Customer load of field programmable gate arrays

• US 10,255,450 B2
• Filed: 12/04/2017
• Issued: 04/09/2019
• Est. Priority Date: 04/28/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Arnold, Todd W., Check, Mark A., Condorelli, Vincenzo
• Primary Examiner(s): Shiferaw, Eleni A
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US15/830,106
• Publication Number:
  US 20180101689A1
• Time in Patent Office: 491 Days
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Customer content is securely loaded on a field programmable gate array (FPGA) located on a secure cryptography card. The customer content is loaded such that it may not be extracted. A customer obtains a secure cryptography card that includes a field programmable gate array and a master key generated by the secure cryptography card. The customer loads customer specific content on the field programmable gate array, wherein, based on the loading, the customer specific content is secure from extraction via the master key by at least entities other than the customer.

Claims

1. A computer program product for loading field programmable gate arrays, the computer program product comprising:

a computer readable storage medium readable by a processor and storing instructions for performing a method comprising;

loading, by a customer using the processor, customer specific content on a field programmable gate array, the field programmable gate array being located on a secure cryptography card, the secure cryptography card further including a master key generated by the secure cryptography card and the field programmable gate array including a field programmable gate array key, the master key and the field programmable gate array key being used to secure the customer specific content within an image encrypted with the field programmable gate array key, which is then further encrypted with the master key generated by the secure cryptographic card into an encrypted image that is a multi-encrypted image, and wherein, based on the loading, the customer specific content is secure from extraction by at least entities other than the customer; and

wherein the loading comprises;

loading in a temporary location within the secure cryptography card the encrypted image to be loaded in the field programmable gate array, the encrypted image encrypted with the field programmable gate array key and the master key;

decrypting the loaded encrypted image using the master key to remove the master key and provide an image encrypted with the field programmable gate array key;

sending the image encrypted with the field programmable gate array key from the temporary location to the field programmable gate array;

decrypting the image encrypted with the field programmable gate array key to remove the field programmable gate array key to provide a field programmable gate array image that is decrypted, the decrypting using the field programmable gate array key; and

installing the field programmable gate array image in the field programmable gate array on the secure cryptography card, the field programmable gate array image including the customer specific content.

2. The computer program product of claim 1, wherein the customer specific content is further secure from extraction by the customer.

3. The computer program product of claim 1, wherein the method further comprises initially providing by an entity other than the customer a base load to be loaded on the field programmable gate array, wherein the field programmable gate array includes customer specific content and other content not specific to the customer.

4. The computer program product of claim 1, wherein the method further comprises:

loading a root key on the secure cryptography card; and

validating the encrypted image to be loaded in the field programmable gate array using the root key, the validating occurring prior to loading the encrypted image in the temporary location.

5. The computer program product of claim 4, wherein the validating comprises validating the encrypted image which is stored in another temporary location within the secure cryptography card, and wherein the method further comprises providing the encrypted image stored in the other temporary location, the providing comprising:

loading a signed protected load of the customer on the secure cryptography card, the signed protected load being encrypted with a customer private key and the field programmable gate array key;

decrypting the signed protected load using the customer private key to remove the customer private key;

re-encrypting the signed protected load using the master key to provide the encrypted image; and

storing the encrypted image in the other temporary location.

6. The computer program product of claim 5, wherein the loading the encrypted image in the temporary location comprises forwarding the encrypted image stored in the other temporary location to the temporary location.

7. The computer program product of claim 5, wherein the method further comprises obtaining the signed protected load to be loaded on the secure cryptography card, wherein the obtaining comprises:

obtaining, by the customer, a base image;

adding, by the customer, the customer specific content to the base image to provide a field programmable gate array content;

encrypting the field programmable gate array content with the field programmable gate array key;

encrypting the field programmable gate array content with the customer private key; and

obtaining the signed protected load, the signed protected load signed with the root key and generated using the field programmable gate array content encrypted with the field programmable gate array key and the customer private key.

8. The computer program product of claim 7, wherein the method further comprises generating the customer private key.

9. A computer system for loading field programmable gate arrays, the computer system comprising:

a memory; and

a processor, in communication with the memory, wherein the computer system is configured to perform a method, said method comprising;

loading, by a customer using the processor, customer specific content on a field programmable gate array, the field programmable gate array being located on a secure cryptography card, the secure cryptography card further including a master key generated by the secure cryptography card and the field programmable gate array including a field programmable gate array key, the master key and the field programmable gate array key being used to secure the customer specific content within an image encrypted with the field programmable gate array key, which is then further encrypted with the master key generated by the secure cryptographic card into an encrypted image that is a multi-encrypted image, and wherein, based on the loading, the customer specific content is secure from extraction by at least entities other than the customer; and

wherein the loading comprises;

loading in a temporary location within the secure cryptography card the encrypted image to be loaded in the field programmable gate array, the encrypted image encrypted with the field programmable gate array key and the master key;

decrypting the loaded encrypted image using the master key to remove the master key and provide an image encrypted with the field programmable gate array key;

sending the image encrypted with the field programmable gate array key from the temporary location to the field programmable gate array;

decrypting the image encrypted with the field programmable gate array key to remove the field programmable gate array key to provide a field programmable gate array image that is decrypted, the decrypting using the field programmable gate array key; and

installing the field programmable gate array image in the field programmable gate array on the secure cryptography card, the field programmable gate array image including the customer specific content.

