Load CT Only When Needed (Prevention) - Load CT Only When Needed (Prevention) - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)
Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English

If the design can be partitioned into sections that contain non-critical and critical technology blocks, it might be possible to only have the non-CT portion of the design resident at all times and use partial reconfiguration (PR) features (refer to PRC/EPRC: Data Integrity and Security Controller for Partial Reconfiguration Application Note (XAPP887)) of the FPGA to allow the CT to be loaded only when needed. The CT can then be erased by loading in a black box version of the PR region when it has completed its tasks. The partial bitstream for the CT can be decrypted by your algorithm of choice in the FPGA logic. In response to a tamper event, both the PR region and the key for the CT (perhaps stored in block RAM or FPGA logic registers) could be erased.

For example, this section illustrates a general system with an FPGA, CPU, and external memory devices (for FPGA configuration, PR, CPU code, and CPU boot code). In the following figure, the PR region (named user CT logic region) is empty.

Figure 1. Use Model: Protecting System CT
x1098_13 Sheet.49 Sheet.50 Sheet.36 Configure UltraScale/UltraScale+ FPGA Using AES-GCM Configure UltraScale/UltraScale+ FPGAUsing AES-GCM Sheet.38 Memory I/F Memory I/F Sheet.39 Other User Logic OtherUserLogic Sheet.40 X1098_13_031415 X1098_13_031415 Rectangle.595 Limited Services Boot Code LimitedServicesBoot Code Rectangle.43 CPU CPU Rectangle.44 RAM for CPU CT Code RAM for CPU CTCode Rectangle.45 Encrypted FW and SW EncryptedFW and SW Rectangle.46 Encrypted FPGA Bitstream EncryptedFPGA Bitstream Rectangle.48 User CT Logic Region UserCTLogicRegion Standard Arrow.596 Standard Arrow.597 Standard Arrow.596.53 Standard Arrow.589 Standard Arrow.589.55

In the following figure, the PR region on the FPGA has been dynamically loaded with CT logic via PR (named user CT logic). When the CT function is completed or a tamper event occurs, the PR region can be returned to the state shown in the previous figure by loading in a black box version of the PR module.

Figure 2. Use Model: Protecting System CT–Tamper Response
x1098_14 Sheet.2 Sheet.3 Sheet.4 Configure UltraScale/UltraScale+ FPGA Using AES-GCM Configure UltraScale/UltraScale+ FPGAUsing AES-GCM Sheet.5 Memory I/F Memory I/F Sheet.6 Other User Logic OtherUserLogic Sheet.7 X1098_14_031415 X1098_14_031415 Rectangle.595 Limited Services Boot Code LimitedServicesBoot Code Rectangle.43 CPU CPU Rectangle.44 Sensitive CPU Code SensitiveCPUCode Rectangle.45 Encrypted FW and SW EncryptedFW and SW Rectangle.46 Encrypted FPGA Bitstream EncryptedFPGA Bitstream Rectangle.48 User CT Logic Region UserCTLogicRegion Standard Arrow.596 Standard Arrow.597 Standard Arrow.53 Standard Arrow.589 Standard Arrow.55 Sheet.19 Erase in Response to a Tamper Event Erase in Responseto a Tamper Event Standard Arrow.589.20 Standard Arrow.21
Note: If a tamper event occurs, the external sensitive CPU code memory could be erased so that only encrypted, cleared, or non-sensitive external memory contents remain.

In these examples, the ICAPE3 is used to perform the PR. Because the ICAPE3 is a trusted channel, it allows either encrypted or unencrypted PR bitstreams (even if an eFUSE key is being used with the cfg_aes_only eFUSE bit blown). An encrypted and authenticated PR bitstream is always recommended where the decryption and authentication take place with your decryptor authentication engine of choice in the FPGA logic. A useful reference on secure PR is PRC/EPRC: Data Integrity and Security Controller for Partial Reconfiguration Application Note (XAPP887).