Side channel analysis attacks employ the emanated side channel information to deduce the secret keys from cryptographic implementations by analyzing the power traces during execution or scrutinizing faulty outputs. To be effective, a countermeasure must remove or conceal as many as possible side channels. However, many of the countermeasures against side channel attacks are applied independently. In this article, the authors present a novel countermeasure (referred to as QuadSeal ) against Power Analysis Attacks and Electromagentic Fault Injection Attacks (FIAs), which is an extension of the work proposed in Reference [27]. The proposed solution relies on algorithmically balancing both Hamming distances and Hamming weights (where the bit transitions on the registers and gates are balanced, and the total number of 1s and 0s are balanced) by the use of four identical circuits with differing inputs and modified SubByte tables. By randomly rotating the four encryptions, the system is protected against variations, path imbalances, and aging effects. After generating the ciphertext, the output of each circuit is compared against each other to detect any fault injections or to correct the faulty ciphertext to gain reliability. The proposed countermeasure allows components to be switched off to save power or to run four executions in parallel for high performance when resistance against power analysis attacks is not of high priority, which is not available with the existing countermeasures (except software based where source code can be changed). The proposed countermeasure is implemented for Advanced Encryption Standard (AES) and tested against Correlation Power Analysis and Mutual Information Attacks attacks (for up to a million traces), and none of the secret keys was found even after one million power traces (the unprotected AES circuit is vulnerable for power analysis attacks within 5,000 power traces). A detection circuit (referred to as C-FIA circuit) is operated using the algorithmic redundancy presented in four circuits of QuadSeal to mitigate Electromagnetic Fault Injection Attacks. Using Synopsys PrimeTime, we measured the power dissipation of QuadSeal registers and XOR gates to test the effectiveness of Quadruple balancing methodology. We tested the QuadSeal countermeasure with C-FIA circuit against Differential Fault Analysis Attacks up to one million traces; no bytes of the secret key were found. This is the smallest known circuit that is capable of withstanding power-based side channel attacks when electromagnetic injection attack resistance, process variations, path imbalances, and aging effects are considered.

Checkpoint recovery (CR) is a classic fault-tolerance technique, which enables computing systems to execute correctly even when affected by transient faults. Although a number of software and hardware based approaches for CR does exist, these approaches usually are either too large, too slow, or require extensive modifications to the software and the caching/memory schemes. In this paper, we propose a novel CR approach, which is based on re-engineering the instruction set of a target processor. We take the base instruction set and augment the native micro-operations, i.e., an architectural description language (ADL), with additional microoperations to perform checkpointing at the granularity of basic blocks. The recovery mechanism is realized by three custom instructions, which can undo the corruptions caused by transient faults during instruction execution, including the values of general-purpose registers, data memory, and special-purpose registers (PC, status registers, etc.), which were incorrectly modified. Our checkpoint storage is sized according to the application program executed. The experimental results show that our approach degrades the system performance by just 0.76 percent when there is no fault, and introduces an area overhead of 44 percent on average and 79 percent in the worst case. During the fault injection test with the benchmark applications, the recovery took just 62 clock cycles (worst case).

Future on-chip manycore systems are expected to have hundreds of cores, and to be used for a number of applications to amortize their fabrication costs. In this paper, we examine how software pipelines, which are useful for streaming/multimedia applications, can be efficiently executed on a manycore system with shared memory. The goal is to balance the stages of the pipeline under workload and resource variations. This paper presents ADAPT, a method to quickly detect bottleneck stages and add cores (workers) to those bottleneck stages at run-time. Further, if there are no idle workers, then a shuffling of workers across stages is performed to improve/maintain throughput. ADAPT is implemented in a 48-core system which is built using a commercial core and tool suite. For a variety of applications, ADAPT takes less than 2 µs for one run-time adaptation, and achieves up to 2.1× the throughput of a state-of-the-art method (which is modified and implemented in the same system for a fair comparison). These results illustrate the applicability of ADAPT for fine-grained run-time management of manycore systems to achieve high throughput for software pipelines.

