PLD Secure Boot Using Pre-Authenticated Configuration Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for secure booting systems and methods for programmable logic devices (PLDs) that protect configuration data and prevent subversion of desired operations, particularly in trusted computing applications, without incurring downtime or impacting performance.
Innovation Solution
The implementation of a secure boot system for PLDs involves pre-authenticating configuration images using an on-chip authentication engine, storing the authentication status, and selectively programming the PLD fabric based on this status, allowing secure booting with minimal performance impact. Additionally, lock statuses are assigned to assets and configuration images to prevent unauthorized access and data extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If configuration images are authenticated using an on-chip authentication engine before programming the PLD fabric, then security against unauthorized access and data extraction is improved, but boot time and system downtime increase
Solution Approach 1:
The patent implements pre-authentication of configuration images before they are programmed into the PLD fabric. The authentication engine verifies the configuration image in advance, and only authenticated images are programmed, ensuring security while optimizing boot time by avoiding re-authentication during boot operations.
Solution Approach 2:
The patent extracts the authentication function into a separate on-chip authentication engine that operates independently from the main PLD fabric programming process. This allows authentication to be performed in parallel or beforehand, separating the security verification step from the time-critical boot programming operation.
2Reliability
If lock statuses are assigned to assets and configuration images to prevent unauthorized access, then data protection is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent implements lock statuses at the granularity of individual assets and configuration images rather than applying uniform security across the entire device. This allows selective protection where needed while maintaining operational flexibility and minimizing unnecessary complexity in unprotected areas.
Solution Approach 2:
The authentication engine automatically verifies configuration images against stored authentication data and enforces lock statuses without requiring external intervention. The system self-manages the security verification process, reducing operational overhead despite the added security mechanisms.
3Reliability
If configuration data is protected against subversion of desired operations, then operational integrity is improved, but ease of configuration and programming is worsened
Solution Approach 1:
The patent introduces an authentication engine as an intermediary between the configuration programming process and the PLD fabric. This intermediary automatically verifies configuration images against authentication data, providing security without requiring manual intervention or complex security management from the user.
Data Source
AI summary
Systems and methods for secure booting of secure programmable logic devices (PLDs) are disclosed. An example system includes a secure PLD including programmable logic blocks (PLBs) arranged in a PLD fabric of the secure PLD, and a configuration engine configured to program the PLD fabric according to a configuration image stored in a non-volatile memory (NVM) of the secure PLD and/or coupled through a configuration input/output (I/O) of the secure PLD to the configuration engine. The secure PLD is configured to retrieve a pre-authentication status associated with the configuration image from the NVM, determine or verify the retrieved pre-authentication status associated with the configuration image includes a valid status, and boot the PLD fabric of the secure PLD using the configuration image.