Detecting an activated Trojan horse in embedded systems and processors with Bloom filter-based memory applications

Hardware trojans pose a number of security risks for modern processor-based systems. It comes with many security vulnerabilities such as changing the program executed on the processor, sending non-program instructions to the processor, capturing critical information of the programmer or hardware with analysis on the program, and preventing validation between sources. With Bloom filter-based memory applications, it is possible to ensure that the execution inside the processor is reliable. Thanks to the querying and training capability provided by the Bloom filter, training is done with a data set of commands and memory addresses, and this trained data is queried during execution. This ensures that execution on the processor is reliable and verified. On the other hand, with a number of encryption and secure network protocols to be determined between the processor and the compilation source, the problems caused by the sources verifying each other and external interventions to the system can be prevented. In this thesis, studies on architectural designs that will prevent the specified security vulnerabilities are explained. The first work discussed in the thesis is a processor architecture that proposes to detect hardware trojan horse (HWT) activation. %Hardware Trojan Horses (HWTs) have been currently inserted in commercial CPUs and, very recently, in memories. In processor based system, HWT could execute their own software on the victim system. Such attacks may allow attackers to run their own instructions or to gain higher/unauthorized privileges over the system. Proposed architecture presents a protection architecture meant to shield the communication between the processor and the memory in processor based system. The architecture aims at detecting the activation on HWTs infesting the instruction and data memories of the system. Our proposal relies on the use of Bloom Filters that are included in ad-hoc designed checkers and integrated in the protection architecture. Bloom filters could guarantee zero false alarms and a small and configurable percentage of undetected alarms. We applied the protection architecture to a case study system based on a processor RI5CY of Pulpino (RISC-V instruction set) implemented on an FPGA and running a set of benchmark programs. Bloom filter based HWT checker mechanism demonstrated to be able to detect more than 99% of possible HWTs activations with zero false alarms. Also we measured a lookup table overhead ranging from 0.68% up to 10.52% and a flip-flop overhead between 0.68% and 0.99%, and with no working frequency reduction. Another study discussed in the thesis proposes to ensure the security of execution inside the processor and to protect the program itself and the network between the processor and the compiler from attackers, especially HWT activation. Modern cloud computing systems distribute software executables over a network to keep the software sources, which are typically compiled in a security-critical cluster, secret. We develop ERIC, a new, efficient, and general software obfuscation framework. ERIC protects software against (i) static analysis, by making only an encrypted version of software executables available to the human eye, no matter how the software is distributed, and (ii) dynamic analysis, by guaranteeing that an encrypted executable can only be correctly decrypted and executed by a single authenticated device. ERIC comprises key hardware and software components to provide efficient software obfuscation support: (i) a hardware decryption engine (HDE) enables efficient decryption of encrypted hardware in the target device, (ii) the compiler can seamlessly encrypt software executables given only a unique device identifier. Both the hardware and software components are ISA-independent, making ERIC general. The key idea of ERIC is to use physical unclonable functions (PUFs), unique device identifiers, as secret keys in encrypting software executables. Malicious parties that cannot access the PUF in the target device cannot perform static or dynamic analyses on the encrypted binary. We develop ERIC's prototype on an FPGA to evaluate it end-to-end. Our prototype extends RISC-V Rocket Chip with the hardware decryption engine (HDE) to minimize the overheads of software decryption. We augment the custom LLVM-based compiler to enable partial/full encryption of RISC-V executables. The HDE incurs minor FPGA resource overheads, it requires 2.63% more LUTs and 3.83% more flip-flops compared to the Rocket Chip baseline. LLVM-based software encryption increases compile time by 15.22% and the executable size by 1.59%. ERIC is publicly available and can be downloaded from https://github.com/kasirgalabs/ERIC.