Security on the NI FPGA Compile Farm Server

Issue Details

I want to know what security features are available in the NI LabVIEW FPGA Compile Farm Server. The question typically comes up before deploying an NI LabVIEW FPGA Compile Farm on a shared corporate network, or before approving the deployment to handle sensitive design intellectual property. The compile farm accepts FPGA compilation jobs from LabVIEW developer computers over a network connection, and source files and compiled bitfiles cross the network in both directions. 

• Which user accounts can submit compilations, and how are permissions controlled?
• What piece of architecture is used to send the VHDL files from the client computer to the Farm Server?
• How is the design intellectual property in the VHDL source files protected while in transit?

Environment: LabVIEW 2021 and onwards, LabVIEW FPGA Module, LabVIEW FPGA Compile Farm Toolkit

Solution

1. Authentication and access control:
   The compile farm supports per-user authentication and role-based permissions through the Security Configuration section of the Compile Farm Console. The available pages are:
   • Users  accounts permitted to submit compilations or operate the server.
   • Groups group membership used to assign permissions to multiple accounts at once.
   • Permissions actions allowed for each group (for example, submitting compilations, viewing job status, or administering the server.
2. Transport security:
   The LabVIEW FPGA Compile Farm sits on top of the System Web Server, which carries all client-server traffic. The transport configuration is exposed in Web Server Configuration >> Web Servers.
3. IEEE 1735 encryption of design intellectual property:
   The intermediate VHDL files sent from the developer's computer to the compile farm are encrypted with IEEE 1735 before they leave the local file system. This is a base-level security feature applied to every compilation.
   
   • Files sent to the server: intermediate VHDL files (.vhd, .vhe).
   • Files returned by the server: the compiled bitfile (.lvbitx) placed in the project's FPGA Bitfiles folder, plus Xilinx_log and output_files.zip placed at C:\NIFPGA\compilation\<project folder>

Additional Information

IEEE 1735 is the IEEE recommended practice for encryption and management of electronic design intellectual property. NI applies IEEE 1735 encryption to VHDL files generated by LabVIEW FPGA so that the design IP is not exposed in plain text during transfer to or processing by the Xilinx toolchain.