WO2018006556A1 - 非易失性fpga片上数据流文件的保密系统及解密方法 - Google Patents

非易失性fpga片上数据流文件的保密系统及解密方法 Download PDF

Info

Publication number
WO2018006556A1
WO2018006556A1 PCT/CN2016/111406 CN2016111406W WO2018006556A1 WO 2018006556 A1 WO2018006556 A1 WO 2018006556A1 CN 2016111406 W CN2016111406 W CN 2016111406W WO 2018006556 A1 WO2018006556 A1 WO 2018006556A1
Authority
WO
WIPO (PCT)
Prior art keywords
module
user
volatile memory
programming
data
Prior art date
Application number
PCT/CN2016/111406
Other languages
English (en)
French (fr)
Inventor
高三达
朱璟辉
乔珀拉·蒂瓦卡
Original Assignee
广东高云半导体科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广东高云半导体科技股份有限公司 filed Critical 广东高云半导体科技股份有限公司
Publication of WO2018006556A1 publication Critical patent/WO2018006556A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0622—Securing storage systems in relation to access
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/76—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/0614—Improving the reliability of storage systems
    • G06F3/0619—Improving the reliability of storage systems in relation to data integrity, e.g. data losses, bit errors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0623—Securing storage systems in relation to content
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0629—Configuration or reconfiguration of storage systems
    • G06F3/0637—Permissions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0646—Horizontal data movement in storage systems, i.e. moving data in between storage devices or systems
    • G06F3/0652—Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0673—Single storage device
    • G06F3/0679—Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0683—Plurality of storage devices
    • G06F3/0688—Non-volatile semiconductor memory arrays

