JP2006180375A - Programmable logic circuit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a programmable logic circuit capable of securing confidential design information with encrypted configuration data, without using a decoding circuit for exclusive use. <P>SOLUTION: An encrypted configuration bit stream is loaded to a register (not shown) of each configuration circuit 2, formed into an arrayed form PE 4 along a configuration chain 6. At this time, since the value of input configuration bit stream is changed in the process of passing the configuration chain 6, no one but a designer can know what value is going to be obtained, when reaching a destination PE in the arrayed PE 4. Accordingly, data are stirred, if a return circuit 40a is provided between desired two points of configuration circuit 2 if the data are returned, which makes it difficult for a third party to infer configuration data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an LSI programmable logic circuit having a security function. In particular, the present invention can internally decrypt confidential configuration data such as a programmable logic array that can ensure the confidentiality of configuration data. The present invention relates to a programmable logic circuit.

  Conventionally, as an LSI digital signal processing device whose function can be electrically reconfigured, an FPGA (Field Programmable Logic Array), an ALU (Arithmetic and Logical Unit) array processor, and the like are known. Hereinafter, these are collectively referred to as a programmable logic array. In a programmable logic array, various logic circuits (logic) can be realized by loading (writing) digital data called configuration data. For example, a discrete cosine transform processing circuit can be realized by loading first configuration data into one FPGA, and a discrete wavelet transform processing circuit can be realized by loading other configuration data into the same FPGA. Can be realized.

  Therefore, when designing a product using a programmable logic array, configuration data may be designed and loaded according to the function to be realized. In another aspect, this poses a risk that a malicious third party can easily analyze the functions realized by the product by analyzing the configuration data. For example, there is a static random access memory (SRAM) type FPGA in which configuration data is stored in an external flash memory or ROM and loaded into the FPGA at the time of booting. In this configuration, the flash memory is generally a general-purpose product, and since it is connected to the FPGA outside the LSI, the contents of the configuration data can be easily read.

  Therefore, conventionally, when it is necessary to maintain the confidentiality of the design information in the programmable logic array, an antifuse type FPGA that can be written only once, an FPGA with a built-in nonvolatile memory, or the like is used. However, these devices are inferior in performance in spite of the high cost compared to the SRAM type FPGA that can use an inexpensive flash memory. Furthermore, in recent years, attempts have been made to distribute configuration data via a network, and ensuring confidentiality in configuration data of a programmable logic array has become a major issue. As one method for solving such a problem of confidentiality, a method of encrypting configuration data is known.

  Japanese Patent Application Laid-Open No. 2004-228561 discloses a technique for ensuring the confidentiality of configuration data by decrypting encrypted configuration data with a dedicated decryption circuit inside the LSI and programming the FPGA.

  Furthermore, a technique for obtaining configuration data by preliminarily storing secret key information in the programmable logic and calculating an exclusive OR (XOR) between the loaded data and the secret key information is disclosed. Has been. According to this technique, the confidentiality of the configuration data is protected as long as the secret key information is not leaked (see, for example, Patent Document 2).

That is, a configuration data concealment method using a general secret key (common key) cipher is provided by having a decryption circuit inside the programmable logic and decrypting the encrypted configuration data by the decryption circuit inside the chip. Confidentiality is ensured. For example, a high-end FPGA manufactured by Xilinx or Altera has a decoding circuit for such a purpose.
JP 2002-50956 A JP 2003-303095 A

  However, the technique described in Patent Document 1 requires a separate decoding circuit for decoding the configuration data, which increases the circuit scale and increases the cost of the LSI. In addition, the speed of loading configuration data is limited by the processing time required for decoding.

  Furthermore, in the technique described in Patent Document 2, in order to protect the configuration data, secret key information having a data amount equivalent to the configuration data is required. In other words, if the private key information with the same amount of data as the configuration data is not retained, the private key information can be easily obtained by observing the operation of the programmable logic by loading data obtained by changing a part of the loaded data. Will be deciphered. Therefore, in order to protect the configuration data by the technique disclosed in Patent Document 2, a large amount of memory elements are required, and as a result, the cost of the programmable logic is increased.

