Design security for configurable devices

• US 7,345,502 B1
• Filed: 01/17/2006
• Issued: 03/18/2008
• Est. Priority Date: 01/17/2006
• Status: Active Grant

• Current Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Original Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Inventors: Jenkins, Jesse H. IV, Lakkapragada, Shankar
• Primary Examiner(s): Barnie; Rexford
• Assistant Examiner(s): Hammond; Crystal L
• Application Number:
  US11/333,927
• Time in Patent Office: 791 Days
• Field of Search: 326/8, 326/37, 713/1, 714/194
• US Class Current: 326/8
• CPC Class Codes: G01R 31/318533 using scanning techniques, e.g. LSSD, Boundary Scan, JTAG
• CPC Class Codes: G06F 30/34 for reconfigurable circuits, e.g. field programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H03K 19/17768 for security

Abstract

Methods and structures for design security in configurable devices are described. In some embodiments, a configurable device may be placed in an unsecured mode allowing for access to configuration data and other diagnostic functions during development and production phases. Once the device is finalized, it may be placed in a secure mode that disables a configuration path and enables a bypass path, thereby securing the configuration data. In some embodiments, the configurable device may be a programmable logic device, such as a complex programmable logic device.

Claims

1. An integrated circuit having secured and unsecured operation modes, the integrated circuit comprising:

configuration memory for storing configuration data;

control logic for receiving the configuration data;

a configuration path comprising a configuration register coupled to the control logic for storing the configuration data in the configuration memory;

a bypass path comprising a bypass register coupled to the control logic; and

select logic enabling the selection of one of the configuration path and the bypass path based upon the operation mode of the integrated circuit;

wherein when the integrated circuit is in the unsecured operation mode, the select logic selects the configuration path, and

wherein when the integrated circuit is in the secured operation mode, the select logic selects the bypass path to prevent the configuration data from being accessed.

2. The integrated circuit of claim 1 further comprising configurable resources coupled to the configuration memory, wherein the configuration data is used to configure the configurable resources.

3. The integrated circuit of claim 2 wherein the configurable resources comprise at least one of a plurality of complex programmable logic device (CPLD) function blocks and a plurality of configurable logic blocks (CLBs).

4. The integrated circuit of claim 2 wherein the integrated circuit is at least one of a programmable logic device, a complex programmable logic device, and a field programmable gate array.

5. The integrated circuit of claim 1 further comprising an authentication block for providing a secure signal.

6. The integrated circuit of claim 5 wherein the authentication block comprises a decryption circuit.

7. The integrated circuit of claim 1 further comprising a storage element for providing a secure signal.

8. The integrated circuit of claim 7 wherein the storage element comprises at least one memory bit in the configuration memory.

9. The integrated circuit of claim 7 wherein the storage element comprises a register in the control logic.

10. The integrated circuit of claim 7 wherein the storage element comprises a one-time programmable memory.

11. The integrated circuit of claim 1 wherein the select logic comprises a multiplexer coupled to the configuration path and the bypass path.

12. The integrated circuit of claim 1 wherein the control logic comprises at least one interface selected from the group consisting of a JTAG interface, a serial interface, and a parallel interface.

13. The integrated circuit of claim 12 further comprising a serial data input and a serial data output for coupling the integrated circuit to at least one other device in a scan chain.

14. A method for securing configuration data in a configurable device, the method comprising:

placing the configurable device in an unsecured state based upon a mode selection signal,

wherein placing the configurable device in the unsecured state comprises enabling a configuration path;

providing the configuration data to the configurable device in the unsecured state via the configuration path; and

placing the configurable device in a secured state after storing the configuration data in a configuration memory,

wherein placing the configurable device in the secured state disables the configuration path and enables a bypass path to prevent the configuration data from being accessed.

15. The method of claim 14 further comprising performing at least one diagnostic function on the configurable device in the unsecured state.

16. The method of claim 14 wherein placing the configurable device in the secured state comprises programming at least one nonvolatile memory.

17. The method of claim 14 wherein placing the configurable device in the secured state comprises receiving authentication data.

18. A configurable device comprising:

means for designating an operation mode;

means for receiving configuration data;

means for configuring configurable resources of the configurable device during an unsecured operation mode;

means for bypassing the means for configuring during a secured operation mode to prevent the configuration data from being accessed; and

means for selecting one of the means for configuring and the means for bypassing;

wherein when the configurable device is in an unsecured operation mode, the means for selecting selects the means for configuring, and

wherein when the configurable device is in a secured operation mode, the means for selecting selects the means for bypassing.