Reconfigurable device bitstream key authentication

1. An electronic processing system, comprising:

a processor;

persistent storage media communicatively coupled to the processor;

a reconfigurable device communicatively coupled to the processor over a physically isolated trusted communication channel;

a secure provisioner communicatively coupled to the processor and the reconfigurable device to provision a secure storage area and to securely store a remotely generated bitstream security key in the provisioned secure storage area, wherein the secure provisioner is further to:

partition an enclave for the secure storage area;

associate an enclave identifier with the enclave; and

provide the enclave identifier to the reconfigurable device over the physically isolated trusted communication channel; and

a device configurer to configure the reconfigurable device with a remotely generated bitstream and the remotely generated bitstream security key, wherein the remotely generated bitstream is to be encoded with the enclave identifier and encrypted with the remotely generated bitstream security key, wherein the remotely generated bitstream and the remotely generated bitstream security key are obtained by the secure provisioner via a secure communication channel and provided over the physical isolated trusted communication channel to configure the reconfigurable device.

2. The system of claim 1 , further comprising a source system to:

establish the secure communication channel between the source system and the secure provisioner;

remotely generate a bitstream security key at the source system for the remotely generated bitstream security key; and

provide the remotely generated bitstream security key to the secure provisioner over the secure communication channel.

3. A configurable apparatus, comprising:

a configurable device;

a secure provisioner communicatively coupled to the configurable device to provision a secure storage area and to securely store a remotely generated bitstream security key in the provisioned secure storage area;

a secure communicator communicatively coupled to the configurable device and the secure provisioner to establish a physically isolated trusted communication path between the provisioned secure storage area and the configurable device, wherein the secure provisioner is further to:

partition an enclave for the secure storage area;

associate an enclave identifier with the enclave; and

provide the enclave identifier to the reconfigurable device over the physically isolated trusted communication path; and

a device configurer communicatively coupled to the configurable device to configure the configurable device with a remotely generated bitstream and the remotely generated bitstream security key, wherein the remotely generated bitstream is to be encoded with the enclave identifier and encrypted with the remotely generated bitstream security key, wherein the remotely generated bitstream and the remotely generated bitstream security key are obtained by the secure provisioner via a secure communication channel and provided over the physical isolated trusted communication path to configure the configurable device.

4. The apparatus of claim 3 , further including a source system to:

establish the secure communication channel between the source system and the secure provisioner;

remotely generate a bitstream security key at the source system for the remotely generated bitstream security key; and

provide the remotely generated bitstream security key to the secure provisioner over the secure communication channel.

5. The apparatus of claim 4 , wherein the source system further comprises:

a bitstream encoder to remotely encode the bitstream with the enclave identifier at the source system; and

a bitstream encrypter to remotely encrypt the bitstream with the bitstream security key at the source system.

6. The apparatus of claim 3 , wherein the configurable device comprises a reconfigurable device.

7. The apparatus of claim 6 , wherein the reconfigurable device comprises a field programmable gate array device.

8. A method of configuring a device, comprising:

provisioning a secure storage area;

securely storing a remotely generated bitstream security key in the provisioned secure storage area;

establishing a physically isolated trusted communication path between the provisioned secure storage area and a configurable device, including:

partitioning an enclave for the secure storage area;

associating an enclave identifier with the enclave; and

providing the enclave identifier to the configurable device over the physically isolated trusted communication path; and

configuring the configurable device with a remotely generated bitstream and the remotely generated bitstream security key, wherein the remotely generated bitstream is to be encoded with the enclave identifier and encrypted with the remotely generated bitstream security key, wherein the remotely generated bitstream and the remotely generated bitstream security key are obtained by the provisioned secure storage area via a secure communication channel and provided over the physical isolated trusted communication path to configure the configurable device.

9. The method of claim 8 , further comprising:

establishing the secure communication channel between a source system and the provisioned secure storage area;

remotely generating a bitstream security key at the source system for the remotely generated bitstream security key; and

providing the remotely generated bitstream security key to the provisioned secure storage area over the secure communication channel.

10. The method of claim 9 , further comprising: remotely encoding the bitstream with the enclave identifier at the source system; and

remotely encrypting the bitstream with the bitstream security key at the source system.

11. The method of claim 8 , wherein the configurable device comprises a reconfigurable device.

12. The method of claim 11 , wherein the reconfigurable device comprises a field programmable gate array device.

13. At least one non-transitory computer readable medium, comprising a set of instructions, which when executed by a computing device cause the computing device to:

provision a secure storage area;

securely store a remotely generated bitstream security key in the provisioned secure storage area;

establish a physically isolated trusted communication path between the provisioned secure storage area and a configurable device, including:

partition an enclave for the secure storage area;

associate an enclave identifier with the enclave; and

provide the enclave identifier to the configurable device over the physically isolated trusted communication path; and

configure the configurable device with a remotely generated bitstream and the remotely generated bitstream security key, wherein the remotely generated bitstream is to be encoded with the enclave identifier and encrypted with the remotely generated bitstream security key, wherein the remotely generated bitstream and the remotely generated bitstream security key are obtained by the provisioned secure storage area via a secure communication channel and provided over the physical isolated trusted communication path to configure the configurable device.

14. The at least one non-transitory computer readable medium of claim 13 , comprising a further set of instructions, which when executed by a computing device cause the computing device to:

establish the secure communication channel between a source system and the provisioned secure storage area;

remotely generate a bitstream security key at the source system for the remotely generated bitstream security key; and

provide the remotely generated bitstream security key to the provisioned secure storage area over the secure communication channel.

15. The at least one non-transitory computer readable medium of claim 14 , comprising a further set of instructions, which when executed by a computing device cause the computing device to:

remotely encode the bitstream with the enclave identifier at the source system; and

remotely encrypt the bitstream with the bitstream security key at the source system.

16. The at least one non-transitory computer readable medium of claim 13 , wherein the configurable device comprises a reconfigurable device.

17. The at least one non-transitory computer readable medium of claim 16 , wherein the reconfigurable device comprises a field programmable gate array device.