200 likes | 372 Views
CoolRunner ™ -II CPLDs in Cell Phone Security. Overview. Application Example: Cell Phone Security Feature Overview Shadow RAM based CPLDs Background Mode Programming Demonstration. Wall Street Journal Article. Application Example: Cell Phone Security.
E N D
Overview • Application Example: Cell Phone Security • Feature Overview • Shadow RAM based CPLDs • Background Mode Programming • Demonstration
Application Example: Cell Phone Security • SIM based cell phones such as those in Europe are a high priority target for thieves • User is identified by SIM card in phone • Thief steals phone, removesSIM • Sells phone
Subscriber Identity Module (SIMs) • Subscriber Identity Module block diagram • ISO 7816 for original • New models: UIM, R-UIM VCC E2PROM CPU CLK RST I/O RAM ROM GND SMART CARD Technology
Bullet Proof Security? • Absolute security is just not possible • With enough time, money and resources, determined thieves can always find a way • However... • By increasing the difficulty/risk of the theft, it is possible to increase the ‘cost’ of the crime such that it is not economically viable • How can CoolRunner-II CPLDs help?
CoolRunner-II CPLD Advanced Features • CoolRunner-II CPLDs contain “designer friendly” new features that add value to the CPLD product line • DualEdge Flip Flops • Clock Divider • Schmitt Trigger inputs • DataGATE • Four levels of security • OTF Reconfiguration
Traditional CPLDs - bipolar sense amp product terms Always consumes power Even at standby Performance is traded for power consumption as devices get larger CoolRunner-II RealDigital design uses 100% CMOS for product terms Virtually no standby current Combines high performance & ultra low power No power limits on device size Turbo vs Non Turbo Larger R = slower response & less power Vcc A B C A C B D Sense amplifier 0.25mA each - Standby Higher ICC at Fmax RealDigital : CMOS Everywhere - Zero Static Power RealDigital™ Design Advantage
A B C D RealDigital Configuration Method • Sense amplifiers are required to read from NV memory • Once configuration data captured in SRAM cell, NV memory is turned off Vdd A A From non-volatile
Two Configuration Storage Areas • At time of power up (or ISP forced initialization) data is transferred from NV block to SRAM block • After initialization, NV block contents have no influence on device operation • NV Block may be modified while part is running, with no effect on operation of PLD • Data transfer from NV to SRAM occurs in ~30 to 200 us NV SRAM 100101100101001110101010101011110
An Opportunity for Innovation • Since the operation of the device is controlled completely by the SRAM contents, and • Since the EE portion of the device has no bearing on the operation of the CPLD once configuration is complete, therefore: • It is possible to reprogram the NV portion of the CPLD while the CPLD is running and fully operational! • This background mode programming is known as On The Fly (OTF) reconfiguration
Take a Byte Out of Crime…. Microproc. • Insert CoolRunner-II CPLD into mission critical aspect of phone, and interface to SIM card JTAG JTAG VCC ROM CLK CPU SIM I/O E2PROM RAM RST CoolRunner-II GND Keyboard, display interface, or RF controller Mission Critical Feature
Basic Handset Flow • User must know security code to switch out SIM cards • Incorrect code results in disablement Phone operable Y N SIM Match? Enter User Code Y Accept New SIM N Perform Self Erase Code Match?
Self Erase • CoolRunner-II CPLD can operate independent of NV contents or manipulation of NV memory • CPLD can modify its own contents as part of the normal operation • Three I/O pins are tied to TDI, TMS, TCK • These three pins manipulate the JTAG signals to produce a bulk erased device
Self Erase (cont.) • Simple state machine indexes through and drives TDI,TMS, and TCK. • Some timers exist to produce required ‘burn time’ delays. • After programming EE array, device initiates an ‘Init’ command • Part erases itself using design requiring only 27mc (75 states and a few timers) • Easily fits into smallest CoolRunner-II CPLD
Generation of OTF Files • Obviously, self erase is a small, intensely specific application • How would other, more complicated reconfigurations be generated?
OTF via IMPACT • IMPACT is the ISP configuration utility provided by Xilinx • Typical use is direct ISP operation: Erase, Program, Verify, Blank Check etc. • Users may modify their SVF file to function as OTF by making a simple modification to the SVF file
Enabling OTF • In normal SVF flow, select “On-The-Fly Program” to generate appropriate SVF file
Demonstration • A small demo board has been created to illustrate this capability • Please allow us to play a brief movie showing the operation of this board
Summary • CoolRunner-II CPLDs contain inherent features that facilitate innovative application • Additional design measures can be used to increase level of security • OTF also useful in other applications • PicoBlaze • Design for Test automation • Any design where rapid reconfiguration is needed • Questions?