Definitions

  • the present invention relates to the field of integrated circuit data protection, and more particularly to a security system and a decryption method for a non-volatile FPGA on-chip data stream file.
  • FPAG A wafer is a wafer that can be used to input a desired control program after power-on. It is not a fixed circuit, but a wafer that can be changed as needed. Its function can be changed with the input data.
  • Volatile FPGAs typically use SRAM memory to store programming data stream files.
  • SRAM memory When the device is powered up, it is typically programmed by an external CPU or automatically loaded with programming data stream files from an external non-volatile memory. After the power is turned off, all loaded information will disappear.
  • the non-volatile FPGA has retained the programming data stream file in its own memory, and can enter the working state after power-on. After the power is turned off, all loaded information will be retained.
  • the FPGA is a general-purpose device, different users can design their own intellectual property on the FPGA and apply it in different fields.
  • the user's intellectual property is stored in the FPGA device as a data stream file, enabling the FPGA to generate the functionality that the user needs. If the illegal agent steals the data stream file from the FPGA, the same FPGA device can be purchased, and the stolen data stream file can be downloaded and programmed, so that the user system can be completely copied, and the intellectual property of the user can be produced.
  • Non-volatile memory data encryption problems have been around for a long time.
  • the data in the memory can be read out. Since the data is not lost after the power is turned off, this gives the criminals a chance to remove the device directly from the system board. Put it into your own lab to study the crack and read the data.
  • the existing reverse design technology can already find the security bit on the device. If it can be found and the security bit is destroyed, it is possible to make the memory readable. The data is read. What's more, when the safety bit design is only one bit, or the position of the safety bit is relatively concentrated, it is possible to erase the safety bit by simply erasing the security bit, and it is easy to crack the data.
  • the present invention provides a security system for a non-volatile FPGA on-chip data stream file that does not permit any operation other than full erasure without decrypting data.
  • a non-volatile FPGA on-chip data stream file security system comprising a user-defined programmable logic module, a non-volatile memory module, a programming control module, a programming I/O port, and a user I/O port; a user-defined programmable logic module, a non-volatile memory module, and a programming I/O port are all connected to the programming control module, and the user I/O port is connected to the user-defined programmable logic module; the non-volatile An encryption area unit is included in the memory module;
  • the non-volatile memory module allows only the full erase operation in the default state. After the full erase operation is completed, the non-volatile memory module enters the initial state, and only the non-volatile memory module in the initial state The operation is valid.
  • connection interface between the non-volatile memory module and the programming control module, and the programming control module can only perform read and write operations on the non-volatile memory module through the interface.
  • the user-defined programmable logic module includes an SRAM array that stores programming data sent by the programming control module and performs real-time control of the entire user-defined programmable logic module.
  • the user-defined programmable logic module includes a logic interface that receives user data of a user data unit acquired by the program control module from the non-volatile memory module.
  • the non-volatile memory module includes a plurality of programming logic data units, a plurality of user data units, and an encryption area unit; a connection of the programming logic data unit, the user data unit, and the encryption area unit through the non-volatile memory module
  • the interface is connected to the programming control module; the programming data is transferred to the programming logic data unit of the non-volatile memory module through the programming I/O port; the user data is user-defined programmable logic from the user I/O port
  • the logic interface of the module is sent to the programming control module and then sent to the user data unit of the non-volatile memory module via the programming control module.
  • a method for decrypting a security system of a non-volatile FPGA on-chip data stream file includes the following steps:
  • S2 the user inputs the decrypted data from the user I/O port and enters the programming control module through the user-defined programmable logic module, and the programming control module authenticates the decrypted data input by the user to determine the validity thereof;
  • the program control module sends the valid decrypted data to the encrypted area unit of the non-volatile memory module to decrypt the non-volatile memory module to complete the decryption operation.
  • the programming control module initializes the user data in the non-volatile memory module to the static memory module of the user.
  • the programming control module loads the programming data in the non-volatile memory module into the user-defined programmable logic module SRAM array.
  • the decrypted data can only be input when the non-volatile memory module is in an initial state.
  • the decrypted data includes dynamic data.
  • the non-volatile memory module of the present invention allows only a full erase operation, and the non-volatile memory module enters an initial state after the full erase operation is completed, and the operation of the non-volatile memory module is effective in the initial state. Further, the encryption area unit is set in the non-volatile memory module, and only the decrypted data written in the encryption area unit in the initial state can make the non-volatile memory module readable, thereby completing the decryption of the system, thus Greatly improved the accuracy of confidentiality.
  • Figure 1 is a structural view of the system of the present invention
  • a non-volatile FPGA on-chip data stream file security system includes a user-defined programmable logic module, a non-volatile memory module, a programming control module, a programming I/O port, and a user I. /O port; the user-defined programmable logic module, the non-volatile memory module and the programming I/O port are all connected with the programming control module, and the user I/O port is connected with the user-defined programmable logic module;
  • the non-volatile memory module includes an encryption area unit;
  • the non-volatile memory module allows only the full erase operation in the default state. After the full erase operation is completed, the non-volatile memory module enters the initial state, and only the non-volatile memory module in the initial state The operation is valid.
  • connection interface between the non-volatile memory module and the programming control module, and the programming control module can only read and write non-volatile memory modules through the interface.
  • the user-defined programmable logic module includes an SRAM array that stores programming data sent by the programming control module and performs real-time control of the entire user-defined programmable logic module.
  • the user-defined programmable logic module includes a logic interface that receives user data of a user data unit that the program control module retrieves from the non-volatile memory module.
  • the non-volatile memory module includes a plurality of programming logic data units, a plurality of user data units, and an encryption area unit; a programming logic data unit, a user data unit, and an encryption area unit through a non-volatile memory module connection interface and a programming control module Connection; programming data is transferred to the programming logic data unit of the non-volatile memory module through the programming I/O port through the programming control module; the user data is sent from the user I/O port via the logical interface of the user-defined programmable logic module To the programming control module, and then sent to the user data unit of the non-volatile memory module via the programming control module.
  • a method for decrypting a security system of a non-volatile FPGA on-chip data stream file includes the following steps:
  • S2 the user inputs the decrypted data from the user I/O port and enters the programming control module through the user-defined programmable logic module, and the programming control module authenticates the decrypted data input by the user to determine the validity thereof;
  • the program control module sends the valid decrypted data to the encrypted area unit of the non-volatile memory module to decrypt the non-volatile memory module to complete the decryption operation.
  • the programming control module initializes the user data in the non-volatile memory module to the static memory module of the user.
  • the programming control module loads the programming data in the non-volatile memory module into the user-defined programmable logic module SRAM array.
  • the decrypted data can only be input when the non-volatile memory module is in an initial state; the decrypted data includes dynamic data.
  • the non-volatile memory module of the present invention allows only a full erase operation, and the non-volatile memory module enters an initial state after the full erase operation is completed, and the operation of the non-volatile memory module is effective in the initial state. Further, the encryption area unit is set in the non-volatile memory module, and only the decrypted data written in the encryption area unit in the initial state can make the non-volatile memory module readable, thereby completing the decryption of the system, thus Greatly improved the accuracy of confidentiality.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)
  • Read Only Memory (AREA)

