Xilinx, Inc.

Xlnx, Inc.

James D Wesselkamper

Jason J Moore

Edward S Peterson

Steven E McNeil

James B Anderson

Stephen M Trimberger

James F Anderson

Roger D Flateau, Jr

Krishna C Patakamuri

Sagheer Ahmad

Brian C Gaide

Ahmad R Ansari

Santosh Yachareni

Boon Yong Ang

Shidong Zhou

Lawrence C Hung

Lester S Sanders

Felix Burton

Anil Kumar Kandala

Aman Gupta

Brendan K Bridgford

Frank C Wirtz, Ii

Yatharth K Kochar

Sree Rkc Saraswatula

Giulio Corradi

Ramakrishna G Poolla

Sandeep Vundavalli

Danny Tsung-Heng Wu

Nader Sharifi

John C Hoffman

Nathan A Menhorn

Thomas Paul Leboeuf

An integrated circuit die stack and method thereof are described herein that is capable of detecting a physical tampering event. The integrated circuit die stack includes a first integrated circuit die including a sensor network that extends substantially across an entire top surface of the first integrated circuit die, and a second integrated circuit die stacked below the first integrated circuit die. The second integrated circuit die is configured to receive sensing signals generated by the sensor network via a plurality of through-silicon-vias coupled with the first integrated circuit die and the second integrated circuit die.

Tamper sensor for 3-dimensional die stack

Some examples described herein provide for securely booting a heterogeneous integration circuitry apparatus. In an example, an apparatus (e.g., heterogeneous integration circuitry) includes a first portion and a second portion of one or more entropy sources on a first component and a second component, respectively. The apparatus also includes a key generation circuit communicatively coupled with the first portion and the second portion to generate a key encrypted key based on a first set of bits output by the first portion and a second set of bits output by the second portion. The apparatus also includes a key security circuit to generate, based on the key encrypted key and an encrypted public key stored at the apparatus, a plaintext public key to be used by a boot loader during a secure booting operation for the apparatus.

System and method for secure deconstruction sensor in a heterogeneous integration circuitry

A physically unclonable function includes a circuit that translates a normally distributed sequence of raw sample into a sequence of uniformly distributed binned values across sub-bins of bins. Helper circuitry generates centering values and parity bits based on binned values generated during registration. Each centering value is associated with a raw sample value corresponding to a binned value and indicates an offset of a sub-bin in one of the bins. A distance calculator generates a set of distances from each raw sample value based on the centering value associated with the raw sample value. Each distance indicates a difference between the respective raw sample value and a raw sample value equivalent to a midpoint of a sub-bin offset by the associated centering value in a bin. A trellis decoder generates a PUF signature based on the candidate symbols, sets of distances, and parity bits.

Registration of a PUF signature and regeneration using a trellis decoder

Disclosed approaches for validating initialization vectors determining by a configuration control circuit whether or not an input initialization vector is within a range of valid initialization vectors. In response to determining that the initialization vector is within the range of valid initialization vectors, the configuration control circuit decrypts the ciphertext into plaintext using the input initialization vector and configures a memory circuit with the plaintext. In response to determining that the first initialization vector is outside the range of valid initialization vectors, the configuration control circuit signals that the first initialization vector is invalid.

Protection against differential power analysis attacks involving initialization vectors

An array of non-volatile memory cells includes rows and columns. A volatile storage circuit provides addressable units of storage. A control circuit reads first type data and second type data from one or more of the rows and multiple ones of the columns of the array of non-volatile memory cells. The control circuit stores the first type data and second type data read from each row in one or more addressable units of storage of the volatile storage. A security circuit reads first data from the one or more of the addressable units of the volatile storage and selects from the first data, the second type data that includes one or more bits of each of the one or more of the addressable units. The security circuit performs an integrity check on the selected second type data, and generates an alert signal that indicates a security violation in response to failure of the integrity check.

Mixed storage of data fields

Disclosed approaches for controlling debug access to an integrated circuit (IC) device include receiving a debug packet by a debug interface circuit of the IC device. The debug interface circuit authenticates the debug packet in response to the debug packet having a command code that specifies enable debug mode or a command code that specifies disable debug mode. In response to the debug packet passing authentication and the command code specifying enable, the debug interface circuit enables debug mode of the IC device. In response to the debug packet passing authentication and the command code specifying disable, the debug interface circuit disables the debug mode of the IC device. In response to the debug packet failing authentication, the debug interface circuit rejects the debug packet.

System-on-chip having secure debug mode

Apparatus and associated methods relate to authenticating a back-to-front-built configuration image. In an illustrative example, a circuit may include memory configured to store a signature S, a second hash H, and a first data chunk C. Signature S may be signed on a first hash H. Hmay be the hash for Hand C. If signature S passes verification, a hash engine may perform hash functions on Cand Hto generate a hash H'. H&#x2032; may be compared with Hto indicate whether Chas been tampered with or not. By using the incremental authentication, a signature that appears at the beginning of the image may be extended to the entire image while only using a small internal buffer. Advantageously, internal buffer may only need to store two hashes H, H, and a data chunk C, or, a signature S, a hash H, and a data chunk C.

