IP Checker Circuit for Secure Hardware Accelerator Licensing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data centers, existing technologies lack effective methods to securely lock the execution of intellectual property (IP) cores to licensed programmable devices, preventing unauthorized use and potential attacks such as device spoofing or whitelist modification.
Innovation Solution
A hardware accelerator with a programmable device featuring a static region and kernel logic, including an IP checker circuit that obtains and verifies a device identifier against a signed whitelist, selectively enabling or disabling kernel logic operation based on authorized device presence and signature verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP cores are licensed on a project basis allowing use on any number of programmable devices, then system integrators have flexibility in device deployment, but IP owners cannot control or limit execution to specific authorized devices in data centers
Solution Approach 1:
The patent segments the license management system into distinct components: a whitelist stored in non-volatile memory containing authorized device IDs, and an IP checker circuit that verifies device authorization. This segmentation allows the system to maintain simplicity while enabling controlled deployment to specific devices.
Solution Approach 2:
The IP checker circuit acts as an intermediary between the kernel logic and the programmable device, verifying device authorization before allowing IP execution. This intermediary component enables license control without complicating the overall system architecture.
2Ease of operation
If no device authorization mechanism is implemented, then IP can execute freely on any programmable device, but unauthorized devices can execute IP cores leading to potential attacks and loss of intellectual property protection
Solution Approach 1:
The system performs preliminary authorization verification by storing a whitelist of authorized device IDs in non-volatile memory before IP execution. The IP checker circuit verifies device authorization in advance, preventing unauthorized execution while allowing legitimate devices to operate without interruption.
Solution Approach 2:
The patent converts the potential harm of unauthorized access into a beneficial security feature by implementing an IP checker circuit that actively verifies device authorization. This transforms the vulnerability of unrestricted IP execution into a robust protection mechanism.
3Reliability
If a whitelist verification system is implemented to prevent unauthorized device execution, then IP protection is improved, but the system complexity and overhead for device verification increases
Solution Approach 1:
The verification system is implemented locally within the hardware accelerator, with the IP checker circuit and whitelist stored in non-volatile memory integrated into the device. This local implementation eliminates the need for complex external verification systems while maintaining reliable authorization checks.
4Adaptability or versatility
If kernel logic is made reconfigurable to allow flexible IP deployment, then adaptability is improved, but the risk of device spoofing and whitelist modification attacks increases
Solution Approach 1:
The system prepares for potential spoofing attacks by storing a whitelist of authorized device IDs in non-volatile memory before execution. The IP checker circuit uses this pre-prepared whitelist to verify device authorization, cushioning against spoofing attempts without limiting kernel reconfigurability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An example hardware accelerator (122) for a computer system (102) includes a programmable device (128) and further includes kernel logic (138) configured in a programmable fabric (3) of the programmable device, and an intellectual property (IP) checker circuit (180) in the kernel logic. The IP checker circuit is configured to obtain (1302) a device identifier (ID) of the programmable device and a signed whitelist (1004), the signed whitelist including a list of device IDs (1002) and a signature (1010), verify (1104) the signature of the signed whitelist, compare (1106) the device ID against the list of device IDs, and selectively (1106) assert or deassert an enable of the kernel logic in response to presence or absence, respectively, of the device ID in the list of device IDs and verification of the signature.