.webp){kind=small}
Technology Solution
Security
Trust anchored in silicon, crypto at line rate, and a security model you can update in the field.
Optimized FPGA Security for Every Node
Security requirements are entering a new phase. Algorithms are changing, and equipment shipping today will outlive the ciphers inside it – post-quantum standards are arriving mid-lifecycle, for systems already in the field. The EU Cyber Resilience Act and similar regulation now put update obligations on products long after they ship. Trust has to start at the factory, often at a contract manufacturer, and hold through a decade of updates and field service. Every node added makes key management harder.
Fixed silicon can't change after tape-out, but your security needs to. Altera® Agilex® and Stratix® 10 FPGAs are built for that shift – trust anchored in silicon, and a security model that stays updatable in the field.
The Challenges, and Why FPGA
The Challenge
Ciphers Expire Before Products Do
Cipher suites get deprecated on a schedule no product roadmap controls. An ASIC commits at tape-out and holds that choice for the life of the product.
Why FPGA
Reprogrammable Cryptography
Programmable logic implements crypto in reconfigurable fabric, so a new algorithm is a bitstream update rather than a new mask set.
The Challenge
Software Trust Starts Too Late
Software-based trust starts after boot, which is already too late. Keys provisioned at a contract manufacturer must never be exposed on the line.
Why FPGA
Trust Anchored in Hardware
A hardware root of trust in immutable silicon authenticates the device's own configuration before any logic comes alive, including provisioning.
The Challenge
Encryption That Costs Latency
Encryption bolted on in software costs latency at every hop, and the penalty grows as ports move from 100G to 400G and 800G.
Why FPGA
Shared Hardware, Isolated Tenants
Clouds run many customers' workloads on the same hardware. Each tenant must stay isolated, and the operator needs proof the device runs only what was deployed.
The Challenge
Hardware-Enforced Isolation
Agilex and Stratix 10 FPGAs partition tenants in silicon, with hardware identity management and authenticated bitstreams and partial bitstreams.
Why FPGA
Hardware Isolation
Partition tenants in silicon with authenticated bitstreams and partial bitstreams, so workloads can change at runtime while staying isolated.
Why Altera
Flexible Firmware-Driven Security Subsystem
Altera's Secure Device Manager (SDM) serves as the central command center for the FPGA fabric, hard processor system (HPS) in SoCs, embedded hard IP blocks, and I/O blocks. The SDM controls key operations: configuration, device security, single event upset (SEU) responses, and power management.
Network Security
Agilex FPGAs with 200G (half-duplex) hard crypto blocks and MACsec IP for physical and data link layer protection capabilities help meet the growing demand for security at every node in a network system.
Endpoint and Industrial Security
Endpoints must be secured from malicious commands and malware. Hardened authentication capabilities (in both hard and soft logic) built into Stratix 10 and Agilex FPGAs help protect against remote attacks, and hardware command/control logic reduces the attack surface compared with software-only updates.
Post-Quantum Ready, Shipping Today
Post-quantum cryptography (PQC)-enabled secure boot on Agilex 3 and Agilex 5 devices, with a Quartus® Prime Pro Edition software v26.1.1 flow, anchors trust for a decade.
Get Started
Common Questions
Authentication checks that a configuration image is authorized and unmodified, while encryption protects its contents from disclosure. A design may need both, with supported key provisioning and recovery policies for the selected device.
Use hard crypto when the selected device's supported algorithms, rates and interfaces meet the requirements. Fabric IP allows different supported functions or updates but consumes logic and needs its own timing and security validation.
Crypto agility updates supported algorithms or policies in programmable logic or firmware. It does not imply that immutable silicon capabilities can change; evaluate configuration authentication and traffic cryptography separately for the exact device.
Provisioning needs the device's supported secure process, authorized tools and protected handling of credentials and ownership. Verify exposure risks, access controls and audit evidence for the actual manufacturing flow rather than relying on a generic hardware-trust claim.
Use the selected device's documented recovery and fallback mechanisms, preserving a known authorized image. Investigate image signing, version policy, key status and configuration error reports before retrying an update.