Power based side-channel attacks attempt to obtain the secret key from implementations of cryptographic algorithms, such as Advanced Encryption Standard (AES), by analyzing the power traces during execution. Such attacks employ statistical methods to find correlations of power traces with parts of the secret key. In order to be effective, a countermeasure must remove or conceal such a signature. Previous countermeasures have either removed dynamic power signatures or leakage power signatures, but have not demonstrated effectiveness against both. In this paper, for the first time, we propose a balance and rotate technique for block cipher based algorithms and demonstrate it on an AES circuitry to remove the signature of the secret key from both the static and dynamic components of the power traces and further demonstrate that the countermeasure can withstand the path imbalances and process variation effects. Our solution, relies on algorithmically balancing Hamming distances and Hamming weights (where the bit transitions on the registers and gates are balanced, and the total number of 1s and 0s are balanced) by the use of four identical circuits with differing inputs and modified SubByte tables. By randomly rotating the four encryptions, the system is protected against variations, path imbalances and aging effects. When resistance against power analysis attacks is not of high priority, the proposed countermeasure allows components to be switched off to save power, or to run four executions in parallel for high performance. The proposed countermeasure is implemented for AES and tested against CPA and MIA attacks (for up to a million traces) and none of the secret keys were found even after one million power traces (unprotected AES circuit revealed the secret key within 5,000 power traces). This is the smallest known circuit which is capable of withstanding power based side-channel attacks when variations, path imbalances and aging effects are considered.

Pipeline of processors allow the execution of a sequential streaming program on multiple processors. However, partitioning sequential code for Multiprocessor Systems-on-Chips (MPSoCs), and then creating the MPSoC platform for the sequential code to execute, is a challenging problem. Parallelizing/pipelining statements within a control loop will improve the throughput of each iteration and the overall performance. Existing techniques, such as OpenMP, for parallelizing control loops is agnostic of the underlying MPSoC architecture, thus limiting the possibilities for further parallelisation. Previous techniques related to distribution of statements to MPSoCs considered homo geneous processors and not automated. In this paper, we propose a novel automated parallelization/ pipelining approach to synthesize a heterogeneous distributed pipelined MPSoC to improve the throughput of a loop (critical for streaming applications). An Integer Linear Programming (ILP)-based formulation to map statements to processor configurations is presented, in order to find the most suitable heterogeneous processor configurations for maximal throughput. Our approach complements state-of-the-art parallelization techniques, such as OpenMP, to further improve the performance of an application. A complete MPSoC platform, for the Tensilica framework, is automatically generated within minutes using our approach for the tested applications.

The need for Multiprocessor Systems-on-Chip (MPSoCs) to satisfy performance demands of applications in embedded systems has enabled vendors to create different communication architectures for MPSoCs. It is a challenge to rapidly identify the best communication architecture and its best configuration, in terms of task mapping and buffer size, for a given application. In this paper, we propose a novel predictive methodology to first quickly predict the communication architecture and then iteratively search for the optimal configuration of the selected MPSoC architecture. A correction approach is applied at the end to make sure that the selected MPSoC architecture and its configuration is the best suited for the area and application latency constraints. Our exploration is significantly quicker than a Particle Swarm approach, achieving an improvement factor of 15 and 87 in solving time when using fresh hardware and existing hardware builds respectively. While our approach is mostly accurate in finding the optimal solution, certain inaccuracies are observed due to less accurate corrector.

