Back to results
US 10,482,291 B2Granted
Secure field-programmable gate array (FPGA) architecture
AssigneeRaytheon Company
InventorThomas R. Woodall
Life of this patent
Estimating the term…
Abstract
Method and systems using stateful encryption for non-bypassable FPGA configuration including receiving, at an FPGA, FPGA-configuration data comprising a cryptographic state to initialize a cryptographic state of the FPGA, and decrypting, at the FPGA, the FPGA-configuration data, wherein decrypting the FPGA-configuration data yields at least a second cryptographic state and decrypted FPGA-configuration data. Embodiments can include receiving, at the FPGA, a challenge message, processing, at the FPGA, the challenge message to yield at least a third cryptographic state and a response, and transmitting the response from the FPGA.
Claims6
A method of using a stateful encryption algorithm for non-bypassable FPGA configuration, the method comprising:
- before encrypting FPGA-configuration data, generating, by a cryptographic algorithm, a first message authentication code (MAC) value using the FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the FPGA-configuration data;
- encrypting the FPGA-configuration data;
- receiving, at an FPGA, the encrypted FPGA-configuration data and the first MAC value;
- decrypting, at the FPGA, the encrypted FPGA-configuration data;
- generating, by the cryptographic algorithm, a second MAC value using the decrypted FPGA-configuration data and the first initial value;
- comparing the first MAC value with the second MAC value;
- in response to the first MAC value being the same as the second MAC value, authenticating the decrypted FPGA-configuration data;
- receiving, at the FPGA, a challenge message from an authentication device;
- generating, by the cryptographic algorithm, a third MAC value using the challenge message and the second MAC value as a second initial value;
- encrypting, at the FPGA, the challenge message to generate a response message, wherein the response message includes the third MAC value;
- and
- transmitting the response message from the FPGA to the authentication device.
9 more elements
A field-programmable gate array (FPGA) comprising:
- one or more interfaces-configured to:
- receive encrypted FPGA-configuration data and a first message authentication code (MAC) value that is generated by a cryptographic algorithm using unencrypted FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the unencrypted FPGA-configuration data;
- and
- receive a challenge message from an authentication device;
- a state-encryption unit configured to:
- decrypt the encrypted FPGA-configuration data;
- generate, by the cryptographic algorithm, a second MAC value using the decrypted FPGA-configuration data and the first initial value;
- compare the second MAC value with the first MAC;
- in response to the first MAC value being the same as the second MAC value, authenticate the decrypted FPGA-configuration data;
- generate, by the cryptographic algorithm, a third MAC value using the challenge message and the second MAC value as a second initial value;
- encrypt the challenge message to generate a response message, wherein the response message includes the third MAC value;
- and the one or more interfaces are configured to transmit the response message to the authentication device;
- and
- a programmable logic unit configured to:
- receive the decrypted FPGA-configuration data.
12 more elements
A system comprising:
- a field-programmable gate array (FPGA) configured to:
- receive encrypted FPGA-configuration data and a first message authentication code (MAC) value that is generated by a cryptographic algorithm using unencrypted FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the unencrypted FPGA-configuration data;
- decrypt the encrypted FPGA-configuration data;
- compare the first MAC value with a second MAC value that is generated by the cryptographic algorithm using the decrypted FPGA-configuration data and the first initial value;
- and
- in response to the first MAC value being the same as the second MAC value, authenticate the decrypted FPGA-configuration data and configure a programmable logic unit of the FPGA with the decrypted FPGA-configuration data;
- and
- an authentication device configured to:
- transmit a challenge message to the FPGA and receive a response message to the challenge message, wherein the response message is generated, at the FPGA, by encrypting the challenge message, wherein the response message includes a third MAC value generated by the cryptographic algorithm using the challenge message and the second MAC value as a second initial value;
- and
- authenticate the response message by comparing the third MAC value to a fourth MAC value.
8 more elements
Dependencies are inferred from the claim text.