  The present invention has been made in view of such a point, and a programmable logic circuit capable of protecting configuration data by decrypting configuration data encrypted without using a dedicated decryption circuit inside the programmable logic. The purpose is to provide.

  In order to solve the above-described problem, the programmable logic circuit of the present invention is a programmable logic circuit that loads configuration data to each register by shifting the configuration data to each register connected in series. A logic circuit having a configuration including an arithmetic unit connected to a desired register among the registers and a feedback circuit that feeds back configuration data to the arithmetic unit from a connection part of another register. .

  That is, the programmable logic circuit of the present invention shifts the configuration data to the serially connected registers, and loads the configuration data into the registers. It is possible to generate configuration data for changing input data by inputting configuration data fed back from a connection portion of another register to the arithmetic unit. Therefore, according to such a configuration, since the configuration data is agitated by the feedback of the configuration data, it is difficult to estimate the process of generating the configuration data from the input data by the secret arithmetic unit. . As a result, the confidentiality of the configuration data can be ensured at a high level.

  The programmable logic circuit of the present invention is a programmable logic circuit that loads configuration data into each register by shifting in the configuration data to each register connected in series. The configuration is such that a bit rearrangement circuit that is connected to a desired one of the registers and rearranges the bits of the configuration data is provided.

  According to such a configuration, since the bit of the configuration data is rearranged by the bit rearrangement circuit arranged at a desired position, since the configuration data is agitated in units of bits, the confidentiality of the configuration data Can be increased.

  In addition to the configuration of the invention, the programmable logic circuit of the present invention includes a bit rearrangement circuit that is connected to a desired register of each register and rearranges the bits of the configuration data. The rearrangement circuit is configured to be inserted into a part of a connection part of a register forming a loop by feedback of configuration data.

  That is, the programmable logic circuit of the present invention employs a configuration in which a bit rearrangement circuit is inserted in a part of the connection portion of the register in addition to the configuration of the feedback circuit that forms a loop by feedback of configuration data. According to such a configuration, the configuration data is agitated by the feedback circuit and agitated bit by bit, so that the confidentiality of the configuration data can be further enhanced.

  The programmable logic circuit of the present invention is a programmable logic circuit that loads configuration data to each register by shifting in the configuration data to each register connected in series. A configuration including a storage element that stores key information, and a specific arithmetic unit that performs specific arithmetic processing between configuration data passing through a connection portion of a desired register and secret key information acquired from the storage element. ing.

  According to such a configuration, the storage element for storing the secret key information and the specific arithmetic unit are arranged at a desired position, thereby estimating the secret key information and the position of the arithmetic unit in order to analyze the configuration data. Since necessity arises, the confidentiality of configuration data can be improved.

  The programmable logic circuit according to the present invention includes a storage element that stores secret key information, configuration data that passes through a connection portion of a desired register, and secret key information acquired from the storage element, in addition to the configuration of each invention described above. And a specific arithmetic unit that performs specific arithmetic processing between the storage element and the specific arithmetic unit, and a configuration in which the storage element and the specific arithmetic unit are inserted into a part of a connection portion of a register that forms a loop by feedback of configuration data. ing.

  That is, the programmable logic circuit of the present invention stores a secret key information in addition to the configuration of a feedback circuit that forms a loop by feedback of configuration data and a bit rearrangement circuit that rearranges bits of configuration data. The memory element is inserted into a part of a connection portion of a register that forms a loop by feedback of configuration data. According to such a configuration, the configuration data is agitated by the feedback circuit and agitated bit by bit, and it is necessary to acquire the secret key information in order to analyze the configuration data. Can be further improved.

  According to the programmable logic circuit of the present invention, the secrecy of the configuration data can be realized only by making a slight change to the load circuit originally possessed by the programmable logic. Thereby, the secrecy of the configuration data can be ensured with only a slight increase in circuit scale. In the programmable logic circuit of the present invention, the complexity of the operation can be greatly improved by adopting the loop structure, despite the simple structure. In other words, the programmable logic circuit of the present invention is superior to the prior art in that the complexity of the operation leads to the difficulty in decrypting the code.

