Security in Low-Power Flash Devices
v1.1
15- 9
Security in Action
This section illustrates some applications of the security advantages of Actel’s devices (
Figure 15-6).
Application 1: Trusted Environment
design locations where research and development take place. Therefore, encryption is not
necessary and is optional to the user. This is often a secure way to protect the design, since the
design program files are not sent elsewhere. In situations where production programming is not
available at the design location, programming centers (such as Actel In-House Programming)
provide a way of programming designs at an alternative, secure, and trusted location. In this
scenario, the user generates a STAPL programming file from the Designer software in plaintext
format, containing information on the entire design or the portion of the design to be
programmed. The user can choose to employ the FlashLock Pass Key feature with the design. Once
the design is programmed to unprogrammed devices, the design is protected by this FlashLock Pass
Key. If no future programming is needed, the user can consider permanently securing the IGLOO
Application 2: Nontrusted Environment—Unsecured Location
Often, programming of devices is not performed in the same location as actual design
implementation, to reduce manufacturing cost. Overseas programming centers and contract
manufacturers are examples of this scenario.
To achieve security in this case, the AES key and the FlashLock Pass Key can be initially programmed
in-house (trusted environment). This is done by generating a programming file with only the
security settings and no design contents. The design FPGA core, FlashROM, and (for Fusion) FB
contents are generated in a separate programming file. This programming file must be set with the
same AES key that was used to program to the device previously so the device will correctly decrypt
this encrypted programming file. As a result, the encrypted design content programming file can
Note: Flash blocks are only used in Fusion devices.
Figure 15-6 Security Options
Plaintext
Source File
AES
Encryption
Cipher Text
Source File
Public
Domain
AES Decryption Core
FlashROM
Flash Blocks
Flash Device
Application
3
Application
2
Application
1
FPGA Core