Implementing Memory Protection Primitives on Reconfigurable Hardware Brett Brotherton Nick Callegari Ted Huffmire

Project Goals Evaluate security primitives for reconfigurable hardware Build a real system with multiple cores Design a security policy for the system Efficient memory system performance Programmatic interface to system

Reconfigurable Protection Separation Kernels DRAM app1 app3 app2 kernel Reconfigurable Protection DRAM app1 app2 app3 Reference Monitor Physical Software

Reference Monitor

Moats

System Overview OPB ublaze 1 Ref Monitor/Arbiter Shared External Memory AES Core RS232 Ethernet

Have integrated an ethernet core into the system Designed Software to communicate over TCP with the processor Can send data and operation and get back encrypted/decrypted data

Software For Microblaze Have modified the serial code to work with new file format. Can receive and process files over serial and Etherenet Have set up two processor system and ran simultaneous applications

Reference Monitor and OPB First Integrated reference monitor with OPB block ram controller  Functions correctly low latency and overhead Next integrated reference monitor with the OPB  Can regulate access to any of the slave peripherals on the bus  Adds one cycle to the latency  No way to get around this really?

Still To finish Design reference monitor with new stateful security policy  Integrate this with the system and run tests Test Microblaze software with new file sending application

User Interface Currently using Hyperterminal to connect to AES core via serial connection  Tested using 128 bit key & data manually parsed into 32 bit lines and sent via Hyperterminal. GOAL  Incorporate a User Interface to allow the user to select a data file and key file and receive the corresponding result s ce537f5e 5a567cc9 966d e 6a118a e64e a 503f1d35

User Interface Progress  Implemented User Interface in C++ to allow more functionality and user friendliness. ENCRYPT OF DECRYPT? [1-ENCRYPT][2-DECRYPT] INPUT FILENAME: KEY FILENAME: OUTPUT SENT TO OUTPUT.TXT  Modularized functionality  Currently implemented serial socket coding to allow user to connect to Xilinx board. Functions enabled to listen to the board and output the encrypted/decrypted data to a text file

User Interface Future Work  The main goal is the Memory Reference Monitor  Key ingredient:  Multiple cores accessing Shared Memory  User interface’s role  Incorporate UI for multiple I/O (Serial & Ethernet)  Each I/O can have its own corresponding core.  Merge Brett’s Ethernet interface with the Serial Interface, and allow user to specify which platform to connect to the Xilinx board.