(Summary of Invention)
The programmable logic circuit of the present invention reads configuration data in a programmable logic such as an FPGA or an ALU array type processor by decrypting the encrypted configuration data inside the programmable logic without using a dedicated decryption circuit. It is protected so that it does not.

  That is, in the system in which configuration data is loaded by a circuit in which registers are connected in series (that is, connected in a row), the programmable logic circuit of the present invention is simply connected in one column in the conventional programmable logic circuit. Then, the register connection is partially looped to perform specific arithmetic processing within the loop. With such a configuration, in the programmable logic circuit according to the present invention, the value of the input configuration data is changed by the above-described calculation. Therefore, a data string having a value different from the original configuration data is calculated by performing reverse calculation from the contents of the calculation processing. It is necessary to input (that is, a specific calculation process in the loop corresponds to decryption, and reverse calculation corresponds to encryption). That is, the programmable logic circuit of the present invention secures high confidentiality of configuration data by complicating the contents of the arithmetic processing without using a dedicated decoding circuit.

  Further, in the programmable logic circuit of the present invention, the contents of the arithmetic processing are kept secret, so that the original configuration data (for example, how the FPGA is programmed) can be seen even if the configuration data input by anyone other than the designer is seen. Information). Specific operation processing includes (1) XOR (or arithmetic addition) in a looping part, (2) bit rearrangement, and (3) XOR (or arithmetic addition) between a secret key and configuration data. I do. In addition, the process used as a basic calculation by a well-known encryption algorithm can be applied to these specific calculation processes.

  Hereinafter, some embodiments of a programmable logic circuit according to the present invention will be described in detail with reference to the drawings. In the drawings used in the embodiments, the same components are denoted by the same reference numerals, and redundant description is omitted as much as possible. In the embodiment described below, a case where a model of a programmable logic array is applied as a programmable logic circuit will be described as an example. In order to facilitate understanding of the present invention, the conventional programmable logic array which is the premise for configuring the programmable logic array of the present invention will be described in order.

(Embodiment 1)
FIG. 1 is a block diagram showing a model of a general programmable logic array that has been conventionally known. The programmable logic array of the present invention is based on the configuration diagram of FIG. In FIG. 1, a programmable logic array 1 has a configuration in which a large number of small arithmetic units called PE (Processing Element) 4 composed of a configuration circuit 2 and a programmable arithmetic unit 3 are arranged in an array. These arrayed PEs 4 are connected by an interconnect bus 5 so that data is transferred between the PEs 4. The configuration circuit 2 of each PE 4 is connected in series by a configuration chain 6, and its terminal is connected to an input pin 7 and an output pin 8.

  The programmable arithmetic unit 3 is a part that actually performs data processing, and the function of the programmable arithmetic unit 3 can be changed by a designer. The function can be set by the configuration circuit 2, and the details will be described later. That is, PE4 is also called a programmable logic element, and the function of PE4 is determined by the configuration data of the configuration circuit 2. The configuration chain 6 that connects the configuration circuits 2 in series has a function as a load circuit for loading configuration data.

  FIG. 2 is a configuration diagram showing in detail the connection between the configuration circuit 2 and the configuration chain 6 in FIG. In this figure, the interconnect bus is omitted. As shown in FIG. 2, the configuration circuits 2 are connected in series by a configuration chain 6 in a daisy chain (that is, in a daisy chain). Hereinafter, such a network is referred to as a configuration chain 6. Further, one end of the configuration chain 6 is connected to the input pin 7, and when data is continuously input from the input pin 7, the data passes through the configuration chain 6 and is stored in the configuration circuit 2. Distributed throughout the array. Hereinafter, data input from the input pin 7 of the configuration chain 6 is referred to as a configuration bit stream. Further, data that is held in each configuration circuit 2 and sets the programmable arithmetic unit 3 is referred to as configuration data.

