Programmable logic device with resistance to external monitoring attacks

• US 8,977,864 B2
• Filed: 03/07/2014
• Issued: 03/10/2015
• Est. Priority Date: 12/04/2009
• Status: Active Grant

• Current Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Kocher, Paul C., Rohatgi, Pankaj, Jaffe, Joshua M.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/201,539
• Publication Number:
  US 20140247944A1
• Time in Patent Office: 368 Days
• Field of Search: 380/277, 380/44, 713/181, 713/189, 713192-194, 726 26- 27
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2125 Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/003 for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 : Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 : the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3271 : using challenge-response
• CPC Class Codes: H04L 9/50 : using hash chains, e.g. blockchains or hash trees

Abstract

Techniques usable by devices to encrypt and decrypt sensitive data to in a manner that provides security from external monitoring attacks. The encrypting device has access to a base secret cryptographic value (key) that is also known to the decrypting device. The sensitive data are decomposed into segments, and each segment is encrypted with a separate encryption key derived from the base key and a message identifier to create a set of encrypted segments. The encrypting device uses the base secret cryptographic value to create validators that prove that the encrypted segments for this message identifier were created by a device with access to the base key. The decrypting device, upon receiving an encrypted segments and validator(s), uses the validator to verify the message identifier and that the encrypted segment are unmodified, then uses a cryptographic key derived from the base key and message identifier to decrypt the segments.

Claims

1. A programmable logic device comprising:

a keystore to store a secret value; and

a cryptography logic coupled to the keystore, the cryptography logic to;

receive a bitstream comprising a validator and a first encrypted segment of configuration data for the programmable logic device;

retrieve the secret value from the keystore;

derive an initial key for the bitstream based at least in part on the secret value;

verify, using the received validator, that the first encrypted segment has not been modified; and

decrypt the first encrypted segment using a first decryption key derived from the initial key to produce a first decrypted segment responsive to verifying that the first encrypted segment has not been modified.

2. The programmable logic device of claim 1, wherein the initial key for the bitstream is also based at least in part on an identifier of the bistream.

3. The programmable logic device of claim 1, wherein the programmable logic device comprises a field programmable gate array (FPGA), and wherein the first encrypted segment comprises a first portion of configuration data for the FPGA.

4. The programmable logic device of claim 1, wherein the received bitstream further comprises a second encrypted segment of configuration data for the programmable logic device, the cryptography logic to:

verify whether the second encrypted segment has been modified; and

decrypt the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment responsive to verifying that the second encrypted segment has not been modified.

5. The programmable logic device of claim 4, the cryptography logic to:

responsive to a failure to successfully verify that the second encrypted segment has not been modified, delete the first decrypted segment of configuration data.

6. The programmable logic device of claim 1, wherein the bitstream comprises a plurality of encrypted segments, and wherein the cryptography logic is to perform hash chaining operations to decrypt the plurality of encrypted segments, the hash chaining operations comprising:

cryptographically transforming the first encrypted segment of the plurality of encrypted segments to produce a first derived value;

comparing the first derived value with a first expected value;

responsive to determining that the first derived value matches the first expected value, decrypting the first encrypted segment using the first decryption key to produce the first decrypted segment and a second expected value;

cryptographically transforming the second encrypted segment to produce a second derived value;

comparing the second derived value with a second expected value; and

responsive to determining that the second derived value matches the second expected value, decrypting the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment.

7. The programmable logic device of claim 1, wherein the bitstream comprises a plurality of encrypted segments, and wherein the cryptography logic is to perform hash chaining operations to decrypt the plurality of encrypted segments, the hash chaining operations comprising:

cryptographically transforming the first encrypted segment of the plurality of encrypted segments to produce a first derived value;

comparing the first derived value with a first expected value;

responsive to determining that the first derived value matches the first expected value, decrypting the first encrypted segment using the first decryption key to produce the first decrypted segment and deconcatenating the first encrypted segment to produce a second expected value;

cryptographically transforming the second encrypted segment to produce a second derived value;

comparing the second derived value with a second expected value; and

responsive to determining that the second derived value matches the second expected value, decrypting the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment.

8. The programmable logic device of claim 1, further comprising:

a programmable logic, wherein the bitstream comprises a plurality of encrypted segments of the configuration data, and wherein the programmable logic is configured using the configuration data after all of the plurality of encrypted segments of the configuration data are decrypted; and

one or more status registers to track a status for a bistream loading process that configures the programmable logic.

9. The programmable logic device of claim 1, the cryptography logic further to:

derive the initial key using a path through a key tree, wherein the path through the key tree is based on an identifier of the bitstream and identifies a plurality of entropy distribution operations used to derive the initial key.

10. The programmable logic device of claim 9, the cryptography logic further to:

divide the identifier into a plurality of parts, where each of the plurality of parts determines a leg of the path, and where each leg of the path is associated with a particular entropy distribution operation of the plurality of entropy distribution operations.

11. The programmable logic device of claim 10, the cryptography logic further to:

compute a plurality of intermediate keys in succession, wherein each of the plurality of intermediate keys is computed based on applying one of the plurality of entropy distribution operations to at least one of the secret value or a previous intermediate key in the succession.

