Classic McEliece is a code-based quantum-resistant public-key scheme characterized with relative high encapsulation/decapsulation speed and small ciphertexts, with an in-depth analysis on its security. However, slow key generation with large public key size make it hard for wider applications. Based on this observation, Mckeycutter, a high-throughput key generator in hardware, is proposed to accelerate the key generation in Classic McEliece based on algorithm-hardware co-design. Meanwhile the storage overhead caused by large-size keys is also minimized. First, compact large-size GF(2) Gauss elimination method is presented by adopting naive processing array and memory-friendly scheduling strategy. Second, an optimized constant-time hardware sorter is proposed to support regular memory accesses with less comparators and storage. Third, algorithmlevel pipeline is enabled for high-throughput processing, allowing for concurrent key generations. Our FPGA implementation results achieve around 4× improvements in throughput with 9~14× less memory-time product compared with the existing FPGA solutions.

Fully homomorphic encryption (FHE) is a novel encryption method that can perform operations on encrypted data. The performance of applications based on FHE is still low due to the high computational complexity of operations on the ciphertext. This article combines the characteristics of FHE and the redundant encoding method to achieve faster radix-2 arithmetic operations in BGV-like schemes. First, a ciphertext integer addition with multiplicative depth two, namely, redundant carry-free addition (RCFA), is proposed by applying the carry-free feature of the redundant encoding method. This addition is$7.207\times $faster and uses 15.0% of the occupied memory at 512 bits compared with the nonredundant method. After utilizing the single-instruction–multiple-data (SIMD) technique, RCFA with SIMD further improves the efficiency by$3903\times $at 512 bits compared with the nonredundant SIMD method. Its ciphertext size and occupied memory are only 34.59% and 1.6% those of the nonredundant SIMD method. Second, to achieve efficient ciphertext multiplications, redundant multiplication (RM) of dual SIMD data (RMDS) and RM of SIMD and non-SIMD data (RMSNS) methods are proposed; they obtain speedups of$65.6\times $and$631.0\times $, respectively, at 32 bits compared with the nonredundant implementations. Finally, SHA-256 is implemented to validate the efficiency of the proposed arithmetic operations. Compared with the nonredundant SIMD method, this article obtains a speedup of$4.34\times $.

Saber, the only module-learning with rounding-based algorithm in NIST's third round of post-quantum cryptography (PQC) standardization process, is characterized by simplicity and flexibility. However, energy-efficient implementation of Saber is still under investigation since the commonly used number theoretic transform can not be utilized directly. In this manuscript, an energy-efficient configurable crypto-processor supporting multi-security-level key encapsulation mechanism of Saber, is proposed. First, an 8-level hierarchical Karatsuba framework is utilized to reduce degree-256 polynomial multiplication to the coefficient-wise multiplication. Second, a hardware-efficient Karatsuba scheduling strategy and an optimized pre-/post-processing structure is designed to reduce the area overheads of scheduling strategy. Third, a task-rescheduling-based pipeline strategy and truncated multipliers are proposed to enable fine-grained processing. Moreover, multiple parameter sets are supported in LWRpro to enable configurability among various security scenarios. Enabled by these optimizations, LWRpro requires 1066, 1456 and 1701 clock cycles for key generation, encapsulation, and decapsulation of Saber768. The post-layout version of LWRpro is implemented with TSMC 40 nm CMOS process within 0.38 mm2. The throughput for Saber768 is up to 275k encapsulation operations per second and the energy efficiency is 0.15 uJ/encapsulation while operating at 400 MHz, achieving nearly 50× improvement and 31× improvement, respectively compared with current PQC hardware solutions.

Defending against distributed denial of service (DDoS) attacks on the Internet is a fundamental problem. However, recent industrial interviews with over 100 security experts from more than ten industry segments indicate that DDoS problems have not been fully addressed. The reasons are twofold. On one hand, many academic proposals that are provably secure witness little real-world deployment. On the other hand, the operation model for existing DDoS-prevention service providers (e.g., Cloudflare, Akamai) is privacy invasive for large organizations (e.g., government). In this paper, we present Umbrella, a new DDoS defense mechanism enabling Internet service providers to offer readily deployable and privacy-preserving DDoS prevention services to their customers. At its core, Umbrella develops a multi-layered defense architecture to defend against a wide spectrum of DDoS attacks. In particular, the flood throttling layer stops amplification-based DDoS attacks; the congestion resolving layer, aiming to prevent sophisticated attacks that cannot be easily filtered, enforces congestion accountability to ensure that legitimate flows are guaranteed to receive their fair shares regardless of attackers' strategies; and finally the user-specific layer allows DDoS victims to enforce self-desired traffic control policies that best satisfy their business requirements. Based on Linux implementation, we demonstrate that Umbrella is capable to deal with large-scale attacks involving millions of attack flows, meanwhile imposing negligible packet processing overhead. Further, our physical test bed experiments and large-scale simulations prove that Umbrella is effective to mitigate various DDoS attacks.

