Method and apparatus for providing secure programmable logic devices

• US 7,536,559 B1
• Filed: 05/05/2005
• Issued: 05/19/2009
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Original Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Inventors: Wirtz, Frank C. II, Darling, Roy D., Edwards, Eric E., Jenkins, Jesse H. IV, Davies, Thomas J. Jr.
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/123,531
• Time in Patent Office: 1,475 Days
• Field of Search: 726/26, 726/30, 713/174, 713/189, 713/190, 713192-194, 380/265
• US Class Current: 713/189
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]

Abstract

Method and apparatus for providing secure programmable logic devices is described. One aspect of the invention relates to securing a programmable logic device having instruction register logic coupled to control logic via an instruction bus. A non-volatile memory is provided for storing at least one security bit for at least one instruction associated with the programmable logic device. Gating logic is provided in communication with the non-volatile memory and at least a portion of the instruction bus. The gating logic is configured to selectively gate decoded instructions transmitted from the instruction register logic towards the control logic based on state of the at least one security bit.

Claims

1. Apparatus for securing an integrated circuit device having instruction register logic coupled to control logic via an instruction bus, comprising:

a non-volatile memory for storing at least one security bit for at least one instruction associated with said programmable logic device; and

gating logic in communication with said non-volatile memory and at least a portion of said instruction bus, said gating logic configured to selectively gate decoded instructions transmitted from said instruction register logic towards said control logic based on state of said at least one security bit.

2. The apparatus of claim 1, wherein said at least one security bit comprises a security bit for each said at least one instruction.

3. The apparatus of claim 1, wherein said at least one security bit comprises multiple security bits for each said at least one instruction.

4. The apparatus of claim 1, wherein said at least one instruction includes a group of instructions, and wherein said at least one security bit is associated with said group of instructions.

5. The apparatus of claim 1, wherein said gating logic comprises at least one logic gate respectively associated with said at least one instruction.

6. The apparatus of claim 5, wherein each said at least one logic gate is configured to receive output from a memory cell in said non-volatile memory.

7. The apparatus of claim 5, wherein each said at least one logic gate is configured to receive output from a plurality of memory cells in said non-volatile memory.

8. The apparatus of claim 1, wherein said gating logic comprises a plurality of logic gates associated with each said at least one instruction.

9. The apparatus of claim 8, wherein, for each said at least one instruction, each said plurality of logic gates is configured to receive output from a memory cell in said non-volatile memory.

10. The apparatus of claim 1, further comprising:

a multiplexer configured to receive output from said control signal logic and test pins of said programmable logic device; and

additional gating logic in communication with said non-volatile memory for controllably causing said multiplexer to select between said output from said control signal logic and said test pins.

11. The apparatus of claim 1, wherein said at least one instruction comprises at least one of:

a) an erase instruction; and

b) one or more boundary scan instructions.

12. The apparatus of claim 1, wherein said programmable logic device comprises one of a complex programmable logic device (CPLD) and a field programmable gate array (FPGA).

13. A method for securing an integrated circuit device having instruction register logic coupled to control logic via an instruction bus, comprising:

storing at least one security bit for at least one instruction associated with said integrated circuit device; and

selectively gating decoded instructions transmitted from said instruction register logic towards said control logic based on state of said at least one security bit.

14. The method of claim 13, wherein said at least one security bit comprises a security bit for each said at least one instruction.

15. The method of claim 13, wherein said at least one security bit comprises multiple security bits for each said at least one instruction.

16. The method of claim 13, wherein said at least one instruction includes a group of instructions, and wherein said at least one security bit is associated with said group of instructions.

17. The method of claim 13, wherein said at least one instruction comprises at least one of:

a) an erase instruction; and

b) one or more boundary scan instructions.

18. The method of claim 13, wherein said at least one security bit for said at least one instruction is stored in a non-volatile memory within said programmable logic device.

19. The method of claim 18, wherein said programmable logic device comprises one of a complex programmable logic device (CPLD) and a field programmable gate array (FPGA).

20. Apparatus for securing an integrated circuit device having instruction register logic coupled to control logic having a control bus, comprising:

a non-volatile memory for storing at least one security bit for instructions associated with said integrated circuit device; and

gating logic in communication with said non-volatile memory and at least a portion of said control bus, said gating logic configured to selectively gate control signals produced by said control logic based on state of said at least one security bit, said control logic generating said control signals in response to decoded instructions from said instruction register logic.