Embedded Systems Security Guy GOGNIAT guy.gogniat@univ-ubs.fr - - PowerPoint PPT Presentation

▶
embedded systems security
SMART_READER_LITE
LIVE PREVIEW

Embedded Systems Security Guy GOGNIAT guy.gogniat@univ-ubs.fr - - PowerPoint PPT Presentation

Nov 01, 2023 426 likes •1.02k views

Session Scurit Informatique - Mercredi 28 mars 2007 Embedded Systems Security Guy GOGNIAT guy.gogniat@univ-ubs.fr Journe 2007 de la section lectronique du club EEA SiP et SoC : nouvelles perspectives, nouveaux dfis Session

slide-1
SLIDE 1

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Embedded Systems Security

Guy GOGNIAT guy.gogniat@univ-ubs.fr Journée 2007 de la section électronique du club EEA SiP et SoC : nouvelles perspectives, nouveaux défis Session Sécurité Informatique Mercredi 28 mars 2007

slide-2
SLIDE 2

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-3
SLIDE 3

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-4
SLIDE 4

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Cryptography primitives

  • Confidentiality
  • Data and messages
  • Integrity
  • Data and messages
  • Authentication
  • Users and hosts
  • Symmetric cryptography
  • AES, DES/3DES, RC5
  • Hashing function
  • MD5, SHA-1, SHA-2
  • Asymmetric cryptography
  • RSA, ECC
slide-5
SLIDE 5

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Symmetric encryption

  • Block cipher

Encryption (E)

Plaintext P Ciphertext C=EKe(P) n Ke P=DKd(C) n n

n-bit

Ke

Decryption (D)

n

slide-6
SLIDE 6

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Asymmetric algorithm

slide-7
SLIDE 7

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

  • 1. Public key (size 1024 or 2048 bits)

Compute e as “PGDC(n,e) = 1”

  • 2. Private key
  • 3. Ciphering requires e and n
  • 4. Deciphering requires d and n

Adleman Rivest Shamir

q p n

  • =

( ) ( ) ( )

1 1 mod

1

  • =
  • q

p e d

n m c

e mod

=

n c m

d mod

=

RSA

Three researchers from MIT, Ron Rivest, Adi Shamir and Len Adleman have patented in 1983 the RSA algorithm

slide-8
SLIDE 8

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Hashing function

  • Prof. Robert this message to

confirm our meeting tomorrow at 1 pm at my office

  • Prof. Robert this message to

confirm our meeting tomorrow at 9 pm at my office Initial message Received message 215e781c0c3f7d1353518bd5f649805b Digest of the initial message 0601e38b93c1cc1c1a4b87dd8771b452 Digest of the received message

  • Both digests are different
  • Someone has modified the message
  • There been an error during the communication
slide-9
SLIDE 9

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007 COMP

Integrity Checking

H(M)

Message M Tag T Alice Bob Unsecured channel (M; T) (M; T) M T Integrity Flag K

  • Principle:

Meeting at 7h00 am in … Meeting at 7h00 am in …

  • Hash functions:

 Compression function  One-way function  gives a compact representative image of the input

  • MAC(*) functions: take a secret key as additional input to authenticate the source of the message.

(*) Message Authentication Code

H(M)

Hash function

hi-1 Message Mi message digest hi = f(Mi, hi-1)

MAC function

K

T’

Tag reference

slide-10
SLIDE 10

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-11
SLIDE 11

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Many sensitive data will be embedded

slide-12
SLIDE 12

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Classification of attacks

Power consumption Analysis Timing analysis

Electromagnetic emission analysis Chemical attack

  • f the chip

Chip cutting Variation of Vdd or T° Glitch attack (power, clock) Black Box Logic bomb Trojan horse Virus Worm

Hardware attacks Software attacks

Physical Irreversible (invasive) Physical Reversible (non-invasive) Side-channel (non-invasive)

Active attacks Passive attacks

slide-13
SLIDE 13

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Processor-Memory Transactions Vulnerabilities

  • Most embedded systems use off-chip memories
  • Data and instructions are exchanged in clear over the processor-memory

bus

Address bus Data bus

SoC

(Trusted) External Memory

  • Objectives: Ensure the confidentiality and the integrity of data stored in
  • ff-chip memories and transferred on SoC memory interfaces
  • Threats:

 Unauthorized data reads  Code injection or data alteration  Memory tampering

Trusted Area

slide-14
SLIDE 14

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Passive Attacks

Address bus Data bus

SoC

(Trusted) External Memory

  • Bus probing – eavesdropping [1]

