Programmable logic device

• US 7,783,897 B2
• Filed: 03/07/2006
• Issued: 08/24/2010
• Est. Priority Date: 03/24/2005
• Status: Expired due to Fees

• Current Assignee: Sony United Kingdom Limited (Sony Group Corp.)
• Original Assignee: Sony United Kingdom Limited (Sony Group Corp.)
• Inventors: McLean, Ian, Keating, Stephen Mark
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/368,594
• Publication Number:
  US 20060265603A1
• Time in Patent Office: 1,631 Days
• Field of Search: None
• US Class Current: 713/189
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A hardware decryption processor operates, when power is applied to a programmable logic device, to read an encrypted configuration program, to decrypt the encrypted configuration program using a first secret configuration key stored in a register, and to configure a programmable array of logic elements with the configuration program. The programmable array when configured with the configuration program operates to read the encrypted configuration program from a non-volatile store, to decrypt the configuration program using the first secret configuration key, which was provided with the configuration program, to generate a second secret key, to adapt the configuration program by inserting the second secret key into the configuration program, to re-encrypt the adapted configuration program using the first secret configuration key, and to replace the configuration program with the adapted and encrypted configuration program in the non-volatile store.

Claims

1. A programmable logic device, comprising:

a programmable array of logic elements which when loaded with a configuration program is operable to perform a process in accordance with a configuration of the logic elements by the configuration program; and

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and

the hardware decryption processor is operable, when power is applied to the programmable logic device, to read the encrypted configuration program, to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and to configure the programmable array of logic elements with the configuration program,

the programmable array when configured with the configuration program being operable to read the encrypted configuration program from the non-volatile store, to decrypt the configuration program using the first secret configuration key provided with the configuration program, to generate a second secret key, to adapt the configuration program by inserting the second secret key into the configuration program, to re-encrypt the adapted configuration program using the first secret configuration key, and to replace the configuration program with the adapted and encrypted configuration program in the non-volatile store.

2. The programmable logic device as claimed in claim 1, wherein the second secret key is a private key and the configured programmable array is operable to generate a public key, the second private key and the public key forming a private/public key pair for performing an asymmetric encryption/decryption.

3. The programmable logic device as claimed in claim 1, wherein the second secret key is a first private key for use in a symmetric encryption process.

4. The programmable logic device as claimed in claim 1, wherein the first secret key is generated during a pre-initialisation stage, during which the first secret key is loaded into the register of the hardware decryption processor and the configuration program, encrypted with the first secret configuration key, is loaded into the non-volatile store.

5. The programmable logic device as claimed in claim 1, wherein the configuration program is provided with a first update key, and the programmable array when configured with the configuration program is operable to receive an update configuration program which has been encrypted with the first update key, to decrypt the update configuration program with the first update key, and to adapt the update configuration program, to the effect that the second secret key is preserved in the adapted configuration program.

6. The programmable logic device as claimed in claim 5, wherein the programmable array when configured with the configuration program is operable to encrypt the adapted update configuration program with the first secret configuration key and to store the encrypted and adapted update configuration program in the non-volatile store.

7. The programmable logic device as claimed in claim 5, wherein the update configuration program includes a second update key, and the programmable array when configured with the adapted update configuration program is operable to decrypt a subsequent update program which has been encrypted with the second update key using the second update key.

8. The programmable logic device as claimed in claim 3, further comprising:

a second non-volatile store, wherein the programmable array when configured with the configuration program is operable to generate a second private key and a public key forming a private key/public key pair for an asymmetric encryption, to encrypt the second private key and the public key with the second secret key using a symmetric encryption, and to store the encrypted second private key and the public key pair in the second non-volatile store.

9. A receiver for receiving and decrypting encrypted content data, the receiver including a content decryption engine and a content key decryption engine, the content key decryption engine including the programmable logic device as claimed in claim 1, the hardware decryption processor being coupled to the non-volatile store and the register, the programmable array when configured with the configuration program being provided with a private key forming a private key/public key pair with a public key and being operable to receive an encrypted content key provided with the encrypted content data, the content key having been encrypted with the public key, and to decrypt the content key using the private key, which was provided in the configuration program, the content key decryption engine being operable to decrypt the encrypted content data using the content key.

