Forum Discussion

BSusi's avatar
BSusi
Icon for New Contributor rankNew Contributor
6 years ago

How to use ekp as persistent master key on MAX 10.

I've tried to develop a secure FPGA environment with master key (8.ekp) and encrypted ROM image (*.pof). The idea is to program the master key once before the FPGA left to the customer and the (*.pof...
JohnT_Altera's avatar
JohnT_Altera
Icon for Regular Contributor rankRegular Contributor
6 years ago

Hi,

  1. The ekp content is store in the ICB portion and not on CFM. If you would like to prevent it from erasable then JTAG Secure mode is the most suitable method as this will disable JTAG from accessing it.
  2. Any system can enable it. I would recommend you to use "On-Chip Flash Intel FPGA" IP (https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/hb/max-10/ug_m10_ufm.pdf) for you to update the CFM content. This will prevent user from accidentally erasing the EKP. Since you plan to performed filed upgrade then I would recommend you to use "Dual Configuration" IP so that you have a golden design that you are able to revert to in case there is a corrupted image during field upgrade. By using this method, JTAG Secure mode can also be enabled without any issue as we no longer using JTAG to update the CFM. The only thing that you need to do is to design a interface that you can use to remotely communicate (other than JTAG) and connect it to "On-Chip Flash Intel FPGA" and "Dual Configuration" IP. You may refer to https://www.intel.com/content/dam/www/programmable/us/en/pdfs/literature/an/an741.pdf which is using UART interface to performed remote upgrade.