Securing Boot of an Embedded Linux on FPGA

Devic, Florian; Torres, Lionel; Badrignans, Benoit

doi:10.1109/ipdps.2011.141

Cited by 6 publications

(9 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [4], Devic et al implement on FPGA a boot mechanism that precludes kernel modifications using SHA-256 (Secure Hash Algorithm) hash function preventing from replays attacks and supports updates. Three implementations, (last twos based on hardware acceleration mechanisms), are proposed to offer three performance/area overhead trade-offs:…”

Section: B Boot Protectionmentioning

confidence: 99%

“…Cotret et al [2] proposes a latency-efficient alternative for MPSoC based on the ARM AXI bus protocol with flexible security configurations and additional cryptographic features. This work describes further how this solution can be added to the Linux boot protection flow of Devic et al [4] to provide a completely secure chain from bitstream download to runtime application execution: such a system should be able to manage updates of OS and protection of runtime transactions in the target multiprocessor system.…”

Section: Runtime Protectionmentioning

confidence: 99%

“…Unfortunately, there is a security breach in such a flow: an attacker can easily update the Flash memory with a malicious kernel because there is no integrity verification of the Flash. That is the reason why Devic et al [4] add blocks in the previous flow ( Figure 1) to provide a flexible integrity protection layer. In this case, the kernel is copied into the DDR memory.…”

Section: A Flexible Boot Of An Embedded Linuxmentioning

confidence: 99%

“…Hardware accelerators are also made for providing a user-defined protection layer during the boot of the OS or the execution of the main application running on an embedded system. Devic et al [4] proposed a solution to secure the boot of an embedded Linux on a Xilinx ML605 FPGA platform. In such a solution, designers can securely set a Linux-based embedded system; unfortunately, during runtime execution, there is no additional protection mechanism to protect the system against attacks.…”

Section: Introductionmentioning

confidence: 99%

“…For instance, an attacker can easily modify memory contents to make the system misbehave or create denial-of-service. This work presents an extension of the work of Devic et al [4] to provide the final user a complete protection flow from bitstream download to runtime applications execution. This paper is organized as follows.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Security enhancements for FPGA-based MPSoCs: A boot-to-runtime protection flow for an embedded Linux-based system

Cotret

Devic

Gogniat

et al. 2012

7th International Workshop on Reconfigurable and Communication-Centric Systems-on-Chip (ReCoSoC)

Self Cite

View full text Add to dashboard Cite

Nowadays, embedded systems become more and more complex: the hardware/software codesign approach is a method to create such systems in a single chip which can be based on reconfigurable technologies such as FPGAs (Field-Programmable Gate Arrays). In such systems, data exchanges are a key point as they convey critical and confidential information and data are transmitted between several hardware modules and software layers. In case of an FPGA development life cycle, OS (Operating System) / data updates as runtime communications can be done through an insecure link: attackers can use this medium to make the system misbehave (malicious injection) or retrieve bitstream-related information (eavesdropping). Recent works propose solutions to securely boot a bitstream and the associated OS while runtime transactions are not protected. This work proposes a full boot-to-runtime protection flow of an embedded Linux kernel during boot and confidentiality/integrity protection of the external memory containing the kernel and the main application code/data. This work shows that such a solution with hardware components induces an area occupancy of 10% of a xc6vlx240t Virtex-6 FPGA while having an improved throughput for Linux booting and lowlatency security for runtime protection.

show abstract

Section: B Boot Protectionmentioning

confidence: 99%

Section: Runtime Protectionmentioning

confidence: 99%

Section: A Flexible Boot Of An Embedded Linuxmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Security enhancements for FPGA-based MPSoCs: A boot-to-runtime protection flow for an embedded Linux-based system

Cotret

Devic

Gogniat

et al. 2012

7th International Workshop on Reconfigurable and Communication-Centric Systems-on-Chip (ReCoSoC)

Self Cite

View full text Add to dashboard Cite

show abstract

Digital filter implementation over FPGA platform with LINUX OS

Galván-Tejada

Celaya-Padilla

et al. 2012

Procedia Engineering

View full text Add to dashboard Cite

Firmware Integrity Protection: A Survey

Marchand,

Imine,

Ouarnoughi

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Over the last years, firmware integrity protection has significantly been addressed in various contexts such as internet of things, vehicles, wireless sensor networks and other systems. However, due to variety of studied systems, the proposed approaches often make divergent and sometimes even conflicting security assumptions. In this regard, we propose in this article a complete survey of the most relevant approaches addressing the firmware integrity protection regardless the considered system or field of application. We first organize the approaches in three main categories, depending on the protection type: 1. secure update, 2. attestation, and 3. secure boot. We then propose two new taxonomies, the first one concerns secure update mechanisms and the second one considers secure boot. Moreover, we extend the scope of an existing taxonomy for attestation mechanisms by studying new approaches and discussing limitations. Finally, we identify open research challenges and then give suggestions and guidelines on how to address them.

show abstract

Securing Boot of an Embedded Linux on FPGA

Cited by 6 publications

References 4 publications

Security enhancements for FPGA-based MPSoCs: A boot-to-runtime protection flow for an embedded Linux-based system

Security enhancements for FPGA-based MPSoCs: A boot-to-runtime protection flow for an embedded Linux-based system

Digital filter implementation over FPGA platform with LINUX OS

Firmware Integrity Protection: A Survey

Contact Info

Product

Resources

About