Secure dynamically reconfigurable logic

• US 8,516,272 B2
• Filed: 06/30/2010
• Issued: 08/20/2013
• Est. Priority Date: 06/30/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kahle, James A., Paolini, Michael A., Hofstee, H Peter
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US12/827,726
• Publication Number:
  US 20120005473A1
• Time in Patent Office: 1,147 Days
• Field of Search: 713168-174, 713182-186, 713/202, 709/225, 709/229, 726 2- 8
• US Class Current: 713/191
• CPC Class Codes: G06F 15/7867 with reconfigurable architecture
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]

Abstract

A mechanism for securely and dynamically reconfiguring reconfigurable logic is provided. A state machine within a data processing system establishes a hardware boundary to the reconfigurable logic within the data processing system thereby forming isolated reconfigurable logic. The state machine clears any prior state existing within the isolated reconfigurable logic. The state machine authenticates a new configuration to be loaded into the isolated reconfigurable logic. The state machine determines whether the authentication of the new configuration is successful. Responsive to the authentication of the new configuration being successful, the state machine loads the new configuration into the isolated reconfigurable logic. The state machine then starts operation of the isolated reconfigurable logic.

Claims

1. A method, in a data processing system, for securely and dynamically reconfiguring reconfigurable logic, the method comprising:

establishing, by a state machine within the data processing system, a hardware boundary to the reconfigurable logic within the data processing system thereby forming isolated reconfigurable logic;

clearing, by the state machine, any prior state existing within the isolated reconfigurable logic;

authenticating, by the state machine, a new configuration to be loaded into the isolated reconfigurable logic;

determining, by the state machine, whether the authentication of the new configuration is successful;

responsive to the authentication of the new configuration being successful, loading, by the state machine, the new configuration into the isolated reconfigurable logic; and

starting, by the state machine, operation of the isolated reconfigurable logic, wherein the hardware boundary restricts access such that the reconfigurable logic is only written to by the state machine and wherein none of the state or transitions inside the reconfigurable logic are observable except for modifications made by the reconfigurable logic to a non-secure communication area.

2. The method of claim 1, further comprising:

determining, by the state machine, whether the load of the new configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the new configuration failing to successfully load within the isolated reconfigurable logic, clearing, by the state machine, any state of the isolated reconfigurable logic;

returning, by the state machine, the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signaling, by the state machine, that the loading of the new configuration was not successful.

3. The method of claim 1, further comprising:

responsive to the authentication of the new configuration failing, clearing, by the state machine, any state of the isolated reconfigurable logic;

returning, by the state machine, the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signaling, by the state machine, that the loading of the new configuration was not successful.

4. The method of claim 1, further comprising:

responsive to a request to clear the isolated reconfigurable logic, clearing, by the state machine, any state of the isolated reconfigurable logic;

returning, by the state machine, the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signaling, by the state machine, that the reconfigurable logic has been cleared.

5. The method of claim 1, wherein the reconfigurable logic is at least one of a field-programmable gate array (FPGA), logic reconfigurable by scanning, logic reconfigurable by writing configuration registers, or logic for a reconfigurable data path.

6. The method of claim 1, further comprising:

receiving, by the state machine, another configuration to be loaded into the isolated reconfigurable logic;

authenticating, by the state machine, the other configuration to be loaded into the isolated reconfigurable logic;

determining, by the state machine, whether the authentication of the new configuration is successful;

responsive to the authentication of the other configuration being successful, clearing, by the state machine, the previous configuration existing within the isolated reconfigurable logic without returning the isolated reconfigurable logic to a non-isolated state;

loading, by the state machine, the other configuration into the isolated reconfigurable logic; and

starting, by the state machine, the operation of the isolated reconfigurable logic.

7. The method of claim 6, further comprising:

determining, by the state machine, whether the load of the other configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the other configuration failing to successfully load within the isolated reconfigurable logic, clearing, by the state machine, any state of the isolated reconfigurable logic;

returning, by the state machine, the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signaling, by the state machine, that the loading of the other configuration was not successful.

8. The method of claim 6, further comprising:

responsive to the authentication or of the other configuration failing, clearing, by the state machine, any state of the isolated reconfigurable logic;

returning, by the state machine, the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signaling, by the state machine, that the loading of the other configuration was not successful.