  FIG. 3 is a diagram showing an internal configuration and configuration operation of the PE 4 configured around the ALU in the programmable logic array 1 shown in FIG. That is, FIG. 3 is a diagram for explaining the inside of the PE 4 in more detail and explaining the operation of the configuration circuit 2. The PE4 is known to have various configurations such as an ALU (Arithmetic Logic Unit) or a LUT (Look Up Table). However, any configuration is possible. There is no change in the basic configuration of having the functions of the calibration circuit 2 and the programmable arithmetic unit 3, and the specific configuration does not directly affect the present invention.

  In the example of FIG. 3, the inside of the PE configured around the ALU 13 and a part of the interconnect bus are illustrated. In the example of FIG. 3, the interconnect bus includes a data bus 11 and a switch circuit 12. The PE programmable arithmetic unit 3 includes an ALU 13 that performs arithmetic and logical operations, a switch circuit 14 that selects input data to the ALU 13, a register 15 that stores the operation results, and a selector 16 that determines output data from the PE. It is constituted by. The configuration circuit 2 includes a register 17 connected to the configuration chain 6, a decoder 18, and a configuration memory 19 that stores configuration data.

  In FIG. 3, the configuration circuit 2 operates as follows. Data (that is, a configuration bit stream) input via the configuration chain 6 is held in the register 17. In the next cycle, this data is transferred via the configuration chain 6 to the register 17 of the configuration circuit 2 in the PE of the next stage daisy chain. At the same time, the data (that is, the configuration bit stream) is input to the decoder 18 in its own PE.

  Then, the decoder 18 decodes the contents of the input data, and when it is determined that the PE is data to be used, the decoder 18 controls the configuration memory 19 to write the input data. The contents of the configuration memory 19 specify the function of the programmable arithmetic unit 3, that is, the instruction of the ALU 13, the connection information of the switch circuit 14, and the selection bit of the selector 16. Therefore, by rewriting the configuration memory 19, the functions of the ALU 13, the switch circuit 14, and the selector 16 in the programmable arithmetic unit 3 can be changed. The programmable logic array has hundreds to tens of thousands of PEs, and the bit width of the configuration chain 6 is 1 to 8 bits. Therefore, the above operation is repeated for several hundred to several tens of thousands of cycles until data is set in all the configuration memories 19.

  FIG. 4 is a diagram showing an internal configuration and configuration operation of a PE configured around the LUT in the programmable logic array 1 shown in FIG. That is, this figure shows a configuration example of a PE centered on a 4-input and 1-output LUT. Compared with the PE configured around the ALU 13 shown in FIG. 3, the PE configured around the LUT 21 shown in FIG. 4 is an interconnect bus composed of the data bus 11 and the switch circuit 12 and the components of the configuration circuit 2. Are the same. However, the programmable arithmetic unit 3 includes an LUT 21, an FF (Flip Flop) 22 including a 1-bit storage element, and a selector 23. Even in this configuration, the operation of the configuration circuit 2 is almost the same as that in FIG. Since the LUT 21 in the example of FIG. 4 itself has a memory, it is directly controlled by the configuration circuit 2 and the table value of the LUT 21 is written by the configuration data.

  FIG. 5 is a block diagram of an LSI showing an example of the prior art in which a decoding circuit is added to the circuit of the programmable logic array of FIG. That is, FIG. 5 shows the technology disclosed in the above-mentioned Patent Document 1, in which the encrypted configuration data is decrypted by the decryption circuit inside the LSI, and the FPGA is programmed to increase the confidentiality of the configuration data. The technology to ensure is applied to the circuit of the programmable logic array of FIG. That is, the LSI including the programmable logic array shown in FIG. 5 has a configuration in which the decryption circuit 31 and the secret key 32 are added to the circuit of the programmable logic array shown in FIG.

  The LSI technology including the programmable logic array shown in FIG. 5 encrypts and inputs a configuration bit stream, and decrypts the configuration data by the decryption circuit 31 inside the LSI using a secret key 32. Is to secure. As the encryption technology, a standardized general secret key (common key) encryption method such as AES (Advanced Encryption Standard) or DES (Data Encryption Standard) is used. One form to which this technology is applied is that a decryption circuit 31 for an encrypted bit stream, a non-volatile memory (not shown) that holds a secret key 32, and a programmable logic array as shown in FIG. Is realized.

