In this article, we focus on the emulation of fault injections on FPGA boards using saboteurs by presenting LiteInjector. LiteInjector is an open source bit- and cycle-accurate logic fault emulator written in Python, developed with the aim of accelerating security evaluation campaigns for systems-on-chip (SoC). LiteInjector has been tested on several use cases. These use cases rely on VerifyPin codes from the FISSC security benchmark running on a Linux-capable system-on-chip with a RISC-V core. We demonstrate that the tool provides a flexible solution that supports a large set of fault models. Furthermore, results show that, compared to an HDL simulation-based tool, LiteInjector allows reducing the fault injection campaign time by a factor of 210 considering a Linux-based system.

In the era of the Internet of Things (IoT), embedded systems are massively spreading in critical infrastructures. Low-cost and low-power components are used to build such devices, which manipulate sensitive data and communicate at continuously growing throughput. To protect these data, IoT nodes embed cryptographic primitives including countermeasures against Side-Channel Attacks (SCA). In this article, we explore the interest of hardware-based shuffling to protect AES ciphers against power-based side-channel attacks in the context of low-cost IoT devices. Shuffling is performed via a dedicated hardware module, wherein a Pseudo-Random Number Generator provides a random vector used to control a permutation network, generating a permutation which determines the AES computation sequence. The approach has been explored and evaluated through several FPGA-based design solutions in term of area, timing performance, and security. Compared to an unprotected design, the best solution leads to a minimum area overhead factor of 1.2 or a maximum throughput of 45.23 Mbit/s. Furthermore, compared to existing works that also depend on hardware shuffling, the proposed solution is up to 10.4 times faster. Results show that hardware-based shuffling solution as implemented increases the Measure-to-Disclosure metric by a factor greater than 10,000 when considering Correlation Power Analysis-based SCA.

Randomizing the mapping of addresses to cache entries has proven to be an effective technique for hardening caches against contention-based attacks like Prime+Probe. While attacks and defenses are still evolving, it is clear that randomized caches significantly increase the security against such attacks. However, one aspect that is missing from most analyses of randomized cache architectures is the choice of the replacement policy. Often, only the random- and LRU replacement policies are investigated. However, LRU is not applicable to randomized caches due to its immense hardware overhead, while the random replacement policy is not ideal from a performance and security perspective.

Fault Injection Attacks (FIA) pose significant threats to the security and reliability of embedded systems. FIAs can be used to target an embedded processor by manipulating its clock signal, power supply or by using electromagnetic pulses. In this study, we analyze FIA on the Physical Memory Protection (PMP) configuration flow of a CVA6 RISC-V core. Fault injection campaigns targeting an FPGA implementation on an ARTY A7-100T board are performed to characterize the fault effects. For that purpose, we rely on clock glitches. Moreover, in order to further characterize the induced faults, Error-Correction Code (ECC) is considered. We extend the ID pipeline stage with hardware modules to filter faults using Hamming code. Experimental results demonstrate that FIA has multiple effects on the PMP configuration registers. By classifying these effects in regards with injection parameters, we highlight that a given effect can be obtained with high probability by an attacker. Furthermore, thanks to integrated ECC modules used as filters, we confirm that single bit-flips is a prevalent effect in our experiments. Particularly, results demonstrate that numerous fault effects observed in the PMP configuration registers are caused by single bit-flips in the ID stage of the CVA6 core.

This paper presents FISSA, an open-source software tool that facilitates the building of fault injection campaigns based on well-known HDL simulation tools. The proposed solution relies on two software modules that encapsulate an existing HDL simulator. The first module generates TCL scripts to drive the simulation process and automatically inject faults according to the user's needs. The second module is dedicated to fault analysis, enabling users to assess the resilience of their design. The proposed approach allows the designers to seamlessly integrate fault injection simulations into their workflow. To demonstrate the solution's capacity, this paper proposes a case study to evaluate the robustness of a Dynamic Information Flow Tracking mechanism integrated into a RISC-V processor against different fault injection scenarios. For that purpose, a total of 360,747 simulations have been performed.

The paper explores hardware supports for replaying instructions to protect processors against some fault injection attacks. A replay instruction is added to the instruction set of a small 32-bit RISC processor to allow the automatic and parametrized replay of sequences of instructions. Various detection elements are added to the processor, implemented on FPGA, and compared in terms of performances, cost and fault coverage. The proposed extension leads to significant improvements compared to software protections for a small silicon overhead.

In this paper, we present a lightweight secured AES hardware implementation designed to further resist to Side Channel Attacks relying on Power Analysis. The proposed architecture is based on an 8-bit data-path, and the protection is provided by shuffling computations and memory locations. Our shuffling module is based on a permutation network controlled by a Random Number Generator and leads to the best compromise between security, area, and performances compared to state-of-the-art. Implementation results on a spartan-6 FPGA show that the proposed protection mechanisms impact the area and the timing performance of the unprotected design by factors of 1.58 and 0.35 respectively. Security evaluation based on simulation results shows that the proposed secure architecture resists to a regular CPA by revealing a unique key byte when attacking with up to 1 million traces while state-of-the-art shuffled designs requires only 50000 traces to retrieve the entire secret key. Considering an integrated CPA (also called windowing attack), the proposed architecture allows increasing up to ×300 the required number of traces (Measurements to Disclosure) to retrieve 40% of the key bytes and reveals no more than 9 key bytes when attacking with up to 1 million traces.

