Embedded Systems Security Guy GOGNIAT guy.gogniat@univ-ubs.fr - PowerPoint PPT Presentation

Session Sécurité Informatique - Mercredi 28 mars 2007 Embedded Systems Security Guy GOGNIAT guy.gogniat@univ-ubs.fr Journée 2007 de la section électronique du club EEA SiP et SoC : nouvelles perspectives, nouveaux défis Session Sécurité Informatique Mercredi 28 mars 2007 Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Outline Cryptography principles  Attacks on embedded systems  Countermeasures  Hardware Mechanisms for Secured Processor-Memory Transactions • for Embedded Systems • PE-ICE/Extended OTP Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream • Security Architecture for Embedded Systems: SANES • • Security primitive: AES case study on Virtex-II Pro Existing solutions: Secure Coprocessor/Microcontroller • Conclusion  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Outline  Cryptography principles Attacks on embedded systems  Countermeasures  Hardware Mechanisms for Secured Processor-Memory Transactions • for Embedded Systems • PE-ICE/Extended OTP Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream • Security Architecture for Embedded Systems: SANES • • Security primitive: AES case study on Virtex-II Pro Existing solutions: Secure Coprocessor/Microcontroller • Conclusion  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Cryptography primitives Symmetric cryptography Confidentiality   AES, DES/3DES, RC5 Data and messages • • Hashing function Integrity   MD5, SHA-1, SHA-2 Data and messages • • Asymmetric cryptography  Authentication  RSA, ECC Users and hosts • • Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Symmetric encryption Block cipher  K e Encryption (E) n n Ciphertext C=E Ke (P ) Plaintext P n-bit Decryption (D) n n P=D Kd (C) K e Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Asymmetric algorithm Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 RSA Three researchers from MIT, Ron 1. Public key (size 1024 or 2048 bits) R ivest, Adi S hamir and Len A dleman have patented in 1983 the RSA n p q = � algorithm Compute e as “PGDC(n,e) = 1” 2. Private key 1 � ( ( ) ( ) ) d e mod p 1 q 1 = � � � Rivest Adleman Shamir 3. Ciphering requires e and n e mod c m n = 4. Deciphering requires d and n d mod m c n = Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Hashing function Initial message Digest of the initial message Prof. Robert this message to 215e781c0c3f7d1353518bd5f649805b confirm our meeting tomorrow at 1 pm at my office Received message Digest of the received message Prof. Robert this message to 0601e38b93c1cc1c1a4b87dd8771b452 confirm our meeting tomorrow at 9 pm at my office Both digests are different  Someone has modified the message • There been an error during the communication • Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Integrity Checking Principle:  Tag T H(M) (M; T) Message M Meeting at 7h00 am in … Unsecured Alice channel T Integrity Flag (M; T) M COMP H(M) T’ K Tag reference Bob Meeting at 7h00 am in … K message digest Hash functions:  Message M i Hash MAC h i = f(M i , h i-1 ) Compression function  function function h i-1 One-way function  gives a compact representative image of the input  MAC ( * ) functions: take a secret key as additional input to authenticate the source of the message.  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734 (*) Message Authentication Code

Session Sécurité Informatique - Mercredi 28 mars 2007 Outline Cryptography principles   Attacks on embedded systems Countermeasures  Hardware Mechanisms for Secured Processor-Memory Transactions • for Embedded Systems • PE-ICE/Extended OTP Preventing Piracy and Reverse Engineering of SRAM FPGAs Bitstream • Security Architecture for Embedded Systems: SANES • • Security primitive: AES case study on Virtex-II Pro Existing solutions: Secure Coprocessor/Microcontroller • Conclusion  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Many sensitive data will be embedded Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Classification of attacks Hardware attacks Software attacks Glitch attack Timing analysis Chip cutting (power, clock) Trojan horse Power consumption Chemical attack Variation of Vdd or T° of the chip Analysis Logic bomb Physical Electromagnetic Irreversible Black Box emission analysis (invasive) Virus Side-channel Physical (non-invasive) Reversible Worm (non-invasive) Active attacks Passive attacks Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Processor-Memory Transactions Vulnerabilities Most embedded systems use off-chip memories  Data and instructions are exchanged in clear over the processor-memory • bus Trusted Area Threats:  Unauthorized data reads  Address bus SoC External Code injection or data alteration  (Trusted) Memory Memory tampering  Data bus Objectives: Ensure the confidentiality and the integrity of data stored in  off-chip memories and transferred on SoC memory interfaces Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Passive Attacks Bus probing – eavesdropping [1]  Data / Instruction Add 0x080ff0fa 0x00000010 Address bus External 0101000100010000011100100 0101000100010000011100100 SoC 1 Memory 1 (Trusted) 0111010101010001011100100 0111010101010001011100100 Data bus 1 1 [1] M. G. Kuhn, “Cipher Instruction Search Attack on the Bus-Encryption Security Microcontroller DS5002FP” IEEE Trans. Comput., vol. 47, pp. 1153–1157, October. 1998. Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Passive Attacks Bus probing – eavesdropping [1]  Data / Instruction Add 0x00000010 0x080ff0fa Address bus External 0x0ab820ff 0x00000014 0101000100010000011100100 SoC Memory 1 0x00000018 0x080112f4 (Trusted) 0111010101010001011100100 0x0000001C 0x102bcd0f Data bus 1 0x00000020 0x11ff11ab Attacker motivation:  Off-line analysis:  Key recovery • Message recovery • Raw materials for active attacks…  [1] M. G. Kuhn, “Cipher Instruction Search Attack on the Bus-Encryption Security Microcontroller DS5002FP” IEEE Trans. Comput., vol. 47, pp. 1153–1157, October. 1998. Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Active Attacks Code and data injection  Address bus External SoC Memory (Trusted) Data bus Malicious Memory Three kinds of active attacks are defined depending on the choice made by the  adversary on the data to insert: Memory Spoofing: Random data injection  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Active Attacks Code and data injection  Address bus External SoC Memory (Trusted) Data bus Malicious Memory Three kinds of active attacks are defined depending on the choice made by the  adversary on the data to insert: Memory Data(@1) Spoofing: Random data injection  Data(@2) Splicing: Spatial permutation  Data(@3) Data(@4) Data(@7) Data(@5) Data(@6) Data(@7) Data(@7) Data(@8) Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Active Attacks Code and data injection  Address bus External SoC Memory (Trusted) Data bus Malicious Memory Three kinds of active attacks are defined depending on the choice made by the  adversary on the data to insert: Memory Data(@1, t1) Data(@1, t4) Spoofing: Random data injection  Data(@2, t9) Data(@2, t1) Splicing: Spatial permutation  Data(@3, t1) Data(@3, t8) Replay: Temporal permutation  Data(@4, t1) Data(@4, t1) Data(@4, t7) Data(@4, t1) Data(@4, t1) Data(@5, t1) Data(@6, t6) Data(@6, t1) Data(@7, t4) Data(@7, t1) Data(@8, t1) Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734

Session Sécurité Informatique - Mercredi 28 mars 2007 Active Attacks Code and data injection  Address bus External SoC Memory (Trusted) Data bus Malicious Memory Three kinds of active attacks are defined depending on the choice made by the  adversary on the data to insert: Spoofing: Random data injection  Splicing: Spatial permutation  Replay: Temporal permutation  Attacker motivation:  Hijack the software execution  Reduce the search space for key recovery or message recovery  Laboratoire LESTER - Université de Bretagne Sud/CNRS FRE 2734