Programmable logic device

• US 20060265603A1
• Filed: 03/07/2006
• Published: 11/23/2006
• Est. Priority Date: 03/24/2005
• Status: Active Grant

• Current Assignee: Sony United Kingdom Limited (Sony Group Corp.)
• Original Assignee: Sony United Kingdom Limited (Sony Group Corp.)
• Inventors: Keating, Stephen Mark, McLean, Ian
• Granted Patent: US 7,783,897 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A programmable logic device includes a programmable array of volatile logic elements which when loaded with a configuration program is operable to perform a process in accordance with the configuration of the logic elements by the configuration program. The programmable logic device includes a hardware decryption processor including a register having stored therein a first secret configuration key. A non-volatile store is arranged to store a configuration program which has been encrypted with the first secret configuration key. The configuration program includes therein the first secret configuration key, and the hardware decryption processor is operable, when power is applied to the programmable logic device to read the encrypted configuration program, to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and to configure the programmable array of logic with the configuration program. The programmable logic array when configured with configuration program is operable to read the encrypted configuration program from the non-volatile store, to decrypt the configuration program using the first secret configuration key provided with the configuration program, to generate a second secret key and to adapt the configuration program by inserting the second secret key into the configuration program. The configured programmable array is operable to re-encrypt the adapted and encrypted configuration program using the first secret configuration key, and to replace the configuration program with the adapted configuration program in the memory.

Claims

1. A programmable logic device comprising

a programmable array of volatile logic elements which when loaded with a configuration program is operable to perform a process in accordance with the configuration of the logic elements by the configuration program,

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and the hardware decryption processor is operable, when power is applied to the programmable logic device

to read the encrypted configuration program,

to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and

to configure the programmable array of logic elements with the configuration program, the programmable logic array when configured with configuration program being operable

to read the encrypted configuration program from the non-volatile store,

to decrypt the configuration program using the first secret configuration key provided with the configuration program,

to generate a second secret key,

to adapt the configuration program by inserting the second secret key into the configuration program,

to re-encrypt the adapted configuration program using the first secret configuration key, and

to replace the configuration program with the adapted and encrypted configuration program in the memory.

2. A programmable logic device as claimed in claim 1, wherein the second secret key is a private key and the configured programmable array is operable to generate a third public key, the second private key and the third public key forming a private/public key pair for performing asymmetric encryption/decryption.

3. A programmable logic device as claimed in claim 1, wherein the second secret key is a private key for use in a symmetric encryption process.

4. A programmable logic device as claimed in claim 1, wherein the first secret key is generated during a pre-initialisation stage, during which the first secret key is loaded into the register of the hardware decryption processor and the configuration program, encrypted with the first secret configuration key is loaded into the non-volatile store.

5. A programmable logic device as claimed in claim 1, wherein the configuration program is provided with a fourth update key, and the programmable logic array when configured with the configuration program is operable

to receive an update configuration program which has been encrypted with the fourth update key,

to decrypt the fourth update configuration program with the fourth update key,

to adapt the update configuration program, to the effect that the second secret key is preserved in the adapted configuration program.

6. A programmable logic device as claimed in claim 5, wherein the programmable logic array when configured with the configuration program is operable

to encrypt the adapted configuration program with the first configuration key and

to store the encrypted and adapted configuration program in the non-volatile store.

7. A programmable logic device as claimed in claim 5, wherein the update configuration program includes a fifth update key, and the programmable logic array when configured with the adapted update configuration program is operable

to decrypt a subsequent update program which has been encrypted with the fifth update key using the fifth update key.

8. A programmable logic device as claimed in claim 3, comprising a second non-volatile store, wherein the programmable logic array when configured with the configuration program is operable

to generate a sixth private key and a seventh public key forming a private key/public key pair for asymmetric encryption,

to encrypt the sixth private key and the seventh public key with the second secret key using a symmetric encryption, and

to store the encrypted sixth private key and the seventh public key pair in the second non-volatile store.

9. A receiver for receiving and decrypting encrypted content data, the receiver including a content decryption engine and a content key decryption engine, the content key decryption engine including a programmable logic device as claimed in claim 1, the programmable logic device comprising a programmable array of volatile logic elements, a hardware decryption processor coupled to a non-volatile store and a register having stored therein a first secret configuration key, the hardware decryption processor being operable, when power is applied to the programmable logic device to decrypt an encrypted configuration program stored in the non-volatile store using the first secret configuration key stored in the register, and to configure the programmable array of logic with the configuration program, the programmable logic array when configured with the configuration program being provided with a second private key forming a private key/public key pair with a third public key and being operable

to receive an encrypted content key provided with the encrypted content, the content key having been encrypted with the third public key, and

to decrypt the content key using the second private key provided in the configuration program, the content decryption engine being operable to decrypt the encrypted content using the content key.