Cache-based side-channel attacks (SCAs) are becoming a security threat to the emerging computing platforms. To mitigate these attacks, numerous countermeasures have been proposed. However, these countermeasures require either radical hardware modification or they are incompatible with the performance features like super-page and data de-duplication. This paper presents a countermeasure, called Flush+Prefetch, which obfuscates the memory access behavior of a secure application using independent threads that randomly access the memory belonging to secure application. Unlike existing state-of-the-art countermeasures, Flush+Prefetch works with commodity hardware and it is compatible with existing performance features. As a proof-of-concept, we have studied the effectiveness of Flush+Prefetch by defending the secret key of RSA cryptosystem against a high-resolution cache side-channel attack called Flush+Reload. We have evaluated the confidentiality of RSA decryption process on an Intel Xeon E5-2643 processor by generating 100,000 requests to a web-server sequentially while considering the effect on performance as well. Our experimental results show that the confidentiality of memory accesses by RSA is preserved under Flush+Prefetch countermeasure. Our results show that the performance, in terms of average execution time , is improved by 10.2% for best design case as compared to the system under attack.

Somewhat Homomorphic Encryption (SHE) schemes allow to carry out operations on data in the cipher domain. In a cloud computing scenario, personal information can be processed secretly, inferring a high level of confidentiality. For many years, practical parameters of SHE schemes were overestimated, leading to only consider the FFT algorithm to accelerate SHE in hardware. Nevertheless, recent work demonstrates that parameters can be lowered without compromising the security [1]. Following this trend, this work investigates the benefits of using Karatsuba algorithm instead of FFT for the Fan-Vercauteren (FV) Homomorphic Encryption scheme. The proposed accelerator relies on an hardware/software co-design approach, and is designed to perform fast arithmetic operations on degree 2,560 polynomials with 135 bits coefficients, allowing to compute small algorithms homomorphically. Compared to a functionally equivalent design using FFT, our accelerator performs an homomorphic multiplication in 11.9 ms instead of 15.46 ms, and halves the size of logic utilization and registers on the FPGA.

Current cache Side-Channel Attacks (SCAs) countermeasures have not been designed for many-core architectures and need to be revisited in order to be practical for these new technologies. Spatial isolation of resources for sensitive applications has been proposed taking advantage of the large number of resources offered by these architectures. This solution avoids cache sharing with sensitive processes. Consequently, their cache activity cannot be monitored and cache SCAs cannot be performed. This work focuses on the implementation of this technique in order to minimize the induced performance overhead. Different strategies for the management of isolated secure zones are implemented and compared.

Security is a major issue nowadays for the embedded systems community. Untrustworthy authorities may use a wide range of attacks in order to retrieve critical information. This paper introduces ARMHEx, a practical solution targeting DIFT (Dynamic Information Flow Tracking) on ARM-based SoCs (e.g. Xilinx Zynq). Current DIFT implementations suffer from two major drawbacks. First, recovering required information for DIFT is generally based on software instrumentation leading to high time overheads. ARMHEx takes profit of ARM CoreSight debug components and static analysis to drastically reduce instrumentation time overhead (up to 90% compared to existing works). Then, security of the DIFT hardware extension itself is not considered in related works. In this work, we tackle this issue by proposing a solution based on ARM Trustzone.

Security in embedded systems remains a major concern. Untrustworthy authorities use a wide range of software attacks. This demo introduces ARMHEx, a practical solution targeting DIFT (Dynamic Information Flow Tracking) implementations on ARM-based SoCs. DIFT is a solution that consists in tracking the dissemination of data inside the system and allows to enforce some security properties. In this demo, we show an implementation of ARMHEx on Xilinx Zynq SoC. Especially, we show how the required information for DIFT is recovered with the help of traces produced by CoreSight components, static analysis and instrumentation.

Somewhat Homomorphic Encryption (SHE) schemes can be used to carry out operations on ciphered data. In a cloud computing scenario, personal information can be processed secretly, inferring a high level of confidentiality. The principle limitation of SHE is the size of ciphertext compared to the size of the message. This issue can be addressed by using a batching technique that “packs” several messages into one ciphertext. However, this method leads to important drawbacks in standard implementations. This paper presents a fast hardware/software co-design implementation of an encryption procedure using the Karatsuba algorithm. Our hardware accelerator is 1.5 times faster than the state of the art for 1 encryption and 4 times faster for 4 encryptions.

This work details a hardware-assisted approach for information flow tracking implemented on a reconfigurable chip. Current solutions are either time-consuming or hardly portable (modifications of both sofware/hardware layers). This work takes benefits from debug components included in ARMv7 processors to retrieve details on instructions committed by the CPU. First results in terms of silicon area and time overheads are also given.