Turnkey solutions that combine energy-efficient remote sensing and secure communication of telemetry are desirable in data collection, risk control and situation appraisal with the large scale deployment of resource constrained Internet of Things devices. In this paper, a new low-cost physical unclonable function (PUF) based temperature sensor for secure remote temperature sensing is proposed. The design exploits the approximately linear positive temperature coefficient of CMOS inverter in super-threshold operation to calibrate the running frequency of ring oscillator (RO) in a reconfigurable RO PUF at different temperature. The RO frequency corresponding to the sensed temperature is fed into a randomizer seeded by the input challenge to select new RO pairs for comparison to generate a random, unique and physically unclonable digital tag, which is valid for a selected input challenge to a target device at a particular temperature. Using only standard logic cells and a very simple structure, the proposed temperature sensor can be easily implemented on FPGA and integrated into other digital systems. It protects the integrity of the sensed information by preventing falsified sensor data and masquerade sensing node. The FPGA implementation of our proposed design has demonstrated the feasibility of making a trust temperature telemetry system out of PUF.

This paper presents a dynamically reconfigurable processing array named Anole for symmetric-key algorithms. Processing elements and the interconnections between them are designed to support various block and stream ciphers. Without affecting flexibility, three key techniques are presented to increase energy efficiency (throughput/power, the number of operations per unit energy consumption) and area efficiency (throughput/area). First, the distributed control network supports multithreading on reconfigurable fabrics at a low cost, thereby maximizing the utility of computing resources in the space domain. Second, the concurrent computation and reconfiguration scheme integrates configuration contexts with processing data to simultaneously execute in the data-path. The resulted immediate switching between different configurations increases the utilization rate of hardware resources in the temporal domain. Third, under configuration context compression and organization, the context memory size and configuration time are further minimized. Anole is implemented on a 7.75 mm2silicon square with TSMC 65-nm technology at 400 MHz. Experiments show that Anole significantly outperforms field programmable gate array and general purpose processor by more than two orders of magnitude in energy and area efficiencies. Compared with state-of-the-art reconfigurable solutions, Anole achieves (average) 16.5× higher energy efficiency and 9.4× higher area efficiency.

Coarse grained reconfigurable architectures (CGRA) have been applied to numerous fields of computing- and data-intensive applications, such as computer vision, baseband communication, and cipher processing. A CGRA usually comprises hundreds of reconfigurable computing-cells (RCC), which account for a majority of the die area. As such, RCCs have a higher probability of being attacked by hardware Trojans, which seriously affects CGRA behavior. However, a CGRA can be dynamically and partially reconfigured via configuration contexts at runtime; this property could be utilized as an effective countermeasure against malicious hardware. This particular topic has yet to undergo significant research. This paper proposes a secure mapping approach called dynamic resource management based on security value (DRMaSV) to enhance CGRA capability against hardware Trojans by selectively protecting RCCs. DRMaSV realizes run-time monitoring based on an adapted triple modular redundancy mechanism under hardware resource constraints (i.e., area constraints). First, in order to measure the capability against hardware Trojans, a security capability metric called “security value” (SV) is defined, with measurements categorized as “Influence” and “Unreliability.” Here, both the circuit architecture and the level of Unreliability for modules used in the circuit are considered. Next, a DRM strategy to maximize the SV under hardware resource constraints is introduced. This strategy is described by the dynamic programming model (i.e., 0/1 knapsack problem), which can obtain an optimal solution. Finally, a mapping approach for CGRAs is derived by attaching the DRM strategy to a generic mapping flow. Simulations show that the proposed secure mapping approach ensures a given number of correct outputs, which then allows the number of outputs affected by activated Trojans under any given hardware resource constraint (area constraint) or overhead (area overhead) to be minimized. The results of actual chip design experiments are in agreement with the simulation results, indicating that the proposed secure mapping approach is effective.

