# US 11,443,018 B2 · Locking execution of cores to licensed programmable devices in a data center

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,018 B2
- Document ID: US11443018B2
- Status: Granted
- Kind: B2
- Application number: 16/299,575
- Filed: 2019-03-12
- Published: 2020-09-17
- Granted: 2022-09-13
- Earliest claimed: 2019-03-12
- Assignees: Xilinx, Inc.
- Applicants: Xilinx, Inc.
- Inventors: Brian S. Martin; Premduth Vidyanandan; Mark B. Carson; Neil Watson; Gary J. McClintock
- Web page: https://patentgrep.com/patent/US11443018B2

## CPC

- G06F 21/123: {by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- G06F 9/5027: {the resource being a machine, e.g. CPUs, Servers, Terminals}
- G06F 21/1011: {to devices}
- G06F 21/575: {Secure boot}
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/3247: {involving digital signatures}
- G06F 21/1064: {Restricting content processing at operating system level}
- G06F 21/107: {License processing; Key processing}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An example hardware accelerator for a computer system includes a programmable device and further includes kernel logic configured in a programmable fabric of the programmable device, and an intellectual property (IP) checker circuit in the kernel logic. The IP checker circuit is configured to obtain a device identifier (ID) of the programmable device and a signed whitelist, the signed whitelist including a list of device IDs and a signature, verify the signature of the signed whitelist, compare the device ID against the list of device IDs, and selectively assert or deassert an enable of the kernel logic in response to presence or absence, respectively, of the device ID in the list of device IDs and verification of the signature.

## Claims

### Claim 1

A hardware accelerator for a computer system, the hardware accelerator including a programmable device, the hardware accelerator comprising:
a static region comprising non-reconfigurable static circuitry; and
kernel logic configured in a programmable portion of the programmable device, wherein the kernel logic is at least partially reconfigurable, and operation of the kernel logic is configured to be selectively enabled or disabled, and wherein the kernel logic comprises an intellectual property (IP) checker circuit, the IP checker circuit configured to:
obtain a device identifier (ID) of the programmable device and a signed whitelist, the signed whitelist including a list of device IDs and a signature;
verify the signature of the signed whitelist;
compare the device ID against the list of device IDs; and
selectively enable or disable the operation of the kernel logic by selectively asserting or deasserting an enable of the kernel logic based on presence or absence, respectively, of the device ID in the list of device IDs and verification of the signature.

### Claim 2 (depends on 1)

The hardware accelerator of claim 1, further comprising:
a shell circuit configured in the programmable portion, the shell circuit configured to provide an interface between a computer system and the kernel logic.

### Claim 3 (depends on 1)

The hardware accelerator of claim 1, wherein the IP checker circuit is configured with the signed whitelist.

### Claim 4 (depends on 1)

The hardware accelerator of claim 1, wherein the IP checker circuit receives the signed whitelist from a computer system having the hardware accelerator disposed therein.

### Claim 5 (depends on 1)

The hardware accelerator of claim 1, wherein the IP checker circuit is configured to verify the signature of the signed whitelist by:
decrypting the signature using a public key of a public/private key pair, the signature encrypted using a private key of the public/private key pair;
determining a hash of the list of device IDs; and
comparing the hash with the decrypted signature.

### Claim 6 (depends on 1)

The hardware accelerator of claim 1, wherein the IP checker circuit comprises:
a device ID read circuit configured to read the device ID;
a memory configured to store the signed whitelist; and
a checker circuit configured to compare the device ID against the list of device IDs and selectively assert or deassert the enable of the kernel logic.

### Claim 7 (depends on 1)

The hardware accelerator of claim 1, wherein the IP checker circuit comprises:
a device ID read circuit configured to read the device ID;
an interface circuit configured to receive the signed whitelist from a computer system; and
a checker circuit configured to compare the device ID against the list of device IDs and selectively assert or deassert the enable of the kernel logic.

