Memory monitor module for embedded systems

Embedded systems are vulnerable to buffer overflow attacks. In this paper, we propose a hardware memory monitor module that aims to detect buffer overflow attacks by analyzing the security of an embedded processor at the instruction level. The functionality of the memory monitor module does not rely on the source code and can perform security check through dynamic methods. Compared with several existing countermeasures that protect only part of the program’s data space, our proposed memory monitor module can protect the program’s entire data space. The proposed memory monitor module has negligible performance overhead because it runs in parallel with the embedded processor. As demonstrated in an FPGA (Field Programmable Gate Array) based prototype, the experimental results show that our memory monitor module can effectively resist several types of buffer overflow attacks with approximately a 15% hardware cost overhead and only a 0.1% performance penalty.     

轻量级安全内存：RISC-V嵌入式微处理器安全增强

近年来,针对嵌入式设备中硬件的新型攻击不断出现,严重威胁嵌入式设备的安全.特别是随着非易失性存储器开始被配备到嵌入式设备中,就需要考虑如何保护配备非易失性存储器的嵌入式设备的安全.安全内存,就是这样一种通过保护内存来增强嵌入式设备安全性的有效手段.通过设计一种安全内存加密引擎来实现安全内存.在保证该安全内存加密引擎足够轻量、开销低的同时,将其集成到RISC-V嵌入式微处理器中,并通过FPGA对该安全内存加密引擎进行了评估.评估结果表明,安全内存加密引擎能够在提升RISC-V嵌入式微处理器安全性的同时,保证其合理的访存性能以及较小的面积开销.研究结果具有良好的参考价值和应用前景.     

基于虚拟化内存隔离的Rowhammer攻击防护机制

随着虚拟化技术的发展与云计算的流行,虚拟化环境下的安全防护问题一直受到广泛的关注。最近的Rowhammer攻击打破了人们对于硬件的信赖,同时基于Rowhammer攻击的各种攻击方式已经威胁到了虚拟化环境下的虚拟机监视器以及其他虚拟机的安全。目前业界已有的对Rowhammer攻击的防御机制或者局限于修改物理硬件,或者无法很好的部署在虚拟化环境下。本文提出一种方案,该方案实现了一套在虚拟机监视器层面的Rowhammer感知的内存分配机制,能够在虚拟机监视器层面以虚拟机的粒度进行Rowhammer攻击的隔离防护。测试表明,该方案能够在不修改硬件,以及引入较小的性能开销（小于6%的运行时开销和小于0.1%的内存开销）的前提下,成功阻止从虚拟机到虚拟机监视器以及跨虚拟机的Rowhammer攻击。     

嵌入式系统的安全启动机制研究与实现

针对目前移动智能平台系统面临的安全威胁,利用可信计算技术解决嵌入式系统的安全问题,是一种可行且高效的安全解决方案。在不改变现有移动设备硬件架构的前提下,提出了一种嵌入式平台系统的安全启动机制,将安全TF卡作为外置可信平台模块,构建了一条从Bootloader到上层应用程序的完整的信任链,该信任链的起点保护在安全TF卡的安全区域内,启动过程中各个组件的度量标准值由安全TF卡中的密钥签名存放。描述了该机制的实现过程,并对其安全性、效率进行了详细的分析测试。实验结果显示,该机制能够抵御针对嵌入式平台的多种攻击,有效保护嵌入式系统安全。     

面向物联网应用的SoC安全检查架构设计

物联网（IoT）应用的快速发展和软硬件开源化趋势使得IoT设备所面临的硬件安全威胁日益严峻,尤其是利用运行时条件触发的系统级攻击,很难通过传统测试方法进行检测和防御,需要提供运行时安全检查机制。分析IoT系统芯片面临的安全威胁,结合数据加密传输路径中的攻击、任务流和检查内容,设计4条功能完整性安全检查策略,搭建SoC安全策略检查架构并植入运行时触发硬件木马。仿真结果显示,运行时策略检查状态机可以检查出加密核、内存和UART接口的功能完整性问题,并通过发送错误中断信号进行反馈,证明了所设计的系统级安全策略检查架构的正确性与有效性。     

A hybrid encryption/hiding method for secure transmission of biometric data in multimodal authentication system

Biometric security is a fast growing area that gains an increasing interest in the last decades. Digital encryption and hiding techniques provide an efficient solution to protect biometric data from accidental or intentional attacks. In this paper, a highly secure encryption/hiding scheme is proposed to ensure secure transmission of biometric data in multimodal biometric identification/authentication system. The secret fingerprint and iris vectors are sparsely approximated using accelerated iterative hard thresholding technique and then embedded in the host Slantlet-SVD domain of face image. Experiments demonstrate the efficiency of our technique for both encryption and hiding purpose, where the secret biometric information is well encrypted and still extractable with high fidelity even though the carrier image is seriously corrupted. Our experimental results show the efficiency of the proposed technique in term of robustness to attacks, Invisibility, and security.

