Providing efficient protection against energy consumption based side channel attacks (SCAs) for block ciphers is a relevant topic for the research community, as current overheads are in the 100× range. Unprofiled SCAs exploit information leakage from the outmost rounds of a cipher; we propose a solution encasing it between keyed transformations amenable to an efficient SCA protection. Our solution can be employed as a drop in replacement for an unprotected implementation, or be retrofit to an existing one, while retaining communication capabilities with legacy insecure endpoints. Experiments on a Cortex-M4 µC, show performance improvements in the range of 60×, compared with available solutions.

Subset Construction (SC) is the classical algorithm for the determinization of a nondeterministic finite automaton (NFA) into an equivalent deterministic one (DFA). Although SC works fine in most application domains, it may be inappropriate when the NFA expands over time and determinization is required after each expansion, such as in diagnosis of active systems in artificial intelligence, or in model-based testing in software engineering. For such an expanding automaton, the IDEA algorithm (Incremental Determinization of Expanding Automata) may be more suitable. Given an NFA N⁠, an equivalent DFA D⁠, and an expansion ΔN of N⁠, the determinization of N′=N∪ΔN into D′ is performed based not only on N′ but also on ΔN and D⁠. Rather than starting from scratch the generation of the DFA D′ equivalent to N′⁠, IDEA applies the set of actions which are sufficient for transforming D into D′⁠. This way, a possibly large part of the determinization process is avoided. Experiments show that the degree of convenience in determinizing expanding automata using IDEA rather than SC largely depends on the nature of the expanding automaton in the actual application domain.

The determinization of a nondeterministic finite automaton (FA) is the process of generating a deterministic FA (DFA) equivalent to (sharing the same regular language of) . The minimization of is the process of generating the minimal DFA equivalent to . Classical algorithms for determinization and minimization are available in the literature for several decades. However, they operate monolithically, assuming that the FA to be either determinized or minimized is given once and for all. By contrast, we consider determinization and minimization in a dynamic context, where augments over time: after each augmentation, determinization and minimization of into is required. Using classical monolithic algorithms to solve this problem is bound to poor performance. An algorithm for incremental determinization and minimization of acyclic finite automata, called IDMA, is proposed. Despite being conceived within the narrow domain of model-based diagnosis and monitoring of active systems, the algorithm is general-purpose in nature. Experimental evidence indicates that IDMA is far more efficient than classical algorithms in solving incremental determinization and minimization problems. Copyright © 2015 John Wiley & Sons, Ltd.

A prominent threat to embedded systems security is represented by side-channel attacks: they have proven effective in breaching confidentiality, violating trust guarantees and IP protection schemes. State-of-the-art countermeasures reduce the leaked information to prevent the attacker from retrieving the secret key of the cipher. We propose an alternate defense strategy augmenting the regular information leakage with false targets, quite like chaff countermeasures against radars, hiding the correct secret key among a volley of chaff targets. This in turn feeds the attacker with a large amount of invalid keys, which can be used to trigger an alarm whenever the attack attempts a content forgery using them, thus providing a reactive security measure. We realized a LLVM compiler pass able to automatically apply the proposed countermeasure to software implementations of block ciphers. We provide effectiveness and efficiency results on an AES implementation running on an ARM Cortex-M4 showing performance overheads comparable with state-of-the-art countermeasures.

Baseline RISC instruction sets for ultra-low power processors are constantly being tuned to reduce cycle count when executing computation-intensive applications. Performance improvements often come at a non-negligible price in terms of area and critical path length and imply deeper pipelines and complex memory interfaces. This penalizes control-intensive code execution and significantly increases cost and complexity of building multi-core clusters. In addition, some extensions are not easily exploited by compilers and may increase code development effort, especially when considering parallel applications. In this paper we describe our efforts in enhancing a baseline open ISA (OpenRISC) and its LLVM compiler back-end to significantly reduce execution cycles while minimizing the impact on core micro-architecture complexity, number of pipeline stages, area and power. In addition, we improved the core micro-architecture to streamline its integration in a tightly-coupled cluster, sharing instruction cache and data memory, thereby further enhancing parallel execution efficiency. The combined effect of ISA, compiler and micro-architecture evolution gives an average energy efficiency boost of 59% on vector intensive code and 41% otherwise, at an area and power increase of 2.3% and 18% on a four-core processor cluster.