Abstract

一种非易失性FPGA片上数据流文件的保密系统及解密方法，系统配置非易失性的存储器模块只允许全擦写操作，全擦写操作完成后非易失性的存储器模块进入初始状态，初始状态下对非易失性的存储器模块的操作才有效，进而在非易失性的存储器模块中设置加密区域单元，只有在初始状态下写入加密区域单元的解密的数据才能使非易失性的存储器模块可读，从而完成对系统的解密，这样就大大提高了保密精度。

Description

非易失性FPGA片上数据流文件的保密系统及解密方法
技术领域
本发明涉及集成电路数据保护领域，更具体地，涉及一种非易失性FPGA片上数据流文件的保密系统及解密方法。
背景技术
集成电路的分类方法很多，按照功能可分为存储器（Memory），微处理器(CPU)，定制电路（ASICs）和可编程逻辑器件。可编程逻辑器件中有可分为SPLD，CPLD，FPGA。期中FPGA如今已成为主流。下面就以FPGA来称呼可编程逻辑器件。
FPAG 晶片是一种可以在上电之后再把需要的控制程式输入的晶片，它不是固定的电路，而是一种可以视需要而改变功能的晶片，它的功能可以随着输入的数据而改变。
PGA从存储编程数据的特性来讲分为易失性FPGA和非易失性FPGA两种。易失性FPGA通常采用SRAM存储器来存放编程数据流文件。在器件上电时，一般要由外部CPU编程，或者自动由外部的非易失性存储器中加载编程数据流文件。在掉电后，所有加载的信息会消失。而非易失性FPGA由于自身存储器中已保留编程数据流文件，上电后即可进如工作状态。在掉电后，所有加载的信息会保留。
由于FPGA是通用器件，不同用户可在FPGA上设计自己的知识产权，应用在不同的领域。用户的知识产权以数据流文件的形式存储在FPGA器件里，使FPGA产生用户所需要的功能。如果不法份子窃取到FPGA里的数据流文件，就可以购买同样FPGA器件，并将窃取来的数据流文件对其编程下载，这样就完全复制用户系统，可生产贩卖用户的知识产权。
易失性FPGA的数据流文件的编程下载是从外挂的非易失器件加载，或者依靠外部的中央处理器（CPU）加载。因此，骇客可以在外部通过对下载数据进行截取而获的用户的知识产权。非易失FPGA器件的数据流文件是在器件内部，相对易失性FPGA要安全，但是通过特殊方式，骇客也可能获得用户的知识产权。
非易失性存储器数据加密问题由来以久。存储器中的数据本来就是可以读出来的，由于此类存储器在掉电以后数据不遗失，这就给了不法分子可趁之机，将器件直接从系统电路板中拆除。放入自己的实验室中研究破解之道，将数据读出来。
为了解决存储器是可读的和对数据需要加密的矛盾，早在1982年，德州仪器公司（Texas Instruments Incorporated，Dallas，Texas）的Karl M. Guttag和Steve Nussrallah就提出了一种非易失性存储器数据加密的方法，通过增加一位数据用来做加密位（Security Bit）。当需要正常读写此存储器时，此位不设置（如为“0”）。当需要加密时，此位设置（如为“1”）。这时存储器电路会自动阻止任何读操作，而此时，唯一能将此为变回“0”并正常读写这个存储器的办法是将整个数据和此位一起擦除。这样，就达到了保护用户数据的目的。
到目前为止，所有数据流文件加密的方式都有一个共同点，那就是存储器在默认情况下是可读的。当数据需要加密时，通过设置一个或多个安全位来使数据不可读，成为加密状态。而如果存储器是可擦写的，就只有将安全位及数据全部擦掉以恢复为默认状态，从而达到了保密的目的。
随着破解技术的发展，已有的反向设计技术已经可以找到器件上的安全位。如能找到并对安全位进行破坏，就可能使存储器变为可读状态。对其中数据进行读取。更有甚者，当安全位设计只有一位，或者安全位的位置相对集中时，通过精确的定位擦除，就有可能刚好只擦掉安全位，轻而易举得破解了数据。
发明内容
本发明提供一种在没有解密数据的情况下，不准许除了全擦除的任何操作的高安全性的非易失性FPGA片上数据流文件的保密系统。
本发明的又一目的在于提供一种该保密系统的解密方法。
为了达到上述技术效果，本发明的技术方案如下：
一种非易失性FPGA片上数据流文件的保密系统，包括用户自定义可编程逻辑模块、非易失性的存储器模块，编程控制模块、编程I/O口和用户I/O口；所述用户自定义可编程逻辑模块、非易失性的存储器模块和编程I/O口均与编程控制模块连接，用户I/O口与用户自定义可编程逻辑模块连接；所述非易失性的存储器模块中包括加密区域单元；
非易失性的存储器模块在默认状态下，只允许全擦写操作，全擦写操作完成后非易失性的存储器模块进入初始状态，且只有初始状态下对非易失性的存储器模块的操作有效。
进一步地，所述非易失性的存储器模块与编程控制模块的连接接口只有一个，编程控制模块仅能通过该接口对非易失性的存储器模块进行读写操作。
进一步地，所述用户自定义可编程逻辑模块包括SRAM阵列，所述SRAM阵列存储编程控制模块发送过来的编程数据并对整个用户自定义可编程逻辑模块进行实时控制。
进一步地，所述用户自定义可编程逻辑模块包括逻辑接口，该逻辑接口接收编程控制模块从非易失性的存储器模块中获取的用户数据单元的用户数据。