     

Implementation of an improved chaotic encryption algorithm for real-time embedded systems by using a 32-bit microcontroller

Currently, several embedded applications in military, industry, banking transference, e-commerce, biometric systems and others use insecure communication channels such as Internet to transmit or store confidential information. Therefore, the integrity and security of information are an important issue in continuous research. In last years, chaotic systems have been proposed in cryptography due they have several properties related with cryptography properties such as extreme sensibility on initial conditions with confusion and ergodicity with diffusion. In this paper, we present a 32-bit microcontroller implementation of an improved text encryption algorithm (based on Murillo-Escobar’s algorithm [13]) for real-time embedded systems and we present a complete security analysis such as key size analysis, key sensitivity, plain text sensitivity, floating frequency, histograms, N-grams, autocorrelation, information entropy, robustness against classic attacks, randomness analysis, and security characteristics. In addition, the digital implementation and performance are analyzed such as programming details, memory required, frequency system, implementation costs and encryption time. In contrast with recent approaches presented in literature, we present a complete security analysis in both statistical and implementation level, to justify the proposed scheme in a real application. Based in the results, the proposed embedded text encryption system is secure, effective and at low cost, and it could be implemented in real-time cryptosystem based on microcontroller.     

An identity-based approach to secure P2P applications with Likir

Structured overlay networks are highly susceptible to attacks aimed at subverting their structure or functionalities. Although many secure architectural design proposals have been presented in the past, a widely accepted and comprehensive solution is lacking. Likir (Layered Identity-based Kademlia-like Infrastructure) is our solution for implementing a secure Peer-to-Peer network based on a Distributed Hash Table. Our purpose is to focus on three main goals: (1) providing security services and a secure overlay infrastructure against the vast majority of security threats on P2P systems, (2) dynamically creating a bridge between randomly generated peer identifiers and user identities, and (3) supplying the developer with a middleware API that can easily deal with peers’ identities. Placing the emphasis on user identity results in a highly secure distributed framework which is very fitting for privacy-aware and efficient implementation of identity-based applications like social networking applications. Detailed security analysis and performance evaluation are provided. Moreover, an implementation of Likir is introduced and a case study is presented in order to show its practical use in a real-life example.     

基于双核的安全Windows网络驱动程序的研究

提出了一种基于双核的网络安全解决方案,研究并实现了主辅核之间的通信机制和辅核Windows端网络驱动程序。双核的安全Windows终端架构是将安全防护模块移植到嵌入式系统中,可以有效地防止黑客对Windows终端的侵入及终端内敏感信息的流出。驱动程序开发使用的环境为:VC++6.0、Windows Driver Development Kit、DriverStudio3.2。实验证明该方案可以对网络数据包安全分析和过滤,达到Windows终端安全的目的。     

基于二维安全防护体系的WAF系统

针对Web攻击,传统防火墙对应用层防护存在不足,而Web应用防火墙可利用其架构的技术优势,应对繁多的攻击方式。给出二维安全防护系统及Web服务器核心内嵌模型,进一步给出Web应用防火墙设计实现方案。实验表明,该系统能够解决Web应用安全问题,具有较高的网络性能,支持策略的定制与扩展。     

面向嵌入式多核的OpenMP扩展方法

为多核平台开发一种有效的编程方法已经成为并行软件研究的一个重要目标.在嵌入式多核平台上进行了OpenMP并行程序的有效的实施运行.针对嵌入式具有有限内存资源的特点,提出了通过扩展OpenMP自定义制导语句tiling来提高并行程序在嵌入式多核平台上的运行效率.扩展后的OpenMP并行程序支持循环分片,从而能够充分利用层...     

Efficient and secure stored-value cards with leakage resilience

Stored-value cards (SVCs) are a kind of smartcards that can be used to store monetary values. SVCs have demonstrated a wide range of applications in commerce. SVCs are in general tamper-resistant, but they are very computationally weak and their security mechanisms are also weak against side-channel attacks. In this paper, we propose an efficient and secure stored-value card system. With the help of pre-computations, stored-value cards in our scheme are only required to perform simple arithmetic operations and bitwise comparisons. Our system especially for SVCs is secure with unbounded computational leakage resilience. Our novel scheme provides a practical solution to side-channel attacks for light-weight devices.     

