Secure Designs Using Microchip PolarFire® Family

Value Proposition: Why Secure FPGAs?

In today's connected world, protecting your design, data and creating “root-of-trust” is paramount. Traditional FPGAs often lack comprehensive, built-in security, leaving systems vulnerable to a range of attacks, from reverse engineering and cloning to malicious tampering and side-channel analysis. The PolarFire family of FPGAs addresses these challenges by integrating a hardware-based "security enclave."

Securing the edge requires robust security. The PolarFire family of FPGAs and SoC FPGAs is built upon the three fundamental security principles of confidentiality, integrity and authenticity. We offer a cryptographically secured supply chain, side-channel-resistant crypto accelerators, state-of-the-art Physically Unclonable Function (PUF)-based key storage and industry-leading anti-tamper features to protect your design and enable you to deploy edge applications securely.

Security Concepts

The PolarFire device security architecture is built on a layered approach, combining hardware, design and data security features. By providing these capabilities in a low-power, non-volatile architecture, PolarFire FPGAs enable engineers to deploy secure, reliable and energy-efficient systems at the edge.

_{Figure 1 - Programmable Security for Low-Power Edge Compute Applications}

Design Security

This provides confidentiality and authenticity to your design while monitoring the environment for physical attacks. Anti-tamper features and a cryptographically secured supply chain provide confidence that the device is authentic and has not been compromised. Additionally, our secure manufacturing flow can extend to anywhere in the world by adopting our secure production programming solution. 

Data Security

Data at rest or in transit should exhibit Confidentiality, Integrity and Authenticity (CIA) and PolarFire provides all these elements to create a secure design. For example, a dedicated crypto-coprocessor and other hardware accelerators protect sensitive data during storage, computation and communication. In addition, encrypted bitstreams and secure key storage prevent unauthorized design access and cloning.

Secure Hardware

Microchip FPGAs use licensed, patented differential power analysis countermeasures with NIST-certified cryptographic algorithms, providing correctness and interoperability. A cryptographically controlled manufacturing process can verify the devices shipped have not been tampered with in transit, providing a secure programmable platform for your design.

PolarFire FPGA Security Hardware

PolarFire integrates the following device architecture from a security perspective.  

_{Figure 2 - PolarFire Device Simplified Security Model}

Design Implementation

PolarFire FPGAs are built with a robust security architecture that supports secure design deployment, runtime data protection and anti-tamper mechanisms. Libero SoC provides the tools to configure, verify and deploy the data security, design security and trusted hardware provided by the PolarFire FPGA device families. The creation of the hardware is accomplished in a few simple steps.

Design Hardware

In our PolarFire FPGA and SoC FPGA families, trusted hardware refers to a set of integrated, tamper-resistant components and technologies that form the foundation for secure system design in addition to a secure manufacturing flow. Secure manufacturing includes hardware security modules, custom firmware, secure protocols, device authentication and controlled programming jobs. This helps protect IP, secures supply chains and supports third party manufacuring.  

PolarFire FPGAs contain a certificate injected at manufacturing time, which includes critical information about the device such as speed and temperature grade.  This enables each FPGA to be authenticated and verified for its specified performance and operational parameters, and ultimately provides customers with initial device trust.

Design Security

Design security in the context of Microchip PolarFire FPGAs refers to the comprehensive set of hardware and firmware features that protect the user's intellectual property (IP), sensitive data and overall device integrity throughout the lifecycle of the FPGA-based system. It verifies that the design operates as intended, is protected against unauthorized access or tampering and that cryptographic keys and configuration bitstreams remain confidential and authentic. The following are features that enable design security.   

_{Table 1 - Deign Security Functionality Enabled by Libero}

These are configurable within the Libero design tools and can be quickly applied to both debug and production level bitstreams.  

Bitstream Encryption

Libero encrypts all bitstreams either factory loaded, or user provided design security key.

Design Security Keys and Key Management

The critical link is key management in a secure system includes securely generating, distributing and storing keys. The FPGA contains factory provisioned key material and X.509-complaint certificate. This can be used to authenticate and provide a starting point for enrolling user keys. Within PolarFire FPGAs, passcodes are used to escalate access privileges to device features by unlocking non-permanent user-enabled locks.

_{Figure 3 - Flow Diagram User Passcode Keys}

Customers can also inject their own design security keys and passcodes, disabling factory keys for additional protection. In addition, the SRAM-PUF enciphers code keys and hashes passcodes which are stored in NVM.