12. The programmable logic device of claim 1, the cryptography logic further to:

receive and decrypt a plurality of encrypted segments using hash chaining operations comprising;

decrypting the first encrypted segment of the plurality of encrypted segments to produce a first plaintext segment comprising a first decrypted segment and a first hash value;

validating the first hash value; and

responsive to validating the first hash value, decrypting a second encrypted segment of the plurality of encrypted segments to produce a second plaintext segment comprising a second decrypted segment and a second hash value.

13. The programmable logic device of claim 1, wherein to verify that the encrypted segment has not been modified the cryptography logic is to:

compute a hash of the encrypted segment;

generate an expected validator based on performing a plurality of entropy distribution operations on the initial key using a key tree, wherein the hash indicates a path through the key tree, the path identifying the plurality of entropy distribution operations; and

compare the expected validator to the received validator.

14. A method comprising:

receiving, by a programmable logic device (PLD), a bitstream comprising a validator and a first encrypted segment of configuration data for the PLD;

deriving, by the PLD, an initial key for the bitstream based at least in part on a secret value and a plurality of entropy distribution operations;

verifying, using the received validator, that the first encrypted segment has not been modified; and

decrypting the first encrypted segment using a first decryption key derived from the initial key to produce a first decrypted segment responsive to verifying that the first encrypted segment has not been modified.

15. The method of claim 14, wherein deriving, by the PLD, an initial key for the bitstream is also based at least in part on an identifier of the bitstream.

16. The method of claim 14, wherein the PLD comprises a field programmable gate array (FPGA), and wherein the first encrypted segment comprises a first portion of configuration data for the FPGA.

17. The method of claim 14, wherein the received bitstream further comprises a second encrypted segment of configuration data for the PLD, the method further comprising:

verifying whether the second encrypted segment has been modified; and

decrypting the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment responsive to verifying that the second encrypted segment has not been modified.

18. The method of claim 17, further comprising:

responsive to a failure to successfully verify that the second encrypted segment has not been modified, deleting the first decrypted segment of configuration data.

19. The method of claim 14, wherein the bitstream comprises a plurality of encrypted segments, and wherein hash chaining operations are performed to decrypt the plurality of encrypted segments, the hash chaining operations comprising:

cryptographically transforming the first encrypted segment of the plurality of encrypted segments to produce a first derived value;

comparing the first derived value with a first expected value;

responsive to determining that the first derived value matches the first expected value, decrypting the first encrypted segment using the first decryption key to produce the first decrypted segment and a second expected value;

cryptographically transforming the second encrypted segment to produce a second derived value;

comparing the second derived value with a second expected value; and

responsive to determining that the second derived value matches the second expected value, decrypting the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment.

20. The method of claim 14, wherein the bitstream comprises a plurality of encrypted segments, and wherein hash chaining operations are performed to decrypt the plurality of encrypted segments, the hash chaining operations comprising:

cryptographically transforming the first encrypted segment of the plurality of encrypted segments to produce a first derived value;

comparing the first derived value with a first expected value;

responsive to determining that the first derived value matches the first expected value, decrypting the first encrypted segment using the first decryption key to produce the first decrypted segment and deconcatentating the first encrypted segment to produce a second expected value;

cryptographically transforming the second encrypted segment to produce a second derived value;

comparing the second derived value with a second expected value; and

responsive to determining that the second derived value matches the second expected value, decrypting the second encrypted segment using a second decryption key derived from the initial key to produce a second decrypted segment.

21. The method of claim 14, wherein the bitstream comprises a plurality of encrypted segments of the configuration data, the method further comprising:

after decrypting all of the plurality of encrypted segments of the configuration data, configuring the PLD using the configuration data.

22. The method of claim 14, further comprising:

deriving the initial key using a path through a key tree, wherein the path through the key tree is based on an identifier of the bitstream and identifies the plurality of entropy distribution operations.

23. The method of claim 22, further comprising:

dividing the identifier into a plurality of parts, where each of the plurality of parts determines a leg of the path, and where each leg of the path is associated with a particular entropy distribution operation of the plurality of entropy distribution operations.

24. The method of claim 23, further comprising:

computing a plurality of intermediate keys in succession, wherein each of the plurality of intermediate keys is computed based on applying one of the plurality of entropy distribution operations to at least one of the secret value or a previous intermediate key in the succession.

25. The method of claim 14, further comprising receiving and decrypting a plurality of encrypted segments using hash chaining operations comprising:

decrypting the first encrypted segment of the plurality of encrypted segments to produce a first plaintext segment comprising a first decrypted segment and a first hash value;

validating the first hash value; and

responsive to validating the first hash value, decrypting a second encrypted segment to produce a second plaintext segment comprising a second decrypted segment and a second hash value.

26. The method of claim 14, wherein verifying that the encrypted segment has not been modified comprises:

computing a hash of the encrypted segment;

generating an expected validator based on performing an additional plurality of entropy distribution operations on the initial key using a key tree, wherein the hash indicates a path through the key tree, the path identifying the additional plurality of entropy distribution operations; and

comparing the expected validator to the received validator.