Somewhat Homomorphic Encryption (SHE) schemes allow to carry out operations on data in the cipher domain. In a cloud computing scenario, personal information can be processed secretly, inferring a high level of confidentiality. Most practical Somewhat Homomorphic Encryption (SHE) schemes require the implementation of fast polynomial arithmetic, that is why hardware accelerators usually target the FFT/NTT algorithm. This paper proposes a co-design hardware/software approach to accelerate SHE using Karatsuba algorithm. Depending on the needs, Karatsuba algorithm allows to implement additional computations to the hardware in order to reduce software computation time. Our accelerator is designed to speed up arithmetic on degree 2560 polynomials with 125 bits coefficients. We provide 3 different approaches: An area efficient design, a balanced design, and a performance-oriented design. Our accelerator performs a polynomial multiplication in respectively 2.46 ms, 1.70 ms and 1.24 ms, and a relinearization operation in 2.28 ms, 1.53 ms and 1.1 ms, while a functionally equivalent design using the FFT [1] performs the multiplication in 1.96 ms and the relinearization in 4.79 ms for hardware resources consumption equivalent to the balanced design.

Many-core architectures are becoming a major execution platform in order to face the increasing number of applications to be executed in parallel. Such an approach is very attractive in order to offer users with high performance. However it introduces some key challenges in terms of security as some malicious applications may compromise the whole system. A defense-in-depth approach relying on hardware and software mechanisms is thus mandatory to increase the level of protection. This work focuses on the Operating System (OS) level and proposes a set of operating system services able to dynamically create physical isolated secure zones for sensitive applications in many-core platforms. These services are integrated into the ALMOS OS deployed in the TSAR many-core architecture, and evaluated in terms of security level and induced performance overhead.

The multiplication of wireless communication standards is introducing the need of flexible and reconfigurable multistandard baseband receivers. In this context, multiprocessor turbo decoders have been recently developed in order to support the increasing flexibility and throughput requirements of emerging applications. However, these solutions do not sufficiently address reconfiguration performance issues, which can be a limiting factor in the future. This brief presents the design of a reconfigurable multiprocessor architecture for turbo decoding achieving very fast reconfiguration without compromising the decoding performances.

International audience

The multiplication of wireless standards is introducing the need of flexible and reconfigurable multistandard base band receivers. At the physical layer, multiprocessor turbo decoders have been recently developed in order to provide an answer to the increasing throughput requirement of emerging standards. However these solutions do not sufficiently address reconfiguration performance issues which can be a limiting factor in the future. This work focuses on the design of a reconfigurable multiprocessor architecture for turbo decoding achieving very fast reconfiguration without compromising decoding performances. Dynamic reconfiguration can be performed within a single frame decoding duration opening new perspective for reconfigurable multistandard base band receivers. For that purpose, optimizations at the processing element level and a novel bus-based configuration infrastructure are proposed. Results show that up to 64 processings elements can be dynamically configured in 5.352 μs. This low configuration latency corresponds to a single frame decoding duration when performing 6 decoding iterations for a throughput up to 666 Mbps.

Branch prediction is a widely used technique to optimize performances of pipelined microprocessor architectures. In High-Level Synthesis (HLS) domain, few synthesis techniques for optimizing control flows of data dominated applications have been proposed. Previous works mainly focus on using techniques like path-based scheduling algorithms, speculation techniques or static branch prediction for pipelined loops. In this paper, we present a synthesis flow that combines dynamic branch prediction and operation speculation to remove performance bottlenecks imposed by the control flow of applications. Interest of the proposed approach is shown in term of latency improvements and area overhead through a set of experiments.

The multiplication of wireless standards is introducing the need of flexible multi-standard baseband receivers. A multi-ASIP approach for turbo decoding is an answer to reach high throughput and high flexibility. The increasing demand of throughput for new greedy application on mobile devices and the reduction of latency between two frames create the need of an efficient reconfiguration management of such multi-ASIP platforms. In this paper, we propose to tackle reconfiguration optimization of a multi-standard ASIP for turbo decoding developed during previous work. Results show that for an area overhead of 0.012 mm2in 65 nm CMOS technology, a significant reconfiguration time optimization is achieved thanks to a reduction of the ASIP configuration load of 70%. Moreover, in a multi-ASIP context in which 8 ASIPs are implemented the configuration load is divided by ten thanks to the possibility to use a multicast mechanism for ASIP configuration loading.

Many modern and emerging designs require having efficient dynamically reconfigurable and reprogrammable processors. However, when the implemented design needs an upgrade, newly added features have to be quickly supported and validated. This is clearly noticed in modern receivers of recent wireless communication standards that feature continuously different frame lengths and code rates for the channel decoder. This paper explores with an example the possibility of realizing a flexible channel decoder to implement and validate new/incremental algorithm changes with fast turnaround time in design. An application specific instruction-set processor (ASIP) is proposed as flexible core that can decode low-density parity-check (LDPC) codes with the various block sizes and code rates as specified in WiFi and WiMAX standards. Furthermore, the proposed architecture enables quick support of other Quasi-Cyclic LDPC (QC-LDPC) codes, e.g. DVB-S2, with simple incremental hardware changes at design time.