  Advantages of this technique include that it is possible to use a generally known encryption method, so that the design assets of the decryption circuit 31 are abundant and configuration bitstream generation software can be easily created. Can be mentioned. On the other hand, disadvantages include an increase in the circuit scale due to the addition of the decoding circuit 31, and a limitation on the load speed of the configuration bit stream for the decoding process. In particular, with regard to processing time, for example, in a general decryption circuit of 3DES (Triple-DES) known as a scheme having higher encryption strength than DES, 48 cycles are required to process one block (64 bits). . Therefore, in order to perform high-speed configuration of 2 bits or more per cycle, it is necessary to perform parallel processing in the decoding circuit. For this reason, there is a risk of further increase in circuit scale.

  FIG. 6 is a circuit diagram showing an example of the prior art in which a secret key memory is added to the internal configuration of the PE configured around the ALU shown in FIG. That is, FIG. 6 is the technique disclosed in Patent Document 2 described above. In this technology, secret key information is stored in advance in the programmable logic, and configuration data is obtained by calculating an exclusive OR (XOR) between the loaded data and the secret key information. Yes, the PE circuit configuration of FIG. 6 is obtained by adding a secret key memory 24 to the PE circuit configuration of FIG. This technique is intended to protect configuration data by adding (exclusive OR) secret key data to configuration data.

  According to this technique, unless the secret key data stored in the secret key memory 24 is known, the programmable calculator 3 cannot be set to a desired function. Further, unless the secret key data stored in the secret key memory 24 is known, the function of the programmable arithmetic unit 3 cannot be specified from the configuration bit stream. Due to this property, the confidentiality of the configuration data can be ensured.

  The advantage of this technique is that it does not slow down the configuration. Further, a disadvantage is that the size of the secret key memory 24 is increased, resulting in an increase in circuit scale. Furthermore, there is a concern that the cryptographic processing is weak because the arithmetic processing is simple. That is, if a bit stream in which only a part of the configuration bit stream is changed is loaded one after another, there is a risk that the operation of the circuit is observed and the contents of the secret key memory are decrypted.

  Therefore, Embodiment 1 of the present invention realizes a technique for ensuring the secrecy of configuration data by performing specific arithmetic processing without using a dedicated decoding circuit. FIG. 7 is a configuration diagram of the programmable logic array in the present embodiment. Since the programmable logic array of FIG. 7 is drawn based on the configuration of the programmable logic array of FIG. 2, the interconnect bus is omitted.

  In FIG. 7, the programmable logic array 1a according to the first embodiment has a configuration in which PEs 4 including a configuration circuit 2 and a programmable arithmetic unit 3 are arranged in an array. These arrayed PE4s are connected by an interconnect bus (not shown), and data is exchanged with each PE4. The configuration circuit 2 of each PE 4 is connected in series in the form of a daisy chain by a configuration chain 6, and its terminal is connected to an input pin 7 and an output pin 8. Furthermore, the programmable logic array 1a of the first embodiment has a loop structure in which feedback circuits 40a, 40b, and 40c as indicated by broken lines are added to the configuration chain 6. The place where such feedback circuits 40a, 40b, and 40c are inserted is kept secret so that only the designer can know.

  According to such a configuration, since the value of the input configuration bit stream changes in the process of passing through the configuration chain 6, what happens when the target PE is reached among the PEs 4 arranged in an array. Only the designer knows what the value will be. In other words, the configuration bit stream to be input can be calculated backward from the configuration data in the target PE and the structure of the feedback circuits 40a, 40b, and 40c. Only the designer who knows the structure of the feedback circuit can know the actual circuit structure (configuration data) from this configuration bitstream. That is, since the input configuration bitstream data is fed back and stirred by the feedback circuits 40a, 40b, and 40c, there is no possibility that the data is decrypted by a third party, and as a result, the confidentiality of the data is ensured. Is done.

