Efficient, secure, and isolated execution of cryptographic algorithms on a cryptographic unit

Abstract

Cryptographic algorithms handle sensitive information and their safe execution plays an essential role in many security applications. When implemented in software on generalpurpose computers, cryptographic algorithms are vulnerable to a variety of attacks such as side-channel and cold-boot attacks since they either share hardware resources with other simultaneously executing processes or store sensitive information in easily accessible places (e.g. main memory). In this paper, we demonstrate that secure and isolated execution of cryptographic algorithms is possible on a cryptographic unit that can easily be integrated to all RISC processors. The cryptographic unit is capable of physically isolating the execution of cryptographic algorithms from all other simultaneously executing processes. By specifically providing an AES implementation running in this isolated execution environment we demonstrate that it is possible to provide physical process isolation for cryptographic algorithms without any significant overhead in execution time. Furthermore, the proposed technique protects the cryptographic applications against cold-boot and cache attacks as well as any other threats originated from other processes since the sensitive material never leave the cryptographic unit. We realized a RISC-based embedded processor with five-stage pipeline featuring the cryptographic unit on an FPGA device. We included the implementation results both for FPGA and ASIC realizations.

Enhancing an Embedded Processor Core for Efficient and Isolated Execution of Cryptographic Algorithms†

“…Any data that goes out of the chip Other architectures modify or extend processor cores mostly for accelerating the cryptographic algorithms [23], [24]. There are also other architectures, which propose solutions for both secure and fast execution of cryptographic algorithms [19], [21], [1] and [20]. A recent work in [24] explores design possibilities for accelerating cryptographic algorithms while secure execution is not considered.…”

“…To accelerate the basic arithmetic operations in fields with prime characteristics, we use the functional units presented in [20,21]. Table 6, we present the timing results for the prime extension field arithmetic used in pairing-based cryptography.…”

“…We also demonstrate that well-known cryptographic algorithms, RSA, ECC, pairing-based cryptography, AES, SHA-1, and SHA-256 can be implemented on an embedded processor equipped with the protected zone with superior time performance, efficiency, and high-level security. A similar approach is used in [21] only for AES implementation; however the proposed technique in [21] cannot easily be extended to more complicated public key algorithms. We provide a complete, generic approach that is readily applicable to any cryptographic algorithm and does not necessitate Assembly language implementation, which is essential in [21].…”

“…A similar approach is used in [21] only for AES implementation; however the proposed technique in [21] cannot easily be extended to more complicated public key algorithms. We provide a complete, generic approach that is readily applicable to any cryptographic algorithm and does not necessitate Assembly language implementation, which is essential in [21].…”

Implementing a Protected Zone in a Reconfigurable Processor for Isolated Execution of Cryptographic Algorithms

“…We also demonstrate that well-know cryptographic algorithms, RSA, ECC, AES can be implemented on embedded processor equipped with the protected zone with superior time performance, efficiency, and high-level security. A similar approach is used in [21] only for AES implementation; however the proposed techniquein [21] cannot easily be extended to more complicated public key algorithms. We provide a complete, generic approach that is readily applicable to any cryptographic algorithm and does not necessitate Assembly language implementation which is essential in [21].…”