Firmware security interface for field programmable gate arrays

Patent metadata

Field	Value
Publication number	US-9940483-B2
Application number	US-201615005412-A
Country	US
Kind code	B2
Filing date	Jan 25, 2016
Priority date	Jan 25, 2016
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

This disclosure provides for implementing a firmware security interface within a field-programmable gate array (FPGA) for communicating between secure and non-secure environments executable within the FPGA. A security monitor is implemented within the programmable logic of the FPGA as a soft core processor and the firmware security interface modifies one or more functions of the security monitor. The modifications to the security monitor include establishing a timer “heartbeat” within the FPGA to ensure that the FPGA invokes a secure environment and raising an alarm should the FPGA fail to invoke such environment.

First claim

The invention claimed is:

1. A system for securing a field-programmable gate array, the system comprising:
a first machine-readable memory storing a first operating system that implements a secure environment for a field-programmable gate array (FPGA);
a second machine-readable memory storing a second operating system that implements a non-secure environment for the FPGA;
at least one hardware processor of the FPGA communicatively coupled to the first machine-readable memory and the second machine-readable memory, the at least one hardware processor configurable to:
transition to the secure environment by executing the first operating system;
reset a watchdog timer communicatively coupled to the at least one hardware processor by loading a register associated with the watchdog timer with a predetermined value; and
transition to the non-secure environment by executing the second operating system; and

programmable logic of the FPGA communicatively coupled to the at least one hardware processor, the programmable logic configurable to:
implement a reset timer, the reset timer signaling when the programmable logic is to instruct the at least one hardware processor to transition to the secure environment;
retrieve an event value from a status register associated with the watchdog timer; and
determine whether the first operating system was executed by the at least one hardware processor by comparing the retrieved event value with a second predetermined value.

2. The system of claim 1 , wherein the watchdog timer comprises a private watchdog timer assigned to the at least one hardware processor.

3. The system of claim 1 , wherein the predetermined value comprises a time interval measured in milliseconds.

4. The system of claim 1 , wherein the programmable logic is further configurable to implement the reset timer by using the predetermined value loaded into the register associated with the watchdog timer.

5. The system of claim 1 , wherein the programmable logic is further configurable to implement an event timer, the event timer signaling when the programmable logic is to retrieve the event value from the status register associated with the watchdog timer.

6. The system of claim 5 , wherein the programmable logic is further configurable to implement the event timer using a time interval greater than the predetermined value loaded into the register associated with the watchdog timer.

7. The system of claim 1 , wherein the programmable logic is further configurable to repetitively instruct the at least one hardware processor to transition to the secure environment and retrieve the event value from the status register so long as the programmable logic determines that the watchdog timer did not reach a zero value.

8. The system of claim 7 , wherein the retrieved event value comprises a first value indicating that the watchdog timer did not reach a zero value or a second value indicating that the watchdog timer reached a zero value.

9. The system of claim 1 , wherein the programmable logic is further configurable to initiate a lockdown procedure for the FPGA where the comparison of the retrieved event value with the second predetermined value indicates that the watchdog timer was not reset by the at least one hardware processor.

10. A method for securing a field-programmable gate array, the method comprising:
instructing, by a programmable logic of a field-programmable gate array (FPGA), at least one hardware processor of the FPGA to transition to a secure environment, the secure environment implemented by a first operating system executable by the at least one hardware processor;
instructing, by the programmable logic, the at least one hardware processor to reset a watchdog timer communicatively coupled to the at least one hardware processor with a predetermined value;
instructing, by the programmable logic, the at least one hardware processor to transition to a non-secure environment, the non-secure environment implemented by a second operating system executable by the at least one hardware processor;
implementing, by the programmable logic, an event timer signaling when the programmable logic is to retrieve an event value from a status register associated with the watchdog timer;
retrieving, by the programmable logic, the event value from the status register associated with the watchdog timer; and
determining, by the programmable logic, whether the first operating system was executed by comparing the retrieved event value with a second predetermined value.

11. The method of claim 10 , wherein the watchdog timer comprises a private watchdog timer assigned to the at least one hardware processor.

12. The method of claim 10 , wherein the predetermined value comprises a time interval measured in milliseconds.

13. The method of claim 10 , further comprising:
implementing, by the programmable logic, a reset timer signaling when the programmable logic is to instruct the at least one hardware processor to transition to the secure environment.

14. The method of claim 13 , wherein the reset timer is implemented using the predetermined value used to reset the watchdog timer.

15. The method of claim 10 , wherein the event timer is implemented using a time interval greater than the predetermined value loaded into the register associated with the watchdog timer.

16. The method of claim 10 , further comprising:
repetitively instructing the at least one hardware processor to transition to the secure environment and repetitively retrieving the event value from the status register so long as the programmable logic determines that the watchdog timer did not reach a zero value.

17. The method of claim 16 , wherein the retrieved event value comprises a first value indicating that the watchdog timer did not reach a zero value or a second value indicating that the watchdog timer reached a zero value.

18. The method of claim 10 , further comprising:
initiating a lockdown procedure for the FPGA where the comparison of the retrieved event value with the second predetermined value indicates that the watchdog timer was not reset by the at least one hardware processor.

Assignees

• Raytheon Co

Inventors

• Areno Matthew C
• Hoffman John
• Jennings William T

Classifications

• G06F21/76 Primary

  in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title