进一步地，所述非易失性的存储器模块包括若干编程逻辑数据单元、若干用户数据单元以及加密区域单元；编程逻辑数据单元、用户数据单元和加密区域单元通过非易失性的存储器模块的连接接口与编程控制模块连接；编程数据通过编程I/O口经编程控制模块传送到非易失性的存储器模块的编程逻辑数据单元；用户的数据从用户I/O口经用户自定义可编程逻辑模块的逻辑接口发送到编程控制模块，再经编程控制模块发送到非易失性的存储器模块的用户数据单元。
一种非易失性FPGA片上数据流文件的保密系统的解密方法，包括以下步骤：
S1：给系统上电，对非易失性的存储器模块进行全擦写操作使其进入初始状态；
S2：用户从用户I/O口输入解密数据经用户自定义可编程逻辑模块进入编程控制模块，编程控制模块对用户输入的解密数据进行鉴别以判断其有效性；
S3：编程控制模块将有效的解密数据发送至对非易失性的存储器模块的加密区域单元进行解密使非易失性的存储器模块处于可读状态进而完成解密操作。
其中，系统解密后编程控制模块将非易失性的存储器模块中的用户数据初始化给用户的静态存储器模块。
其中，系统解密完成后编程控制模块将非易失性的存储器模块中的编程数据加载到用户自定义可编程逻辑模块SRAM阵列中。
其中，所述解密数据只能在非易失性的存储器模块处于初始状态才能输入。
其中所述解密数据包括动态的数据。
与现有技术相比，本发明技术方案的有益效果是：
本发明配置非易失性的存储器模块只允许全擦写操作，全擦写操作完成后非易失性的存储器模块进入初始状态，初始状态下对非易失性的存储器模块的操作才有效，进而在非易失性的存储器模块中设置加密区域单元，只有在初始状态下写入加密区域单元的解密的数据才能使非易失性的存储器模块可读，从而完成对系统的解密，这样就大大提高的了保密精度。
附图说明
图1为本发明系统的结构图；
图2为本发明方法的流程图。
具体实施方式
附图仅用于示例性说明，不能理解为对本专利的限制；
为了更好说明本实施例，附图某些部件会有省略、放大或缩小，并不代表实际产品的尺寸；
对于本领域技术人员来说，附图中某些公知结构及其说明可能省略是可以理解的。
下面结合附图和实施例对本发明的技术方案做进一步的说明。
实施例1
如图1所示，一种非易失性FPGA片上数据流文件的保密系统，包括用户自定义可编程逻辑模块、非易失性的存储器模块，编程控制模块、编程I/O口和用户I/O口；所述用户自定义可编程逻辑模块、非易失性的存储器模块和编程I/O口均与编程控制模块连接，用户I/O口与用户自定义可编程逻辑模块连接；所述非易失性的存储器模块中包括加密区域单元；
非易失性的存储器模块在默认状态下，只允许全擦写操作，全擦写操作完成后非易失性的存储器模块进入初始状态，且只有初始状态下对非易失性的存储器模块的操作有效。
非易失性的存储器模块与编程控制模块的连接接口只有一个，编程控制模块仅能通过该接口对非易失性的存储器模块进行读写操作。
用户自定义可编程逻辑模块包括SRAM阵列，所述SRAM阵列存储编程控制模块发送过来的编程数据并对整个用户自定义可编程逻辑模块进行实时控制。
用户自定义可编程逻辑模块包括逻辑接口，该逻辑接口接收编程控制模块从非易失性的存储器模块中获取的用户数据单元的用户数据。
非易失性的存储器模块包括若干编程逻辑数据单元、若干用户数据单元以及加密区域单元；编程逻辑数据单元、用户数据单元和加密区域单元通过非易失性的存储器模块的连接接口与编程控制模块连接；编程数据通过编程I/O口经编程控制模块传送到非易失性的存储器模块的编程逻辑数据单元；用户的数据从用户I/O口经用户自定义可编程逻辑模块的逻辑接口发送到编程控制模块，再经编程控制模块发送到非易失性的存储器模块的用户数据单元。
实施例2
如图2所示，一种非易失性FPGA片上数据流文件的保密系统的解密方法，包括以下步骤：
S1：给系统上电，对非易失性的存储器模块进行全擦写操作使其进入初始状态；
S2：用户从用户I/O口输入解密数据经用户自定义可编程逻辑模块进入编程控制模块，编程控制模块对用户输入的解密数据进行鉴别以判断其有效性；
S3：编程控制模块将有效的解密数据发送至对非易失性的存储器模块的加密区域单元进行解密使非易失性的存储器模块处于可读状态进而完成解密操作。
其中，系统解密后编程控制模块将非易失性的存储器模块中的用户数据初始化给用户的静态存储器模块。
其中，系统解密完成后编程控制模块将非易失性的存储器模块中的编程数据加载到用户自定义可编程逻辑模块SRAM阵列中。
其中，解密数据只能在非易失性的存储器模块处于初始状态才能输入；解密数据包括动态的数据。
本发明配置非易失性的存储器模块只允许全擦写操作，全擦写操作完成后非易失性的存储器模块进入初始状态，初始状态下对非易失性的存储器模块的操作才有效，进而在非易失性的存储器模块中设置加密区域单元，只有在初始状态下写入加密区域单元的解密的数据才能使非易失性的存储器模块可读，从而完成对系统的解密，这样就大大提高的了保密精度。
相同或相似的标号对应相同或相似的部件；
附图中描述位置关系的用于仅用于示例性说明，不能理解为对本专利的限制；
显然，本发明的上述实施例仅仅是为清楚地说明本发明所作的举例，而并非是对本发明的实施方式的限定。对于所属领域的普通技术人员来说，在上述说明的基础上还可以做出其它不同形式的变化或变动。这里无需也无法对所有的实施方式予以穷举。凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明权利要求的保护范围之内