Traditional detection countermeasures against fault attacks have been criticized as insecure because of the fragile comparison operation that can be maliciously bypassed. In order to avoid the comparison, infection countermeasures have been designed to confuse the faulty ciphertexts so that the output cannot be further explored. This paper presents an infection method that resists fault attacks using the existing Benes network module in high-performance crypto processors. The Benes network is originally used to accelerate permutation operations in block ciphers. The hamming weight of the differential results is balanced by modifying specific network switches, without changing the network topology. A further confusion is performed to destroy the determinacy by configuring part of the network with a random bit-stream. Furthermore, a statistical evaluation method is presented to quantitatively verify the proposed countermeasure in addition to a formal proof of security. This also provides a new concept for the evaluation of future random-enhanced infection methods. Experiments are carried out using Advanced Encryption Standard (AES), triple Data Encryption Standard (DES), and Camellia as examples. Under statistical evaluation, the results show that the proposed countermeasure improves the fault resistance by over four orders of magnitude compared with the unprotected case. Also, the performance and the area overhead are within 10% compared with the original Benes network.

With the increasing accuracy of fault injections, it has become possible to inject two faults into specific circuit regions precisely at a certain time. Unfortunately, most existing fault attack countermeasures are based on the single fault assumption, and it is, therefore, very difficult to resist double fault attacks. Reconfigurable array architecture (RAA) has the ability to introduce spatial and time randomness by dynamic reconfiguration, which can alleviate the threat of double fault attacks. This paper, for the first time, analyzes the double fault attack issues in the fault injection phase systematically. An evaluation model, named injection effort model (IEM), is proposed to quantify the efforts of a successful fault injection. In IEM, the real injection process is described mathematically using the probability method, so that a theoretical basis can be provided for the corresponding countermeasure design. Based on the concept of spatial and time randomization, three countermeasures are implemented on RAA for the purpose of decreasing the implementation overhead under the premise of ensuring the security. When these countermeasures are adopted, tradeoffs can be made between the double fault resistance and the extra overhead through changing the degree of randomness. Experiments are carried out to analyze the relationship between the resistance and the overhead using Advanced Encryption Standard (AES), Data Encryption Standard (DES), and Camellia. When the overhead constraints in terms of throughput, hardware resources, and energy are 5%, 35%, and 10% respectively, the double fault resistance can increase by two to four orders of magnitude (ranging from 824 to 10 149 for different algorithms).

A mixed-grained reconfigurable computing platform targeting multiple-standard video decoding is proposed in this paper. The platform integrates eight coarse-grained Reconfigurable Processing Units (RPUs), each of which consists of 16×16 multi-functional Processing Elements (PEs) and are implemented in TSMC 65 nm technology and two Altera Stratix IV EP4SE820 FPGAs. By exploiting dynamic reconfiguration of the RPUs and static reconfiguration of the FPGAs, the proposed platform achieves scalable performances and cost trade-offs to support a variety of video coding standards, including H.264, MPEG-2, AVS and HEVC. Two types of platform configuration are tested in this work. One configuration utilizes two RPUs and targets multiple-standard high-definition (HD) video decoding, while the other utilizes only one RPU, which works under a lower frequency and targets at standard resolution (SD) decoding. The HD configuration can decode 1920×1080 H.264 video streams at 30 frames per second (fps) under 200 MHz and 1920×1080 HEVC video streams at 30 fps under 236 MHz. It achieves a 25% performance gain over an industrial coarse-grained reconfigurable processor for H.264 decoding, and a 3.85× performance boosts over the Intel i5 general-purpose CPU for HEVC decoding.

A coarse-grained reconfigurable processing unit (RPU) consisting of 16 ×16 multi-functional processing elements (PEs) interconnected by an area-efficient line-switched mesh connect (LSMC) routing is implemented on a 5.4 mm ×3.1 mm die in TSMC 65 nm LP1P8M CMOS technology. A hierarchical configuration context (HCC) organization scheme is proposed to reduce the implementation overhead and the energy dissipation spent on fast reconfiguration. The proposed RPU is integrated into two system-on-a-chips (SoCs), targeting multiple-standard video decoding. The high-performance chip, comprising two RPU processors (named REMUS_HPP), can decode 1920 ×1080 H.264 video streams at 30 frames per second (fps) under 200 MHz. REMUS_HPP achieves a 25% performance gain over the XPP-III reconfigurable processor with only 280 mW power consumption, resulting in a 14.3 × improvement on energy efficiency. The other chip (named REMUS_LPP), targeting low power applications, integrates only one RPU processor. REMUS_LPP can decode 720 ×480 H.264 video streams at 35fps with 24.5 mW under 75 MHz, achieving a 76% reduction in power dissipation and a 3.96 × improvement on energy efficiency compared with the ADRES reconfigurable processor.