0101000100010000011100100 1

Add Data / Instruction

0101000100010000011100100 1 0111010101010001011100100 1

0x00000010

0111010101010001011100100 1

0x080ff0fa

[1] M. G. Kuhn, “Cipher Instruction Search Attack on the Bus-Encryption Security Microcontroller DS5002FP” IEEE Trans. Comput.,

  • vol. 47, pp. 1153–1157, October. 1998.
slide-15
SLIDE 15

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Passive Attacks

  • Attacker motivation:

 Off-line analysis:

  • Key recovery
  • Message recovery

 Raw materials for active attacks…

Address bus Data bus

SoC

(Trusted) External Memory

0101000100010000011100100 1

Add Data / Instruction

0111010101010001011100100 1

0x00000010 0x080ff0fa 0x00000014 0x0ab820ff 0x00000018 0x0000001C 0x00000020 0x080112f4 0x102bcd0f 0x11ff11ab

  • Bus probing – eavesdropping [1]

[1] M. G. Kuhn, “Cipher Instruction Search Attack on the Bus-Encryption Security Microcontroller DS5002FP” IEEE Trans. Comput.,

  • vol. 47, pp. 1153–1157, October. 1998.
slide-16
SLIDE 16

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Active Attacks

Address bus Data bus

SoC

(Trusted)

 Spoofing: Random data injection

Memory

  • Code and data injection

External Memory Malicious Memory

  • Three kinds of active attacks are defined depending on the choice made by the

adversary on the data to insert:

slide-17
SLIDE 17

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Active Attacks

  • Code and data injection

 Spoofing: Random data injection  Splicing: Spatial permutation

Memory

Data(@2) Data(@3) Data(@4) Data(@5) Data(@6) Data(@7) Data(@8) Data(@7) Data(@7)

SoC

(Trusted)

  • Three kinds of active attacks are defined depending on the choice made by the

adversary on the data to insert:

Address bus Data bus

Data(@1)

External Memory Malicious Memory

slide-18
SLIDE 18

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Data(@7, t1)

Active Attacks

  • Three kinds of active attacks are defined depending on the choice made by the

adversary on the data to insert:

Address bus Data bus

SoC

(Trusted)

  • Code and data injection

 Spoofing: Random data injection  Splicing: Spatial permutation  Replay: Temporal permutation

Memory

Data(@2, t1) Data(@3, t1) Data(@4, t1) Data(@5, t1) Data(@6, t1) Data(@8, t1) Data(@1, t1) Data(@4, t1) Data(@1, t4) Data(@3, t8) Data(@4, t7) Data(@6, t6) Data(@7, t4) Data(@2, t9) Data(@4, t1) Data(@4, t1)

External Memory Malicious Memory

slide-19
SLIDE 19

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Active Attacks

  • Three kinds of active attacks are defined depending on the choice made by the

adversary on the data to insert:

Address bus Data bus

SoC

(Trusted)

  • Code and data injection

 Spoofing: Random data injection  Splicing: Spatial permutation  Replay: Temporal permutation

  • Attacker motivation:

 Hijack the software execution  Reduce the search space for key recovery or message recovery

External Memory Malicious Memory

slide-20
SLIDE 20

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory

Transactions for Embedded Systems

  • PE-ICE/ Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-21
SLIDE 21

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

PE-ICE Principles1

  • PE-ICE: Parallelized Encryption & Integrity Checking Engine

 Only 1 pass over the data to provide both data confidentiality and integrity.  Tag are not computed over the data

  • Confidentiality is ensured by block encryption

 Rijndael (J.Daemen, V.Rijmen) – AES (NIST(*) standard)

  • Data integrity checking relies on the diffusion property of block encryption:

P T Block Encryption (Ek) Ciphered (P;T)

 AREA (Added Redundancy Explicit Authentication) applied at the block level

 Redundancy is inserted in each plaintext block before encryption  Redundancy is checked after each block decryption

(*) NIST: National Institute of Standard and Technology AES: Advanced Encryption Standard

1Hardware Mechanisms for Secured Processor-Memory Transactions for Embedded Systems, Reouven Elbaz

December 2006

slide-22
SLIDE 22

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

SoC: Trusted area

Memory Controller

External Memory

CPU

Cache

PE-ICE

Memory Block Encryption

RV Generator

PE-ICE for Read Write Data

C: Ciphered memory block

  • Write operations: The redundancy is added in each plaintext block

RV’

C = Ek (PL || RV) RV’ RV

slide-23
SLIDE 23

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

SoC: Trusted area

Memory Controller

External Memory

CPU

Cache

PE-ICE

Ciphered memory block

Memory SoC: Trusted area

Memory Controller

External Memory

CPU

Cache

PE-ICE

Memory Block Encryption

RV Generator

PE-ICE for Read Write Data

C: Ciphered memory block

Block Decryption

COMP

OK?

