Incremental Authentication for Memory-Constrained FPGA Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data integrity and authentication methods for programmable integrated circuits, such as FPGAs, face challenges in efficiently verifying the integrity and authenticity of large configuration images, particularly when on-chip memory is limited, and there is a need to reduce memory consumption and authentication time while ensuring security.
Innovation Solution
A method that uses incremental authentication, where a signature at the beginning of the image is extended to the entire image using a small internal buffer, storing only two hashes and a data chunk, and employing hash functions like SHA-3 and RSA to verify data chunks, allowing for sequential retrieval and authentication of data chunks from off-chip memory, reducing memory consumption and authentication time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used for large configuration images, then data integrity and authenticity can be verified, but memory consumption increases and authentication time lengthens
Solution Approach 1:
The configuration image is divided into multiple data chunks (C1, C2, ..., Cn), and the authentication process is segmented into incremental steps where each chunk is authenticated individually using hash chains, allowing verification without loading the entire image into memory
Solution Approach 2:
Hash values (H1, H2, ..., Hn) are pre-computed and stored alongside the data chunks during configuration image generation, enabling efficient incremental authentication without requiring complex real-time computations during loading
2Reliability
If traditional authentication methods are used for large configuration images, then data integrity and authenticity can be verified, but authentication time increases
Solution Approach 1:
The authentication process is divided into incremental steps that can be performed sequentially during configuration loading, avoiding the need to wait for complete image loading before starting verification
Solution Approach 2:
Authentication operations continue concurrently with configuration image loading through incremental verification of each data chunk as it is loaded, maximizing utilization of processing resources and reducing total authentication time
3Speed
If all configuration data is loaded into on-chip memory, then fast access is enabled, but memory capacity requirements increase
Solution Approach 1:
The configuration image is divided into data chunks that can be loaded and processed incrementally, allowing smaller portions of data to reside in fast on-chip memory at any given time while maintaining overall system performance
Solution Approach 2:
Hash chains serve as an intermediary verification mechanism that enables security validation without requiring the entire configuration image to be simultaneously present in on-chip memory, bridging the gap between external storage and internal processing
Data Source
AI summary
Apparatus and associated methods relate to authenticating a back-to-front-built configuration image. In an illustrative example, a circuit may include memory configured to store a signature S, a second hash H2, and a first data chunk C1. Signature S may be signed on a first hash H1. H1 may be the hash for H2 and C1. If signature S passes verification, a hash engine may perform hash functions on C1 and H2 to generate a hash H1′. H1′ may be compared with H1 to indicate whether C1 has been tampered with or not. By using the incremental authentication, a signature that appears at the beginning of the image may be extended to the entire image while only using a small internal buffer. Advantageously, internal buffer may only need to store two hashes Hi, Hi+1, and a data chunk Ci, or, a signature S, a hash Hi, and a data chunk Ci.