基于USB Key的安全增强密钥生成方案

针对目前嵌入式系统环境下密钥存储安全性不足的问题,提出了一种安全增强密钥（Security-Enhanced Key,SEK）的生成方案。该方案在不改变现有嵌入式系统（Embedded System,ES）架构的前提下,分别利用ES的唯一硬件特征值和USB Key（UK）产生的随机数生成各自的密钥种子,之后ES和UK利用密钥种子进行迪菲-赫尔曼协商（Diffie-Hellman Key Exchange,DHKE）生成SEK。SEK仅在需要时生成,使用后即销毁,不需要在嵌入式设备上存储,从根本上提高了密钥的安全性,并在一定程度上解决了嵌入式系统密钥泄漏的安全问题。方案原型的实现和安全性评估表明,在嵌入式系统中加入该方案之后,密钥的安全性得到明显增强,能够抵抗针对嵌入式系统密钥的多种攻击,且增加的额外开销不会对系统性能造成显著影响。     

A queueing analysis for the denial of service (DoS) attacks in computer networks

In most network security analysis, researchers mainly focus on qualitative studies on security schemes and possible attacks, and there are few papers on quantitative analysis in the current literature. In this paper, we propose one queueing model for the evaluation of the denial of service (DoS) attacks in computer networks. The network under DoS attacks is characterized by a two-dimensional embedded Markov chain model. With this model, we can develop a memory-efficient algorithm for finding the stationary probability distribution which can be used to find other interesting performance metrics such as the connection loss probability and buffer occupancy percentages of half-open connections for regular traffic and attack traffic. Different from previous works in the literature, this paper gives a more general analytical approach to the study of security measures of a computer network under DoS attacks. We hope that our approach opens a new avenue to the quantitative evaluation of more complicated security schemes in computer networks.     

Adaptive security architecture for protecting RESTful web services in enterprise computing environment

In this modern era of enterprise computing, the enterprise application integration (EAI) is a well-known industry-recognized architectural principle that is built based on loosely coupled application architecture, where service-oriented architecture (SOA) is the architectural pattern for the implementation of EAI, whose computational elements are called as “services.” Though SOA can be implemented in a wide range of technologies, the web services implementation of SOA becomes the current selective choice due to its simplicity that works on basic Internet protocols. Web service technology defines several supporting protocols and specifications such as SOAP and WSDL for communication with client and server for data interchange. A new architectural paradigm has emerged in SOA in recent years called REpresentational State Transfer (REST) that is also used to integrate loosely coupled service components, named RESTful web services, by system integration consortiums. This SOA implementation does not possess adequate security solutions within it, and its security is completely dependent on network/transport layer security that is obsolete owing to latest web technologies such as Web 2.0 and its upgraded version, Web 3.0. Vendor security products have major implementation constraints such as they need secured organizational environment and breach to SOA specifications, hence introducing new vulnerabilities. Herein, we examine the security vulnerabilities of RESTful web services in the view of popular OWASP rating methodologies and analyze the gaps in the existing security solutions. We hence propose an adaptive security solution for REST that uses public key infrastructure techniques to enhance the security architecture. The proposed security architecture is constructed as an adaptive way-forward Internet-of-Things (IoT) friendly security solution that is comprised of three cyclic parts: learn, predict and prevent. A novel security component named “intelligent security engine” is introduced which learns the possible occurrences of security threats on SOA using artificial neural networks learning algorithms, then it predicts the potential attacks on SOA based on obtained results by the developed theoretical security model, and the written algorithms as part of security solution prevent the SOA attacks. This paper is written to present one of such algorithms to prevent SOA attacks on RESTful web services along the discussion on the obtained results of the conducted proof-of-concept on the real-time SOA environment. A comparison of the proposed system with other competing solutions demonstrates its superiority.     

A secure authentication scheme based on elliptic curve cryptography for IoT and cloud servers

The Internet of Things (IoT) is now a buzzword for Internet connectivity which extends to embedded devices, sensors and other objects connected to the Internet. Rapid development of this technology has led to the usage of various embedded devices in our daily life. However, for resource sharing and communication among these devices, there is a requirement for connecting these embedded devices to a large pool of resources like a cloud. The promising applications of IoT in Government and commercial sectors are possible by integrating cloud servers with these embedded devices. But such an integration of technologies involves security issues like data privacy and authentication of devices whenever information is exchanged between them. Recently, Kalra and Sood proposed an authentication scheme based on elliptic curve cryptography (ECC) for IoT and cloud servers and claimed that their scheme satisfies all security requirements and is immune to various types of attacks. However, in this paper, we show that Kalra and Sood scheme is susceptible to offline password guessing and insider attacks and it does not achieve device anonymity, session key agreement, and mutual authentication. Keeping in view of the shortcomings of Kalra and Sood’s scheme, we have proposed an authentication scheme based on ECC for IoT and cloud servers. In the proposed scheme in this paper, we have formally analyzed the security properties of the designed scheme by the most widely accepted and used Automated Validation of Internet Security Protocols and Applications tool. Security and performance analysis show that when compared with other related schemes, the proposed scheme is more powerful, efficient, and secure with respect to various known attacks.     