Claims (10)

  1. 一种非易失性FPGA片上数据流文件的保密系统，其特征在于，包括用户自定义 可编程逻辑 模块、 非易失性的存储器 模块，编程控制模块、编程I/O口和用户I/O口；所述用户自定义 可编程逻辑 模块、 非易失性的存储器 模块和编程I/O口均与编程控制模块连接，用户I/O口与用户自定义 可编程逻辑 模块连接；所述 非易失性的存储器 模块中包括加密区域单元；
    非易失性的存储器 模块在默认状态下，只允许全擦写操作，全擦写操作完成后 非易失性的存储器 模块进入初始状态，且只有初始状态下对 非易失性的存储器 模块的操作有效。
  2. 根据权利要求1所述的非易失性FPGA片上数据流文件的保密系统，其特征在于，所述 非易失性的存储器 模块与编程控制模块的连接接口只有一个，编程控制模块仅能通过该接口对 非易失性的存储器 模块进行读写操作。
  3. 根据权利要求2所述的非易失性FPGA片上数据流文件的保密系统，其特征在于，所述用户自定义 可编程逻辑 模块包括 SRAM阵列 ，所述 SRAM阵列存储 编程控制模块发送过来的 编程数据 ， 并对 整个用户自定义 可编程逻辑 模块 进行实时控制 。
  4. 根据权利要求3所述的非易失性FPGA片上数据流文件的保密系统，其特征在于，所述用户自定义 可编程逻辑 模块包括逻辑接口，该逻辑接口接收编程控制模块从 非易失性的存储器 模块中获取的 用户数据 单元的用户数据。
  5. 根据权利要求4所述的非易失性FPGA片上数据流文件的保密系统，其特征在于，所述 非易失性的存储器 模块包括若干 编程逻辑数据 单元、若干 用户数据 单元以及加密区域单元； 编程逻辑数据 单元、 用户数据 单元和加密区域单元通过 非易失性的存储器 模块的连接接口与编程控制模块连接；编程数据通过编程I/O口经编程控制模块传送到 非易失性的存储器 模块的 编程逻辑数据 单元；用户的数据从用户I/O口经用户自定义 可编程逻辑 模块的逻辑接口发送到编程控制模块，再经编程控制模块发送到 非易失性的存储器 模块的 用户数据 单元。
  6. 一种对权利要求5所述的非易失性FPGA片上数据流文件的保密系统的解密方法，其特征在于，包括以下步骤：
    S1：给系统上电，对 非易失性的存储器 模块进行全擦写操作使其进入初始状态；
    S2：用户从用户I/O口输入解密数据经用户自定义 可编程逻辑 模块进入编程控制模块，编程控制模块对用户输入的解密数据进行鉴别以判断其有效性；
    S3：编程控制模块将有效的解密数据发送至对 非易失性的存储器 模块的加密区域单元进行解密使 非易失性的存储器 模块处于可读状态进而完成解密操作。
  7. 根据权利要求6所述的非易失性FPGA片上数据流文件的保密系统的解密方法，其特征在于，系统解密后编程控制模块将 非易失性的存储器 模块中 的用户数据初始化给用户 的 静态存储器模块 。
  8. 根据权利要求6所述的非易失性FPGA片上数据流文件的保密系统的解密方法，其特征在于，系统解密完成后编程控制模块将 非易失性的存储器 模块中 的编程数据加载 到用户自定义 可编程逻辑 模块 SRAM阵列 中。
  9. 根据权利要求6所述的非易失性FPGA片上数据流文件的保密系统的解密方法，其特征在于，所述解密数据只能在 非易失性的存储器 模块处于初始状态才能输入。
  10. 根据权利要求6所述的非易失性FPGA片上数据流文件的保密系统的解密方法，其特征在于，所述解密数据包括动态的数据。
PCT/CN2016/111406 2016-07-07 2016-12-22 非易失性fpga片上数据流文件的保密系统及解密方法 WO2018006556A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610534391.4 2016-07-07
CN201610534391.4A CN106201352B (zh) 2016-07-07 2016-07-07 非易失性fpga片上数据流文件的保密系统及解密方法