  According to the configuration of the programmable logic array 1a of the first embodiment as shown in FIG. 7, the confidentiality of the configuration data can be enhanced without increasing the load time of the configuration data. Further, since the circuit elements added by the first embodiment are only the wirings of the feedback circuits 40a, 40b, and 40c and a few arithmetic units, the circuit scale is slightly increased as compared with the conventional programmable logic array.

(Embodiment 2)
In the second embodiment, a circuit configuration of a programmable logic array is proposed in which the programmable logic array in the first embodiment is further improved. FIG. 8 is a configuration diagram of the programmable logic array in the present embodiment. Since the programmable logic array of FIG. 8 is drawn based on the configuration of the programmable logic array of FIG. 2, the interconnect bus is omitted.

  In the programmable logic array 1b of the second embodiment shown in FIG. 8, bit rearrangement circuits 41a, 41b,... 41n are inserted in the configuration chain 6 with respect to the configuration of the programmable logic array of FIG. The arrangement pattern of these bit rearrangement circuits 41a, 41b,... 41n can be kept secret except for the designer, thereby enhancing the confidentiality of the configuration data.

  FIG. 9 is a diagram showing an example of the bit rearrangement circuit in the programmable logic array 1b shown in FIG. In the example of the bit rearrangement circuit of FIG. 9, the address line and the data line of the configuration chain 6 are separated and each have a width of 4 bits. As shown in FIG. 9, the 4 bits of the address are not rearranged and are output in the order of the input bits. However, 4 bits of data are output in the order of [d′ 0, d′ 1, d′ 3, d′ 2] with respect to the input bit sequence of [d3, d2, d1, d0]. In this way, only the data is rearranged to facilitate rearrangement of configuration data while facilitating control. Further, by using the bit rearrangement circuit as shown in FIG. 8 together with the feedback circuit of the first embodiment shown in FIG. 7, the effect of mixing the data can be enhanced, so that higher secrecy is ensured. can do.

(Embodiment 3)
The third embodiment proposes a circuit configuration of a programmable logic array that can further improve the confidentiality of configuration data compared to the programmable logic array in the second embodiment. FIG. 10 is a configuration diagram of the programmable logic array in the present embodiment. Since the programmable logic array of FIG. 10 is drawn based on the configuration of the programmable logic array of FIG. 2, the interconnect bus is omitted.

  In the programmable logic array 1c of the third embodiment shown in FIG. 10, secret key memories 43a, 43b, 43c, 43d for storing secret key information, and a configuration chain 6 are added to the programmable logic array shown in FIG. Arithmetic circuits 44a, 44b, 44c, and 44d that perform operations on the data passing above and secret key information are added. According to such a configuration, the confidentiality of the configuration data can be ensured at a high level as long as the secret key information is not leaked.

  Further, the confidentiality can be further improved by combining the configuration of the programmable logic array 1c shown in FIG. 10 and the feedback circuit shown in FIG. At this time, if the agitation effect of the bit is enhanced by using another calculation in the feedback circuit portion and the portion to which the secret key is added, the concealment effect is further improved. For example, if the exclusive OR is used in the feedback circuit portion and the arithmetic sum (normal addition) is performed in the portion to which the secret key is added, the effect of confidentiality is further improved. Further, by inserting the bit rearrangement circuit shown in FIG. 8 into the configuration of the programmable logic array 1c shown in FIG. 10, the bit agitation effect can be obtained, so that the secrecy can be further improved. Of course, if the feedback circuit shown in FIG. 7 and the bit rearrangement circuit shown in FIG. 8 are used together and applied to the programmable logic array 1c shown in FIG. 10, further improvement in secrecy can be realized.

(Embodiment 4)
FIG. 11 is a configuration diagram of a programmable logic array according to the fourth embodiment of the present invention. Since the programmable logic array of FIG. 11 is drawn based on the configuration of the programmable logic array of FIG. 2, the interconnect bus is omitted. FIG. 11 shows a configuration example of the most desirable programmable logic array. That is, the programmable logic array 1d shown in FIG. 11 is a configuration diagram of the programmable logic array when the feedback circuit of FIG. 7, the bit rearrangement circuit of FIG. 8, and the secret key memory and the arithmetic circuit of FIG. It is.