  • Write operations: The redundancy is added in each plaintext block
  • Read operations: The redundancy is checked after decryption

RV’ RV’

C = Ek (PL || RV) PL || RV = Dk(C) T’ = RV’ T = RV T’ = T ? RV’ RV

slide-24
SLIDE 24

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

PE-ICE: Simulation Results

0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1 ADPCM DES Finger Print MP2Audio CJPEG DJPEG MP3 player Huffman

(a) 4KB Normalized (to Baseline) IPC

0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1 A D P C M D E S F i n g e r P r i n t M P 2 A u d i

  • C

J P E G D J P E G M P 3 p l a y e r H u f f m a n

(b) 128KB Normalized (to Baseline) IPC

Degradation

AES PE-ICE GC(AES+CBC-MAC)

slide-25
SLIDE 25

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs

Bitstream

  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-26
SLIDE 26

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Configurable Computing Security Space

Attacks

  • Secure Configurable System
  • The whole system is configurable.

The security is provided by the agility of the whole system Attacks

  • Configurable Design Security
  • Protect the configurable

computing configuration Attacks

  • Configurable Security Primitive
  • Use configurable computing primitive

to protect a system, the module is seen as an agile hardware unit

slide-27
SLIDE 27

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

SRAM FPGA

  • Really reconfigurable !
  • Need of a bitstream transfer upon power-on, security sensitive

The pirate can“read” the bitstream Solution: Bitstream encryption ...

slide-28
SLIDE 28

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Xilinx Solution

  • Need of an external

battery to save the keys

  • The decryption

circuit takes FPGA resources (silicon)…

  • No flexibility for the

decryption algorithm

  • Partial

reconfiguration is no more available

encrypted configuration EPROM FPGA Virtex -II decryption circuit keys storage +

  • external

battery CAD TOOL configuration generator encryption software secret keys (Triple DES - 3 x 56 bits) configuration memory secret keys (Triple DES - 3 x 56 bits)

Protection against cloning and reverse engineering

slide-29
SLIDE 29

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Altera Solution

  • The decryption circuit

takes FPGA resources (silicon)…

  • No flexibility for the

decryption algorithm

encrypted configuration EPROM FPGA Stratix -II decryption circuit keys storage CAD TOOL configuration generator encryption software secret key (AES 128 bits) configuration memory secret key (AES 128 bits)

slide-30
SLIDE 30

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

LESTER/UMASS Solution

  • Dynamic security of the bitstream for SRAM FPGA

encrypted bitstream

  • f SCP 1

EPROM configuration controller encrypted bitstream

  • f SCP 2

no-encrypted bitstream NCP bitstream decryption circuit 1 bitstream decryption circuit 2 FPGA secret key Decryption circuit 1 or 2 configuration memory SRP encrypted bitstream

  • f SCP 1

EPROM configuration controller encrypted bitstream

  • f SCP 2

no-encrypted bitstream NCP bitstream decryption circuit 1 bitstream decryption circuit 2 FPGA secret key secret key Decryption circuit 1 or 2 configuration memory SRP

in
  • ut
ce write clk

I C A P Controller/ MicroBlaze (soft core) Block RAM

8 bits Direct-link 8 bits 50 Mbit/s 8 bits add

Source of bitstream FRAME A FRAME B FRAME C FRAME D FRAME E FRAME F FRAME G FRAME H Configuration Array

8 bits in
  • ut
ce write clk

I C A P Controller/ MicroBlaze (soft core) Block RAM

8 bits Direct-link 8 bits 50 Mbit/s 8 bits add

Source of bitstream FRAME A FRAME B FRAME C FRAME D FRAME E FRAME F FRAME G FRAME H Configuration Array

8 bits
slide-31
SLIDE 31

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-32
SLIDE 32

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES Platform: case study with a virtex-II Pro

PowerPC 405 core PLB (32 bits) PLB/OPB bridge AES security primitive Bit-streams memory int

Data_in (128 bits) Key (128 bits)

AES core

Data_out (128 bits)

OPB (32 bits)

