PAGURUS: Low-Overhead Dynamic Information Flow Tracking on Loosely Coupled Accelerators

Abstract

Software-based attacks exploit bugs or vulnerabilities to get unauthorized access or leak confidential information. Dynamic information flow tracking (DIFT) is a security technique to track spurious information flows and provide strong security guarantees against such attacks. To secure heterogeneous systems, the spurious information flows must be tracked through all their components, including processors, accelerators (i.e., applicationspecific hardware components) and memories. We present PAGU-RUS, a flexible methodology to design a low-overhead shell circuit that adds DIFT support to accelerators. The shell uses a coarsegrain DIFT approach, thus not requiring to make modifications to the accelerator's implementation. We analyze the performance and area overhead of the DIFT shell on FPGAs and we propose a metric, called information leakage, to measure its security guarantees. We perform a design-space exploration to show that we can synthesize accelerators with different characteristics in terms of performance, cost and security guarantees. We also present a case study where we use the DIFT shell to secure an accelerator running on a embedded platform with a DIFT-enhanced RISC-V core.

Dynamic Information Flow Tracking: Taxonomy, Challenges, and Opportunities

“…Additionally, the address space is bounded by using extended instructions to enforce access control on different parties. [19] proposed an IP wrapper to protect access to IPs from software. The DIFT operations are implemented as hardware logic in the IP wrapper to check for malicious access.…”

“…Piccolboni et al. in [ 19 ] proposed an IP wrapper to protect access to IPs from software. The DIFT operations are implemented as hardware logic in the IP wrapper to check for malicious access.…”

“…However, software solutions often introduce high performance overheads because additional instructions are added to support DIFT. Meanwhile, hardware assisted DIFT design [15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30] can extract sufficient runtime data from the hardware level to enforce different security rules. By modifying the hardware, all DIFTrelated operations are implemented as hardware logic to accelerate the tag propagation and tag checking.…”

Memory-Based High-Level Synthesis Optimizations Security Exploration on the Power Side-Channel

“…Many cryptographic cores naturally map into HLS languages, making it an attractive approach for designing cryptographic hardware. While it is easy to measure the performance, power, and resource usage, there is not a standard, built-in way to determine the security of a particular design [5]. It is thus important to understand how these HLS optimizations effect the design's security alongside the traditional power, performance, and resource usage metrics.…”