Incremental authentication for memory constrained systems

A disclosed circuit arrangement includes a bank of efuse cells, first and second sense amplifiers coupled to input signals representing constant logic-1 and logic-0 values, respectively, a storage circuit, an efuse control circuit, and an efuse security circuit. The efuse control circuit inputs signals from the bank of efuse cells and signals that are output from the first and second sense amplifiers, and stores data representative of values of the signals in the storage circuit. The efuse security reads the data from the storage circuit and generates an alert signal having a state that indicates a security violation in response to data representative of the value of the signal from the first sense amplifier indicating a logic-0 value or data representative of the value of the signal from the second sense amplifier indicating a logic-1 value.

Efuse bank and associated anchor bits

Apparatus and associated methods relate to a glitch detection circuit monitoring a duration that a selected fractional supply voltage is below a predetermined voltage threshold. The selected fractional supply voltage may be at the predetermined threshold when the supply voltage is between a valid circuit-supply voltage and a power-on circuit-reset (POR). A glitch detect signal may be generated, for example, when the monitored duration is greater than a predetermined duration threshold. A test glitch generator may generate a test glitch, for example, having selectable voltage and duration, which may be selectably applied to the glitch detection circuit to verify operation. Various exemplary glitch detection circuits may advantageously determine externally produced tampering attempts by detecting circuit-supply voltages and durations that meet specific selectable supply voltage and duration criteria, improving security of sensitive field programmable gate array (FPGA) data by taking protective action in response to the detection.

Glitch detector and test glitch generator

Methods and circuits are disclosed for measuring temperature and/or voltage using ring oscillators. In an example implementation, temperature and/or voltage are determined using an iterative measurements of a ring oscillator. The ring oscillator oscillates with a different voltage-temperature response in each of the first, second and third modes. In each iteration, a first set of indications of frequency are determined for a ring oscillator in a first mode, a second mode, and a third mode. A coarse temperature estimate and a coarse voltage estimate of the ring oscillator are determined based on the indications of frequency measured in a first iteration. A more accurate temperature estimate and a more accurate voltage estimate of the ring oscillator are determined as a function of a second set of indications of frequency measured in a second iteration, the coarse temperature estimate, and the coarse voltage estimate.

Ring oscillator for temperature or voltage sensing

The disclosure describes approaches for protecting a circuit design for a programmable integrated circuit (IC). A black key is generated from an input red key by a registration circuit implemented on the programmable IC, and the black key is stored in a memory circuit external to the programmable IC. The programmable IC is configured to implement a pre-configuration circuit, which inputs the black key from the memory circuit and generates the red key from the black key. A ciphertext circuit design is decrypted into a plaintext circuit design by the programmable IC using the red key, and the red key is erased from the programmable IC. The programmable IC is reconfigured with the plaintext circuit design.

Secure external key storage for programmable ICS

A method of generating a physically unclonable function is described. The method comprises calculating a total variation associated with differences between a plurality of elements of an entropy source in an integrated circuit; calculating a global variation associated the plurality of elements of the entropy source; generating a local variation by removing the global variation associated with the plurality of elements from the total variation; and generating a unique signature based upon the generated local variation. A circuit for generating a physically unclonable function is also described.

Method of and circuit for generating a physically unclonable function

In one approach for protecting a design, a plurality of implementations of the design are generated. Each implementation includes an identification function. One of the implementations is selected as a current implementation, and the current implementation is installed on one or more electronic systems. For each electronic system, a method determines whether or not the current implementation is an authorized version on the electronic system from an output value of the identification function. If in the current implementation is not an authorized version on the electronic system, a signal is output indicating that the current implementation is not an authorized version on the electronic system. Periodically, another one of the implementations is selected as a new current implementation, and the new current installation is used for installations on one or more electronic systems.

Protection of designs for electronic systems

A system generally relating to an SoC, which may be a field programmable SoC ('FPSoC'), is disclosed. In this SoC, dedicated hardware includes a processing unit, a first internal memory, a second internal memory, an authentication engine, and a decryption engine. A storage device is coupled to the SoC. The storage device has access to a boot image. The first internal memory has boot code stored therein. The boot code is for a secure boot of the SoC. The boot code is configured to cause the processing unit to control the secure boot.

Secured booting of a field programmable system-on-chip including authentication of a first stage boot loader to mitigate against differential power analysis

Approaches for configuring a programmable integrated circuit (IC) are disclosed. Encrypted configuration data is input to the programmable IC, and the encrypted configuration data is stored in configuration memory of the programmable IC. As the encrypted configuration data is input, a determination is made as to whether or not the encrypted configuration data is authentic. In response to the encrypted configuration data being authentic, the encrypted configuration data is read from the configuration memory and decrypted, and the decrypted configuration data is stored back in the configuration memory.

Growing community of inventors

Albuquerque, NM, United States of America

James D Wesselkamper