10. The computer system of claim 9, wherein the method further comprises:

loading a root key on the secure cryptography card; and

validating the encrypted image to be loaded in the field programmable gate array using the root key, the validating occurring prior to loading the encrypted image in the temporary location.

11. The computer system of claim 10, wherein the validating comprises validating the encrypted image which is stored in another temporary location within the secure cryptography card, and wherein the method further comprises providing the encrypted image stored in the other temporary location, the providing comprising:

loading a signed protected load of the customer on the secure cryptography card, the signed protected load being encrypted with a customer private key and the field programmable gate array key;

decrypting the signed protected load using the customer private key to remove the customer private key;

re-encrypting the signed protected load using the master key to provide the encrypted image; and

storing the encrypted image in the other temporary location.

12. The computer system of claim 11, wherein the method further comprises obtaining the signed protected load to be loaded on the secure cryptography card, wherein the obtaining comprises:

obtaining, by the customer, a base image;

adding, by the customer, the customer specific content to the base image to provide a field programmable gate array content;

encrypting the field programmable gate array content with the field programmable gate array key;

encrypting the field programmable gate array content with the customer private key; and

obtaining the signed protected load, the signed protected load signed with the root key and generated using the field programmable gate array content encrypted with the field programmable gate array key and the customer private key.

13. A computer-implemented method of loading field programmable gate arrays, the computer-implemented method comprising:

obtaining a field programmable gate array; and

loading, by a customer using a processor, customer specific content on the field programmable gate array, the field programmable gate array being located on a secure cryptography card, the secure cryptography card further including a master key generated by the secure cryptography card and the field programmable gate array including a field programmable gate array key, the master key and the field programmable gate array key being used to secure the customer specific content within an image encrypted with the field programmable gate array key, which is then further encrypted with the master key generated by the secure cryptographic card into an encrypted image that is a multi-encrypted image, and wherein, based on the loading, the customer specific content is secure from extraction by at least entities other than the customer; and

wherein the loading comprises;

loading in a temporary location within the secure cryptography card the encrypted image to be loaded in the field programmable gate array, the encrypted image encrypted with the field programmable gate array key and the master key;

decrypting the loaded encrypted image using the master key to remove the master key and provide an image encrypted with the field programmable gate array key;

sending the image encrypted with the field programmable gate array key from the temporary location to the field programmable gate array;

decrypting the image encrypted with the field programmable gate array key to remove the field programmable gate array key to provide a field programmable gate array image that is decrypted, the decrypting using the field programmable gate array key; and

installing the field programmable gate array image in the field programmable gate array on the secure cryptography card, the field programmable gate array image including the customer specific content.

14. The computer-implemented method of claim 13, further comprising:

loading a root key on the secure cryptography card; and

validating the encrypted image to be loaded in the field programmable gate array using the root key, the validating occurring prior to loading the encrypted image in the temporary location.

15. The computer-implemented method of claim 14, wherein the validating comprises validating the encrypted image which is stored in another temporary location within the secure cryptography card, and wherein the method further comprises providing the encrypted image stored in the other temporary location, the providing comprising:

loading a signed protected load of the customer on the secure cryptography card, the signed protected load being encrypted with a customer private key and the field programmable gate array key;

decrypting the signed protected load using the customer private key to remove the customer private key;

re-encrypting the signed protected load using the master key to provide the encrypted image; and

storing the encrypted image in the other temporary location.

16. The computer-implemented method of claim 15, wherein the loading the encrypted image in the temporary location comprises forwarding the encrypted image stored in the other temporary location to the temporary location.

17. The computer-implemented method of claim 15, further comprising obtaining the signed protected load to be loaded on the secure cryptography card, wherein the obtaining comprises:

obtaining, by the customer, a base image;

adding, by the customer, the customer specific content to the base image to provide a field programmable gate array content;

encrypting the field programmable gate array content with the field programmable gate array key;

encrypting the field programmable gate array content with the customer private key; and

obtaining the signed protected load, the signed protected load signed with the root key and generated using the field programmable gate array content encrypted with the field programmable gate array key and the customer private key.