Securely field configurable device

• US 8,756,438 B2
• Filed: 04/20/2010
• Issued: 06/17/2014
• Est. Priority Date: 11/12/2004
• Status: Active Grant

• Current Assignee: Verayo, Inc.
• Original Assignee: Verayo, Inc.
• Inventors: Devadas, Srinivas, Ziola, Thomas J.
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US12/763,254
• Publication Number:
  US 20100272255A1
• Time in Patent Office: 1,519 Days
• Field of Search: 713/189, 713/191, 713/193, 713/153
• US Class Current: 713/193
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G11C 16/20 Initialising; Data preset; Chip identification
• CPC Class Codes: G11C 16/22 Safety or protection circuits preventing unauthorised or accidental access to memory cells
• CPC Class Codes: G11C 2029/4402 Internal storage of test result, quality data, chip identification, repair information
• CPC Class Codes: G11C 2029/5002 Characteristic
• CPC Class Codes: G11C 7/24 Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/304 based on error correction codes, e.g. McEliece
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

A field configurable device, such as an FPGA, supports secure field configuration without using non-volatile storage for cryptographic keys on the device and without requiring a continuous or ongoing power source to maintain a volatile storage on the device. The approach can be used to secure the configuration data such that it can in general be used on a single or a selected set of devices and/or encryption of the configuration data so that the encrypted configuration data can be exposed without compromising information encoded in the configuration data.

Claims

1. A method for configuring an electronic device having configurable logic comprising:

providing configuration data to the device, the configuration data including first configuration data and encrypted configuration data;

configuring at least part of the configurable logic according to the first configuration data, including forming a key generator in the configurable logic;

generating a volatile key using the key generator configured in configurable logic circuitry in the device, the volatile key dependent on a fabrication variation among devices fabricated according to a same design as the device;

decrypting the encrypted configuration data within the device using the generated volatile key; and

configuring at least another part of the configurable logic on the device using the decrypted configuration data.

2. The method of claim 1 wherein configuring the configurable logic on the device includes configuring a programmable gate array according to the decrypted configuration data.

3. The method of claim 1 further comprising:

clearing all information stored on the device from which the volatile key can be determined; and

wherein generating the volatile key is performed without the device receiving information from which the volatile key can be determined subsequent to the clearing of the information.

4. The method of claim 1 wherein configuring at least part of the configurable logic according to the first configuration data includes forming at least part of logic for the decryption of the encrypted configuration data.

5. The method of claim 1 wherein generating the volatile key includes generating a volatile response, and the method further comprises performing at least one of (a) providing a first input value to the device that is used to generate the volatile response based, and (b) providing a second input value to the device and combining the volatile response and the second input value to determine the volatile key.

6. The method of claim 5 further comprising storing at least one of the first value and the second value in a non-volatile storage on the device.

7. The method of claim 5 further comprising determining at least one of the first value and the second value such that a desired volatile key is generated.

8. A method of operating a configurable logic device comprising:

loading a configurable logic device with a first module for generating a volatile response that varies among configurable logic devices fabricated according to the same design;

using the first module to generate a first volatile response for the device;

forming configuration data according to the first volatile response;

loading the configuration data into the configurable logic device, including implementing the first module in the configurable logic device;

operating the device according to the configuration data including

using the first module to generate a second volatile response for the device;

determining whether the second volatile response matches the first volatile response;

disabling functionality specified by the configuration data if the second volatile response does not match the first volatile response.

9. The method of claim 8, wherein disabling functionality includes inhibiting configuration of the configurable logic.

10. The method of claim 8, wherein disabling functionality includes at least one of disabling functionality implemented in the configurable logic prior to an initial use of the functionality after configuration of the logic, and disabling functionality during use of the functionality.