Implementing Memory Protection Primitives on Reconfigurable Hardware Brett Brotherton Nick Callegari Ted Huffmire

Project Goals Evaluate security primitives for reconfigurable hardware Build a real system with multiple cores Design a security policy for the system Efficient memory system performance Programmatic interface to system

System Overview OPB ublaze 1 Ref Monitor/Arbiter Shared External Memory AES Core RS232 Ethernet

Security Policy Range 0  [0x ,0x4140ffff]; (Debug) Range 1  [0x ,0x ]; (AES1) Range 2  [0x ,0x28000fff]; (AES2) Range 3  [0x ,0x ]; (DRAM1) Range 4  [0x ,0x24ffffff]; (DRAM2) Range 5  [0x ,0x4060ffff]; (RS-232) Range 6  [0x40c00000,0x40c0ffff]; (Ethernet) Range 7  [0x ,0x ]; (Ctrl_Word 1 ) Range 8  [0x ,0x f]; (Ctrl_Word 2 ) Range 9  [0x ,0x ]; (Ctrl_Word AES )

Security Policy Access 0  {M 1,rw,R 5 }|{M 2,rw,R 6 }|{M 1,rw,R 3 } |{M 2,rw,R 4 }|{M 1,rw,R 0 }|{M 2,rw,R 0 }; Access 1  Access 0 |{M 1,rw,R 1 }|{M 1,rw,R 9 }; Access 2  Access 0 |{M 2,rw,R 1 }|{M 2,rw,R 9 }; Trigger 0  {M 1,w,R 7 }; Trigger 1  {M 1,w,R 8 }; Trigger 2  {M 2,w,R 7 }; Trigger 3  {M 2,w,R 8 }; Expr 1  Access 0 |Trigger 3 Access 2 *Trigger 4 ; Expr 2  Access 1 |Trigger 2 Expr 1 *Trigger 1 ; Expr 3  Expr 1 *Trigger 1 Expr 2 *; Policy  Expr 1 *|Expr 1 *Trigger 3 Access 2 * |Expr 3 Trigger 2 Expr 1 *Trigger 3 Access 2 * |Expr 3 Trigger 2 Expr 1 *|Expr 3 |  ;

Security Policy DFA

System Overview OPB ublaze 1 Ref Monitor/Arbiter Shared External Memory AES Core RS232 Ethernet

Performance Results One cycle latency increase for reference monitor  vs cycles Area overhead very small  116 LUTs (1% increase) Clock speed increase  65 to 73 MHz

Impact of Moats Moats tested for size 0, 1, 2, 6 Best case: 0 and 6  only a 4% decrease in clock frequency Area overhead minimal

User Interface Currently using Hyperterminal to connect to AES core via serial connection  Tested using 128 bit key & data manually parsed into 32 bit lines and sent via hyperterminal. GOAL  Incorporate a User Interface to allow the user to select a data file and key file and receive the corresponding result over multiple communication platforms to test multi-core design and Reference Monitor. s ce537f5e 5a567cc9 966d e 6a118a e64e a 503f1d35

User Interface Progress  Implemented User Interface in C++ to allow more functionality and user friendliness.  SERIAL OR ETHERNET? [1-SERIAL][2-ETHERNET]  ENCRYPT OR DECRYPT? [1-ENCRYPT][2-DECRYPT]  INPUT FILENAME:  KEY FILENAME:  OUTPUT SENT TO OUTPUT.TXT

Demo