Software testing is vital for strengthening the security of embedded systems by identifying and rectifying code errors, flaws and vulnerabilities. This is particularly significant when addressing vulnerabilities associated with side-channel attacks, given that they introduce a distinctive class of vulnerabilities, primarily subject to manual testing procedures. Manual testing remains prevalent despite advances in automation, posing challenges, particularly for complex environments. This research aims to automate embedded software testing on hardware in a modular and scalable manner, addressing the limitations of manual testing. We present a system designed to automate testing, including Side-Channel Analysis (SCA), in Continuous Integration (CI) environments, emphasizing accessibility and collaboration through open-source tools. Our evaluation setup based on GitLab, Jenkins and the ChipWhisperer framework shows that automating and integrating Side-Channel Analysis (SCA) in Continuous Integration (CI) environments is possible in an efficient way.

Hard real-time systems are increasingly vulnerable to cyberattacks. Since real-time systems represent a significant proportion of safety-critical systems not only established safety standards but also security standards have to be considered. In particular, standard cryptographic libraries are required to reach an adequate level of protection. In this study, we investigate whether it is possible to en-sure security and hard real-time without compromising either side. Thus, we examine relevant state-of-the-art cryptographic primitives provided by one of the de-facto standard libraries Mbed TLS, which is widely-used in embedded systems. We investigate the possibility to derive a Worst-Case Execution Time (WCET) for these primitives and review the code base with regard to compliance on safety-related coding guidelines. In addition, we assess the relevant aspects when security concerns must be considered in the safety-related context. Our research reveals several obstacles to fully apply Mbed TLS in hard real- time systems.

Many IoT devices are trusted with critical tasks and therefore require solid device security. As a result, manufacturers search for cost-efficient and easy-to-integrate trust anchors, but common IT solutions, like a Trusted Platform Modules (TPMs) are often not suitable for Internet of Things (IoT) use cases. Simultaneously, the adoption of System on Chip (SoC) devices, integrating a set of ARM® cores and Programmable Logic (PL) within one package are on the rise in several industries. While the ARM® processors facilitate networking and graphical user interfaces, a Field Programmable Gate Array (FPGA) fabric enables real-time control or acceleration of AI applications on the edge. This paper presents a solution to combine these trends for the benefit of device security: an FPGA Implementation of a Security Module as Open Source (FISMOS). The security module focuses on simplicity, providing security capabilities by little expense of logic as well as engineering resources. FISMOS is based on the PicoRV32 soft-core processor and features an AXI memory interface for data exchange with its host. It enables secure symmetric and asymmetric cryptographic functions, key enclosure, and may serve as a trust anchor for the Linux kernel. This configuration allows for customized security functionalities and a robust segmentation between the encapsulated area of the FISMOS and the Linux OS.