Publications (1)

Publication Number Publication Date
WO2018006556A1 true WO2018006556A1 (zh) 2018-01-11

Family

ID=57473925

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/111406 WO2018006556A1 (zh) 2016-07-07 2016-12-22 非易失性fpga片上数据流文件的保密系统及解密方法

Country Status (3)

Country Link
US (1) US10997088B2 (zh)
CN (1) CN106201352B (zh)
WO (1) WO2018006556A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106201352B (zh) * 2016-07-07 2019-11-29 广东高云半导体科技股份有限公司 非易失性fpga片上数据流文件的保密系统及解密方法
CN106933752B (zh) * 2017-03-09 2019-10-08 西安电子科技大学 一种sram型fpga的加密装置及方法
CN107885694B (zh) * 2017-10-18 2018-10-23 广东高云半导体科技股份有限公司 一种支持系统级集成电路芯片
CN108830114B (zh) * 2018-05-23 2020-07-07 广东高云半导体科技股份有限公司 非易失性存储器的数据处理方法与装置、存储介质
CN111506519B (zh) * 2020-04-22 2021-04-27 上海安路信息科技股份有限公司 为fpga码点分配sram单元的方法及系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444799A (zh) * 2000-07-28 2003-09-24 爱特梅尔股份有限公司 加密可编程逻辑器件
CN102053926A (zh) * 2009-10-30 2011-05-11 鸿富锦精密工业（深圳）有限公司 存储装置及其数据安全管控方法
US20120216001A1 (en) * 2011-02-22 2012-08-23 Noor Hazlina Ramly Integrated circuit with tamper-detection and self-erase mechanisms
US20130159725A1 (en) * 2011-12-14 2013-06-20 Electronics And Telecommunications Research Institute Fpga apparatus and method for protecting bitstream
CN103413097A (zh) * 2013-07-15 2013-11-27 北京华大信安科技有限公司 加密方法、装置及安全芯片
CN104716954A (zh) * 2015-03-17 2015-06-17 广东高云半导体科技股份有限公司 带有片上用户非易失性存储器的可编程逻辑器件
CN106201352A (zh) * 2016-07-07 2016-12-07 广东高云半导体科技股份有限公司 非易失性fpga片上数据流文件的保密系统及解密方法

