Method for providing a secret unique key for a volatile FPGA

A non-volatile configuration memory for configuring a volatile FPGA, wherein the non-volatile memory contains a bit-file, wherein the bit-file is configured to program the FPGA to implement a security IP block that embeds a value for a group key and a default value of an initialization state indicator, wherein

• the bit-file is encrypted with bit-file encryption that is configured to be decrypted with a hardwired decryption module embedded on the FPGA,
• and/or
• the group key is obfuscated within the bit-file, and
• wherein the default value represents an uninitialized state where no secret unique key has been generated before, and
• wherein the security IP block is further configured to:
• retrieve a value of a data record from a non-volatile memory, wherein the data record has been encrypted and authenticated with a key derived from the group key and represents values of the secret unique key and the initialization state indicator;
• decrypt the value of the data record with the key derived from the group key;
• determine an initialization status on the basis of the retrieved value of the initialization state indicator, the initialization status being selected from a list comprising at least the uninitialized state and an initialized state where a secret unique key has been generated before;
• and
• if the determined initialization status represents the uninitialized state,
• generate a new value for the secret unique key,
• send a specific value derived from the new value of the secret unique key to be received by an external validation system,
• wait to receive a validation signal for the specific value from the external validation system, wherein the validation signal indicates that the specific value has been successfully validated by the external validation system;
• and
• if a signal validating the unique secret key is received, store a new value of the data record to the non-volatile memory, wherein the said value represents the generated new value of the secret unique key and initialized state of the initialization state indicator, and wherein said value is encrypted and authenticated with the group key.

A non-transitory computer-readable medium on which is stored a configuration program comprising a bit-file that is configured to program a volatile FPGA to implement a security IP block that embeds a value for a group key and a default value of an initialization state indicator, wherein

• the bit-file is encrypted with a bit-file encryption that is configured to be decrypted with a hardwired decryption module embedded on the FPGA,
• and/or
• the group key is obfuscated within the bit-file, and
• wherein the default value represents an uninitialized state where no secret unique key has been generated before, and wherein the security IP block is further configured to:
• retrieve a value of a data record from a non-volatile memory, wherein the data record has been encrypted and authenticated with a key derived from the group key and represents values of the secret unique key and the initialization state indicator;
• decrypting the value of the data record with the key derived from the group key;
• determine an initialization status on the basis of the retrieved value of the initialization state indicator, the initialization status being selected from a list comprising at least the uninitialized state and an initialized state where a secret unique key has been generated before;
• and
• if the determined initialization status represents the uninitialized state,
• generate a new value for the secret unique key,
• send a specific value derived from the new value of the secret unique key to be received by an external validation system,
• wait to receive a validation signal for the specific value from the external validation system, wherein the validation signal indicates that the specific value has been successfully validated by the external validation system;
• and
• if a signal validating the unique secret key is received, store a new value of the data record to the non-volatile memory, wherein the said value represents the generated new value of the secret unique key and initialized state of the initialization state indicator, and wherein said value is encrypted and authenticated with the group key.