  That is, in the programmable logic array 1d in the fourth embodiment shown in FIG. 11, the data rearranging circuit 41a, 41b,... 41n is inserted on the basis of the feedback circuits 40a, 40b, 40c, and the data agitation effect is enhanced. Furthermore, by adding a secret key realized by the secret key memories 43a, 43b, 43c, and 43d and the arithmetic circuits 44a, 44b, 44c, and 44d, it becomes more difficult to analyze configuration data by a malicious third party. Concealment can be further enhanced.

  In the fourth embodiment shown in FIG. 11, a method of using both bit rearrangement and secret key calculation is shown, but other general methods such as S-Box (table reference) and multiplication on a finite field are also used. It is also possible to insert a calculation method used in a known encryption method. However, even if any calculation method is inserted, the secrecy is not sufficient by itself. Therefore, the effect is enhanced by adding the feedback circuit proposed in Embodiment 1 in FIG. 7, and sufficient secrecy is achieved. Can be secured.

  That is, as shown in FIG. 11, the function of the PE 4 that is the programmable logic element is determined by the configuration data that passes through the configuration chain 6. At this time, the feedback of the feedback circuits 40a, 40b, and 40c surrounded by the broken line makes it difficult to analyze how the configuration data changes internally, so that the confidentiality of the configuration data is sufficiently high. Can be secured. Based on such a feedback loop structure, the effect of secrecy can be greatly enhanced by rearranging bits and using a secret key together. In the present invention, the meaning of preventing the conventional means of analyzing data one by one from the end of the configuration chain 6 by the feedback loop structure is significant.

(Embodiment 5)
In the fifth embodiment, a circuit configuration of a programmable logic array for easily manufacturing the programmable logic array in the first to fourth embodiments is proposed. FIG. 12 is a configuration diagram of the programmable logic array in the present embodiment. Since the programmable logic array of FIG. 12 is drawn based on the configuration of the programmable logic array of FIG. 7, the interconnect bus is omitted.

  In programmable logic array 1e of the fifth embodiment shown in FIG. 12, feedback circuits 45a, 45b,... 45n with switches are added to programmable logic array 1a of FIG. 7 instead of feedback circuits 40a, 40b, 40c. Yes. Here, the feedback circuits 45a, 45b,... 45n with switches include switches 46a, 46b,.

  The programmable logic array 1e has exactly the same function as the programmable logic array 1 of FIG. 2 when all the switches 46a, 46b,. The programmable logic array 1e has exactly the same function as the programmable logic array 1a of FIG. 7 when the three switches 46a, 46b, 46c are short-circuited and the other switches 46d, 46e,.

  That is, according to the circuit configuration of the programmable logic array of the present embodiment, the insertion position of the feedback circuit can be set even after the LSI is manufactured, and as a result, the LSI that is different for each user (configuration data designer) Therefore, programmable logic having a configuration data concealing function can be easily mass-produced.

  By the way, the opening / closing of the switches 46a, 46b,... 46n needs to be set in a safe manner so that a malicious third party cannot read the state of the switches 46a, 46b,. There is. Examples of the solution include the following.

  The first method is to store setting information of the switches 46a, 46b,... 46n in a nonvolatile memory. The designer of the FPGA internal circuit stores the switch setting information in a non-volatile memory, keeps the configuration bitstream confidential based on the switch setting information, and keeps the design information confidential. can do. Note that the switch setting information has a much smaller capacity than the setting information (that is, configuration data) of the programmable arithmetic unit, and has few opportunities to change the switch setting information. do not become.

  The second method is to make it possible to change the switches 46a, 46b,... 46n only once using a technique similar to that of the antifuse type FPGA. Also in this method, since the state of the switch can be known only by the designer, the secrecy of the configuration data can be ensured by the technique of the present invention.