Family Cites Families (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4521852A (en) * 1982-06-30 1985-06-04 Texas Instruments Incorporated Data processing device formed on a single semiconductor substrate having secure memory
JP3310060B2 (ja) * 1993-09-13 2002-07-29 株式会社東芝 記憶装置および同装置の制御プログラム書換え方法
US5845313A (en) * 1995-07-31 1998-12-01 Lexar Direct logical block addressing flash memory mass storage architecture
US5892712A (en) * 1996-05-01 1999-04-06 Nvx Corporation Semiconductor non-volatile latch device including embedded non-volatile elements
US6522694B1 (en) * 1998-10-09 2003-02-18 Matsushita Electric Industrial Co., Ltd. Programmable filter for removing stuffing bits from an MPEG-2 bit-stream
US7162644B1 (en) * 2002-03-29 2007-01-09 Xilinx, Inc. Methods and circuits for protecting proprietary configuration data for programmable logic devices
US7878902B2 (en) * 2003-07-16 2011-02-01 Igt Secured verification of configuration data for field programmable gate array devices
US7190190B1 (en) * 2004-01-09 2007-03-13 Altera Corporation Programmable logic device with on-chip nonvolatile user memory
US8112618B2 (en) * 2004-04-08 2012-02-07 Texas Instruments Incorporated Less-secure processors, integrated circuits, wireless communications apparatus, methods and processes of making
WO2005121924A2 (en) * 2004-06-09 2005-12-22 Koninklijke Philips Electronics N.V. Architectures for privacy protection of biometric templates
US20060059369A1 (en) * 2004-09-10 2006-03-16 International Business Machines Corporation Circuit chip for cryptographic processing having a secure interface to an external memory
US20060059373A1 (en) * 2004-09-10 2006-03-16 International Business Machines Corporation Integrated circuit chip for encryption and decryption using instructions supplied through a secure interface
US7368935B2 (en) * 2005-10-18 2008-05-06 Honeywell International Inc. Tamper response system for integrated circuits
US7856546B2 (en) * 2006-07-28 2010-12-21 Drc Computer Corporation Configurable processor module accelerator using a programmable logic device
WO2008070812A2 (en) * 2006-12-06 2008-06-12 Fusion Multisystems, Inc. (Dba Fusion-Io) Apparatus, system, and method for data storage using progressive raid
JP4392672B2 (ja) * 2007-08-01 2010-01-06 Ｎｅｃシステムテクノロジー株式会社 ソフトウェア無線通信装置、及びソフトウェア更新方法、並びに、ソフトウェア無線通信システム
US20110215829A1 (en) * 2007-08-22 2011-09-08 Intrinsic Id B.V. Identification of devices using physically unclonable functions
US20090125726A1 (en) * 2007-11-14 2009-05-14 Mcm Portfolio Llc Method and Apparatus of Providing the Security and Error Correction Capability for Memory Storage Devices
CN201142071Y (zh) * 2007-12-04 2008-10-29 上海海尔集成电路有限公司 8位闪存微控制器
US7683660B1 (en) * 2008-01-31 2010-03-23 Actel Corporation Programmable logic device with a microcontroller-based control system
US8037380B2 (en) * 2008-07-08 2011-10-11 International Business Machines Corporation Verifying data integrity of a non-volatile memory system during data caching process
US9003118B2 (en) * 2009-01-09 2015-04-07 Dell Products L.P. Systems and methods for non-volatile cache control
JP5552541B2 (ja) * 2009-12-04 2014-07-16 クリプトグラフィ リサーチ， インコーポレイテッド 検証可能な耐漏洩性暗号化および復号化
CN101835146A (zh) * 2010-04-12 2010-09-15 东南大学 第三代移动网络手机语音端到端加密装置及方法
US20110302329A1 (en) * 2010-06-03 2011-12-08 Asad Azam Embedded Programmable Module for Host Controller Configurability
CN102651686A (zh) * 2011-02-23 2012-08-29 上海华虹集成电路有限责任公司 单片机在线可编程的身份认证方法
US8909979B2 (en) * 2011-06-27 2014-12-09 Huawei Technologies Co., Ltd. Method and system for implementing interconnection fault tolerance between CPU
US8671241B2 (en) * 2011-09-13 2014-03-11 Dell Products Lp Systems and methods for using reserved solid state nonvolatile memory storage capacity for system reduced power state
US10318158B2 (en) * 2012-05-17 2019-06-11 Brilliant Points, Inc. System and method for digital signaling and digital storage
WO2014138626A1 (en) * 2013-03-08 2014-09-12 Robert Bosch Gmbh Systems and methods for maintaining integrity and secrecy in untrusted computing platforms
US8918778B2 (en) * 2013-04-17 2014-12-23 American Megatrends, Inc. Method of fail safe flashing management device and application of the same
WO2014178814A2 (en) * 2013-04-29 2014-11-06 Hewlett-Packard Development Company, L.P. Non-volatile memory to store resettable data
JP6032360B2 (ja) * 2013-06-12 2016-11-24 日本電気株式会社 コンフィグレーション制御システム及びコンフィグレーション制御方法
US10073627B2 (en) * 2015-01-13 2018-09-11 Sandisk Technologies Llc Addressing, interleave, wear leveling, and initialization schemes for different chip enables and memory arrays of different types
US10341311B2 (en) * 2015-07-20 2019-07-02 Schweitzer Engineering Laboratories, Inc. Communication device for implementing selective encryption in a software defined network
US10305869B2 (en) * 2016-01-20 2019-05-28 Medicom Technologies, Inc. Methods and systems for transferring secure data and facilitating new client acquisitions
US9940483B2 (en) * 2016-01-25 2018-04-10 Raytheon Company Firmware security interface for field programmable gate arrays
US10725677B2 (en) * 2016-02-19 2020-07-28 Sandisk Technologies Llc Systems and methods for efficient power state transitions

