Programmable logic device with decryption and structure for preventing design relocation

A method for configuring a programmable logic device (PLD), comprising:

• storing a plurality of decryption keys in storage elements of the PLD;
• receiving a configuration bitstream at the PLD, wherein the configuration bitstream includes control data and configuration data, the control data includes an address that references configuration memory of the PLD, and at least the configuration data is encrypted;
• decrypting the configuration bitstream in the PLD using the address from the configuration bitstream and the plurality of decryption keys, whereby a decrypted configuration bitstream is generated;
• storing configuration data from the decrypted configuration bitstream in configuration memory of the PLD;
• disabling readback of configuration data from the PLD after storing the configuration data in configuration memory;
• and
• disabling partial reconfiguration of the PLD in response to decryption of the configuration bitstream.

An apparatus for configuring a programmable logic device (PLD), comprising:

• means for storing a plurality of decryption keys in storage elements of the PLD;
• means for receiving a configuration bitstream at the PLD, wherein the configuration bitstream includes control data and configuration data, the control data includes an address that references configuration memory of the PLD, and at least the configuration data is encrypted;
• means for decrypting the configuration bitstream in the PLD using the address from the configuration bitstream and the plurality of decryption keys, whereby a decrypted configuration bitstream is generated;
• means for storing configuration data from the decrypted configuration bitstream in configuration memory of the PLD;
• means for disabling readback of configuration data from the PLD after storing the configuration data in configuration memory;
• and
• means for disabling partial reconfiguration of the PLD in response to the means for decrypting the configuration bitstream.

A programmable logic device (PLD), comprising:

• a configuration memory;
• programmable logic circuitry coupled to the configuration memory;
• a key management circuit adapted for storage of a plurality of keys;
• a configuration circuit coupled to the configuration memory and to the plurality of storage elements, the configuration circuit adapted to configure the configuration memory with an input configuration bitstream, wherein the configuration bitstream includes control data and configuration data, the control data includes an address that references configuration memory of the PLD, and at least the configuration data is encrypted;
• and
• a decryptor coupled to the configuration circuit and to the plurality of storage elements, the decryptor configured to decrypt, responsive to the configuration circuit, an input configuration bitstream using the address from the configuration bitstream and a plurality of decryption keys stored in the plurality of storage elements;
• wherein the decryptor is adapted to perform DES decryption using at least one of cipher block chaining and cipher feedback and include the address in an input value to the at least one of cipher block chaining and cipher feedback.