Hardware-Assisted System for Program Execution Security of SOC

Abstract

Abstract. With the rapid development of embedded systems, the systems' security has become more and more important. Most embedded systems are at the risk of series of software attacks, such as buffer overflow attack, Trojan virus. In addition, with the rapid growth in the number of embedded systems and wide application, followed embedded hardware attacks are also increasing. This paper presents a new hardware assisted security mechanism to protect the program's code and data, monitoring its normal execution. The mechanism mainly monitors three types of information: the start/end address of the program of basic blocks; the lightweight hash value in basic blocks and address of the next basic block. These parameters are extracted through additional tools running on PC. The information will be stored in the security module. During normal program execution, the security module is designed to compare the real-time state of program with the information in the security module. If abnormal, it will trigger the appropriate security response, suspend the program and jump to the specified location. The module has been tested and validated on the SOPC with OR1200 processor. The experimental analysis shows that the proposed mechanism can defence a wide range of common software and physical attacks with low performance penalties and minimal overheads.

Embedded System Confidentiality Protection by Cryptographic Engine Implemented with Composite Field Arithmetic

“…But these solutions inevitably increase code sizes, bring performance overhead, or are themselves vulnerable to corruption. Wang [4] proposed a hardware assisted module to support program execution security. They divided program code into basic blocks by offline profiling and checking the code integrity at runtime.…”

“…This may cause a lot of waste in hardware resources due to the storage units have a large area. In the mathematical theory, the finite field of GF (2 8 ) can be built iteratively from GF(2 4 ) using irreducible polynomials:…”

“…The byte substitution transformation in encryption process can be divided into two steps, the modular inversion and affine transition over GF (2 8 ). In the modular inversion stage, the state in GF (2 8 ) is first mapped in GF(2 4 ) using an isomorphic mapping matrix T. Then the inversion in GF (2 8 ) is reduced to be inversion operation in GF (2 4 ). After the reduced inversion operation, an inverse isomorphic mapping is performed.…”