The Multiprocessor System-on-Chip (MPSoC) paradigm as a viable implementation platform for parallel processing has expanded to encompass embedded devices. The ability to execute code in parallel gives MPSoCs the potential to achieve high performance with low power consumption. In order for sequential legacy code to take advantage of the MPSoC design paradigm, it must first be partitioned into data flow graphs (such as Kahn Process Networks — KPNs) to ensure the data elements can be correctly passed between the separate processing elements that operate on them. Existing techniques are inadequate for use in complex legacy code. This paper proposes SDG2KPN, a System Dependency Graph to KPN conversion methodology targeting the conversion of legacy code. By creating KPNs at the granularity of the function-/procedure-level, SDG2KPN is the first of its kind to support shared and global variables as well as many more program patterns/application types. We also provide a design flow which allows the creation of MPSoC systems utilizing the produced KPNs. We demonstrate the applicability of our approach by retargeting several sequential applications to the Tensilica MPSoC framework. Our system parallelized AES, an application of 950 lines, in 4.8 seconds, while H.264, of 57896 lines, took 164.9 seconds to parallelize.

Advanced Encryption Standard (AES) is arguably the most popular symmetric block cipher algorithm. The commonly used mode of operation in AES is the Electronic Codebook (ECB) mode. In the past, side channel attacks (including power analysis based attacks) have been shown to be effective in breaking the secret keys used with AES, while AES is operating in the ECB mode. AES defines a number of advanced modes (namely Cipher Block Chaining - CBC, Cipher Feedback - CFB, Output Feedback - OFB, and Counter - CTR) of operations that are built on top of the EBC mode to enhance security via disassociating the encryption function from the plaintext or the secret key used. In this paper, we investigate the vulnerabilities against power analysis based side channel attacks of all such modes of operations, implemented on hardware circuits for low power and high speed embedded systems. Through such an investigation, we show that AES is vulnerable in all modes of operations against Correlation Power Analysis (CPA) attack, one of the strongest power analysis based side channel attacks. We also quantify the level of difficulty in breaking AES in different modes by calculating the number of power traces needed to arrive at the complete secret key. We conclude that the Counter mode of operation provides a balance in between area and power while maintaining adequate resistance for power analysis attacks than when used with other modes of operations. We show that the previous recommendations for the rate of change in the keys and vectors is grossly inadequate, and suggest that it must be changed at least every 210encryptions in CBC mode and 212encryptions in CFB, OFB and CTR modes in order to resist power analysis attacks.

Power analysis attacks are one of the most common Side-Channel Attacks (SCAs), proven to be extremely successful even on protected embedded devices. This paper proposes the use of a Residue Number System (RNS) architecture with randomly permuted moduli sets to implement the Double-and-Add computation, which is proven as the most susceptible operation in Elliptic Curve Cryptography (ECC). The proposed solution randomly permutes the moduli sets, allowing randomized power traces, significantly removing the correlation between the power dissipation and the secret key and eliminating the need for the intermediate conversion to binary required in the state-of-the-art. Architectures obtained for a 90nm standard cell technology suggest that a significant power analysis resistance is achieved for the Double-and-Add circuitry, incurring an extra performance cost of 3 times compared to the related state-of-the-art.

Security in embedded systems is of critical importance since most of our secure transactions are currently made via credit cards or mobile phones. Power analysis based side channel attacks have been proved as the most successful attacks on embedded systems to retrieve secret keys, allowing impersonation and theft. State-of-the-art solutions for such attacks in Elliptic Curve Cryptography (ECC), mostly in software, hinder performance and repeatedly attacked using improved techniques. To protect the ECC from both simple power analysis and differential power analysis, as a hardware solution, we propose to take advantage of the inherent parallelization capability in Multi-modulo Residue Number Systems (RNS) architectures to obfuscate the secure information. Random selection of moduli is proposed to randomly choose the moduli sets for each key bit operation. This solution allows us to prevent power analysis, while still providing all the benefits of RNS. In this paper, we show that Differential Power Analysis is thwarted, as well as correlation analysis.