### Claim 8

A computer system, comprising:
a processing system; and
a hardware accelerator, coupled to the processing system, the hardware accelerator including:
a static region comprising non-reconfigurable static circuitry; and
kernel logic configured in a programmable portion of a programmable device, wherein the kernel logic is at least partially reconfigurable, and operation of the kernel logic is configured to be selectively enabled or disabled, and wherein the kernel logic comprises an intellectual property (IP) checker circuit in the kernel logic, the IP checker circuit configured to:
obtain a device identifier (ID) of the programmable device and a signed whitelist, the signed whitelist including a list of device IDs and a signature;
verify the signature of the signed whitelist;
compare the device ID against the list of device IDs; and
selectively enable or disable the operation of the kernel logic by selectively asserting or deasserting an enable of the kernel logic based on presence or absence, respectively, of the device ID in the list of device IDs and verification of the signature.

### Claim 9 (depends on 8)

The computer system of claim 8, wherein the hardware accelerator further comprises a shell circuit configured in the programmable portion, the shell circuit configured to provide an interface between the processing system and the kernel logic.

### Claim 10 (depends on 8)

The computer system of claim 8, wherein the IP checker circuit is configured with the signed whitelist.

### Claim 11 (depends on 8)

The computer system of claim 8, wherein the IP checker circuit receives the signed whitelist from the processing system.

### Claim 12 (depends on 8)

The computer system of claim 8, wherein the IP checker circuit is configured to verify the signature of the signed whitelist by:
decrypting the signature using a public key of a public/private key pair, the signature encrypted using a private key of the public/private key pair;
determining a hash of the list of device IDs; and
comparing the hash with the decrypted signature.

### Claim 13 (depends on 8)

The computer system of claim 8, wherein the IP checker circuit comprises:
a device ID read circuit configured to read the device ID;
a memory configured to store the signed whitelist; and
a checker circuit configured to compare the device ID against the list of device IDs and selectively assert or deassert the enable of the kernel logic.

### Claim 14 (depends on 8)

The computer system of claim 8, wherein the IP checker circuit comprises:
a device ID read circuit configured to read the device ID;
an interface circuit configured to receive the signed whitelist from the processing system; and
a checker circuit configured to compare the device ID against the list of device IDs and selectively assert or deassert the enable of the kernel logic.

### Claim 15

A method of locking kernel logic, the method comprising:
configuring kernel logic in a programmable portion of a programmable device of a hardware accelerator, wherein the hardware accelerator comprises a static region comprising non-reconfigurable static circuitry, and wherein operation of the kernel logic is configured to be selectively enabled or disabled;
obtaining, at an intellectual property (IP) checker circuit in the kernel logic, a device identifier (ID) of the programmable device and a signed whitelist, the signed whitelist including a list of device IDs and a signature;
verifying the signature of the signed whitelist;
comparing the device ID against the list of device IDs; and
selectively enabling or disabling the operation of the kernel logic by selectively asserting or deasserting, by the IP checker circuit, an enable of the kernel logic based on presence or absence, respectively, of the device ID in the list of device IDs and verification of the signature.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
configuring a shell circuit in the programmable portion, the shell circuit configured to provide an interface between a computer system and the kernel logic.

### Claim 17 (depends on 15)

The method of claim 15, wherein the IP checker circuit is configured with the signed whitelist.

### Claim 18 (depends on 15)

The method of claim 15, wherein the IP checker circuit receives the signed whitelist from a computer system.

### Claim 19 (depends on 15)

The method of claim 15, wherein the IP checker circuit is configured to verify the signature of the signed whitelist by:
decrypting the signature using a public key of a public/private key pair, the signature encrypted using a private key of the public/private key pair;
determining a hash of the list of device IDs; and
comparing the hash with the decrypted signature.

### Claim 20 (depends on 19)

The method of claim 19, wherein the signature comprises a pre-computed hash of the list of device IDs encrypted by the private key.