In the Latticesemi official account, 5 ways FPGAs can achieve network resilience are mentioned
Cyber resilience, or cyber resilience, feels directly related to crypto security.
The advantages of FPGAs are flexibility, programmability, and parallel processing capabilities, so cyber resilience can be achieved by protecting systems and data from attacks.
1. Flexibility: FPGA is easy to update
This is common sense, so I won't study it in detail.
2 硬件可信根(HRoT)
Secure FPGAs can be highly efficient HRoT devices
Hardware Root of Trust: The more common Chinese translation is the hardware root of trust.
A root of trust is an immutable process or identity that serves as the first entity in a chain of trust. As a result, there is no ancestor entity that can provide trusted proof (in digest or otherwise) of the initial code and data state of the root of trust. In other words, the embedded developer's root of trust is an immutable identity and minimal set of software that can successfully authenticate itself and facilitate secure operations on the system.
The root of trust prevents the following activities:
1) Device cloning
2) Load unauthorized firmware
3) Load malware
4) Establish a root of trust
The foundation of trust starts with the bootloader on the ROM code and hardware, provided by the manufacturer. Where the bootloader public key is stored depends on the board implementation, but typically implements some sort of system-on-chip (SOC) security, such as one-time programmable memory (OTP) or Trusted Platform Module (TPM) hardware. Once the ROM confirms the bootloader signature, the bootloader starts. Each process is then verified by a signature and at that point the process is trusted to run in the system. This is the standard root of trust implemented on most Linux systems (desktop or embedded).
3 Platform Firmware Resiliency (PFR)
When a firmware attack is detected, the FPGA can load a golden image of the authorized firmware to overwrite the unauthorized version.
What is a Golden Image?
Golden Image: A virtual stencil from which you can build a distributable model.
Once the software has been compiled and tested repeatedly, the perfect build is declared as a gold version, no further changes to it are allowed, and all distributable copies are generated from this version.
In an organization, the OS that has important settings in place can be the most golden image
In a virtual machine, a golden image with a well-configured virtual drive is the source of all cloned new virtual machines.
Rather than repeatedly checking and auditing each device (or abandoning it altogether), it is better to determine the trustworthiness of the software image through a thorough audit once and load and distribute it as a "golden image" on each device.
Loading a clean "golden image" into a device goes a long way in ensuring trust in the device, and in this way, there is good reason to be confident that the software running on the device has been audited and is secure.
Intel PFR（platform firmware resilience）简介：
PFR is a security technology designed by Intel to support the security requirements of NIST SP 800-193 documentation, and is designed to protect platform assets, detect malicious or erroneous behavior such as corrupted firmware, and restore platform firmware to good condition.
PFR uses a piece of CPLD as the core of the overall PFR technology and defines a special pre-start state T-1 (T minus 1). After the system is powered on, it first enters the T-1 stage, at this time, all other firmware with possible boot interfaces (PCH, CPU, ME, BMC, etc.) are in the reset state, only PFR CPLD is powered on, and PFR CPLD first verifies the BMC FLASH and BIOS FLASH. If the verification fails, the PFR CPLD erases the FLASH area where the verification fails, uses the image file to restore the FLASH data, and enters the normal boot mode of Bootguard after the verification is successful, and then the T0 mode is displayed. In T0 mode, PFR CPLD will monitor and filter SM BUS and SPI data, and developers can set a whitelist, and data that does not meet the whitelist rules will be blocked from being transmitted or written to FLASH, which has achieved the purpose of filtering malicious data.
According to the information found, this point corresponds to the BMC engineers in the actual project, who do the most basic management of the hardware version and authorization.
4 Supply Chain Protection
Using factory-locked ICs, system architects ensure that their programs are copy- and tamper-proof. This means that you can use the FPGA's cryptographic numbering function to determine which FPGA is authorized, is sold normally and is within the after-sales protection, which has been encountered in the work.
5 Post-quantum cryptography implements PQC
FPGAs can resist PQC-based networks by simplifying PQC migration with agile cryptographic capabilities and PQC algorithms.
This is cutting-edge and involves cryptographic security.
Experts have previously warned that in 2026, the use of quantum computers to crack existing public key systems will only succeed once in seven times, but by 2031, the chance will increase to 1 in 2.
Although there is still some time before the day of quantum cryptography, there are now some practices that can be used to combat quantum computer attacks, among which the post-quantum cryptography (PQC) is the most important.
He mentioned that there are two advantages to using PQC systems, one is that it is less expensive to build and develop, and can be directly used in existing computers and systems, and the other is that it can incorporate a digital signature mechanism using public key cryptography.
In order to be able to compete with quantum computer attacks, PQC itself also integrates multi-domain cryptography knowledge, including coded cryptography, grid cryptography, multivariate cryptography, hashed cryptography, and ultra-universal elliptic curve homologous cryptography.
Now, there are also countries that are developing new standards that are to be used to counter future quantum computer attacks. For example, the National Institute of Standards and Technology (NIST), which developed AES and DES encryption standards, has been working on the national standard for PQC for several years. After three years of formulation, a while ago, NIST announced 7 PQC algorithms that entered the final election, of which 4 are encryption and decryption algorithms, namely Classic McEliece, CRYSTALS-KYBER, NTRU, SABER, and the remaining three are digital signatures, including CRYSTALS-DILITHIUM, FALCON, and Rainbow. In the future, encryption, decryption and digital signature standards will be selected from this, which will become the new standard for the United States to combat quantum computer attacks.
Chen Junming estimates that in about a year to a year and a half, the new standard will be determined, and once it is formulated into the American national standard in the future, these standards will soon become international standards and be used around the world, and at that time, it will replace the existing public key cryptography system, which also means that it will greatly impact the services and applications that use public key cryptography to encrypt and decrypt, such as bitcoin and natural person credentials, will need to be replaced with PQC as a new standard for digital signatures in the future.