10. A transmitter for encrypting and transmitting content data, the transmitter comprising

a content encryption engine operable to encrypt the content data with a content key, and

a content key encryption engine operable to encrypt the content key with a public key provided by a programmable logic device, the programmable logic device comprising

a programmable array of volatile logic elements which when loaded with a configuration program is operable to perform a process in accordance with the configuration of the logic elements by the configuration program,

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and the hardware decryption processor is operable, when power is applied to the programmable logic device

to read the encrypted configuration program,

to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and

to configure the programmable array of logic elements with the configuration program, the programmable logic array when configured with configuration program being operable

to read the encrypted configuration program from the non-volatile store,

to decrypt the configuration program using the first secret configuration key provided with the configuration program,

to generate a second secret key,

to adapt the configuration program by inserting the second secret key into the configuration program,

to re-encrypt the adapted configuration program using the first secret configuration key, and

to replace the configuration program with the adapted and encrypted configuration program in the memory.

11. A method of programming a programmable logic device, the programmable logic device comprising a programmable array of volatile logic elements and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store being arranged to store a configuration program which has been encrypted with the first secret configuration key, the method comprising

providing the configuration program with the first secret configuration key,

reading the encrypted configuration program from the non-volatile store,

decrypting the encrypted configuration program using the first secret configuration key stored in the register,

configuring the programmable array of logic with the configuration program, the programmable logic array when configured with configuration program to perform the steps of

reading the encrypted configuration program from the non-volatile store,

decrypting the configuration program using the first secret configuration key provided with the configuration program,

generating a second secret key,

adapting the configuration program by inserting the second secret key into the configuration program,

re-encrypting the adapted configuration program using the first secret configuration key, and

replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.

12. A configuration program for programming an array of logic elements of a programmable logic device, the programmable logic device comprising

a programmable array of volatile logic elements which when loaded with the configuration program is operable to perform a process in accordance with the configuration of the logic elements by the configuration program,

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key.

13. A configuration program as claimed in claim 12, wherein the programmable logic device includes a non-volatile store in which the configuration program is stored, the configuration program when loaded in the programmable array of logic elements having an effect of

reading the encrypted configuration program from the non-volatile store,

decrypting the configuration program using the first secret configuration key provided with the configuration program,

generating a second secret key,

adapting the configuration program by inserting the second secret key into the configuration program,

re-encrypting the adapted configuration program using the first secret configuration key, and

replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.

14. A data carrier carrying the configuration program as claimed in claim 12.

15. A manufacturing jig arranged for use with a programmable logic device, the programmable logic device comprising

a programmable array of volatile logic elements which when loaded with a configuration program is operable to perform a process in accordance with the configuration of the logic elements by the configuration program,

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and the hardware decryption processor is operable, when power is applied to the programmable logic device,

to read the encrypted configuration program,

to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and

to configure the programmable array of logic elements with the configuration program, the programmable logic array when configured with configuration program being operable

to read the encrypted configuration program from the non-volatile store,

to decrypt the configuration program using the first secret configuration key provided with the configuration program,

to generate a second secret key,

to adapt the configuration program by inserting the second secret key into the configuration program,

to re-encrypt the adapted configuration program using the first secret configuration key, and

to replace the configuration program with the adapted and encrypted configuration program in the memory, the manufacturing jig being arranged in use

to generate the first secret configuration key,

to encrypt the configuration program with the first secret configuration key,

to load the encrypted configuration program into a non-volatile store of the programmable logic device, and

to load a register of the programmable logic device with the first secret configuration key.

16. An apparatus for programming a programmable logic device, the programmable logic device comprising a programmable array of volatile logic elements and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store being arranged to store a configuration program which has been encrypted with the first secret configuration key, the apparatus comprising

means for providing the configuration program with the first secret configuration key,

means for reading the encrypted configuration program from the non-volatile store,

means for decrypting the encrypted configuration program using the first secret configuration key stored in the register,

means for configuring the programmable array of logic with the configuration program, the programmable logic array when configured with configuration program to perform the steps of

means for reading the encrypted configuration program from the non-volatile store,

means for decrypting the configuration program using the first secret configuration key provided with the configuration program,

means for generating a second secret key,

means for adapting the configuration program by inserting the second secret key into the configuration program,

means for re-encrypting the adapted configuration program using the first secret configuration key, and

means for replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.