AlP_Register ArP_Register

Input FSM Output FSM

Start Reset Done

SPC FSM SSC FSM

Fault Battery level Communication Channel Quality Attacks System_state

OPB (32 bits)

Req

ICAP

WE Data
slide-33
SLIDE 33

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Case study: AES algorithm

  • Rijndael algorithm parameters:
  • Data block ciphering
  • 128 bits for the key
  • 128 bits for the data

Encryption

Plain text (128 bits) Cipher key (128 bits) Cipher text (128 bits) 001101101 1010110101 111100110

slide-34
SLIDE 34

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Cipher Key

AES algorithm: encryption process

  • Ten rounds
  • Four transformations
  • SubBytes
  • ShiftRows
  • MixColumns
  • AddRoundKey

2-ShiftRows 1-SubBytes 3-MixColumns 4-AddRoundKey Round Key 0

9

Rounds

ShiftRows SubBytes AddRoundKey

final

Round

Initial

Round

AddRoundKey State Plain text Round Key 10 State cipher text

slide-35
SLIDE 35

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES implementations – security primitive core

  • Four implementations are considered

for the Rijndael algorithm:

  • Non feedback mode without

security (N_FB)

  • Pipeline
  • Feedback mode without security

(FB)

  • Iterative
  • Feedback mode with fault detection

(FB_FD)

  • Parity-based error detection
  • Feedback mode with fault tolerance

(FB_FT)

  • Triple module redundancy

technique

Performance Security

PowerPC 405 core PLB (32 bits) PLB/OPB bridge AES security primitive Bit-streams memory int Data_in (128 bits) Key (128 bits) AES core Data_out (128 bits) OPB (32 bits) AlP_Register ArP_Register Input FSM Output FSM Start Reset Done SPC FSM SSC FSM Fault Battery level Communication Channel Quality Attacks System_state OPB (32 bits) Req ICAP WE Data
slide-36
SLIDE 36

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES feedback mode without security (2/2)

  • Crypto_core
  • Key_gene

Round_key_core

Round_key Cipher_key Rcon Key_register

Initial_round Round_core

data_register ciphertext_register Round_key Plain_text Cipher_text

slide-37
SLIDE 37

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES feedback mode with fault detection (2/3)

  • Crypto_core
  • Key_gene

Round_key_core

Round_key Cipher_key Rcon Key_register

Initial_round Round_core

data_register ciphertext_register Round_key Plain_text Cipher_text Key_parity

Parity Parity

current_parity expected_parity fault parity_register

slide-38
SLIDE 38

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES feedback mode with fault detection (3/3)

  • Round_core

expected_parity Key_parity x0 x1 x15 S S S Byte Sub Shift Row Mix Column Add Key k0 k1 k15

slide-39
SLIDE 39

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

AES feedback mode with fault tolerance (2/3)

  • Crypto_core

Initial_round Round_core

data_register ciphertext_register Round_key Plain_text Cipher_text

Initial_round Initial_round Voter Round_core

data_register

Round_core

data_register

Voter

slide-40
SLIDE 40

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Area and power comparison of Rijndael implementations

2,000 4,000 6,000 8,000 10,000 12,000 14,000 16,000 Virtex-II Pro FPGA Feedback Virtex-II Pro FPGA Feedback Fault detection Virtex-II Pro FPGA Feedback Fault tolerance Virtex-II Pro FPGA Non Feedback Slices

slide-41
SLIDE 41

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Energy efficiency of Rijndael implementations

10-6 10-5 10-4 10-3 10-2 10-1 100 101 102 0.18 micron CMOS Virtex-II Pro FPGA Feedback Virtex-II Pro FPGA Feedback Fault detection Virtex-II Pro FPGA Feedback Fault tolerance Virtex-II Pro FPGA Non Feedback Hand-optimized Assembly code On Pentium II C Sparc Java K virtual machine Sparc Gigabits per joule ASIC FPGA Processor

slide-42
SLIDE 42

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security primitive: constraints

Data_in (128 bits) Key (128 bits) AES core Data_out (128 bits) AlP_Register ArP_Register Input FSM Output FSM Start Reset Done SPC FSM SSC FSM Fault Battery level Communication Channel Quality Attacks System_state OPB (32 bits) Req ICAP WE Data

Virtex-II Pro xc2vp30-5ff896 Module 1 Reconfigurable module Module 2 Fixed module Module 3 Fixed module

slide-43
SLIDE 43

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security primitive: feedback mode without security

  • Feedback mode without security
  • Security primitive core

~2000 slices (16%)

  • Security primitive controller

~50 slices (1 %)

