David Clift
FirstEDA
Blog: How to Secure your IP with IP Encryption
Being able to secure your Intellectual Property (IP) is critical, since your designs represent a significant investment in research and development
—
Aldec supports the encryption of both VHDL and Verilog. It was added to the Verilog standard in Verilog-2005 and became part of VHDL in 2008. Both HDL encryption methodologies are similar, in that they use asymmetric encryption, that is you require both a Public Key for encryption and a private key for decryption. It should go without saying that you should not divulge your Private Key.
For this example explanation, we will look at VHDL IP protection, but Verilog is very similar.
The first thing we need to do is define the protection envelopes – this allows you to select which parts of the HDL should be encrypted. This could be the complete file, to hide everything, or it could be just the architecture, thus hiding just the workings of your IP, but allowing the user to see the interface of the entity.
For VHDL, the encryption envelope is described as follows:
`protect begin
`protect end
After encryption, these regions will comprise the specification of the cryptographic algorithm, key, envelope attributes, and encoded design data.
Encryption tools should be able to recognise and use public keys of tools/vendors authorised to use the IP placed directly in the source code. To guarantee proper recognition by the target tool, the public key should be clearly labelled with the key owner name, the key name, and the encryption method.
The example of the public key properly marked in the VHDL code is shown below:
`protect key_keyowner = "Aldec"
`protect key_method = "rsa"
`protect key_keyname = "ALDEC15_001"
`protect key_public_key
-- place the ALDEC public key here
`protect key_block
To obtain the Aldec public key, please refer to ‘ALDEC Public Key’, in either the Riviera-PRO or Active-HDL user manuals. If you are using the Aldec IP encryption tool however, you will not need to specify the public key (see the example below).
Aldec also provides a stand-alone tool called ‘protectip’. We can run this from the console in Active-HDL or Riviera-PRO with the following command:
!protectip -vhdl Example1.vhd -out Example1.vp
This will take a file (Example1.vhd) with a protection envelope and encrypt it into file Example1.vp. This can then be compiled into the library with:
acom Example1.vp
Please note if you add this file to your design and attempt to compile it by double-clicking on it, it will fail as the Aldec GUI will see .vp files as Verilog, hence why I invoked the VHDL compiler directly in the command line. All you need to remember to do now is to distribute the encrypted file and keep the original safe.
The original design and the encrypted result are shown below:
library ieee;
use ieee.std_logic_1164.all;
entity Dff is
port (
clk : in std_logic;
Rst: in Std_logic;
D : in std_logic;
Q : out std_logic;
Qn : out std_logic );
end entity Dff;
`protect begin
architecture RTL of DFF is
signal iQ : std_logic;
begin
process(Clk, Rst)
begin
if Rst = '1' then
iQ <= '0';
elsif rising_edge(clk) then
iQ <= D;
end if;
end process;
Q <= iQ;
Qn <= not iQ;
end RTL;
`protect end
library ieee;
use ieee.std_logic_1164.all;
entity Dff is
port (
clk : in std_logic;
Rst: in Std_logic;
D : in std_logic;
Q : out std_logic;
Qn : out std_logic
);
end entity Dff;
`protect begin_protected
`protect version = 1
`protect encrypt_agent= "Aldec protectip", encrypt_agent_info= "Riviera-PRO 2020.04.130"
`protect key_keyowner= "Aldec", key_keyname= "ALDEC15_001", key_method= "rsa"
`protect encoding= (enctype="base64", line_length= 76, bytes= 256)
`protect key_block
MLvqxdQeMCc01rfi0Y2j7oWlvoSJu/tugRz8nbQWjfc0s0ZloYEsXQEwleIyFxRAAb/sVstKyR0Q
K9UtsHEsHa1Y7g56QuUYBOdQpYG69dMqqet/N/+dEDb6bcAsdDDLrNEEzRVcqwRkKUzuLea4mKOP
8YL0J91Yw5ec2I3dbkwKeAIYR/gBcPA1KCwnL/iq5QbhYA8nleogWNaNLjjYIrgZ4iZBWxkSag5O
UexaHVHCMmb8mAafJMDHHvhflHgsWXKc8FPgmnksbUJJlc/uBMn/f8AtTRIUD2nFzb5u6DIh+fnV
oVcEPFaC4XIKiYoBeheGByVjSz3y4XrAmLPQBr==
`protect data_method= "aes128-cbc"
`protect encoding= (enctype="base64", line_length= 76, bytes= 288)
`protect data_block
GbzQ3trQGD4fRnAAjvYgUI0f6kvxp15Tpx1LSvqaTY7p+YbaHvM/q7Rc8KSqGWE3IjMuz6kKEGkN
OK/yniG0kw08DvsewTBaroCvJs3RO5goDaBgRjikIgPp7pW4D+Gr1JQ5iwjSvFeYZ31MSxIXIcaZ
GF43HCJN25DkIcBj/uwvqQO8aiTVouJLeTw6B27BSyWRxGYEePzVLzLjOovB1JU+SuXWueW6NUe7
2+DQ8zgHWUvshi1UM5V71S/WP1uqpM/VOAhpqrBqcOIQWFzUS35AFUxohL4KLPZJ5QO9hob78T8d
5UF4dg90O6AX0YfGO55YXHHFQGIspyYA6/RmSw1+WCxw7DIjrzuJre6akrg05Rj2k3K8oIjJNMOl
BUfc
`protect end_protected
I hope that you have found this insight helpful and if you would like to discuss further then please contact us.