We propose an efficient and effective methods to secure software implementations of cryptographic primitives on low-end embedded systems, against passive side channel attacks relying on the observation of power consumption or electro-magnetic emissions. The proposed approach exploits a modified LLVM compiler toolchain to automatically generate a secure binary characterized by a randomized execution flow. We improve the current state-of-the-art in dynamic executable code countermeasures removing the requirement of a writable code segment, and reducing the countermeasure overhead. Also, we provide a new method to refresh the random values employed in the share splitting approaches to lookup table protection. Finally, we devise an automated approach to protect spill actions onto the main memory, which are inserted by the compiler backend register allocator when there is a lack of available registers, thus, removing the need for manual assembly inspection. We report a validation of the performances of our approach on all the current ISO-standard block ciphers, employing an ARM Cortex-M4 based microcontroller as the validation platform.

We propose an efficient and effective method to secure software implementations of cryptographic primitives on low-end embedded systems, against passive side-channel attacks relying on the observation of power consumption or electro-magnetic emissions. The proposed approach exploits a modified llvm compiler toolchain to automatically generate a secure binary characterized by a randomized execution flow. Also, we provide a new method to refresh the random values employed in the share splitting approaches to lookup table protection, addressing a currently open issue. We improve the current state-of-the-art in dynamic executable code countermeasures removing the requirement of a writeable code segment, and reducing the countermeasure overhead.

To support adaptivity of data parallel applications on multi-core platforms, we propose a framework based on the combination of OpenCL application auto-tuning and run-time resource management. The framework addresses computationally intensive multimedia OpenCL applications. For these target applications, we show that application auto-tuning, based on design-time analysis, can become synergistic with run-time resource management. In the proposed framework, run-time decisions are taken by each application, autonomously, to achieve system adaptivity. This paper describes the methodology and related toolchain, defined during the 2PARMA European project, based on the integration of independent tools to provide effective compilation of OpenCL code, multi-objective design space exploration, application monitoring and tuning and system-wide run-time resource management. Experimental results are reported for design optimization of an OpenCL stereo-matching application and then for a resource contention scenario where multiple stereo-matching applications are executed on the same platform with different run-time requirements.

Differential Fault Analysis (DFA) exploits the differences between a correct and a faulty output of a cipher implementation to derive the secret parameters. All the current DFA techniques are tailored to the cipher being attacked and do not provide a general framework. We propose an automated general framework to assess the vulnerability of block ciphers against DFAs, providing a conservative analysis on the attacker capabilities and a practical lower bound on the attacker effort required to extract the secret-key. The proposed technique is based on dataflow analysis of software cipher implementations and has been implemented as a pass of the llvm compiler infrastructure. This work shows how the automated tool we developed is able to detect which and how many faults an attacker can exploit to recover the values of portions of the secret-key material employed by a standard block cipher, validating the effectiveness of our approach. The precise analysis provided by our tool allows to apply the computationally demanding fault attack countermeasures only to the vulnerable portions of the cipher.

The determinization of a nondeterministic finite automaton (NFA) N is the process of generating a deterministic finite automaton (DFA) D equivalent to (sharing the same regular language of) N. The minimization of D is the process of generating the minimal DFA M equivalent to D. Classical algorithms for determinization and minimization are available in the literature for several decades. However, they operate monolithically, assuming that the finite automaton to be either determinized or minimized is given once and for all. By contrast, we consider determinization and minimization in a dynamic context, where N expands over time: after each expansion, determinization and minimization of N into M is required. Using classical monolithic algorithms to solve this problem is bound to poor performances. An algorithm for incremental determinization and minimization of acyclic finite automata, called IDMA, is proposed. Despite being conceived within the narrow domain of model-based diagnosis and monitoring of active systems, the algorithm is general-purpose in nature. Experimental evidence indicates that IDMA is far more efficient than classical algorithms in solving incremental determinization and minimization problems.