ANS-based compression and encryption with 128-bit security

The bulk of Internet interactions is highly redundant and also security sensitive. To reduce communication bandwidth and provide a desired level of security, a data stream is first compressed to squeeze out redundant bits and then encrypted using authenticated encryption. This generic solution is very flexible and works well for any pair of (compression, encryption) algorithms. Its downside, however, is the fact that the two algorithms are designed independently. One would expect that designing a single algorithm that compresses and encrypts (called compcrypt) should produce benefits in terms of efficiency and security. The work investigates how to design a compcrypt algorithm using the ANS entropy coding. First, we examine basic properties of ANS and show that a plain ANS with a hidden encoding table can be broken by statistical attacks. Next, we study ANS behavior when its states are chosen at random. Our compcrypt algorithm is built using ANS with randomized state jumps and a sponge MonkeyDuplex encryption. Its security and efficiency are discussed. The design provides 128-bit security for both confidentiality and integrity/authentication. Our implementation experiments show that our compcrypt algorithm processes symbols with a rate up to 269 MB/s (with a slight loss of compression rate) 178 MB/s.

     

基于无操作系统的DHCP客户端

以嵌入式设备ARM Cortex M3/M4为基础,研究在无操作系统实现DHCP客户端的方法,对运输层UDP校验方案进行优化;采用内存静态分配优化DHCP运行效率和系统稳定性;提出抵御DHCP过程中ARP欺骗的优化算法;给出DHCP过程中根据DHCP ACK进行局域网内ARP缓存更新的方法,以提高DHCP客户端网络安全性和服务性能.     

Protection of heterogeneous architectures on FPGAs: An approach based on hardware firewalls

Embedded systems are parts of our daily life and used in many fields. They can be found in smartphones or in modern cars including GPS, light/rain sensors and other electronic assistance mechanisms. These systems may handle sensitive data (such as credit card numbers, critical information about the host system and so on) which must be protected against external attacks as these data may be transmitted through a communication link where attackers can connect to extract sensitive information or inject malicious code within the system. This work presents an approach to protect communications in multiprocessor architectures. This approach is based on hardware security enhancements acting as firewalls. These firewalls filter all data going through the system communication bus and an additional flexible cryptographic block aims to protect external memory from attacks. Benefits of our approach are demonstrated using a case study and some custom software applications implemented in a Field-Programmable Gate Array (FPGA). Firewalls implemented in the target architecture allow getting a low-latency security layer with flexible cryptographic features. To illustrate the benefit of such a solution, implementations are discussed for different MPSoCs implemented on Xilinx Virtex-6 FPGAs. Results demonstrate a reduction up to 33% in terms of latency overhead compared to existing efforts.     

Improving the computational efficiency of modular operations for embedded systems

Security protocols such as IPSec, SSL and VPNs used in many communication systems employ various cryptographic algorithms in order to protect the data from malicious attacks. Thanks to public-key cryptography, a public channel which is exposed to security risks can be used for secure communication in such protocols without needing to agree on a shared key at the beginning of the communication. Public-key cryptosystems such as RSA, Rabin and ElGamal cryptosystems are used for various security services such as key exchange and key distribution between communicating nodes and many authentication protocols. Such public-key cryptosystems usually depend on modular arithmetic operations including modular multiplication and exponentiation. These mathematical operations are computationally intensive and fundamental arithmetic operations which are intensively used in many fields including cryptography, number theory, finite field arithmetic, and so on. This paper is devoted to the analysis of modular arithmetic operations and the improvement of the computation of modular multiplication and exponentiation from hardware design perspective based on FPGA. Two of the well-known algorithms namely Montgomery modular multiplication and Karatsuba algorithms are exploited together within our high-speed pipelined hardware architecture. Our proposed design presents an efficient solution for a range of applications where area and performance are both important. The proposed coprocessor offers scalability which means that it supports different security levels with a cost of performance. We also build a system-on-chip design using Xilinx’s latest Zynq-7000 family extensible processing platform to show how our proposed design improve the processing time of modular arithmetic operations for embedded systems.