Programmable logic device with improved security
View Patent ↗Techniques of the present invention impede power consumption measurements of an encryption engine on a logic device by running the encryption engine with an independent clock. This clock produces a signal that is decoupled from and asynchronous to clock signals feeding other circuits on the device. The clock feeding the encryption engine is not accessible externally to the device. Circuits may be employed to intentionally slow down or add jitter to one or more of the clock signals.
1. A programmable logic device comprising:
a plurality of logic elements driven by a first clock signal;
a decryption core configured to process encrypted input data and generate plaintext output data, the decryption core driven by a second clock signal, wherein the second clock signal is an internal asynchronous clock signal undetectable from outside the programmable logic device;
wherein the plaintext output data is generated to configure a plurality of logic blocks comprised of the plurality of logic elements on the programmable logic device, the plurality of logic blocks driven by the first clock signal.
2. The programmable logic device in accordance with claim 1 , further comprising
a first memory on the logic block to buffer input data to the encryption engine from the plurality of logic blocks; and
a second memory on the logic block to buffer output data from the encryption engine to the plurality of logic blocks.
3. The programmable logic device in accordance with claim 2 , wherein the encryption engine processes data from a source other than the first memory and discards the results if the first memory does not contain any input data.
4. The programmable logic device in accordance with claim 1 , wherein the first clock signal is provided by an external device.
5. The programmable logic device in accordance with claim 1 , further comprising circuitry to keep the second clock signal out of phase with the first clock signal.
6. The programmable logic device in accordance with claim 1 , further comprising circuitry to compare a plurality of clock signals and select the slowest signal in the plurality as the first clock signal.
7. The programmable logic device in accordance with claim 1 , further comprising a third clock signal asynchronous with the first and second clock signals, the third clock signal driving other logic components of the device.
8. The programmable logic device in accordance with claim 1 , further comprising a jitter component which induces jitter in the second clock signal.
9. A method for encrypting data on a programmable logic device, comprising:
driving a plurality of logic blocks on the device including output elements with a first clock signal;
generating a second clock signal decoupled from the first clock signal in a logic block on the device, wherein the second clock signal is an internal asynchronous clock signal undetectable from outside the programmable logic device; and
driving an encryption engine implemented on the logic block with the second clock signal, the encryption engine processing input data from the plurality of logic blocks and returning output data to the plurality of logic blocks.
10. The method in accordance with claim 9 , further comprising
buffering input data to the encryption engine from the plurality of logic blocks in a first memory on the logic block; and
buffering output data from the encryption engine to the plurality of logic blocks in a second memory on the logic block.
11. The method in accordance with claim 10 , wherein the encryption engine processes data from a source other than the first memory and discards the results if the first memory does not contain any input data.
12. The method in accordance with claim 9 , wherein the first clock signal is provided by an external device.
13. The method in accordance with claim 9 , further comprising keeping the second clock signal out of phase with the first clock signal.
14. The method in accordance with claim 9 , further comprising comparing a plurality of clock signals and selecting the slowest signal in the plurality as the first clock signal.
15. The method in accordance with claim 9 , further comprising generating a third clock signal asynchronous with the first and second clock signals, and driving other logic components of the device with the third clock signal.
16. The method in accordance with claim 9 , further comprising inducing jitter in the second clock signal.
17. A non-transitory computer readable storage medium comprising instructions for configuring a logic device to
drive a plurality of logic blocks on the device including output elements with a first clock signal;
generate a second clock signal decoupled from the first clock signal in a logic block on the device, wherein the second clock signal is an internal asynchronous clock signal undetectable from outside the programmable logic device; and
drive an encryption engine implemented on the logic block with the second clock signal, the encryption engine processing input data from the plurality of logic blocks and returning output data to the plurality of logic blocks.
18. The non-transitory computer readable storage medium in accordance with claim 17 wherein the instructions further configure the device to
buffer input data to the encryption engine from the plurality of logic blocks in a first memory on the logic block; and
buffer output data from the encryption engine to the plurality of logic blocks in a second memory on the logic block.
19. The non-transitory computer readable storage medium in accordance with claim 17 wherein the instructions further configure the device to keep the second clock signal out of phase with the first clock signal.
20. The non-transitory computer readable storage medium in accordance with claim 17 wherein the instructions further configure the device to compare a plurality of clock signals and select the slowest signal in the plurality as the first clock signal.