Zhang Zhun, Wang Xiang, Hao Qiang, Xu Dongdong, Zhang Jinlei, Liu Jiakang, Ma Jinhui
School of Electronic and Information Engineering, Beihang University, Beijing 100191, China.
Micromachines (Basel). 2021 May 15;12(5):560. doi: 10.3390/mi12050560.
Dynamic data security in embedded systems is raising more and more concerns in numerous safety-critical applications. In particular, the data exchanges in embedded Systems-on-Chip (SoCs) using main memory are exposing many security vulnerabilities to external attacks, which will cause confidential information leakages and program execution failures for SoCs at key points. Therefore, this paper presents a security SoC architecture with integrating a four-parallel Advanced Encryption Standard-Galois/Counter Mode (AES-GCM) cryptographic accelerator for achieving high-efficiency data processing to guarantee data exchange security between the SoC and main memory against bus monitoring, off-line analysis, and data tampering attacks. The architecture design has been implemented and verified on a Xilinx Virtex-5 Field Programmable Gate Array (FPGA) platform. Based on evaluation of the cryptographic accelerator in terms of performance overhead, security capability, processing efficiency, and resource consumption, experimental results show that the parallel cryptographic accelerator does not incur significant performance overhead on providing confidentiality and integrity protections for exchanged data; its average performance overhead reduces to as low as 2.65% on typical 8-KB I/D-Caches, and its data processing efficiency is around 3 times that of the pipelined AES-GCM construction. The reinforced SoC under the data tampering attacks and benchmark tests confirms the effectiveness against external physical attacks and satisfies a good trade-off between high-efficiency and hardware overhead.
嵌入式系统中的动态数据安全在众多安全关键型应用中引发了越来越多的关注。特别是，使用主存储器的片上系统（SoC）中的数据交换正将许多安全漏洞暴露给外部攻击，这将在关键点导致SoC的机密信息泄露和程序执行失败。因此，本文提出了一种安全SoC架构，集成了一个四路并行的高级加密标准-伽罗瓦/计数器模式（AES-GCM）加密加速器，以实现高效的数据处理，保证SoC与主存储器之间的数据交换安全，抵御总线监控、离线分析和数据篡改攻击。该架构设计已在赛灵思Virtex-5现场可编程门阵列（FPGA）平台上实现并验证。基于对加密加速器在性能开销、安全能力、处理效率和资源消耗方面的评估，实验结果表明，并行加密加速器在为交换数据提供保密性和完整性保护时不会产生显著的性能开销；在典型的8KB I/D缓存上，其平均性能开销低至2.65%，其数据处理效率约为流水线式AES-GCM结构的3倍。在数据篡改攻击和基准测试下强化后的SoC证实了其抵御外部物理攻击的有效性，并在高效性和硬件开销之间实现了良好的权衡。