Applying error recovery monotonously can either compromise the real-time constraint, or worsen the power/energy envelope. Neither of these violations can be realistically accepted in embedded system design, which expects ultra efficient realization of a given application. In this paper, we propose a HW/SW methodology that exploits both application specific characteristics and Spatial/Temporal redundancy. Our methodology combines design-time and runtime optimizations, to enable the resultant embedded processor to perform runtime adaptive error recovery operations, precisely targeting the reliability-wise critical instruction executions. The proposed error recovery functionality can dynamically 1) evaluate the reliability cost economy (in terms of execution-time and dynamic power), 2) determine the most profitable scheme, and 3) adapt to the corresponding error recovery scheme, which is composed of spatial and temporal redundancy based error recovery operations. The experimental results have shown that our methodology at best can achieve fifty times greater reliability while maintaining the execution time and power deadlines, when compared to the state of the art.

The need to integrate multiple wireless communication protocols into a single low-cost, low-power hardware platform is prompted by the increasing number of emerging communication protocols and applications. This paper presents a novel application specific platform for integrating multiple wireless communication transmission baseband protocols in a pipelined coprocessor, which can be programmed to support various baseband protocols. This coprocessor can dynamically select the suitable pipeline stages for each baseband protocol. Moreover, each carefully designed stage is able to perform a certain signal processing function in a reconfigurable fashion. The proposed platform is flexible (compared to ASICs) and is suitable for mobile applications (compared to FPGAs and processors). The area footprint of the coprocessor is smaller than an ASIC or FPGA implementation of multiple individual protocols, while the overhead of throughput is 34% worse than ASICs and 32% better than FPGAs. The power consumption is 2.7X worse than ASICs but 40X better than FPGAs on average. The proposed platform outperforms processor implementation in all area, throughput and power consumption. Moreover, fast protocol switching is supported. Wireless LAN (WLAN) 802.11a, WLAN 802.11b and Ultra Wide Band (UWB) transmission circuits are developed and mapped to the pipelined coprocessor to prove the efficacy of our proposal.

Soft error has been identified as one of the major challenges to CMOS technology based computing systems. To mitigate this problem, error recovery is a key component, which usually accounts for a substantial cost, since they must introduce redundancies in either time or space. Consequently, using state-of-art recovery techniques could heavily worsen the design constraint, which is fairly stringent for embedded system design. In this paper, we propose a HW/SW methodology that generates the processor, which performs finely configured error recovery functionality targeting the given design constraints (e.g., performance, area and power). Our methodology employs three application-specific optimization heuristics, which generate the optimized composition and configuration based on the two primitive error recovery techniques. The resultant processor is composed of selected primitive techniques at corresponding instruction execution, and configured to perform error recovery at run-time accordingly to the scheme determined at design time. The experiment results have shown that our methodology can at best achieve nine times reliability while maintaining the given constraints, in comparison to the state of the art.

Embedded systems are ubiquitous and are deployed in a large range of applications. Designing and fabricating Integrated Circuits (ICs) targeting such different range of applications is expensive. Designers seek flexible processors which efficiently execute a multitude of applications. FPGAs are considered affordable, but design cost, high reconfiguration delay and power consumption are all prohibitive. In this paper, we propose a novel ASIC based flexible MPSoC architecture, which can execute separate tasks in parallel, and it can be configured to execute single task with wide data widths or execute multiple tasks with varying data widths. The architecture presented, called Dynamically Reconfigurable MPSoC Architecture (DRMA), can be rapidly reconfigured through instructions. We present applications as case studies to showcase the flexibility and efficacy of DRMA. Results show for an additional area overhead of about 5%, the system is capable of working as four 32-bit processors, a single 128 bit processor or as a pipelined processing system.

Soft error has become a major adverse effect in CMOS based electronic systems. Mitigating soft error requires enhancing the underlying system with error recovery functionality, which typically leads to considerable design cost overhead, in terms of performance, power and area. For embedded systems, where stringent design constraints apply, such cost must be properly bounded. In this paper, we propose a HW/SW methodology DHASER, which enables efficient error recovery functionality for embedded ASIP-based multi-core systems. DHASER consists of three main parts: task level correctness (TLC) analysis, TLC-based processor/core customization, and runtime reliability-aware task management mechanism. It enables each individual ASIP-based processing core to dynamically adapt its specific error recovery functionality according to the corresponding task's characteristics (i.e., soft error vulnerability and execution time deadline). The goal is to optimize the overall system reliability while considering performance/throughput. The experimental results have shown that DHASER can significantly improve the reliability of the system, with little cost overhead, in comparison to the state-of-art counterparts.

