Programmable Logic Reconfiguration Using Configuration-Memory Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting programmable logic circuit designs from unauthorized copying and reverse engineering are insecure, as configuration data can be intercepted during transmission and internally stored decryption keys can be discovered through analysis.
Innovation Solution
A method where the configuration memory of a programmable logic IC is programmed with a first bitstream, and at least a portion of a second bitstream is encrypted using values stored in the configuration memory as a key, allowing secure decryption and programming within the IC, while using current configuration data as a decryption key to prevent key exhaustion and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If configuration data is stored externally in volatile memory and transmitted through configuration access port, then the programmable logic can be configured, but the design can be easily revealed to attackers by monitoring the data transmission
Solution Approach 1:
The patent introduces an encryption intermediary layer between the configuration data and the programmable logic device. Configuration data is encrypted using a key stored in non-volatile memory within the device, creating a secure intermediary mechanism that prevents direct exposure of the design during transmission and configuration.
2Object-affected harmful factors
If a decryption key is stored in non-volatile memory of the programmable logic IC to decrypt encrypted bitstream, then the design is protected during loading, but reverse engineering through decapping and chemical treatment can expose the decryption key
Solution Approach 1:
The patent segments the protection mechanism into multiple components: the decryption key is stored in non-volatile memory, while the configuration data is stored externally in volatile memory. This segmentation ensures that even if the device is reverse engineered, the external configuration data in volatile memory cannot be executed without the key, and the key itself remains protected within the device structure.
Solution Approach 2:
The patent moves the configuration data from internal non-volatile storage to external volatile storage, changing the dimensional aspect of where configuration occurs. This allows the device to load configuration externally after manufacturing, providing flexibility while maintaining security through the keyed encryption mechanism.
3Object-affected harmful factors
If standard encryption algorithms like DES or AES are used to encrypt design, then the design can be protected, but it is difficult to make the design both secure and easy to upgrade by legitimate users
Solution Approach 1:
The patent enables the programmable logic device to perform self-configuration by storing the decryption key in its own non-volatile memory and autonomously decrypting the externally loaded encrypted configuration data. This self-service capability allows legitimate users to upgrade designs by simply loading new encrypted bitstreams without requiring external decryption equipment or complex key management infrastructure.
Data Source
AI summary
An integrated circuit having secure configuration includes configuration memory, programmable logic resources coupled to the configuration memory, programmable interconnection resources coupled to the configuration memory and programmable logic resources, and a configuration controller circuit coupled to the configuration memory. The configuration controller circuit is configured to read values from a configuration memory address of a portion of the configuration memory in response to a configuration memory address contained in input configuration data, and to decrypt the input configuration data using the values as a decryption key. The configuration controller is further configured to program the configuration memory of the integrated circuit with the decrypted input configuration data.