Transparent memory encryption and authentication
Transparent memory encryption and authentication
复制标题
透明内存加密和身份验证
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
S. Mangard
中科院分区：
文献类型：
--
作者：
M. Werner;Thomas Unterluggauer;R. Schilling;David Schaffenrath;S. Mangard
现代 (SoC) FPGA 的安全功能可以在设备断电时保护硬件和软件 IP 的机密性，并在启动时加载时验证 IP 的真实性。然而，这些方法还不够，因为具有物理访问权限的攻击者也可以在运行时执行攻击，需要额外的安全措施。特别是，现代 (SoC) FPGA 使用的 RAM 受到威胁，因为 RAM 在运行时存储软件 IP 以及各种其他敏感信息。为了解决这个问题，我们提出了一个开源框架，用于构建透明的 RAM 加密和身份验证管道，适用于 FPGA 和 ASIC。正如我们对 Xilinx Zynq-7020 SoC 的综合评估所示，该框架支持各种密码和操作模式。对于加密，ECB、CBC 和 XTS 模式中使用密码 Prince 和 AES。此外，经过身份验证的加密密码 Ascon 既可以独立使用，也可以在 TEC 树中使用。我们的结果表明，我们的加密管道的数据处理非常高效，FPGA 接口提供的读取带宽利用率高达 94%。此外，使用像 Ascon 这样的加密功能强大的原语可以产生高度实用的结果，带宽利用率为 54%。
Security features of modern (SoC) FPGAs permit to protect the confidentiality of hard- and software IP when the devices are powered off as well as to validate the authenticity of IP when being loaded at startup. However, these approaches are insufficient since attackers with physical access can also perform attacks during runtime, demanding for additional security measures. In particular, RAM used by modern (SoC) FPGAs is under threat since RAM stores software IP as well as all kinds of other sensitive information during runtime. To solve this issue, we present an open-source framework for building transparent RAM encryption and authentication pipelines, suitable for both FPGAs and ASICs. The framework supports various ciphers and modes of operation as shown by our comprehensive evaluation on a Xilinx Zynq-7020 SoC. For encryption, the ciphers Prince and AES are used in the ECB, CBC and XTS mode. Additionally, the authenticated encryption cipher Ascon is used both standalone and within a TEC tree. Our results show that the data processing of our encryption pipeline is highly efficient with up to 94 % utilization of the read bandwidth that is provided by the FPGA interface. Moreover, the use of a cryptographically strong primitive like Ascon yields highly practical results with 54 % bandwidth utilization.