High security requirements make securely generating, distributing and storing keys a critical task. This is made easier using a factory provisioned key and certificate to authenticate and start enrolling user keys. These factory keys and passcodes are generated by a Microchip NIST-certified HSM and injected in an encrypted form. In addition, the devices include non-volatile memory blocks for storing the security keys and passcodes (pNVM and sNVM) which are hashed and enciphered as key codes.

Lock Bits

Lock bits are a critical part of the security architecture for PolarFire devices and are configured through Libero. The following provides a high-level view of available locks; details of each are defined in the PolarFire and Libero documentation.

_{Table 2 - Overview of Available Locks}

User passcode keys (UPK) are used to unlock any non-permanent user-defined locks when matched by the user.

Using IP to Configure Hardware

There are a few hard blocks that require developers to insert IP blocks using SmartDesign along with additional user specific logic for a security design. 

JTAG

For implementing a secure JTAG interface, use UJTAG_SEC IP available in the Libero catalog which allows a user-defined security monitor to be implemented in fabric to observe JTAG activity and enables control of the System Controller TDI and TRSTB inputs.

TVS

A tamper macro is provided in the Libero IP catalog to access tamper flags and response inputs from fabric.  There are two sets of I/O ports in PF_TAMPER macro.  One set corresponds to detection flags and tamper responses, while the second corresponds to user voltage detectors triggering on minimum or raises above a maximum level.

Tamper Detection

PolarFire FPGAs include several built-in tamper detection and response capabilities that can be used to enhance the security of the device. When a tamper condition is detected, a notification is sent to the fabric via one of many dedicated lines. On tamper event, the customer user fabric design may either choose to ignore the event or take defensive action using built-in tamper responses.   

_{Figure 5 - Tamper Detection Setup/Configuration}

There are several built-in responses that can be utilized with or in place of custom logic to respond to tamper events. This is configurable through Libero and the setup of the Tamper IP.

Security Monitor

The security monitor can be used to enhance the security of a design implemented with tamper detection and response. CoreSMIP_PF includes a watchdog and heartbeat counters with instance of tamper and voltage detect. If a designer integrates this IP, the individual tamper and voltage detect cannot be used.

Design Security Libero Flow

These capabilities are easily configured using the security manager user interface. There are several items to define/setup for design security outlined in the following diagram.

_{Figure 4 - Libero Security Manager Configures Design Security Features}

Data Security

This protects runtime data against unauthorized access or corruption using cryptographic accelerators, secure hardware and many hardware blocks in PolarFire devices. The blocks listed below do not require IP to configure or use and may not be in all devices within the PolarFire family. 

All the hard blocks are defined and usable directly through the system services and RISC-V middleware.    

System Services

System services are system controller actions initiated by asynchronous events from the user design via the system controller's design service interface.

_{Table 3 – Available System Services}

System Services Interface

The SYSTEM_SERVICES IP core provides access to the System Services which are system controller actions initiated by asynchronous events from the user design via the system controller's system service and mailbox interface.

Microchip provides PolarFire System Services firmware driver with a set of functions for controlling with a processor and supports device and data system and fabric services with an AMBA interface and APB target interface. Libero will help the designer add this IP block to their design and configure the various services and sNVM.  

MSS Configurator

MSS Configurator is a utility that helps define MSS startup configuration, including the RISC-V processor subsystem, memory controllers, peripherals, security features, clocking and fabric interface controllers.

_{Figure 7 - Setting Up Security Using MSS Configurator}

For the configuration of security using MSS configurator, start with the memory partition and protection tab and define DDR memory partitioning, processor PMP configuration and AXI switch hardware configuration. Once complete, output the two files that are used for SoftConsole firmware initialization (XML) and Libero SmartDesign component (CXZ).  

Secure FPGA Software

The hardware is defined, and now the software must be compiled using SoftConsole, a free, open-source-based software development environment for SoC-based FPGAs which is used for developing bare-metal and RTOS-based applications.

Hart System Services

HSS is the Zero-Stage Boot Loader (ZSBL) for PolarFire SoC, which runs on the E51 monitor core and is responsible for boot/system initialization, secure service management, communication between E51 and U54 cores and optional ECC scrubbing and crypto services. The following provides a top-level view of the HSS components.

• Boot Service: Loads U-Boot or bare-metal apps
• State Machine Framework: Manages service execution
• IPI Messaging: Inter-core communication
• Storage Services: eMMC, QSPI, SPI
• TinyCLI: Command-line interface
• OpenSBI: Supervisor Binary Interface for Linux

Designers can download the full source code and documentation from our GitHub repository at PolarFire SoC HSS GitHub Repository.

_{Figure 8 - HSS Boot Flow Overview}

The full build in SoftConsole is completed with setting a few parameters in the various files.  

