FPGA Secure Boot Using Delay PUF Key Regeneration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Field Programmable Gate Arrays (FPGAs) face security vulnerabilities during boot-up due to the risk of reverse engineering and tampering with cryptographic keys stored on-chip, which can be extracted using invasive and semi-invasive techniques, compromising data integrity and privacy.
Innovation Solution
A self-authenticating system that uses a hardware-embedded delay Physical Unclonable Function (PUF) to generate a decryption key by measuring path delays, ensuring secure boot-up without relying on vendor-specific FPGA features or embedded security primitives, and utilizing the SHA-3 algorithm for authentication and key regeneration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored on-chip in FPGAs for secure boot-up, then data integrity and privacy are protected, but the keys become vulnerable to extraction using invasive and semi-invasive techniques
Solution Approach 1:
The patent extracts the cryptographic key from physical storage locations (NVM, BBRAM, E-Fuses) and replaces it with a virtual key generated dynamically by a PUF. The PUF generates the key on-demand by measuring physical path delays within the FPGA fabric, eliminating the need for persistent key storage and thus removing the attack surface for key extraction.
Solution Approach 2:
The patent changes the fundamental parameter of key representation from static (stored in memory cells) to dynamic (generated through physical measurement). The key exists only transiently as a measurement result of path delays, and can be regenerated indefinitely with the same expected value, transforming the key from a storable artifact to a reproducible measurement.
2Reliability
If vendor-embedded cryptographic primitives and NVM-based keys are used for secure boot-up, then authentication is achieved, but the system becomes dependent on vendor-specific features and embedded security hardware
Solution Approach 1:
The patent creates a universal secure boot mechanism that works across different FPGA vendors and families by using only the basic FPGA fabric resources (logic elements, routing, and timing). The PUF implementation uses generic delay measurement techniques that are independent of vendor-specific cryptographic primitives, making the solution universally applicable while eliminating dependency on embedded security hardware.
3Reliability
If encrypted bitstreams are stored in off-chip NVM and decrypted using on-chip keys, then bitstream protection is achieved, but recent attacks can read out embedded keys threatening boot-up security
Solution Approach 1:
The patent introduces the PUF as an intermediary between the encrypted bitstream and the decryption key. Instead of directly storing and using static keys, the system uses the PUF's dynamic key generation capability as a mediator. The PUF responds to challenges with expected values that serve as decryption keys, creating an indirect key delivery mechanism that prevents direct key extraction while maintaining decryption functionality.
4Reliability
If E-Fuses are used for key storage in FPGAs, then one-time-programmable security is achieved, but the system becomes vulnerable to semi-invasive attacks using scanning technologies
Solution Approach 1:
The patent creates a functional copy of the key storage concept by replacing physical key bits in E-Fuses with a virtual key generated through PUF measurement. The PUF replicates the key generation function without requiring physical key material to be stored or programmed, thereby eliminating the vulnerability to scanning attacks while maintaining the one-time-programmable security characteristic through challenge-response authentication.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
The solution provides a tamper-evident and self-contained secure boot process that prevents unauthorized access and tampering, ensuring the integrity of the boot-up process and minimizing the exposure of decryption keys, thereby enhancing the security of FPGAs against reverse engineering and tampering attacks.
Implementation Method 1
A self-authenticating system that uses a hardware-embedded delay Physical Unclonable Function (PUF) to generate a decryption key by measuring path delays
Data Source
AI summary
The invention is directed to an autonomous, self-authenticating and self-contained secure boot-up system and methods for field programmable gate arrays (FPGAs) that leverages physical unclonable functions (PUFs).