Design and Characterization of a Hardware Encryption Management Unit for Secure Computing Platforms

Abstract

Software protection is increasingly necessary for a number of applications, ranging from commercial systems and digital content distributors, to military systems exposed in the field of operations. As computing devices become more pervasive, and software more complex, insufficiencies with current software protection mechanisms have arisen. Software-only and data-only protection systems have resulted in broken systems that are vulnerable to loss of software confidentiality and integrity.A growing number of researchers have suggested that hardware encryption mechanisms be employed to enforce software protection. Although there are several competing architectures, few offer the necessary protection while remaining compatible with modern computing systems and models. The Virginia Tech Secure Software Platform is the first architecture to achieve both increased protection and usability.This thesis presents the design and implementation of a fast, flexible Encryption Management Unit (EMU) for Virginia Tech Secure Software and compatible platforms. The design is capable of providing decryption of program instructions residing in page-sized sections of memory, without modification to the core processor. The effect of the EMU is modeled with varying application types and system loads. Lastly, a benchmark designed to measure actual performance was created to measure the actual performance of the EMU and validate the models.

Protection of heterogeneous architectures on FPGAs: An approach based on hardware firewalls

“…Some of these processors are efficient but do not cover our threat model defined in a further section. In [6] authors describe a solution (called SecSoft) to protect software with a hardware Encryption Management Unit (EMU). This work proposes a latency analysis of several modes (block/counter modes for encryption function and with/without encryption).…”

“…Such a solution allows reducing the cryptography latency overhead while maintaining a strong level of protection. Compared to [6,7], we rely on a more comprehensive security policy where developer can finely tune his/her cryptography needs. Then, this work also presents a feedback feature for security mechanisms (Section 4): that is to say how attacks are detected and how the update manager takes care of these information.…”

“…• For memory countermeasures, our approach is similar to [6,7] but the AES-GCM cryptographic primitive is used as proposed by [9]. Such a solution allows reducing the cryptography latency overhead while maintaining a strong level of protection.…”

Intellectual property protection (IPP) using obfuscation in C, VHDL, and Verilog coding

“…1. Another major focus has been the encryption [17][18][19] of software in the XOM approach via a crypto controller inserted between program memory and processor [20][21][22][23] . For embedded systems, however, we have to consider that a factor of 100 more embedded processors systems with hard cost constraints are produced than powerful general purpose processors (GPP).…”