Contact

FPGA Security Engineering Services

Design and implement security for your FPGA-based product.

We help product teams design secure FPGA and adaptive SoC architectures, integrate cryptographic hardware and implement secure boot, updates, key management and protected communication.

Engage us for an architecture review, proof of concept, defined implementation task or complete FPGA security development.

Discuss your FPGA security project

Security across the complete FPGA lifecycle

FPGA security extends beyond adding a cryptographic core. The configuration process, boot chain, key storage, processor subsystem, external memories, debug interfaces and field-update mechanism must form a consistent security architecture.

We help you identify platform-specific risks and implement security mechanisms across FPGA logic, embedded software and hardware interfaces.

Protect bitstreams and firmware against manipulation and extraction

Establish a trusted boot and update chain

Integrate cryptographic hardware within resource and timing constraints

Protect keys, interfaces and debug access throughout the product lifecycle

FPGA security engineering services

We support FPGA development teams throughout the product lifecycle from security architecture and RTL integration to secure provisioning, field updates and compliance preparation. You can engage us for the complete process or for a clearly defined part of your development project. 

Security architecture

  • Threat modeling and attack-surface analysis

  • Security gap analysis and derivation of device requirements
  • Secure partitioning of FPGA logic, processors, memories and interfaces

  • Root of Trust and key-management concepts

Secure boot and updates

  • Secure boot chains for FPGA bitstreams, bootloaders and firmware
  • Bitstream authentication and optional encryption
  • Signed updates, anti-rollback, recovery and fallback
  • Secure key storage and update-key management

Secure provisioning and lifecycle

  • Secure device identity and key provisioning
  • Key storage using eFuse, OTP, BRAM, PUF or secure elements
  • JTAG, debug and bitstream-readback protection

Secure RTL & IP integration

  • Integration of crypto and security IP cores

  • AXI interfaces, HAL, drivers and hardware/software partitioning

  • Optimization for LUT, BRAM, DSP, timing and throughput constraints

Secure communication

  • Integration of cryptographic functions into Ethernet and IP data paths 

  • Hardware/software partitioning for MACsec, IPsec and key management

  • Hardware acceleration and integration into Linux, RTOS or bare-metal systems

Verification & compliance readiness

  • Functional simulation and processor-driven verification

  • Boot, update and failure-path validation

  • Resource, timing and throughput measurements

  • Technical security and implementation documentation

What you get

Depending on the agreed project scope, we deliver the engineering results required for implementation and verification.

FPGA security architecture and threat model

RTL modules or integrated FPGA design

IP-core configuration and integration

Embedded firmware, HAL, drivers and APIs

Secure boot or update implementation

Resource, timing, performance and verification results

Technical implementation and security documentation

FPGA platforms and engineering expertise

Our FPGA security work combines RTL development, embedded software and cryptographic engineering. We support processor-based FPGA SoCs as well as pure-RTL designs, from architecture and IP integration to simulation and hardware validation.

FPGA and embedded engineering

  • SystemVerilog and VHDL RTL design
  • RTL simulation and functional verification
  • AXI-based IP and processor integration
  • FPGA prototyping and hardware-in-the-loop testing
  • HW/SW co-design, HAL and driver development

Security engineering

  • Secure boot and bitstream protection
  • Cryptographic and PQC hardware
  • Protected communication and key management
  • Secure provisioning and lifecycle protection
  • Resource-, timing- and performance-aware security design

Platform and architectures

  • Altera, AMD/Xilinx, Efinix, Lattice, Microchip FPGA platforms

  • ARM and RISC-V based SoC systems

  • FPGA SoCs, softcore processors and pure-RTL architectures

  • Embedded Linux, RTOS, and bare-metal integration

Use cases 

Our expertise in the fields of embedded security and FPGA design is build on real-world client project engagements involving FPGAs, custom SoCs and processor-based solutions.

Implementation of an IPsec/IKEv2 communication architecture on an AMD Zynq-7045 SoC, partitioning security functions between the processor system (PS) and programmable logic (PL).

IKEv2 and key management functions run in Linux on the processing system, while the performance-critical IPsec data plane is accelerated in the FPGA fabric. AES-GCM is implemented in programmable logic to provide hardware-accelerated authenticated encryption of IP traffic.

Scope:

  • IPsec/IKEv2 architecture and HW/SW partitioning
  • IKEv2 and key management in Linux
  • IPsec data-plane acceleration in programmable logic
  • Hardware-accelerated AES-GCM
  • Integration on AMD Zynq-7045 SoC
  • System integration and validation
  •  

KiviCore evaluated for a customer whether ML-KEM hardware acceleration could be integrated into an existing AMD Zynq UltraScale+ based industrial gateway within tight FPGA resource constraints. A hardware prototype on the target platform validated resource fit and cryptographic performance and provided the basis for a phased PQC migration roadmap.

Scope:

  • ML-KEM prototype on the target FPGA
  • Resource and performance validation
  • System integration analysis
  • Data-driven migration roadmap

Implementation of a secure boot solution on an Efinix Titanium Ti375 FPGA SoC. The solution establishes a chain of trust during system startup and ensures that only authenticated software is executed.

Scope:

  • Secure boot architecture
  • Chain-of-trust design
  • Cryptographic verification of software images
  • Integration into the platform-specific boot process
  • Implementation and validation on Efinix Titanium Ti375

Integration of MACsec and MACsec Key Agreement (MKA) into FPGA-based communication system. This includes security architecture, hardware/software partitioning and the integration of cryptographic functions into existing Ethernet data paths.

Scope:

  • MACsec and MKA architecture and integration
  • Hardware/software partitioning for FPGA SoC
  • Integration of cryptographic functions into Ethernet data paths
  • Key management and authentication concepts
  • System integration, testing and validation

Explore our security packages

Envelope

Discuss your FPGA security project

Tell us about your FPGA platform, current development stage and security challenge. We will discuss how we can support your project.

Talk to an engineer