7.7 Software and Hardware Methods of Protecting …
707
• SECRET_KEY—secret key for calculation of the MAC array of random numbers.
This key must coincide to the one recorded in the DS28E01 microcircuit;
• SYSCLOCK—frequency of the clock input Clock_In (set in Hz). This parameter
is used to ensure the temporary requirements of the 1-Wire standard. Maximum
value of SYSCLOCK is 100 MHz.
In a microcircuit of the Cyclone III family, authentication block takes up about
800 logic elements and one block of the built-in M9K RAM. Following the method
described in this article, the user can design a custom more compact authentication
block (e.g., using a compact processor core for software implementation of both the
SHA-1 algorithm and the 1-Wire protocol).
After power-on, the FGPA microcircuit is configured by the data stream
containing the user project and the authentication block. After SHA-1 configuration is complete, IFF Engine disables operation of the user project and starts the
following authentication process:
• It generates an array of random numbers, saves it in the FGPA memory and
records in the EEPROM data area of the DS28E01 microcircuit via the single-wire
interface;
• Reads a unique identification number from the special memory microcircuit;
• Issues the command to the special memory microcircuit to calculate MAC for the
array of random numbers saved in the DS28E01 EEPROM;
• Reads MAC from the DS28E01 microcircuit and calculates its own MAC for the
array of random numbers saved in FGPA memory. Operation of the user project
is enabled only of the codes read from the DS28E01 microcircuit and calculated
by the SHA-1 IFF Engine block coincide.
Figure 7.23 shows the algorithm of operation of the verification block in case of
implementation of the IFF method.
After enabling operation of the user project, the SHA-1 IFF Engine block switches
off to reduce the power consumed by the FGPA microcircuits. The user can restart the
authentication block by organizing corresponding control on the Reset input using
external circuits or a control machine.
As mentioned above, calculation of the hash sequence in the DS28E01 is
performing using the key recorded in the secret memory area in advance. Recording
of the secret key in DS28E01 in the described example of development by Altera
is ensured by the specifically designed CIII_Design_Security_ Load project. This
project is similar to the CIn_Design_Security_Enabler examined above, except for
the fact that the SHA-1 IFF Engine block after completion of FPGA configuration records the secret key in the DS28E01 microcircuit. Operation algorithm of the
CIII_Design_Security_ Load project is shown in Fig. 7.24.
The CIII_Design_Security_Load project is usually used to program small batches
of DS28E01 microcircuits. In order to ensure mass production, it is possible to order
a batch of DS28E01 microcircuits with the secret key programmed at the factory
from the manufacturer.
707
• SECRET_KEY—secret key for calculation of the MAC array of random numbers.
This key must coincide to the one recorded in the DS28E01 microcircuit;
• SYSCLOCK—frequency of the clock input Clock_In (set in Hz). This parameter
is used to ensure the temporary requirements of the 1-Wire standard. Maximum
value of SYSCLOCK is 100 MHz.
In a microcircuit of the Cyclone III family, authentication block takes up about
800 logic elements and one block of the built-in M9K RAM. Following the method
described in this article, the user can design a custom more compact authentication
block (e.g., using a compact processor core for software implementation of both the
SHA-1 algorithm and the 1-Wire protocol).
After power-on, the FGPA microcircuit is configured by the data stream
containing the user project and the authentication block. After SHA-1 configuration is complete, IFF Engine disables operation of the user project and starts the
following authentication process:
• It generates an array of random numbers, saves it in the FGPA memory and
records in the EEPROM data area of the DS28E01 microcircuit via the single-wire
interface;
• Reads a unique identification number from the special memory microcircuit;
• Issues the command to the special memory microcircuit to calculate MAC for the
array of random numbers saved in the DS28E01 EEPROM;
• Reads MAC from the DS28E01 microcircuit and calculates its own MAC for the
array of random numbers saved in FGPA memory. Operation of the user project
is enabled only of the codes read from the DS28E01 microcircuit and calculated
by the SHA-1 IFF Engine block coincide.
Figure 7.23 shows the algorithm of operation of the verification block in case of
implementation of the IFF method.
After enabling operation of the user project, the SHA-1 IFF Engine block switches
off to reduce the power consumed by the FGPA microcircuits. The user can restart the
authentication block by organizing corresponding control on the Reset input using
external circuits or a control machine.
As mentioned above, calculation of the hash sequence in the DS28E01 is
performing using the key recorded in the secret memory area in advance. Recording
of the secret key in DS28E01 in the described example of development by Altera
is ensured by the specifically designed CIII_Design_Security_ Load project. This
project is similar to the CIn_Design_Security_Enabler examined above, except for
the fact that the SHA-1 IFF Engine block after completion of FPGA configuration records the secret key in the DS28E01 microcircuit. Operation algorithm of the
CIII_Design_Security_ Load project is shown in Fig. 7.24.
The CIII_Design_Security_Load project is usually used to program small batches
of DS28E01 microcircuits. In order to ensure mass production, it is possible to order
a batch of DS28E01 microcircuits with the secret key programmed at the factory
from the manufacturer.