An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays
Secure booting within a field-programmable gate array (FPGA) environment is traditionally implemented using hardwired embedded cryptographic primitives and non-volatile memory (NVM)-based keys, whereby an encrypted bitstream is decrypted as it is loaded from an external storage medium, e.g., Flash m...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2018-07-01
|
| Series: | Cryptography |
| Subjects: | |
| Online Access: | http://www.mdpi.com/2410-387X/2/3/15 |
| _version_ | 1811307901676945408 |
|---|---|
| author | Don Owen Derek Heeger Calvin Chan Wenjie Che Fareena Saqib Matt Areno Jim Plusquellic |
| author_facet | Don Owen Derek Heeger Calvin Chan Wenjie Che Fareena Saqib Matt Areno Jim Plusquellic |
| author_sort | Don Owen |
| collection | DOAJ |
| description | Secure booting within a field-programmable gate array (FPGA) environment is traditionally implemented using hardwired embedded cryptographic primitives and non-volatile memory (NVM)-based keys, whereby an encrypted bitstream is decrypted as it is loaded from an external storage medium, e.g., Flash memory. A novel technique is proposed in this paper that self-authenticates an unencrypted FPGA configuration bitstream loaded into the FPGA during the start-up. The internal configuration access port (ICAP) interface is accessed to read out configuration information of the unencrypted bitstream, which is then used as input to a secure hash function SHA-3 to generate a digest. In contrast to conventional authentication, where the digest is computed and compared with a second pre-computed value, we use the digest as a challenge to a hardware-embedded delay physical unclonable function (PUF) called HELP. The delays of the paths sensitized by the challenges are used to generate a decryption key using the HELP algorithm. The decryption key is used in the second stage of the boot process to decrypt the operating system (OS) and applications. It follows that any type of malicious tampering with the unencrypted bitstream changes the challenges and the corresponding decryption key, resulting in key regeneration failure. A ring oscillator is used as a clock to make the process autonomous (and unstoppable), and a novel on-chip time-to-digital-converter is used to measure path delays, making the proposed boot process completely self-contained, i.e., implemented entirely within the re-configurable fabric and without utilizing any vendor-specific FPGA features. |
| first_indexed | 2024-04-13T09:12:25Z |
| format | Article |
| id | doaj.art-aaed4c449b674f1fa1703ea71a330c45 |
| institution | Directory Open Access Journal |
| issn | 2410-387X |
| language | English |
| last_indexed | 2024-04-13T09:12:25Z |
| publishDate | 2018-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Cryptography |
| spelling | doaj.art-aaed4c449b674f1fa1703ea71a330c452022-12-22T02:52:50ZengMDPI AGCryptography2410-387X2018-07-01231510.3390/cryptography2030015cryptography2030015An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate ArraysDon Owen0Derek Heeger1Calvin Chan2Wenjie Che3Fareena Saqib4Matt Areno5Jim Plusquellic6Department of Electrical Communication Engineering, University of New Mexico, Albuquerque, NM 87131, USADepartment of Electrical Communication Engineering, University of New Mexico, Albuquerque, NM 87131, USADepartment of Electrical Communication Engineering, University of New Mexico, Albuquerque, NM 87131, USADepartment of Electrical Communication Engineering, University of New Mexico, Albuquerque, NM 87131, USADepartment of Electrical and Computer Engineering, University of North Carolina, Charlotte 2, Chapel Hill, NC 28223, USATrusted and Secure Systems, LLC, Finksburg, MD 21048 USADepartment of Electrical and Computer Engineering, University of New Mexico, Albuquerque, NM 87131, USASecure booting within a field-programmable gate array (FPGA) environment is traditionally implemented using hardwired embedded cryptographic primitives and non-volatile memory (NVM)-based keys, whereby an encrypted bitstream is decrypted as it is loaded from an external storage medium, e.g., Flash memory. A novel technique is proposed in this paper that self-authenticates an unencrypted FPGA configuration bitstream loaded into the FPGA during the start-up. The internal configuration access port (ICAP) interface is accessed to read out configuration information of the unencrypted bitstream, which is then used as input to a secure hash function SHA-3 to generate a digest. In contrast to conventional authentication, where the digest is computed and compared with a second pre-computed value, we use the digest as a challenge to a hardware-embedded delay physical unclonable function (PUF) called HELP. The delays of the paths sensitized by the challenges are used to generate a decryption key using the HELP algorithm. The decryption key is used in the second stage of the boot process to decrypt the operating system (OS) and applications. It follows that any type of malicious tampering with the unencrypted bitstream changes the challenges and the corresponding decryption key, resulting in key regeneration failure. A ring oscillator is used as a clock to make the process autonomous (and unstoppable), and a novel on-chip time-to-digital-converter is used to measure path delays, making the proposed boot process completely self-contained, i.e., implemented entirely within the re-configurable fabric and without utilizing any vendor-specific FPGA features.http://www.mdpi.com/2410-387X/2/3/15secure bootPhysical Unclonable FunctionFPGAs |
| spellingShingle | Don Owen Derek Heeger Calvin Chan Wenjie Che Fareena Saqib Matt Areno Jim Plusquellic An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays Cryptography secure boot Physical Unclonable Function FPGAs |
| title | An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays |
| title_full | An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays |
| title_fullStr | An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays |
| title_full_unstemmed | An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays |
| title_short | An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays |
| title_sort | autonomous self authenticating and self contained secure boot process for field programmable gate arrays |
| topic | secure boot Physical Unclonable Function FPGAs |
| url | http://www.mdpi.com/2410-387X/2/3/15 |
| work_keys_str_mv | AT donowen anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT derekheeger anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT calvinchan anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT wenjieche anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT fareenasaqib anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT mattareno anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT jimplusquellic anautonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT donowen autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT derekheeger autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT calvinchan autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT wenjieche autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT fareenasaqib autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT mattareno autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays AT jimplusquellic autonomousselfauthenticatingandselfcontainedsecurebootprocessforfieldprogrammablegatearrays |