To assist the system architects with fast exploration and performance evaluation of the reconfigurable software/hardware architectures, this paper presents a system-level simulator, named after SimRPU, for the reconfigurable processing unit (RPU), which is the major computing engine in reconfigurable processor. The proposed simulator consists of a simulation kernel, a software compiler, a system profiler providing performance, area and power information for the desired architectures, and a system debugger supporting inspecting and modification of the internal state of the RPU. Object-oriented hierarchical and parameterized architecture modeling techniques are proposed to satisfy the requirements for a fast and comprehensive evaluation. Cycle-accurate simulation mechanisms are developed to improve the accuracy of the profiled performance data. Compared with the traditional register transfer level (RTL) based simulation scheme, the proposed simulator could achieve an average speedup of 18.5× with only 3.5% reduction on performance estimation accuracy. One reconfigurable processor targeted at high-definition multimedia decoding applications (such as H.264, MPEG2, AVS, etc.) is implemented with Taiwan Semiconductor Manufacturing Company 65-nm process using the proposed exploration and design flow. The measured results show that the implemented architecture has obvious advantages in terms of both performance and power consumption than the reference designs in multimedia decoding applications.

The coarse-grained reconfigurable architecture (CGRA) is proven to be energy efficient in several specific domains. In CGRAs, the on-chip memory hierarchy, which contains the context memory and the data memory organizations, should be well considered to achieve appropriate tradeoffs among three aspects: 1) performance; 2) area; and 3) power. In this paper, two techniques called the hierarchical configuration context (HCC) and the lifetime-based data-memory organization (LDO) focusing on the context memory and the data memory organizations are proposed to compress the on-chip memory space and to reduce the reconfiguration time and the data-reference time. In the HCC, the contexts are constructed in a hierarchical fashion to completely eliminate the repetitive portions of the contexts, not only reducing the overall context storage, but also alleviating the context transportation overhead. A fast context-indexing mechanism in the HCC is proposed to achieve fast reconfiguration, as the hierarchically organized contexts can be located and accessed conveniently. In the LDO, the on-chip data are classified into two types, based on the lifetime of data. The short-lifetime data are stored in the first in first out to increase the reuse ratio of memory space automatically, whereas the long-lifetime data are stored in the radom access memory for several time references. The HCC and the LDO are used in a CGRA core called as reconfigurable processing unit (RPU). Two RPUs are integrated in a reconfigurable computing processor (RCP) called as REconfigurable MUlti-media System, High-Performance Processor (REMUS_HPP). Because of the HCC, compared with a traditional nonhierarchical system, the total context storage required in H.264 decoding is reduced by 77%. Because of the LDO, the normalized on-chip data memory size at same performance level in the REMUS_HPP is only 23.8% and 14.8% of those in XPP-III (a high-performance RCP) and ADRES (a low-power RCP). REMUS_HPP is implemented on a 48.9-mm2silicon with TSMC 65-nm technology, using a 200-MHz working frequency to achieve 1920 × 1088 at 30 fps H.264 high-profile decoding. Compared with XPP-III, the performance of the REMUS_HPP is 1.81× boosted, whereas the energy efficiency is 4.75× higher.

In this paper, a configuration context reduction method for coarse-grained reconfigurable architecture (CGRA) is proposed. The proposed method exploits the structure correlation of computation tasks that are mapped onto CGRA and reduce the redundancies in configuration context. Experimental results show that the proposed method can averagely reduce the configuration context size up to 57% and speed up the execution up to 28.7%.

Computing-intensive algorithms which occupy most of executing time are always the main bottleneck in real-time or high quality video applications. In this paper, the optimization methods of the computing-intensive decoding algorithms of H.264, including MC (Motion Compensation), Deblocking and IDCT-IQ (Inverse Discrete Cosine Transform-Inverse Quantization), are proposed firstly, and then implemented on the REMUS (REconfigurable MUltimedia System) which is an embedded coarse-grain reconfigurable multimedia system. Tests show that the efficiency of MC is improved by 32.5%, Deblocking by 69% and IDCT-IQ by 88.5% compared with XPP PACT(a commercial reconfigurable processor). Compared with typical ASIC solutions, execution performance of MC and IDCT improved by 49% and 17%, respectively, while that of Deblocking remained about the same.

This paper proposes a reconfigurable multi-processor SoC for media applications called REMUS (REconfigurable Multi-media System), which consists of 512 processing engines and two ARMs. The processing engines are divided into two dynamic configuration groups, which can be easily tailored and extended. The processing engines, DBIs (Data Buffering Interface, DBI) and context interfaces build up a large throughput computing system with thread parallelism, algorithms parallelism and data parallelism. Different algorithms can be mapped in at the same time. REMUS is suitable for many applications such as media decoding and baseband processing, etc. Simulation results show that the processing capability of REMUS is to support 1920*1088 @30fps videos at 200 MHz in real-time decoding of H.264 high-profile streams.