PLD Configuration Data Encryption Without Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing programmable logic devices (PLDs) face security challenges in protecting configuration data from unauthorized copying and require complex non-volatile memory for decryption key storage, which delays technology migration and poses security risks.
Innovation Solution
A method where an external storage device encrypts configuration data with a customer-selected encryption key, generating a correction word based on the PLD's ID code, allowing the same key to be used for multiple PLDs with different ID codes, without storing decryption information in the PLD, thus avoiding the need for non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed decryption key is hardwired into the PLD, then decryption functionality is provided, but security is weakened because the same key can be used to decrypt configuration data for multiple PLDs
Solution Approach 1:
The patent applies local quality by making the decryption key unique to each PLD instance. Instead of using a common fixed key across all devices, each PLD is programmed with its own distinct decryption key during manufacturing. This ensures that configuration data encrypted for one PLD cannot be decrypted by another PLD, thereby maintaining security while providing the necessary decryption functionality.
2Object-affected harmful factors
If each PLD uses a different decryption key, then security is improved, but programming complexity increases because different encryption keys are required for each PLD
Solution Approach 1:
The patent applies preliminary action by pre-programming each PLD with its unique decryption key during the manufacturing process. This preliminary configuration eliminates the need for customers to manually program different keys for each device. When a customer purchases multiple PLDs, they all come pre-configured with distinct keys, and the programming software automatically handles the key management, thereby maintaining security without increasing user-facing complexity.
3Duration of action of stationary object
If non-volatile memory is included to store decryption keys, then key retention is achieved, but device complexity and manufacturing difficulty increase
Solution Approach 1:
The patent applies the taking out principle by removing the requirement for non-volatile memory elements from the PLD architecture. Instead of embedding complex non-volatile memory (such as PROM, EPROM, EEPROM, or flash memory) within the PLD to store decryption keys, the system extracts this storage function to external non-volatile memory. The PLD itself uses only volatile memory for key storage, simplifying the device architecture while still providing secure key retention through the external storage medium.
4Duration of action of stationary object
If non-volatile memory is used for key storage, then decryption keys are retained when powered-off, but migration to newer process technologies is delayed
Solution Approach 1:
The patent applies the taking out principle by extracting the non-volatile key storage function from the PLD device itself and placing it in external non-volatile memory. This allows the PLD to be implemented using cutting-edge volatile memory process technologies without being constrained by the need to integrate complex non-volatile memory elements. The external storage handles key persistence, enabling the PLD to benefit from continuous process technology improvements while still maintaining secure key retention across power cycles.
Data Source
AI summary
An external storage device may transmit encrypted configuration data to a PLD during a configuration operation without transmitting the encryption key to the PLD and without retaining decryption information in the PLD. During a set-up operation, the encryption key is provided to the PLD, which generates an ID code upon power-up. The PLD generates a correction word in response to the encryption key and the ID code. The correction word is output from the PLD, which is powered-down, and is stored with the encrypted configuration data in the storage device. Then, during a configuration operation, the PLD is powered-on and re-generates the ID code. The correction word and the encrypted configuration data are transmitted to the PLD, which generates a decryption key in response to the re-generated ID code and the correction word.