Multi-chip secure and programmable systems and methods

Patent metadata

Field	Value
Publication number	US-12417319-B2
Application number	US-202318331114-A
Country	US
Kind code	B2
Filing date	Jun 7, 2023
Priority date	Dec 8, 2020
Publication date	Sep 16, 2025
Grant date	Sep 16, 2025

Abstract

Various techniques are provided to implement multi-chip secure and programmable systems and methods. In one example, a multi-chip module system for providing an integrated programmable logic functionality and security functionality. The multi-chip module system includes a first die including a programmable logic device (PLD) configured to provide at least a portion of the programmable logic functionality. The multi-chip system further includes a second die including a security engine configured to perform at least a portion of the security functionality. The security engine is further configured to receive, from the first die, data associated with a first and second configuration image; perform a read operation on a memory for the second configuration image based on the data; and authenticate the second configuration image. The multi-chip system further includes a configuration engine configured to program the PLD according to the first configuration image. Related devices and methods are provided.

First claim

The invention claimed is:

1. A multi-chip module system for providing an integrated programmable logic functionality and security functionality, the multi-chip module system comprising:
a first die comprising a programmable logic device configured to provide at least a portion of the programmable logic functionality;
a second die comprising a security engine configured to perform at least a portion of the security functionality, wherein the security engine is configured to:
receive, from the first die, data associated with a first configuration image and a second configuration image;
perform a first read operation on a memory for the second configuration image based on the data; and
authenticate the second configuration image; and

a configuration engine configured to program the programmable logic device according to the first configuration image, wherein the configuration engine is disposed within the first die and/or the second die.

2. The multi-chip module system of claim 1 , wherein the first die is configured to implement a root of trust element for both the first die and the second die, wherein the second die is configured to receive the data from the root of trust element, wherein the first die comprises user logic configured to control input/output ports of the first die, wherein the second die comprises an application-specific integrated circuit (ASIC) to implement the security engine, wherein both the first die and the second die include a programmable logic fabric, and wherein one of the first die or second die implements a processor configured to control operation of functionality in both the first die and the second die.

3. The multi-chip module system of claim 1 , wherein:
the first die is configured to implement a root of trust element for both the first die and the second die;
the second configuration image comprises a firmware image;
the second die further comprises a programmable logic fabric configured to receive the data from the root of trust element;
the configuration engine is further configured to
program the programmable logic fabric of the second die using a third configuration image, wherein the third configuration image includes user-generated functionality and functionality determined by a system builder; and
program the second die according to the firmware image after programming the second die according to the third configuration image.

4. The multi-chip module system of claim 1 , wherein either the first die or the second die is configured with a soft processor configured to control functionality implemented in both the first die and the second die based on programming that does not differentiate whether a particular functionality is implemented in the first die or the second die, wherein the first die comprises a memory comprising platform firmware resiliency (PFR) configuration data associated with the second die, and wherein the second die comprises an input/output control block and a PFR block both configured to be programmed with the PFR configuration data stored in the memory of the first die.

5. The multi-chip module system of claim 1 , wherein both the first die and the second die are configured to encrypt, sign and/or encrypt and sign messages across an interface between the first die and the second die, and wherein the data comprises a configuration version number associated with the first die, a boot source information associated with the first configuration image, a customer public key, and/or a memory location associated with the second configuration image.

6. The multi-chip module system of claim 1 , wherein the first die and the second die are configured to communicate with each other using an out of band interface that does not carry user data and another interface that carries user data, wherein the second configuration image comprises an update configuration image, and wherein the security engine is further configured to determine a memory location associated with the second configuration image based on the data.

7. The multi-chip module system of claim 1 , further comprising interfaces configured to allow the multi-chip module system to be configured and/or used as though the multi-chip module system contains one programmable logic die, wherein the first die and the second die share a substrate, and wherein the first die and the second die are configured to communicate with each other via a direct communication and without going through the substrate.

8. The multi-chip module system of claim 1 , wherein the security engine is further configured to:
perform a second read operation on a predetermined memory location of the memory; and
authenticate the second configuration image based on one of a first signature or a second signature according to the second read operation, wherein the memory comprises an external flash memory.

9. The multi-chip module system of claim 8 , wherein:
the second configuration image comprises a customer firmware image;
the first signature comprises a firmware signature;
the second signature comprises a hash message authentication code (HMAC) signature;
the first die comprises a control PLD block;
the second die further comprises a processor;
the security engine is configured to authenticate the second configuration image based on the first signature;
the security engine is further configured to:
receive the second configuration image from the processor; and
determine an HMAC signature based on the second configuration image;

the processor is configured to:
perform a third read operation on the security engine to obtain the HMAC signature; and
perform a write operation to write the HMAC signature into the predetermined memory location of the memory;

the processor is configured to be programmed according to the second configuration image when the second configuration image is successfully authenticated; and
the processor is configured to control the control PLD block of the first die through an inter-chip communication interface.

10. The multi-chip module system of claim 8 , wherein:
the second configuration image comprises an update configuration image,
the security engine of the second die is further configured to determine a memory location associated with the second configuration image based on the data,
the first die comprises a security engine configured to:
authenticate the update configuration image associated with the second configuration image; and
set an authentication bit when authentication of the update configuration image is successful.

11. The multi-chip module system of claim 8 , wherein:
the predetermined memory location is associated with a hash message authentication code (HMAC) signature,
the second configuration image is based on the first signature when the memory location is blank,
the second configuration image is based on the second signature when the memory location is not blank,
the second die further comprises a processor configured to be programmed based at least in part by the second configuration image, and
the processor is configured to:
stream the second configuration image to the security engine;
perform a third read operation to obtain the first signature from the memory; and
send the first signature to the security engine; and

the security engine is configured to:
determine a hash value associated with the second configuration image; and
authenticate the second configuration image based on the first signature and the hash value.

12. A method for configuring the multi-chip module system of claim 1 , the method comprising:
receiving a user design;
synthesizing the user design into a plurality of pro

Assignees

• Lattice Semiconductor Corp

Inventors

• Chandra Srirama
• Vogt Tim
• Gupta Mamta
• Raghava Sharath

Classifications

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title

• H04L9/0841

  involving Diffie-Hellman or related key agreement protocols · CPC title