On-Chip Bitstream Initialization for Secure FPGA Reconfiguration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Reconfigurable hardware devices face issues with untrusted bitstreams from third-party vendors, storage requirements, and security threats during transit, including hardware Trojans and interception, which compromise security and timing.
Innovation Solution
A built-in bitstream initialization (BIBI) framework generates bitstreams on-chip using a sequence generator, masking, encryption, and error correction to ensure secure and efficient configuration of reconfigurable hardware platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If bitstreams are stored in off-chip memories and transferred to the FPGA when needed, then storage capacity is improved, but timing overhead increases
Solution Approach 1:
The system segments the bitstream storage and processing into two parts: a compact seed value is stored on-chip, while the full bitstream is generated on-demand using the seed and a pseudo-random number generator. This segmentation allows the FPGA to store only the small seed (reducing storage overhead) while still having access to the full bitstream when needed (reducing timing overhead compared to off-chip storage).
Solution Approach 2:
The system performs preliminary action by pre-computing and storing the seed value for bitstream generation on-chip during design time. This preliminary preparation eliminates the need to transfer large bitstreams from off-chip memory at runtime, significantly reducing timing overhead while maintaining the ability to store multiple bitstream configurations.
2Quantity of substance
If bitstreams are transferred from off-chip memory to FPGA, then storage requirements are reduced, but security risks increase
Solution Approach 1:
The system implements self-service by enabling the FPGA to generate its own bitstreams locally using an on-chip pseudo-random number generator seeded with a stored seed value. This eliminates the need to transfer bitstreams from off-chip memory, thereby removing the security risks associated with data transmission while still satisfying storage requirements through efficient on-chip generation.
Solution Approach 2:
The system introduces an intermediary mechanism - a pseudo-random number generator - that acts as a mediator between the stored seed value and the required bitstream. This intermediary enables secure on-chip generation without requiring direct transfer of bitstream data from off-chip memory, thus reducing security risks while maintaining storage efficiency.
3Adaptability or versatility
If third-party bitstreams are used, then functionality is improved, but reliability decreases
Solution Approach 1:
The system applies parameter changes by transforming third-party provided functionality specifications into secure on-chip implementations. Instead of using raw third-party bitstreams directly, the system converts the functional requirements into parameters that drive secure on-chip bitstream generation, thereby maintaining functionality while improving reliability through local control and verification.
Data Source
AI summary
A method and system are directed to generating on-chip bitstreams on reconfigurable hardware. The system comprises a built-in bitstream initialization (BIBI) module configured to generate one or more bitstreams on a semiconductor device. The BIBI module comprising a sequence generator configured to generate a sequence of values for each of the one or more bitstreams, a masking module configured to convert the sequence of values to a given precision of bits, an encryption module configured to apply an encryption scheme to the sequence of values, and an error correction module configured to apply error correction on the sequence of values, wherein the one or more bitstreams are transmitted to a routing network configured to map the one or more bitstreams to input positions of one or more compute blocks.