9. A computer program product comprising a non-transitory computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

establish a hardware boundary to reconfigurable logic within a data processing system thereby forming isolated reconfigurable logic;

clear any prior state existing within the isolated reconfigurable logic;

authenticate a new configuration to be loaded into the isolated reconfigurable logic;

determine whether the authentication of the new configuration is successful;

responsive to the authentication of the new configuration being successful, load the new configuration into the isolated reconfigurable logic; and

start an operation of the isolated reconfigurable logic, wherein the hardware boundary restricts access such that the reconfigurable logic is only written to by the state machine and wherein none of the state or transitions inside the reconfigurable logic are observable except for modifications made by the reconfigurable logic to a non-secure communication area.

10. The computer program product of claim 9, wherein the computer readable program further causes the computing device to:

determine whether the load of the new configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the new configuration failing to successfully load within the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the new configuration was not successful.

11. The computer program product of claim 9, wherein the computer readable program further causes the computing device to:

responsive to the authentication of the new configuration failing, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the new configuration was not successful.

12. The computer program product of claim 9, wherein the computer readable program further causes the computing device to:

responsive to a request to clear the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the reconfigurable logic has been cleared.

13. The computer program product of claim 9, wherein the computer readable program further causes the computing device to:

receive another configuration to be loaded into the isolated reconfigurable logic;

authenticate the other configuration to be loaded into the isolated reconfigurable logic;

determine whether the authentication of the new configuration is successful;

responsive to the authentication of the other configuration being successful, clear the previous configuration existing within the isolated reconfigurable logic without returning the isolated reconfigurable logic to a non-isolated state;

load the other configuration into the isolated reconfigurable logic; and

start the operation of the isolated reconfigurable logic.

14. The computer program product of claim 13, wherein the computer readable program further causes the computing device to:

determine whether the load of the other configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the other configuration failing to successfully load within the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the other configuration was not successful.

15. The computer program product of claim 13, wherein the computer readable program further causes the computing device to:

responsive to the authentication or of the other configuration failing, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the other configuration was not successful.

16. An apparatus, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

establish a hardware boundary to reconfigurable logic within a data processing system thereby forming isolated reconfigurable logic;

clear any prior state existing within the isolated reconfigurable logic;

authenticate a new configuration to be loaded into the isolated reconfigurable logic;

determine whether the authentication of the new configuration is successful;

responsive to the authentication of the new configuration being successful, load the new configuration into the isolated reconfigurable logic; and

start an operation of the isolated reconfigurable logic, wherein the hardware boundary restricts access such that the reconfigurable logic is only written to by the state machine and wherein none of the state or transitions inside the reconfigurable logic are observable except for modifications made by the reconfigurable logic to a non-secure communication area.

17. The apparatus of claim 16, wherein the instructions further cause the processor to:

determine whether the load of the new configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the new configuration failing to successfully load within the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the new configuration was not successful.

18. The apparatus of claim 16, wherein the instructions further cause the processor to:

responsive to the authentication of the new configuration failing, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the new configuration was not successful.

19. The apparatus of claim 16, wherein the instructions further cause the processor to:

responsive to a request to clear the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the reconfigurable logic has been cleared.

20. The apparatus of claim 16, wherein the instructions further cause the processor to:

receive another configuration to be loaded into the isolated reconfigurable logic;

authenticate the other configuration to be loaded into the isolated reconfigurable logic;

determine whether the authentication of the new configuration is successful;

responsive to the authentication of the other configuration being successful, clear the previous configuration existing within the isolated reconfigurable logic without returning the isolated reconfigurable logic to a non-isolated state;

load the other configuration into the isolated reconfigurable logic; and

start the operation of the isolated reconfigurable logic.

21. The apparatus of claim 20, wherein the instructions further cause the processor to:

determine whether the load of the other configuration within the isolated reconfigurable logic is successful;

responsive to the loading of the other configuration failing to successfully load within the isolated reconfigurable logic, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the other configuration was not successful.

22. The apparatus of claim 20, wherein the instructions further cause the processor to:

responsive to the authentication or of the other configuration failing, clear any state of the isolated reconfigurable logic;

return the isolated reconfigurable logic to a non-isolated state by re-opening the hardware boundary; and

signal that the loading of the other configuration was not successful.