FPGA configuration bitstream protection using multiple keys

• US 8,826,038 B1
• Filed: 05/18/2012
• Issued: 09/02/2014
• Est. Priority Date: 01/25/2005
• Status: Active Grant

• Current Assignee: Altera Corporation (Intel Corporation)
• Original Assignee: Altera Corporation (Intel Corporation)
• Inventors: Langhammer, Martin, Joyce, Juju, Streicher, Keone, Jefferson, David, Reddy, Srinivas, Prasad, Nitin
• Primary Examiner(s): Zee, Edward
• Application Number:
  US13/474,745
• Time in Patent Office: 837 Days
• Field of Search: 713/189, 713/191, 713/193, 713/194, 726/26, 726/27, 380/44, 380/45, 380/47, 380/281, 380/84
• US Class Current: 713/191
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/26 Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Circuits, methods, and apparatus that prevent detection and erasure of encoding or encryption keys. These encoding keys may be used to encode a configuration bitstream or other data for an FPGA or other device. An exemplary embodiment of the present invention masks a first key to form an encoding key in order to prevent detection of the first key. In a specific embodiment, the first key is encoded using a second key. The encoded key is used to encode a configuration bitstream or other data. The encoded key is stored on an FPGA or other device. When the device is to be configured, the encoded key is retrieved and used to decode the bitstream or other data. A further embodiment stores an encryption key in a one-time programmable memory (OTP) array to prevent its erasure or modification. The encoding key may be further obfuscated before storage.

Claims

1. A method of processing a configuration bitstream at a user computing device comprising:

obtaining, at the user computing device, a plurality of encryption keys and the configuration bitstream;

encoding the configuration bitstream using the plurality of encryption keys to generate an encrypted bit stream;

providing the encrypted bit stream to a configuration device; and

providing, via a JTAG interface of the user computing device, the plurality of encryption keys to an integrated circuit.

2. The method of claim 1, wherein the plurality of encryption keys is provided by a user via a software interface.

3. The method of claim 1, wherein the plurality of encryption keys is generated by the user computing device in response to execution of a software module on the user computing device.

4. The method of claim 1, wherein the encoding is performed using an encryption function selected from a group consisting of a triple data encryption standard (3DES) and an advanced encryption standard (AES).

5. The method of claim 1, wherein the configuration bitstream is in the form of VHDL code or Verilog code.

6. The method of claim 1, wherein the providing of the plurality of encryption keys to the integrated circuit is performed in response to detection of a power up phase of the integrated circuit.

7. The method of claim 1, wherein the providing of the plurality of encryption keys to the integrated circuit is performed in response to detection of an error condition during operation of the integrated circuit.

8. A method of processing a configuration bitstream at a user computing device comprising:

obtaining, at the user computing device, a plurality of encryption keys and the configuration bitstream;

processing the configuration bit stream based, at least in part, on the plurality of encryption keys to generate an encrypted bit stream;

providing the encrypted bit stream to a configuration device external to the user computing device; and

providing, via a JTAG interface of the user computing device, the plurality of encryption keys to an integrated circuit.

9. The method of claim 8, wherein processing the configuration bit stream comprises:

applying a function to the plurality of encryption keys to produce an encoded key; and

providing the encoded key and the configuration bitstream to an encoder to produce the encrypted bit stream.

10. The method of claim 8, wherein the configuration bitstream is in the form of VHDL code or Verilog code.

11. The method of claim 9, wherein the function is equivalent to a corresponding function used in an integrated circuit communicatively coupled to the configuration device.

12. The method of claim 9, wherein the encrypted bit stream is encoded based on a triple encryption standard (3DES).

13. The method of claim 11, wherein the encrypted bit stream is provided to the configuration device in response to detection of a power up phase of the integrated circuit.

14. A user computing device comprising:

a software module configured to;

receive a plurality of encryption keys; and

process the plurality of encryption keys according to a function

to produce an encoded key;

an encoder configured to;

receive a configuration bitstream; and

process the configuration bitstream using the encoded key to produce an encrypted bit stream;

a first interface configured to provide the encrypted bit stream to a configuration device external to the user computing device; and

a second interface configured to provide at least one encryption key of the plurality of encryption keys to an integrated circuit external to the user computing device.

15. The user computing device of claim 14, wherein the configuration bitstream is in the form of VHDL code or Verilog code.

16. The user computing device of claim 14, wherein the function is equivalent to a corresponding function used in an integrated circuit communicatively coupled to the configuration device.

17. The user computing device of claim 14, wherein the user computing device is further configured to provide the at least one encryption key of the plurality of encryption keys to the integrated circuit in response to detection of an error condition during operation of the integrated circuit.

18. The user computing device of claim 14, wherein the user computing device is further configured to provide the at least one encryption key of the plurality of encryption keys to the integrated circuit in response to detection of a fault during operation of the integrated circuit.