Mapping tasks to cores in an Multiprocessor System-on-Chip (MPSoC) to meet constraints is widely investigated. Thus far the data flow graphs used for binding have been limited to acyclic graphs or have been single rate. In this paper we generalize the approach by allowing DFGs to be cyclic and multi rate. We further improve energy consumption by setting frequency per core in a Globally Asynchronous and Locally Synchronous (GALS) architecture (by the distribution of slack). A design flow is proposed with these two approaches to form a latency constrained and energy efficient binding. A generalized solution is proposed, compared to state-of-the-art, using improvements in formulation, data structures and heuristics. Eight benchmarks are experimented upon for mesh and pipeline architectures. Our heuristics achieve significant simulation speedup compared to the state-of-the-art and provide a solution which is 2.5% lower (26% worst case) than the optimal, but the solution is obtained 40x quicker (average case). Such a speedup allows us to rapidly explore a large design space.

The need to integrate multiple wireless communication protocols into a single low-cost flexible hardware platform is prompted by the increasing number of emerging communication protocols and applications in modern embedded systems. The interleaving, one of the key components in the communication baseband, varies in differing communication protocols. A novel reconfigurable variable increment step (VIS) based interleaver is proposed for efficient multimode communication application. The proposed reconfigurable interleaver supports both block and convolutional interleaving, costs little in area, consumes less power compared to some other programmable solutions, and is sufficiently fast to satisfy even the most demanding of Software Defined Radio (SDR) applications. The proposed method is flexible (when compared to ASICs and some reconfigurable solutions) and suitable for mobile applications in terms of area, power consumption and throughput (when compared to FPGAs, processors and some other ASIC based reconfigurable proposals).

This paper presents a novel approach to improve the existing Binary-to-RNS multi-moduli architectures. These architectures reduce the complexity by sharing common intermediate results among various RNS moduli channels. Two types of multi-moduli architectures are distinguished depending on whether the functionality is implemented serially or in parallel. A novel choice of the weights associated to the inputs provides huge improvement when applied to the most efficient topology known to date. Experimental results suggest that the proposed memoryless multi-moduli architectures achieve speedups of 2.02 and 1.79 for parallel and serial implementations, respectively, in comparison with the most efficient state-of-the-art structures. Furthermore, such implementations herein proposed have demonstrated that area reductions of 5.02% and 44.02% are achieved for parallel and serial structures, respectively.

Networks-on-Chip are seen as promising interconnect solutions, offering the advantages of scalability and high frequency operation which the traditional bus interconnects lack. Several NoC implementations have been presented in the literature, some of them having mature tool-flows and ecosystems. The main differentiating factor between the various implementations are the services and communication patters they offer to the end-user. In this paper we present dAElite, a TDM Network-on-Chip that offers a unique combinations of features, namely guaranteed bandwidth and latency per connection, built-in support for multicast, and a short connection set-up time. While our NoC was designed from the ground up, we leverage on existing tools for network dimensioning, analysis and instantiation. We have implemented and tested our proposal in hardware and we found it to compare favorably to the other NoCs in terms of hardware area. Compared with aelite, which is closest in terms of offered services our network offers connection set-up times faster by a factor of 10 network, traversal latencies decreased by 33%, and improved bandwidth.