10. A transmitter for encrypting and transmitting content data, the transmitter comprising:

a content encryption engine operable to encrypt the content data with a content key; and

a content key encryption engine operable to encrypt the content key with a public key provided by a programmable logic device,

the programmable logic device comprising

a programmable array of logic elements which when loaded with a configuration program is operable to perform a process in accordance with a configuration of the logic elements by the configuration program, and

a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and

the hardware decryption processor is operable, when power is applied to the programmable logic device, to read the encrypted configuration program, to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and to configure the programmable array of logic elements with the configuration program,

the programmable logic array when configured with the configuration program being operable to read the encrypted configuration program from the non-volatile store, to decrypt the configuration program using the first secret configuration key provided with the configuration program, to generate a second secret key, to adapt the configuration program by inserting the second secret key into the configuration program, to re-encrypt the adapted configuration program using the first secret configuration key, and to replace the configuration program with the adapted and encrypted configuration program in the non-volatile store.

11. A method of programming a programmable logic device, the programmable logic device comprising a programmable array of logic elements and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store being arranged to store a configuration program which has been encrypted with the first secret configuration key, the method comprising:

providing the configuration program with the first secret configuration key;

reading the encrypted configuration program from the non-volatile store;

decrypting the encrypted configuration program using the first secret configuration key stored in the register;

configuring the programmable array of logic elements with the configuration program;

reading the encrypted configuration program from the non-volatile store;

decrypting the configuration program using the first secret configuration key provided with the configuration program;

generating a second secret key;

adapting the configuration program by inserting the second secret key into the configuration program with the programmable array;

re-encrypting the adapted configuration program using the first secret configuration key; and

replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.

12. A computer-readable storage medium encoded with a configuration program for programming an array of logic elements of a programmable logic device, the programmable logic device comprising the array of logic elements, which when loaded with the configuration program is operable to perform a process in accordance with a configuration of the logic elements by the configuration program, and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, the configuration program when executed by the array of logic elements causing the array of logic elements to perform the operations of:

reading the encrypted configuration program from the non-volatile store;

decrypting the configuration program using the first secret configuration key provided with the configuration program;

generating a second secret key;

adapting the configuration program by inserting the second secret key into the configuration program;

re-encrypting the adapted configuration program using the first secret configuration key; and

replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.

13. A manufacturing jig arranged for use with a programmable logic device, the programmable logic device comprising a programmable array of logic elements which when loaded with a configuration program is operable to perform a process in accordance with a configuration of the logic elements by the configuration program, and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store arranged to store the configuration program which has been encrypted with the first secret configuration key, wherein the configuration program includes therein the first secret configuration key, and

the hardware decryption processor is operable, when power is applied to the programmable logic device, to read the encrypted configuration program, to decrypt the encrypted configuration program using the first secret configuration key stored in the register, and to configure the programmable array of logic elements with the configuration program,

the programmable array when configured with the configuration program being operable to read the encrypted configuration program from the non-volatile store, to decrypt the configuration program using the first secret configuration key provided with the configuration program, to generate a second secret key, to adapt the configuration program by inserting the second secret key into the configuration program, to re-encrypt the adapted configuration program using the first secret configuration key, and to replace the configuration program with the adapted and encrypted configuration program in the non-volatile store,

the manufacturing jig being arranged in use:

to generate the first secret configuration key;

to encrypt the configuration program with the first secret configuration key;

to load the encrypted configuration program into the non-volatile store of the programmable logic device; and

to load the register of the programmable logic device with the first secret configuration key.

14. An apparatus for programming a programmable logic device, the programmable logic device comprising a programmable array of logic elements, and a hardware decryption processor including a register having stored therein a first secret configuration key, and a non-volatile store being arranged to store a configuration program which has been encrypted with the first secret configuration key, the apparatus comprising:

means for providing the configuration program with the first secret configuration key;

means for reading the encrypted configuration program from the non-volatile store;

means for decrypting the encrypted configuration program using the first secret configuration key stored in the register; and

means for configuring the programmable array of logic elements with the configuration program,

the programmable array when configured with the configuration program including

means for reading the encrypted configuration program from the non-volatile store,

means for decrypting the configuration program using the first secret configuration key provided with the configuration program,

means for generating a second secret key,

means for adapting the configuration program by inserting the second secret key into the configuration program,

means for re-encrypting the adapted configuration program using the first secret configuration key, and

means for replacing the configuration program with the adapted and encrypted configuration program in the non-volatile store.