  As described above, the fifth embodiment has proposed and described the technology that makes it possible to change the function for concealment even after the LSI is manufactured. Here, corresponding to the first embodiment, the feedback circuits 40a, 40b, and 40c are replaced with switchable feedback circuits 45a, 45b,. Showed how to set. Similarly, bit rearrangement circuits 41a, 41b,... 41n, secret key memories 43a, 43b, 43c, 43d, and arithmetic circuits 44a, 44b, 44c, 44d are programmable circuit elements corresponding to the second to fourth embodiments. Showed how to replace Thereby, the insertion position and function of these circuit elements can be changed after LSI manufacturing. In particular, the secret key memory 43a, 43b, 43c, 43d can be changed to a secret key by making it a writable non-volatile memory, so that it can be easily realized by the prior art, so that it can be said that the utility is high in application.

  As described above, the programmable logic circuit of the present invention can ensure the secrecy of configuration data only by adding simple elements to the conventional circuit. Can be used effectively.

Configuration diagram showing a model of a general programmable logic array known from the past Configuration diagram showing in detail the connection between the configuration circuit and the configuration chain in FIG. The figure which shows the internal structure and configuration operation | movement of PE comprised centering on ALU in the programmable logic array shown in FIG. The figure which shows the internal structure and configuration operation | movement of PE comprised centering on LUT in the programmable logic array shown in FIG. LSI configuration diagram showing an example of the prior art in which a decoding circuit is added to the programmable logic array circuit of FIG. FIG. 3 is a circuit diagram showing an example of a prior art in which a secret key memory is added to the internal configuration of a PE configured around the ALU shown in FIG. Configuration diagram of programmable logic array according to the first embodiment of the present invention Configuration diagram of programmable logic array in Embodiment 2 of the present invention The figure which shows an example of the bit rearrangement circuit in the programmable logic array shown in FIG. Configuration diagram of programmable logic array in Embodiment 3 of the present invention Configuration diagram of programmable logic array in Embodiment 4 of the present invention Configuration diagram of programmable logic array in Embodiment 5 of the present invention

Explanation of symbols

1, 1a, 1b, 1c, 1d, 1e Programmable logic array 2 Configuration circuit 3 Programmable arithmetic unit 4 PE (Processing Element)
5 Interconnect Bus 6 Configuration Chain 7 Input Pin 8 Output Pin 11 Data Bus 12, 14 Switch Circuit 13 ALU (Arithmetic Logic Unit)
15, 17 Register 16, 23 Selector 18 Decoder 19 Configuration memory 21 LUT (Look Up Table)
22 FF (Flip Flop)
24 secret key memory 31 decryption circuit 32 secret key 40a, 40b, 40c feedback circuit 41a, 41b,... 41n bit rearrangement circuit 43a, 43b, 43c, 43d secret key memory 44a, 44b, 44c, 44d arithmetic circuits 45a, 45b, 45c, ... 45n feedback circuit with switch 46a, 46b, 46c, ... 46n switch

Claims (5)

A programmable logic circuit that loads configuration data into each of the registers by shifting in the configuration data to each of the serially connected registers,
An arithmetic unit connected to a desired register among the registers,
A feedback circuit that feeds back the configuration data from the connection of another register to the computing unit;
A programmable logic circuit comprising: A programmable logic circuit that loads configuration data into each of the registers by shifting in the configuration data to each of the serially connected registers,
A programmable logic circuit comprising a bit rearrangement circuit connected to a desired one of the registers and rearranging the bits of the configuration data. A bit rearrangement circuit connected to a desired one of the registers and rearranging the bits of the configuration data;
2. The programmable logic circuit according to claim 1, wherein the bit rearrangement circuit is inserted into a part of a connection portion of a register that forms a loop by feedback of the configuration data. A programmable logic circuit that loads configuration data into each of the registers by shifting in the configuration data to each of the serially connected registers,
A storage element for storing secret key information;
A specific arithmetic unit that performs specific arithmetic processing between the configuration data passing through a connection portion of a desired register and the secret key information acquired from the storage element;
A programmable logic circuit comprising: A storage element for storing secret key information;
A specific arithmetic unit that performs specific arithmetic processing between configuration data passing through a connection portion of a desired register and secret key information acquired from the storage element;
4. The storage element and the specific arithmetic unit are inserted into a part of a connection portion of a register that forms a loop by feedback of the configuration data. Programmable logic circuit.

Images