Programmable IC Key Selection for Secure Partial Reconfiguration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programmable logic devices using SRAM storage are vulnerable to reverse engineering due to the volatility of SRAM and the ability to monitor data flowing out of nonvolatile storage, compromising the security of configuration data.
Innovation Solution
Implementing a programmable integrated circuit device with separate key stores and control circuitry that selectively decrypts configuration data using different encryption schemes and keys, allowing for partial reconfiguration and secure protection of proprietary data by using a combination of nonvolatile, volatile, and user-inputted keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If SRAM storage is used for configuration data, then device size is reduced and speed is improved, but security against reverse engineering deteriorates due to data volatility and monitorability
Solution Approach 1:
The patent divides configuration data into multiple segments, each encrypted with a different key. Different portions of the configuration data are encrypted using different encryption schemes and stored in separate locations, preventing an attacker from recovering the entire configuration by monitoring a single data stream.
Solution Approach 2:
The patent introduces decryption circuitry as an intermediary between the encrypted configuration data and the programmable logic device. This intermediary decrypts the data in real-time during device operation, preventing the plaintext configuration from being exposed on external pins while still allowing the device to function at full speed.
2Object-affected harmful factors
If encryption is applied to configuration data, then security is improved, but device complexity increases due to additional key management requirements
Solution Approach 1:
The patent segments key management into separate key stores, each holding a specific decryption key. This modular approach to key management simplifies the overall system by organizing complex key handling into discrete, manageable units that can be independently controlled and secured.
Solution Approach 2:
The patent implements dynamic key selection where the decryption circuitry automatically selects which key to use based on which portion of the configuration data needs to be decrypted. This dynamic approach reduces complexity by eliminating the need for manual key selection logic and making the system adaptable to different decryption needs.
3Object-affected harmful factors
If multiple encryption schemes are used for different configuration portions, then security against multiple threats is improved, but manufacturing complexity increases
Solution Approach 1:
The patent divides the configuration data into distinct portions that can be independently encrypted with different schemes. This segmentation allows each portion to be processed and secured separately during manufacturing, simplifying the overall fabrication process while maintaining comprehensive security coverage across all configuration data.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Configuration data for a programmable integrated circuit device is at least partially encrypted according to at least one encryption scheme. A plurality of key stores store a plurality of decryption keys for the at least one encryption scheme. Control circuitry identifies a required key from the at least partially encrypted configuration data and generates a key selection signal. Key selection circuitry responsive to the key selection signal reads the plurality of key stores and provides the required key to the control circuitry. The control circuitry may include decryption circuitry that decrypts the at least partially encrypted configuration data using the required key. In some embodiments, different portions of the configuration data, which may represent separate partial reconfigurations of the device, require different decryption keys. Keys may be generated from combinations of the contents of the key stores.