Protection of heterogeneous architectures on FPGAs: An approach based on hardware firewalls

Abstract

International audienceEmbedded systems are parts of our daily life and used in many fields. They can be found in smart-phones or in modern cars including GPS, light/rain sensors and other electronic assistance mechanisms.These systems may handle sensitive data (such as credit card numbers, critical information about thehost system and so on) which must be protected against external attacks as these data may be transmit-ted through a communication link where attackers can connect to extract sensitive information or injectmalicious code within the system. This work presents an approach to protect communications in multi-processor architectures. This approach is based on hardware security enhancements acting as firewalls.These firewalls filter all data going through the system communication bus and an additional flexiblecryptographic block aims to protect external memory from attacks. Benefits of our approach are demon-strated using a case study and some custom software applications implemented in a Field-ProgrammableGate Array (FPGA). Firewalls implemented in the target architecture allow getting a low-latency securitylayer with flexible cryptographic features. To illustrate the benefit of such a solution, implementations arediscussed for different MPSoCs implemented on Xilinx Virtex-6 FPGAs. Results demonstrate a reductionup to 33% in terms of latency overhead compared to existing effort

Side-channel attack resilience through route randomisation in secure real-time Networks-on-Chip

“…Firewall-based and crypto-based techniques integrated at the network interface are the most commonly used approaches against active NoC attacks over the past decade [6] [2]. Firewalls implement authentication, access control and integrity services by means of traffic matching with a security table.…”

Pro-Active Policing and Policy Enforcement Architecture for Securing MPSoCs

“…Cotret et al proposed a hardware firewall architecture that enforces programmable security policies to protect external and internal traffic in FPGA based multiprocessor architectures, serving as a security bridge between the system resources and the shared system communication bus to monitor control activities. Their proposed work reduces the performance penalty compared to a fully encrypted approach, however it is limited to the detection of attacks and does not provide countermeasures, other than freezing the system communication bus [22]. Jacob et al presented a detailed study of FPGA MPSoC security mechanisms with the focus on Hardware Trojans [13].…”

“…Jacob et al presented a detailed study of FPGA MPSoC security mechanisms with the focus on Hardware Trojans [13]. They proposed the concept of a light-weight AXI-wrapper as one of the prevention methods, similar to one proposed by [22], to encapsulate system assets. Following this work, Benhani et al presented a security evaluation of the ARM TrustZone technology available on FPGA MPSoC.…”

Evaluación del rendimiento de cortafuegos basados en software libre

“…Evaluar las capacidades defensivas de los firewalls y su impacto en las comunicaciones de las redes que monitorean constituyen aspectos esenciales para determinar su efectividad como herramientas de seguridad, y para facilitar su selección en correspondencia con las necesidades de las organizaciones (Lee et al, 2015;Konikiewicz & Markowski, 2017;Mora & Villero 2020). Cotret, Gogniat & Sepúlveda (2016) concluyeron que los firewalls basados en hardware poseen elevadas funcionalidades de seguridad y mantienen índices de desempeño de red eficientes. Sin embargo, los costos de estos dispositivos dificultan su adquisición por parte de las PYMES de países en vías de desarrollo.…”