1. Set environment variables
   export SC_INSTALL_DIR=/path/to/SoftConsole
   export FPGENPROG=/path/to/Libero/bin64/fpgenprog
   export PATH=$PATH:$SC_INSTALL_DIR/python3/bin:$SC_INSTALL_DIR/riscv-unknown-elf-gcc/bin
2. Use Kconfig to configure build options: make BOARD=mpfs-icicle-kit-es config
   Or use default config: make BOARD=mpfs-icicle-kit-es defconfig
3. Compile the HSS: make BOARD=mpfs-icicle-kit-es
4. Output Files: hss-envm.elf, hss-envm.hex, hss-envm.bin and output-envm.map, hss-envm.sym
5. Program HSS to the board: make program

Crypto API Layer

The Crypto API Layer is a software interface to firmware on the RISC-V cores to interact with the user crypto co-processor. It is a firmware abstraction providing drivers and services enabling secure data handling, encryption/decryption and hashing and managing key storage, access control and secure boot integration. 

The HSS must be configured to include crypto services in the boot flow using the

CONFIG_USE_USER_CRYPTO=y

CONFIG_SERVICE_OPENSBI=y

CONFIG_SERVICE_OPENSBI_CRYPTO=y

within the .config or make config. Using SoftConsole, build the HSS with Crypto support using Kconfig to configure build options.

make BOARD=mpfs-icicle-kit-es config

Or default

make BOARD=mpfs-icicle-kit-es defconfig

This will build the hss-envm.elf file with the crypto services enabled. Then you just need to program the eNVM with

make program

In the HSS payload configuration (hss-payload-config.c), define signed payloads. 

{

    .name = "Linux",

    .type = HSS_Payload_Type_Linux,

    .src = HSS_Payload_Source_MMC,

    .signature = "linux.sig",

    .publicKey = "public.pem"

}

And the HSS will verify the signature using the crypto processor before loading the payload. For the application that runs Linux, enable the kernel options.

CONFIG_CRYPTO_DEV_POLARFIRE_SOC=y

CONFIG_CRYPTO_USER=y

CONFIG_CRYPTO_USER_API=y

CONFIG_CRYPTO_USER_API_SKCIPHER=y

Application Code

We provide a User Crypto Processor reference design that integrates with the PolarFire SoC’s RISC-V cores. The application code is designed to interface with the UCP via memory-mapped registers, perform cryptographic operations, and demonstrate secure boot and runtime protection. The reference design can be downloaded from the Microchip GitHub repository PolarFire SoC GitHub.

PolarFire Boot Modes

Authenticated boot is a mechanism by which software is checked for integrity and source authentication before execution. Verification of integrity ensures that data has not been modified. Modification includes the insertion, deletion and substitution of data/information. Authentication verifies the identity of the entity that created the data/information.

_{Figure 9 - Chain of Trust}

The boot-up sequence starts when the PolarFire SoC FPGA is powered-up or reset and ends when the processor is ready to execute a user application. This boot sequence runs through several stages before the execution of user programs begins. The MSS core complex can be booted in one of four modes. However, only two cover the authenticated boot of User Secure Boot and Factory Secure Boot.

_{Figure 10 - PolarFire SoC Boot Modes}

Bring Hardware/Software Together

Once the new project is started within SoftConsole and the .xml is imported the designer can complete the integration of the remaining software blocks to complete the flow. The full process is shown in the following diagram.

_{Figure 11 - Implementing PolarFire SoC Security}

Conclusion

The growing threat landscape in embedded systems demands a proactive approach to security. Our PolarFire FPGAs and SoC FPGAs provide a robust solution by integrating a multi-layered security architecture directly into the hardware. This approach moves beyond traditional software-based security, establishing a hardware root of trust that protects your design from a wide range of physical and digital attacks.

Engineers can leverage this comprehensive security framework to create confidentiality, integrity and authenticity throughout the entire product lifecycle. This approach provides design security to protect your intellectual property with anti-tamper features and a cryptographically secured supply chain so thatthe device is authentic and uncompromised. This also creates data security which safeguards sensitive data at rest and in transit using hardware accelerators and encrypted bitstreams, adhering to the principles of confidentiality, integrity and authenticity. This approach produces secure hardware with built with patented differential power analysis countermeasures and NIST-certified cryptographic algorithms, providing a secure, programmable platform for your design.

To take advantage of these hardware features, Libero and SoftConsole simplify the implementation process, allowing designers to configure security settings, manage cryptographic keys and establish a secure boot chain without needing to be a security expert. By adopting PolarFire FPGAs, you can build secure, reliable and energy-efficient systems for critical edge applications, safeguarding your designs and data in an increasingly connected world.