AN 556: Using the Design Security Features in Intel FPGAs

Download PDF
ID 683269
Date 5/21/2021
Public
Document Table of Contents
Document Table of Contents x
Using the Design Security Features in Intel® FPGAs
Using the Design Security Features in Intel® FPGAs x
Overview of the Design Security Feature Hardware and Software Requirements Steps for Implementing a Secure Configuration Flow Steps to Enable Tamper-Protection Bit Programming Supported Configuration Schemes Security Mode Verification Serial Flash Loader Support with Encryption Enabled Serial Flash Loader Support with Encryption Enabled for Single FPGA Device Chain JTAG Secure Mode for 28-nm and 20-nm FPGAs Document Revision History for AN 556: Using the Design Security Features in Intel® FPGAs
Overview of the Design Security Feature x
Security Encryption Algorithm Non-Volatile and Volatile Key Storage Key Programming Intel® Arria® 10 and Intel® Cyclone® 10 GX Qcrypt Security Tool
Intel® Arria® 10 and Intel® Cyclone® 10 GX Qcrypt Security Tool x
Using Qcrypt Tool Qcrypt Tool Options Security Levels of Qcrypt Tool Security Option
Hardware and Software Requirements x
Hardware Requirements Software Requirements
Steps for Implementing a Secure Configuration Flow x
Step 1: Generating .ekp File and Encrypting Configuration File Step 2a: Programming Volatile Key into the FPGAs Step 2b: Programming Non-Volatile Key into the FPGAs Step 3: Configuring the 40-nm, 28-nm, or 20-nm FPGAs with Encrypted Configuration Data
Step 1: Generating .ekp File and Encrypting Configuration File x
Generating Single-Device .ekp File and Encrypting Configuration File using Intel® Quartus® Prime Software Generating Single-Device .ekp File and Encrypting Configuration File using Command-Line Interface in Intel® Quartus® Prime Software Generating Multi-Device .ekp File and Encrypting Configuration File using Intel® Quartus® Prime Software
Step 2b: Programming Non-Volatile Key into the FPGAs x
Programming Volatile or Non-Volatile Key using Intel® FPGA Ethernet Cable and Intel® Quartus® Prime Software Programming Single-Device Volatile or Non-Volatile Key using Intel® Quartus® Prime Software Programming Single-Device Volatile or Non-Volatile Key using the Command-Line Interface in Intel® Quartus® Prime Software Programming Multi-Device Volatile or Non-Volatile Key using Intel® Quartus® Prime Software Programming Multi-Device Volatile or Non-Volatile Key using the Command-Line Interface in Intel® Quartus® Prime Software Programming Key using JTAG Technologies
Security Mode Verification x
Verification During JTAG Secure Mode
JTAG Secure Mode for 28-nm and 20-nm FPGAs x
Internal JTAG Interface Design Example for JTAG Secure Mode
Design Example for JTAG Secure Mode x
Design Example Intel® Quartus® Prime Design Components LOCK and UNLOCK JTAG Instructions Verifying JTAG Secure Mode
Using the Design Security Features in Intel® FPGAs

LOCK and UNLOCK JTAG Instructions

When you configure this reference design into an Arria V device with the tamper-protection bit enabled, the Arria V device is in JTAG secure mode after power up and configuration, whereby you can only execute mandatory JTAG instructions.

To disable the JTAG secure mode, you can trigger the start_unlock port of the user logic to issue the UNLOCK JTAG instruction. After the start_unlock port goes high, the UNLOCK JTAG instruction is issued. After the UNLOCK JTAG instruction is issued, the device exits from JTAG secure mode, whereby both mandatory and non-mandatory JTAG instructions are allowed.

Figure 4.  LOCK or UNLOCK JTAG Instruction Execution


The start_lock port in the user logic triggers the execution of the LOCK JTAG instruction. The function of the LOCK JTAG instruction is to put the device back into JTAG secure mode.

Table 21.  Input and Output Port of the User Logic
Port Input/Output Function
clk_in Input Clock source for the user logic. The fMAX of the user logic depends on the timing closure analysis. You need to apply timing constraints and perform timing analysis on the path to determine the fMAX .
start_lock Input Logic high to trigger the execution of the LOCK JTAG instruction to the internal JTAG interface.
start_unlock Input Logic high to trigger the execution of the UNLOCK JTAG instruction to the internal JTAG interface.
jtag_core_en_out Output Output of the User_logic_control_block. This port is connected to the corectl port of the JTAG WYSIWYG atom to enable the internal JTAG interface.
tck_out Output Output of the User_logic_control_block. This port is connected to the tck_core port of the JTAG WYSIWYG atom.
tdi_out Output Output of the User_logic_control_block. This port is connected to the tdi_core port of the JTAG WYSIWYG atom.
tms_out Output Output of the User_logic_control_block. This port is connected to the tms_core port of the JTAG WYSIWYG atom.
indicator Output Logic high on this output pin indicates the completion of the LOCK or UNLOCK JTAG instruction execution.
Related Information
Level Two Title