Hot Threads Investigating Multi-Core and Cell Processor Security Dr. Jim Alves-Foss Jessica Smith Rachel Bonas Andrew Groenewald Xiaohui He Mufaddal Taj Mike Beery

Cell Processor Creation 2Jessica Smith, University Of Idaho Power PC (Power Processing Element) + 8 Synergistic Processing Elements

Cell BE Architecture 3Jessica Smith, University Of Idaho

History Air Force Research Lab – “We want to know more about multicore before we use it – send it to Raytheon!” Raytheon – “We don’t know enough, either – let’s send it to UI!” Dr. Alves-F – “I don’t have enough time – let’s get some kids to research it!” 4Jessica Smith, University Of Idaho

Three General Areas Covert Channels “Once by land, Twice by sea” Publicized Security Features Secure Processing Vault Hardware Encryption Key Secure Boot Direct Channels Hello, how are you? 5Jessica Smith, University Of Idaho

Security Concerns EIB ◦ Can anybody read it? ◦ Can one SPE control the flow amounts? BEI ◦ Can a linked-in unit access the EIB? ◦ How much data can we route out? 6Jessica Smith, University Of Idaho

Security Concerns Registers ◦ Who can access (read/write) them? ◦ SPE registers ◦ BEI registers Memory and Memory Flow Controllers ◦ Mailbox program ◦ Privileged memory 7Jessica Smith, University Of Idaho

A Workable Set What we are worrying about ◦ Rouge SPEs ◦ Rouge external components ◦ Secure Processing Vault What we aren’t worrying about ◦ Duplication with Raytheon – PPE ◦ Anything slower than a human ◦ Hardware Encryption Key, Secure Boot 8Jessica Smith, University Of Idaho

Next Step – Designing Tests Feasibility: Time Requirements Risk Analysis 9Jessica Smith, University Of Idaho Includes: What is being tested What equipment is needed What programs will be written Methodology & procedure Analysis methods Results

Designing A Test Harness Purpose – To enable a user to easily run different tests with a wide range of variables. Features ◦ Updateability ◦ Configurable Tests ◦ Reporting ◦ RAM control option 10Jessica Smith, University Of Idaho

Creating the Tests and Harness The tests will be written in C and assembler, designed to run on the PPE and SPEs. The harness will be written in C or C++, designed to run on the PPE. 11Jessica Smith, University Of Idaho

Timeline 15 November – Initial Report Due 15 December - Tests Written 15 February – Basic Tests Coded, Harness Designed 15 March – Harness Coded 15 April – Basic Tests Run, Documentation Finished 25 April – Engineering Expo Jessica Smith, University Of Idaho12

Questions, Comments or Suggestions? Hot Threads Site: IBM Cell Processor Site: Jessica Smith, University Of Idaho13