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444799A (zh) * 2000-07-28 2003-09-24 爱特梅尔股份有限公司 加密可编程逻辑器件
CN102053926A (zh) * 2009-10-30 2011-05-11 鸿富锦精密工业（深圳）有限公司 存储装置及其数据安全管控方法
US20120216001A1 (en) * 2011-02-22 2012-08-23 Noor Hazlina Ramly Integrated circuit with tamper-detection and self-erase mechanisms
US20130159725A1 (en) * 2011-12-14 2013-06-20 Electronics And Telecommunications Research Institute Fpga apparatus and method for protecting bitstream
CN103413097A (zh) * 2013-07-15 2013-11-27 北京华大信安科技有限公司 加密方法、装置及安全芯片
CN104716954A (zh) * 2015-03-17 2015-06-17 广东高云半导体科技股份有限公司 带有片上用户非易失性存储器的可编程逻辑器件
CN106201352A (zh) * 2016-07-07 2016-12-07 广东高云半导体科技股份有限公司 非易失性fpga片上数据流文件的保密系统及解密方法

Also Published As

Publication number Publication date
CN106201352A (zh) 2016-12-07
CN106201352B (zh) 2019-11-29
US20180011803A1 (en) 2018-01-11
US10997088B2 (en) 2021-05-04

Similar Documents

Publication Publication Date Title
WO2018006556A1 (zh) 非易失性fpga片上数据流文件的保密系统及解密方法
US11809584B2 (en) File system metadata protection
US7849514B2 (en) Transparent encryption and access control for mass-storage devices
US7814337B2 (en) Secure flash-memory card reader with host-encrypted data on a flash-controller-mastered bus parallel to a local CPU bus carrying encrypted hashed password and user ID
US9251380B1 (en) Method and storage device for isolating and preventing access to processor and memory used in decryption of text
US7581118B2 (en) Disk sanitization using encryption
CN110618947A (zh) 用于利用存储器加密引擎的安全i/o的技术
KR20090080115A (ko) 외부 비휘발성 메모리에 저장된 정보의 암호화를 위한 방법 및 시스템
TW200405164A (en) Semiconductor device including encryption section, semiconductor device including external interface, and content reproduction method
TW200830830A (en) Hard disc streaming cryptographic operations with embedded authentication
WO2018227518A1 (en) Reconfigurable device bitstream key authentication
US11575505B2 (en) Systems, methods, and devices for key per input/output security
WO2017105768A1 (en) Technologies for protecting audio data with trusted i/o
CN113544653A (zh) 加密的群编程
WO2017138797A1 (ko) 시큐어 시스템 온 칩
KR101043255B1 (ko) Ｕｓｂ 허브 보안 장치 및 이를 이용한 데이터 보안 방법
TWI789291B (zh) 用於認證在儲存裝置和主機裝置之間的資料傳輸之模組和方法
US9780949B2 (en) Data processing device and method for protecting a data processing device against tampering
WO2020138646A1 (ko) 보안 기능이 없는 usb 메모리를 위한 보안 usb 동글
TW201433132A (zh) 機敏資料加密演算儲存裝置
JPH04182885A (ja) 機密保護機能付きｉｃカード
JP2022531538A (ja) 暗号システム
JPH05233460A (ja) ファイル保護方式
US20230208821A1 (en) Method and device for protecting and managing keys
Paul et al. The Blockchain Based Auditor on Secret key Life Cycle in Reconfigurable Platform

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16908060

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 05.06.2019)

122 Ep: pct application non-entry in european phase

Ref document number: 16908060

Country of ref document: EP

Kind code of ref document: A1