Network-on-Chip (NoC) Firewall provides memory protection and process isolation. In this paper, we design, implement and validate hierarchical Linux security primitives on top of a custom NoC Firewall module embedded on the ARM-based Xilinx Zedboard FPGA. Our open-source, multi-layer security protocols aim to protect the privacy of application keys stored in non-cacheable BRAM. Experimental results derived from integrating security within a soft real-time electrocardiogram monitoring, analysis, and visualization application allow evaluating the software overhead of the proposed security primitives. Preliminary results indicate that the performance overhead for supporting data privacy is acceptable for one-time authentication schemes. However, relative to the processing requirements of the E-Health application, security overheads are large, and cannot sustain continuous authentication schemes.

We propose the integration of a network-on-chip-based MPSoC in mixed-criticality systems, i.e. systems running applications with different criticality levels in terms of completing their execution within predefined time limits. An MPSoC contains tiles that can be either CPUs or memories, and we connect them with an instance of a customizable point-to-point interconnect from STMicroelectronics called STNoC. We explore whether the on-chip network capacity is sufficient for meeting the deadlines of external high critical workloads, and at the same time for serving less critical workloads that are generated internally. To evaluate the on-chip network we vary its configuration parameters, such as the link-width, and the Quality-of-Service (QoS), in specific the number (1 or 2) and type (high or low priority) of virtual channels (VCs), and the relative priority of packets from different flows sharing the same VC.

The increasing adoption of multi-core Systems-on-Chip (SoC) in critical systems has turned security into an important design requirement. In addition to making a SoC tamper-resistant by embedding cryptographic solutions, in order to make a system robust, we need to control the level of access to the critical functions and capabilities. We propose a hardware protection architecture to enhance a traditional SoC platform in terms of protection. These hardware enhancements focus on isolating physical memory compartments by applying access rules, thus we allow dynamic security policies to be enforced at the hardware for protection against untrustworthy hardware or software components. We present and analyze an implementation of a prototype that allows sixteen concurrently active protection domains at a system cost of less that three percent and negligible operational overhead.

In multiprocessor system-on-chip (MPSoC), a CPU can access physical resources, such as on-chip memory or I/O devices. Along with normal requests, malevolent ones, generated by malicious processes running in one or more CPUs, could occur. A protection mechanism is therefore required to prevent injection of malicious instructions or data across the system. We propose a self-contained Network-on-Chip (NoC) firewall at the network interface (NI) layer which, by checking the physical address against a set of rules, rejects untrusted CPU requests to the on-chip memory, thus protecting all legitimate processes running in a multicore SoC. To sustain high performance, we implement the firewall in hardware, with rule-checking performed at segment-level based on deny rules. Furthermore, to evaluate its impact, we develop a novel framework on top of gem5 simulation environment, coupling ARM technology and an instance of a commercial point-to-point interconnect from STMicroelectronics (STNoC). Simulation tests include scenarios in which legitimate and malicious processes, running in different CPUs, request access to shared memory. Our results indicate that a firewall implementation at the NI can have a positive effect on network performance by reducing both end-to-end network delay and power consumption. We also show that our coarse-grain firewall can prevent saturation of the on-chip network and performs better than fine-grain alternatives that perform rule checking at page-level. Simulation results are accompanied with field measurements performed on a Zedboard platform running Linux, whereas the NoC Firewall is implemented as a reconfigurable, memory-mapped device on top of AMBA AXI4 interconnect fabric.

Multimedia applications executing on NoC-based multicore architectures demand high performance and power-efficiency. We propose a low-cost NoC DPM controller that performs dynamic frequency scaling on each NoC router by activating shared memory-based monitoring probes at different parallel application slices or using an independent sample rate. We evaluate our DFS module by running an MPEG4 transfer speed test on a cycle-accurate, monitoring-aware SystemC virtual platform of a NoC-based MPSoC. The DFS module improves power-performance characteristics over existing techniques, and has minimal intrusion, significantly less than 0.01% of the total execution time.

We present an open SystemC-based virtual platform that fits the design flow of heterogeneous, self-adaptive shared memory-based multicore SoCs by supporting concept validation and verification of equivalent RTL models, early software development of corresponding system drivers and efficient design space exploration at an early stage of the design. We examine connectivity, functionality and interaction among its components, such as CPU, memory and NoC, and outline innovative features related to supporting system-level monitoring via time-driven and event-based shared memory primitives. As a case-study, we consider co-simulation of shared memory-based array processing using cycle-approximate ARM Cortex-A9 processor models in the presence of application load balancing and best-effort memory bandwidth sharing, e.g. arising from a service-level agreement. Besides improving performance (10% to 23%), we quantify the very low intrusiveness of the shared-memory and processor (load balancing) monitoring probes, together they contribute less than 0.005% to the total execution time.