嵌入式系统条件分支的硬件安全保护方法
Qiang Hao1, Dongdong Xu1, Yusen Qin1
1School of Electronic and Information Engineering, Beihang University, Beijing 100191, China.
Micromachines
|June 27, 2024
概括
本研究介绍了嵌入式系统的硬件安全性,通过锁定分支预测单元和加密分支数据来防止对条件分支的攻击. 该方法提供了针对改和数据盗窃的细粒度保护.
科学领域:
- 计算机工程 计算机工程
- 网络安全 网络安全
- 嵌入式系统安全 嵌入式系统安全
背景情况:
- 嵌入式系统中的分支预测单元 (BPU) 容易受到安全漏洞的攻击.
- 现有的保护方法无法防止像分支预测分析 (BPA) 这样的复杂攻击.
- 对分支机构的改可能导致控制流的完整性 (CFI) 违反和关键数据的盗窃.
研究的目的:
- 为嵌入式系统中的条件分支提出一种新的硬件安全保护方法.
- 加强分支预测单元对各种攻击载体的安全性.
- 为了确保控制流的完整性和保护敏感的分支信息.
主要方法:
- 实施基于值的机制,在一定的更新次数后锁定分支目标缓冲区 (BTB).
- 设计混合仲裁器物理不可克隆函数 (APUF) 电路,用于加密和解密分支详细信息 (方向,地址,索引).
- 使用动态和静态标签比较来检测改指令代码,跳转地址和方向.
主要成果:
- 拟议的方法通过锁定BTB.有效地抵抗分支预测分析 (BPA) 攻击.
- 混合APUF电路增强了随机性,并防御针对分支信息的机器学习攻击.
- 条件分支的细粒度安全保护在FPGA上实现了大约5.4%的资源开销和不到5.5%的性能开销.
结论:
- 开发的硬件安全方法为嵌入式系统中的条件分支提供了强大的保护.
- 该方法成功地缓解了BPU中已知的漏洞,并提高了整体系统安全性.
- 该解决方案适用于嵌入式应用程序,平衡安全性与可接受的性能和资源开销.
相关概念视频
Semiconductors
682
There is variation in the electrical conductivity of materials - metals, semiconductors, and insulators that are showcased with the help of the energy band diagrams.
Metals such as copper (Cu), zinc (Zn), or lead (Pb) have low resistivity and feature conduction bands that are either not fully occupied or overlap with the valence band, making a bandgap non-existent. This allows electrons in the highest energy levels of the valence band to easily transition to the conduction band upon gaining...
Metals such as copper (Cu), zinc (Zn), or lead (Pb) have low resistivity and feature conduction bands that are either not fully occupied or overlap with the valence band, making a bandgap non-existent. This allows electrons in the highest energy levels of the valence band to easily transition to the conduction band upon gaining...
682
Clamper Circuit
401
A clamper circuit, also known as a DC restorer, represents a specialized variant of the rectifier circuit, notable for its method of taking the output across the diode rather than the capacitor. This configuration lends to several distinctive applications, particularly in handling square wave inputs.
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to...
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to...
401
Line Protection with Impedance Relays
76
Coordinating time-delay overcurrent relays in complex radial systems and directional overcurrent relays in multi-source transmission loops can be challenging. Impedance relays address these issues by responding to the voltage-to-current ratio, specifically measuring the apparent impedance of a line. These relays become more sensitive during faults as current increases and voltage decreases, thereby reducing the apparent impedance.
Under normal conditions, low load currents keep the measured...
Under normal conditions, low load currents keep the measured...
76
Metal-Semiconductor Junctions
332
The contact of metal and semiconductor can lead to the formation of a junction with either Schottky or Ohmic behavior.
Schottky Barriers
Schottky barriers arise when a metal with a work function (Φm) contacts a semiconductor with a different work function (Φs). Initially, electrons transfer until the Fermi levels of the metal and semiconductor align at equilibrium. For instance, if Φm > Φs, the semiconductor Fermi level is higher than the metal's before contact. The...
Schottky Barriers
Schottky barriers arise when a metal with a work function (Φm) contacts a semiconductor with a different work function (Φs). Initially, electrons transfer until the Fermi levels of the metal and semiconductor align at equilibrium. For instance, if Φm > Φs, the semiconductor Fermi level is higher than the metal's before contact. The...
332
Norton Equivalent Circuits
374
Norton's theorem is a fundamental concept in the field of electrical engineering that allows for the simplification of complex AC circuits. The theorem states that any two-terminal linear network can be replaced with an equivalent circuit that consists of an impedance, which is parallel with a constant current source. Figure 1 shows the AC circuit portioned into two parts: Circuit A and Circuit B, while Figure 2 depicts the circuit obtained by replacing Circuit A by its Norton equivalent...
374
Block Diagram Reduction
195
The process of deriving the transfer function of a control system often involves reducing its block diagram to a single block. This simplification can be achieved through a series of strategic operations, including relocating branch points and comparators. These operations preserve the overall function of the system while allowing for easier manipulation and combination of blocks.
The first step in this process is the identification and relocation of a branch point. A branch point, where a...
The first step in this process is the identification and relocation of a branch point. A branch point, where a...
195


