture. The architecture includes a system controller providing system control commands for the architecture and a cryptography processor for performing a hash or key operation for authentication of controller-embedded software and attestation of correct firmware in external system resources. The architecture also includes a lock-step fault-tolerant processor being responsive to messages from the system controller, and including a plurality of soft lock-step cores. Each soft core including separate memory and resources and operating on the same input, where each soft core provides output messages that are analyzed by a logic in the fault-tolerant processor that selects one of the messages to be output to the cryptography processor.