Signature based authentication of the configuration of a configurable logic component
View Patent ↗A configurable logic component is shown with a signature generator, responsive to a commanded configuration information signal from a processor, for providing a signed commanded configuration information signal, and with a memory device, responsive to the signed commanded configuration information signal from the signature generator, for storing the signed commanded configuration information signal in the configurable logic component for use by the processor in checking a current configuration of the configurable logic component against a trusted signed configuration file to ensure the current configuration matches the commanded configuration and allowing use of the configurable logic component in case of a match.
1. A method, comprising:
determining to pass by an apparatus, to a configurable logic component, a configuration command signal, wherein the configuration command signal configures said configurable logic component into a commanded configuration;
generating by the apparatus, via a signature generator, a signature of the configuration command signal;
storing by the apparatus, in a last reconfiguration register, said generated configuration command signal signature;
updating by the apparatus via a signature generator, in accordance with the configuration command signal, a historical signature, wherein the historical signature is based on all configuration command signals passed by the apparatus to the configurable logic component since a most recent power-up, and wherein the historical signature is stored in a reconfiguration history register;
performing one or more of:
checking for match between:
a last reconfiguration value record, stored in a non-transitory memory outside the configurable logic component, and
a generated configuration command signal signature stored in the last reconfiguration register; and
checking for match between:
a reconfiguration history value record stored in the non-transitory memory outside the configurable logic component, and
a historical signature stored in the reconfiguration history register; and
allowing by the apparatus, where the one or more performed checks yield match, continued operation of said configurable logic component.
2. The method of claim 1 , wherein one or more of said registers is write-restricted.
3. The method of claim 1 , wherein one or more of said generating the signature of the configuration command signal and said updating of the historical signature employs hash function.
4. The method of claim 1 , wherein the last configuration value record in the non-transitory memory outside the configurable logic component is one of stored in the non-transitory memory at a time of manufacture, calculated by at least one processor outside the configurable logic component, and stored in the non-transitory memory following said passing of the configuration command signal to the configurable logic component.
5. The method of claim 1 , wherein said checks are performed with said passing of the configuration command signal or in accordance with a timer.
6. An apparatus, comprising:
at least one processor; and
at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to:
determine to pass by the apparatus, to a configurable logic component, a configuration command signal, wherein the configuration command signal configures said configurable logic component into a commanded configuration;
generate by the apparatus, via a signature generator, a signature of the configuration command signal;
store by the apparatus, in a last reconfiguration register, said generated configuration command signal signature;
update by the apparatus via a signature generator, in accordance with the configuration command signal, a historical signature, wherein the historical signature is based on all configuration command signals passed by the apparatus to the configurable logic component since a most recent power-up, and wherein the historical signature is stored in a reconfiguration history register;
perform one or more of:
check for match between:
a last reconfiguration value record, stored in a non-transitory memory outside the configurable logic component, and
a generated configuration command signal signature stored in the last reconfiguration register; and
check for match between:
a reconfiguration history value record stored in the non-transitory memory outside the configurable logic component, and
a historical signature stored in the reconfiguration history register; and
allow by the apparatus, where the one or more performed checks yield match, continued operation of said configurable logic component.
7. The apparatus of claim 6 , wherein one or more of said registers is write-restricted.
8. The apparatus of claim 6 , wherein one or more of said generating the signature of the configuration command signal and said updating of the historical signature employs hash function.
9. The apparatus of claim 6 , wherein the last configuration value record in the non-transitory memory outside the configurable logic component is one of stored in the non-transitory memory at a time of manufacture, calculated by the at least one processor outside the configurable logic component, and stored in the non-transitory memory following said passing of the configuration command signal to the configurable logic component.
10. The apparatus of claim 6 , wherein said checks are performed with said passing of the configuration command signal or in accordance with a timer.
11. An apparatus, comprising:
a configurable logic component, wherein the configurable logic component comprises:
at least one signature generator;
a last reconfiguration register; and
a reconfiguration history register;
at least one processor outside the configurable logic component; and
a non-transitory memory outside the configurable logic component,
wherein the at least one processor is configured to determine to pass to the configurable logic component a configuration command signal, wherein the configuration command signal configures said configurable logic component into a command configuration,
wherein the at least one signature generator is configured to generate a signature of the configuration command signal,
wherein the last reconfiguration register is configured to store said generated configuration command signal signature,
wherein said at least one signature generator is configured to update, in accordance with the configuration command signal, a historical signature, wherein the historical signature is based on all configuration command signals passed by the at least one processor to the configurable logic component since a most recent power-up, and wherein the historical signature is stored in the reconfiguration history register,
wherein the at least one processor is configured to perform one or more of:
checking for match between:
a last reconfiguration value record stored in the non-transitory memory outside the configurable logic component, and
a generated configuration command signal signature stored in the last configuration register, and
checking for match between:
a reconfiguration history value record stored in the non-transitory memory outside the configurable logic component, and
a historical signature stored in the reconfiguration history register, and
wherein the at least one processor is configured to allow, where the one or more performed checks yield match, continued operation of the configurable logic component.
12. The apparatus of claim 11 , wherein one or more of said registers is write-restricted.
13. The apparatus of claim 11 , wherein one or more of said generating the signature of the configuration command signal and said updating of the historical signature employs hash function.
14. The apparatus of claim 11 , wherein the last configuration value record in the non-transitory memory outside the configurable logic component is one of stored in the non-transitory memory at a time of manufacture, calculated by the at least one processor outside the configurable logic component, and stored in the non-transitory memory following said passing of the configuration command signal to the configurable logic component.
15. A programmable logic component, comprising:
at least one signature generator;
a last reconfiguration register; and
a reconfiguration history register,
wherein the programmable logic component receives a configuration command signal, wherein the configuration command signal configures said programmable logic component into a command configuration,
wherein the at least one signature generator is configured to generate a signature of the configuration command signal,
wherein the last reconfiguration register is configured to store said generated configuration command signal signature,
wherein said at least one signature generator is configured to update, in accordance with the configuration command signal, a historical signature, wherein the historical signature is based on all configuration command signals received at the programmable logic component since a most recent power-up, and wherein the historical signature is stored in the reconfiguration history register, and
wherein the programmable logic component is allowed to continue operation where one or more of:
performed check yields match between:
a generated configuration command signal signature stored in the last reconfiguration register, and
a non-transitory memory-stored last reconfiguration value record; and performed check yields match between:
a historical signature stored in the reconfiguration history register, and a non-transitory memory-stored reconfiguration history value record.
16. An apparatus, comprising:
at least one outside-configurable-logic-component processor; and
an outside-configurable-logic-component non-transitory memory,
wherein the at least one processor is configured to determine to pass a configurable logic component configuration command signal, wherein said configuration command signal causes configuration into a commanded configuration, wherein there is a configurable logic component last configuration register-stored generated signature of said configuration command signal, and wherein there is a configurable logic component reconfiguration history register-stored updated historical signature which is in accordance with said configuration command signal, wherein said historical signature is based on all configuration command signals passed by the apparatus since a most recent power-up,
wherein the at least one processor is configured to perform one or more of:
checking for match between:
a last reconfiguration value record stored in the non-transitory memory, and
a configurable logic component last configuration register-stored configuration command signal signature, and
checking for match between:
a reconfiguration history value record stored in the non-transitory memory, and
a configurable logic component reconfiguration history register-stored historical signature, and
wherein the at least one processor is configured to allow, where the one or more performed checks yield match, continued configurable logic component operation.