Automatic ILP-based Firewall Insertion for Secure Application-Specific Networks-on-Chip

Abstract

Next to performance, it becomes increasingly important that Networks-on-Chip (NoCs) also provide security features such as access control, authentication and availability. They are usually implemented by firewalls at the network interfaces (NIs) of the processing elements (PEs). This paper provides a more efficient way to integrate these security requirements into application-specific NoCs by inserting firewalls also between NoC routers. This approach helps to reduce the communication overhead required for the security information in the packet headers, which can consume 3% to 9% of the total communication bandwidth. It is challenging to manually find the optimal firewall configuration because an application-specific NoC has an irregular topology, which is customized for certain known application, e.g. a smartphone chip. Thus, we show how to automatically solve this problem by formulating it as an Integer Linear Programming (ILP) problem. The solution results in firewall positions such that the communication overhead is minimized and all given security requirements are satisfied. Experiments are performed on two industrial system specifications. Compared to the solution with the firewalls at the NIs, communication overhead is reduced by up to 63%. The optimization only takes a few seconds for a standard ILP solver.

A Survey on the Security of Wired, Wireless, and 3D Network-on-Chips

“…Hu et al [95] placed a firewall in an application-specific NoC. Unlike general purpose NoCs, the topology is modified in specific-purpose NoC to yield the best performance results.…”

“…Firewall Location Firewall Type Fiorin et al [93] Initiator / Target Static Grammatikatis et al [91] Initiator Static Hu et al [95] Between Routers Static Achballah et al [94] Between Routers Static Kinsy et al [40] Target Static Fiorin et al [92] Initiator / Target Dynamic Cioranesco et al [90] Target Dynamic Fernandes et al [96] Initiator / Target Dynamic of tasks requiring secure communication. SZs are, in fact, network-level facilities to ease intra-group secure communications at the system/application level.…”

Towards memory integrity and authenticity of multi-processors system-on-chip using physical unclonable functions

“…In order to protect these MP-SoCs enhanced firewall management is required. The work of [24,27] proposed the integration of static and multi-level firewalls. Despite the good results for mixed-critical applications, the dynamic nature of some of these applications is not yet supported.…”

Hardware-Assisted Secure Communication in Embedded and Multi-Core Computing Systems

“…Grammatikakis et al [27] have proposed a self-contained NoC firewall within the network interface by validating the memory requests against the predefined set of rules. Hu et al [28] have also presented a similar solution by incorporating access rules verification and authentication mechanism for certain regions of the memory units. In our previous work [29], we have presented an identity and address verification-based security module for multi-core systems in order to detect security attacks and stop illegal accesses to the memory.…”

“…In contrast, our proposed security solution does not require modifications in the processor or memory architecture, operates independently without any help from software side and bears minimal performance overhead for NoC-based systems [31]. Security mechanisms for NoC-based multi-core systems (such as [22,24,[27][28][29] have only been designed specifically for shared-memory architectures and provide protection to memory units only whereas our proposed solution can be used to isolate any processing block ranging from memory controllers to other I/O peripherals. Similarly, the hardware-based security solutions, as discussed by Yan et al [11], are based on disabling some unreliable processing cores when sensitive applications are running.…”