  • System security controller

~50 slices (1 %)

  • The core does not embed any security

mechanisms

  • “Low cost” solution
slide-44
SLIDE 44

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security primitive: feedback mode with fault detection

  • Feedback mode with fault detection
  • Security primitive core

~2000 slices (16%)

  • Security primitive controller

~50 slices (1 %)

  • System security controller

~50 slices (1 %)

  • The core embeds fault detection mechanism
  • “Low cost” solution
  • Best tradeoff in term of security vs.

performance

  • Does not protect against denial of service

attacks

slide-45
SLIDE 45

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security primitive: feedback mode with fault tolerance

  • Feedback mode with fault tolerance
  • Security primitive core

~6000 slices (46%)

  • Security primitive controller

~50 slices (1 %)

  • System security controller

~50 slices (1 %)

  • The core embeds fault tolerance mechanism
  • “high cost” solution
  • Most reliable solution
  • Provides the most efficient protection
slide-46
SLIDE 46

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-47
SLIDE 47

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Secure Coprocessor/Microcontroller

  • Ensure the security of the system
  • Chip resistant against attacks (invasive, non invasive, side channels)
  • Microcontroller embeds ciphering cores and keys generator
  • Secure memory with encrypted data
slide-48
SLIDE 48

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Secure microcontroller: example Dallas DS500 2FP

  • Embedded RNG (generation of keys)
  • NVSRAM (Non Volatile SRAM) for

storage of ciphering

  • DES (64 bit) ciphering for memory

protection

  • Self Destruct Input if an external

device detect an attack and rises this input

  • Two layers of metallization added on

the top of the layout to increase reverse engineering difficulty

slide-49
SLIDE 49

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Trusted Platform Module

  • Architecture
  • Processor dedicated for security
  • Asymmetric cryptography (2048 bits) RSA: data confidentiality
  • Hashing functions SHA-1/-2
  • RNG for keys generation
  • EEPROM non volatile: storage of secret keys
  • Hardware security
  • Countermeasure against power and timing attacks
  • Sensors: frequency, voltage, temperature, light et glitch (clock)
  • Auto-tests functions
slide-50
SLIDE 50

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Trusted Platform Module - Architecture

slide-51
SLIDE 51

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Trusted Platform Module – Example for computer

  • Infineon TPM 1.2 SLB 96 35 TT 1.2
  • http://www.infineon.com/
  • Microcontroller 16 bits
  • Technology CMOS 0,22 µm
slide-52
SLIDE 52

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Outline

  • Cryptography principles
  • Attacks on embedded systems
  • Countermeasures
  • Hardware Mechanisms for Secured Processor-Memory Transactions

for Embedded Systems

  • PE-ICE/Extended OTP
  • Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream
  • Security Architecture for Embedded Systems: SANES
  • Security primitive: AES case study on Virtex-II Pro
  • Existing solutions: Secure Coprocessor/Microcontroller
  • Conclusion
slide-53
SLIDE 53

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security and people, how it will evolve???

slide-54
SLIDE 54

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Security is a big and a complex issue

  • Security deals with
  • Computer science
  • Electronic, computer engineering
  • Telecommunication (protocols)
  • People
  • Companies
  • Curriculum … (new curriculum should be considered)
  • Security is a large domain that does not only focus on technology
  • Require a more global thinking on our society
  • Need to be considered by engineers…
slide-55
SLIDE 55

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Conclusion

  • Security is becoming a critical problem in our society
  • Related cost is more and more important
  • Number of attacks keeps increasing (software but also hardware)
  • More and more embedded systems mobile and connected

(embedding more and more personal data)

  • Strong threats at the hardware level
  • Cryptography algorithms are the pillars of security… But

security is a more complex problem

  • Software and hardware protections
  • Security policy: the right security level at the right time
  • Lot of work still to be done to provide some CAD tools to build

secure architectures/platforms

  • Nothing should be neglected… the threat is where you are not

expected to find it

slide-56
SLIDE 56

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Before ending the presentation…

  • Thanks to Kris Gaj
  • http://ece.gmu.edu/faculty_info/gaj.html
  • Lilian Bossuet
  • http://www.lilianbossuet.com/
  • And Lionel Torres (Reouven Elbaz)
  • http://www.lirmm.fr/~torres
slide-57
SLIDE 57

Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 Session Sécurité Informatique - Mercredi 28 mars 2007

Thanks...

More data available at: http://python.ecs.umass.edu/%7Eessg/home.html guy.gogniat@univ-ubs.fr