System in Package (SiP) relies on integrating different chiplets potentially involving many third-party devices and chiplet foundries. This type of advanced packaging technology opens up numerous threat scenarios, especially: (a) the inauthentic and untraceable integration of chiplets into a SiP, (b) the insecure integration of malicious chiplets, which leads to a severe impact on the SiP security in the field. The current solutions require many hardware cryptographic primitives, making them costly and power-hungry. Therefore, a new lightweight solution is needed to ensure secure chiplet integration and secure SiP operation. In this article, we deal with these problems and introduce iTrustlet , as a combination of a physical unclonable function and an authenticated encryption scheme to ensure an authenticated and traceable chiplet integration. We propose a chiplet integration protocol based on iTrustlet and a classical root-of-trust (RoT) to ensure the integrated chiplets are unaltered and unreplaced. To guarantee SiP in-field security, iTrustlet with a hardware firewall (HWF) is proposed. Their interaction leads to two security features: (i) HWF provides a SiP protection mechanism, and (ii) iTrustlet secures the update of HWF rules. In particular, we provide a multilevel solution centralized around iTrustlet , focusing on lightweightness. The implementation results show that area and power overheads are 1.24% and 1.84% in the case of FPGA and 0.49% and 1.2% for ASIC implementation.

The protection of cryptographic software implementations against power-analysis attacks is critical for applications in embedded systems. A commonly used algorithmic countermeasure against these attacks is masking, a secret-sharing scheme that splits a sensitive computation into computations on multiple random shares. In practice, the security of masking schemes relies on several assumptions that are often violated by microarchitectural side-effects of CPUs. Many past works address this problem by studying these leakage effects and building corresponding leakage models that can then be integrated into a software verification workflow. However, these models have only been derived empirically, putting in question the otherwise rigorous security statements made with verification. We solve this problem in two steps. First, we introduce a contract layer between the (CPU) hardware and the software that allows the specification of microarchitectural side-effects on masked software in an intuitive language. Second, we present a method for proving the correspondence between contracts and CPU netlists to ensure the completeness of the specified leakage models. Then, any further security proofs only need to happen between software and contract, which brings benefits such as reduced verification runtime, improved user experience, and the possibility of working with vendor-supplied contracts of CPUs whose design is not available on netlist-level due to IP restrictions. We apply our approach to the popular RISC-V IBEX core, provide a corresponding formally verified contract, and describe how this contract could be used to verify masked software implementations.

Physical side-channel attacks threaten the security of exposed embedded devices, such as microcontrollers. Dedicated countermeasures, like masking, are necessary to prevent these powerful attacks. However, a gap between well-studied leakage models and observed leakage on real devices makes the application of these countermeasures non-trivial. This work provides a gadget-based concept to automated masking covering practically relevant leakage models to achieve security on real-world devices. We realize this concept with a fully automated compiler that transforms unprotected microcontroller-implementations of cryptographic primitives into masked executables, capable of being executed on the target device. In a case study, we apply our approach to a bitsliced LED implementation and perform a TVLA-based security evaluation of its core component: the PRESENT s-box.