Process migration (PM) is a method used in Multi-Processor System on Chips (MPSoCs) toimprove reliability, reduce thermal hotspots and balance loads. However, existing PM approaches are limited by coarse granularity (i.e. can only switch at application or operating systems boundaries), and thus respond slowly. Such slow response does not allow for fine control over temperature, nor does it allow frequent migration which is necessary in certain systems. In this paper, we propose Thor, an approach which is a fine-grained reliable PM scheme, for Embedded MPSoCs, to overcome the limitations of existing PM approaches. Our approach leverages custom instructions to integrate a base processor architecture, with PM functionality. We have proposed three schemes, Thor-BM (migration at basic block boundaries), Thor-BM/CR (migration at basic block boundaries with checkpoint and recovery), and ThorIM/CR (migration at instruction level with checkpoint and recovery). Our experiments show that the execution time overhead is less than 2%, while the additional area cost and power consumption costs are approximately 50% (excluding main memories, which if taken into account would substantially decrease this overhead). The average migration time cost is 289 cycles.

Multiprocessor System-on-Chip (MPSoC) is an integral element in state-of-the-art embedded devices, ranging from low-end, mobile phones, PDAs, handheld medical devices up to high-end cars, avionics and robotics. Proper and safe functionality of such embedded systems is mandatory to avoid severe consequences, whereas security is absolutely necessary with “Cashless Wallets” forecasted to be the only means of financial transactions in the near future. Such a scenario places immense onus on the security experts where secure transactions using credit cards or mobile phones or any other embedded devices should not be revealing any footprint to the adversary. Side Channel Attacks (SCA) are considered as one of the most effective attacks on these embedded systems because of their effectiveness in realizing the secret information without physically disassembling the device. We propose an MPSoC architecture to prevent power analysis SCA where a dual-core algorithmic balancing is enforced by corrupting the balanced key and swapping the encryption rounds of a block-cipher at random places, random number of times. A case study using DES cryptography is performed. Our approach, CoRaS, alleviates performance by 0.1% and area by 3.6% compared to the state-of-the-art MPSoC solution, however enhances security and practicality by eliminating its weaknesses.

Side-channel attacks in general and power analysis attacks in particular are becoming a major security concern in embedded systems. Countermeasures proposed against power analysis attacks are data and table masking, current flattening, dummy instruction insertion and bit-flips balancing. All these techniques are either susceptible to multi-order power analysis attack, not sufficiently generic to cover all encryption algorithms, or burden the system with high area, run-time or energy cost. In this article, we propose a randomized instruction injection technique ( RIJID ) that overcomes the pitfalls of previous countermeasures. RIJID scrambles the power profile of a cryptographic application by injecting random instructions at random points of execution and therefore protects the system against power analysis attacks. Two different ways of triggering the instruction injection are also presented: (1) softRIJID , a hardware/software approach, where special instructions are used in the code for triggering the injection at runtime; and (2) autoRIJID , a hardware approach, where the code injection is triggered by the processor itself via detecting signatures of encryption routines at runtime. A novel signature detection technique is also introduced for identifying encryption routines within application programs at runtime. Further, a simple obfuscation metric ( RIJIDindex ) based on cross-correlation that measures the scrambling provided by any code injection technique is introduced, which coarsely indicates the level of scrambling achieved. Our processor models cost 1.9% additional area in the hardware/software approach and 1.2% in the hardware approach for a RISC based processor, and costs on average 29.8% in runtime and 27.1% in energy for the former and 25.0% in runtime and 28.5% in energy for the later, for industry standard cryptographic applications.

Side channel attack based upon the analysis of power traces is an effective way of obtaining the encryption key from secure processors. Power traces can be used to detect bitflips which betray the secure key. Balancing the bitflips with opposite bitflips have been proposed, by the use of opposite logic. This is an expensive solution, where the balancing processor continues to balance even when encryption is not carried out in the processor.

Side channel attacks are becoming a major threat to the security of embedded systems. Countermeasures proposed to overcome Simple Power Analysis (SPA) and Differential Power Analysis (DPA), are data masking, table masking, current flattening, circuitry level solutions, dummy instruction insertions and balancing bit-flips. All these techniques are either susceptible to multi-order side channel attacks, not sufficiently generic to cover all encryption algorithms, or burden the system with high area cost, run-time or energy consumption.