Secure remote reconfiguration of an FPGA-based embedded system

Abstract

This paper describes the protocol, architecture, and implementation details of an FPGA-based embedded system that is able to remotely reconfigure the FPGA, using a TCP/IP connection, in a secure way. When considering the security aspects, we imply data confidentiality, explicit key authentication and data origin authentication. Since these aspects are overhead for the main application, the system is to be as small as possible. Therefore we have focused on compactness rather than on speed for the implementation. The implemented solution exists out of 2 components: a communication part and a cryptographic part. The system can be easily integrated at any point in the design of an FPGA-based embedded system, due to the simple and modular architecture. 1 a bitstream is the datastream that describes the configuration of the FPGA and hence defines its operational behavior

A single-chip solution for the secure remote configuration of FPGAs using bitstream compression

“…With a relative usage of around 35%, Table I shows the cost of the static partition is high. The cryptocore is designed with a focus on area and is relatively small [8]. The additional resources used by the static partition are spent on the MicroBlaze with the accompanying bus and the remaining IP cores.…”

“…In [8], Braeken et al describe an on-line system handling incoming bitstreams, providing data confidentiality and authentication, and mutual explicit key authentication. Their work uses external flash memory to store the incoming bitstream, which means the FPGA goes off-line between configurations which could threaten the security.…”

Disposable configuration of remotely reconfigurable systems

“…However, the system proposed in [24] requires a complex control unit and configuring it also takes longer. Since this first work many propositions target static and partial secure reconfiguration [20][21][22][23]25,26]. Even recent FPGAs, such as Xilinx Virtex-6 and Virtex 7, propose security scheme for static and partial reconfiguration [27].…”

“…This key exchange must be secured using a cryptographic algorithm. One such solution would be to use a public key encryption algorithm such as RSA or ECC [25,26]. In general, implementation of public key algorithms is more expensive (as they often require processors and crypto-processors) and they are slower than symmetric key algorithms [9,14].…”

“…Few recent research works were focused on secure remote configuration [23,26,30,33]. However, our work is the first work that proposes both unicast and multicast secure remote configuration as it will be discussed in the following section.…”