704
7 Countermeasures Against Hardware Trojans
7.7 Software and Hardware Methods of Protecting FPGA
from Unauthorized Information Copying
7.7.1 Protection Based on the Identification Friend or Foe
Method
Let us consider one of the most widely used methods of protection from copying of
FPGA-based projects [114, 115]. This method is usually referred to as identification
friend or foe (IFF) by experts. The essence of this method is that functioning of any
project in the FPGA is not allowed until the so-called hash sequences calculated by
the special block inside the FPGA and the external microcircuit of special memory
match. In this case, the project remains protected even in case of interception of the
configuration stream, since it is practically impossible for any intruder to identify this
block of hash sequence calculation, and the access to the block has sequence calculation in the special memory microcircuit which is usually locked. Therefore, special
memory microcircuits can always be used as additional protective microcircuits for
FPGAs.
As is known, most VSLI families of programmable logic with field of
programmable gate arrays (FPGA) architecture today are produced using static RAM
technology and require special reprogramming (configuring) after power-on (this is
performed by specialized external ROMs).
At the same time, FPGA-based projects are vulnerable to copying, since the
configuration data stream can be intercepted and used by intruders to replicate the
project without authorization.
Certain FGPA families can use a special coded configuration stream to protect
project from copying. However, this requires an additional operation of programming
the decoding key into the FPGA nonvolatile memory, which usually involves using
additional equipment. Moreover, such microcircuits supporting encoded configuration are quite expensive, and most FPGA families are unable to use encoded configuration stream. A very effective method of project protection for such families is the
use of the so-called special memory microcircuits.
Implementation of the IFF functions requires using a special additional microcircuit with a hash algorithm implemented in it. Figure 7.20 shows the principle of
implementation of the IFF using serial microcircuit of special memory DS28E01
[116].
The DS28E01 microcircuit by Dallas Semiconductor (at the time of publication
of this book, this brand belongs to Maxim Integrated Products, Inc.) contains 1024
EEPROM bits and a special block for hardware identification of the hash sequence
in accordance with the SHA-1 algorithm (Secure Hash Algorithm, ISO/IEC 10118-3
Standard). The hash sequence is a 160-bit message authentication code (MAC). The
SHA-1 module in the DS28E01 microcircuit performs hardware calculation of the
MAC for the array of random numbers generated by the special module in FPGA and
7 Countermeasures Against Hardware Trojans
7.7 Software and Hardware Methods of Protecting FPGA
from Unauthorized Information Copying
7.7.1 Protection Based on the Identification Friend or Foe
Method
Let us consider one of the most widely used methods of protection from copying of
FPGA-based projects [114, 115]. This method is usually referred to as identification
friend or foe (IFF) by experts. The essence of this method is that functioning of any
project in the FPGA is not allowed until the so-called hash sequences calculated by
the special block inside the FPGA and the external microcircuit of special memory
match. In this case, the project remains protected even in case of interception of the
configuration stream, since it is practically impossible for any intruder to identify this
block of hash sequence calculation, and the access to the block has sequence calculation in the special memory microcircuit which is usually locked. Therefore, special
memory microcircuits can always be used as additional protective microcircuits for
FPGAs.
As is known, most VSLI families of programmable logic with field of
programmable gate arrays (FPGA) architecture today are produced using static RAM
technology and require special reprogramming (configuring) after power-on (this is
performed by specialized external ROMs).
At the same time, FPGA-based projects are vulnerable to copying, since the
configuration data stream can be intercepted and used by intruders to replicate the
project without authorization.
Certain FGPA families can use a special coded configuration stream to protect
project from copying. However, this requires an additional operation of programming
the decoding key into the FPGA nonvolatile memory, which usually involves using
additional equipment. Moreover, such microcircuits supporting encoded configuration are quite expensive, and most FPGA families are unable to use encoded configuration stream. A very effective method of project protection for such families is the
use of the so-called special memory microcircuits.
Implementation of the IFF functions requires using a special additional microcircuit with a hash algorithm implemented in it. Figure 7.20 shows the principle of
implementation of the IFF using serial microcircuit of special memory DS28E01
[116].
The DS28E01 microcircuit by Dallas Semiconductor (at the time of publication
of this book, this brand belongs to Maxim Integrated Products, Inc.) contains 1024
EEPROM bits and a special block for hardware identification of the hash sequence
in accordance with the SHA-1 algorithm (Secure Hash Algorithm, ISO/IEC 10118-3
Standard). The hash sequence is a 160-bit message authentication code (MAC). The
SHA-1 module in the DS28E01 microcircuit performs hardware calculation of the
MAC for the array of random numbers generated by the special module in FPGA and