  Cloud computing platforms are progressively adopting Field Programmable Gate
Arrays to deploy specialized hardware accelerators for specific computational
tasks. However, the security of FPGA-based bitstream for Intellectual Property,
IP cores from unauthorized interception in cloud environments remains a
prominent concern. Existing methodologies for protection of such bitstreams
possess several limitations, such as requiring a large number of keys, tying
bitstreams to specific FPGAs, and relying on trusted third parties. This paper
proposes Aggregate Encryption and Individual Decryption, a cryptosystem based
on key aggregation to enhance the security of FPGA-based bitstream for IP cores
and to address the pitfalls of previous related works. In our proposed scheme,
IP providers can encrypt their bitstreams with a single key for a set S of FPGA
boards, with which the bitstreams can directly be decrypted on any of the FPGA
boards in S. Aggregate encryption of the key is performed in a way which
ensures that the key can solely be obtained onboard through individual
decryption employing the board's private key, thus facilitating secure key
provisioning. The proposed cryptosystem is evaluated mainly on Zynq FPGAs. The
outcomes demonstrate that our cryptosystem not only outperforms existing
techniques with respect to resource, time and energy significantly but also
upholds robust security assurances.
