New embedded S
Secure Hardware implementation and testing guidelines
Download 1.14 Mb.
|
- Navigate this page:
- 8.2.1.2Protective Layer
- 8.2.1.2.2Passive Shield
- 8.2.1.2.3Other protection measures
- 8.2.2Obfuscating the design
- 8.2.2.2Memory Encryption
- 8.2.3Further Protection Measures
- 8.2.3.4Further design guidelines
- 8.2.4.1Preparation and scoping
- 8.2.5Testing guidelines
- 8.2.5.2Security testing
- 8.2.6Testing techniques
- 8.2.6.2Penetration testing
- 8.2.6.4Automated security testing
8.2Secure Hardware implementation and testing guidelines8.2.1Physical protection of the chip8.2.1.1Multi-layeringUsing multiple layers in a chip is a good solution for protecting a chip, making smaller chips, hiding data lines and reaching better chip quality. Furthermore multi-layered chips have considerably higher reverse engineering costs, since special and expensive tools and qualified engineers are required to do it. References: [1] pp. 118-119 [4]
The possibility of measuring the electrical potential on the chip surface is a serious threat that is the basis of many side channel attacks. A possible defense against it is placing one or more protection layer, on top of important regions (e.g. memory). These protective layers are called shields. If a shield is damaged or detects any signs of an attack, the chip can react to this event. This reaction depends on the chip protection mechanism, but typically means resetting the chip or removing important data. There are two basic shield types: active shields and passive shields; but there are other protection mechanisms, as well.
8.2.1.2.1Active ShieldActive shields are current-carrying protection layers (typically a net of thin copper wires), whose integrity are continuously monitored by the chip and are able to detect even small changes in the physical environment. 8.2.1.2.2Passive ShieldThe passive shield usually is not monitored in every moment. This shield is required for the correct working of the chip. An example is the chip power layer, when lies on the top of the chip. If chemical etching is used for decapsulation, the acid immediately turns the chip wrong, because the power layer is destroyed. 8.2.1.2.3Other protection measuresApplying opaque protective layer that’s integrity is continuously monitored by phototransistors is a good hybrid solution. References: [1] pp. 17-38 [4]
8.2.1.3Unmarking, remarking and repackagingRemoving the marks from a semiconductor component or placing a custom chip ID inside the chip makes chip identification more expensive. Changing the mark of the real component to a better protected chip’s mark can discourage and confuse the attacker. However these techniques cause problems only to low budget attackers, since e.g. boundary scan on pins or observing signals on the chip interface can give away information on the chip. References: [1] pp. 116-118 8.2.2Obfuscating the design8.2.2.1Glue logicGlue logic is obfuscating the transistor placement in the chip. There are automatic tools to solve this problem. Glue logic has a lot of reasons to use, like cloning existing chips without licensing, reaching higher reverse engineering cost, and improving chip performance.
Figure - Appling glue logic References: [4]
We have already seen many techniques to read out the content of the memory. A possible countermeasure against this is memory encryption. In this case obtaining the raw memory content is not enough. Some modern chips provide batch- or chip-specific data encryption on memory and/or registers with on the fly encryption and decryption. The key should be located in these secure memory areas. References: [1] pp. 17-38 [4]
8.2.2.3Bus scramblingBus scrambling is not too difficult to implement by the designer/manufacturer but it makes tapping the bus considerably harder. The scrambling itself can be static, chip-specific or even session-specific. 
Figure - Bus scrambling methods References: [23] pp.510-565 8.2.3Further Protection Measures8.2.3.1Physically Unclonable Functions (PUF)PUFs are basically hardware one-way functions. They are not functions in a mathematical sense (as they can produce different outputs with the same input). Their input is called challenge and the output is called response, the corresponding input and output together called challenge-response pair (CRP). The typical usage of a PUF has two stages: construction of the CRP database and evaluating the response of the PUF by the corresponding response in the database. Quite a lot PUF type exists, here are some of them:
The most important properties of a PUF are these:
Secret key generation with PUFs is exploiting the intrinsic randomness introduced by the inevitable manufacturing variability. PUF responses are noisy, so an additional intermediate step is required to use them as secret keys. PUFs are highly secure place for a secret key, since it is never stored in non-volatile memory, only in volatile memory for a short time, during operations on it. This provides additional security against probing and other side channel attacks. That means almost tamper-proof key storage. PUF has other applications, as well, like hardware-entangled cryptography and system identification. Hardware-entangled cryptography is based on a new class of cryptographic primitives that contain PUFs integrated into them. Their very high security level arises from that they do not use external secret keys. The first result was a PUF-based block cipher. PUFs’ third and most typical usage is system identification. It works similarly to biometric identification: The verifier picks a CRP from the DB and compares the response to the one that was given by the PUF. FAR/FRR values can be fine-tuned with the acceptance threshold level. References: [24], [25] 8.2.3.2Unique Chip IDEvery chip with a unique ID can be traced during production, the can use their IDs to generate secret keys and their presence allows the manufacturer to generate blacklists after production. Chip IDs are usually implemented with PUFs or write once, read multiple (WORM) memory (a.k.a. one-time programmable - OTP - memory). References: [23] pp.510-565 [4]
8.2.3.3SensorsIn the previous discussions we have already recommended the use of these types of sensors:
However think twice if the planned sensors are all really useful and consider no power or no external clock situations, as well. References: [23] pp.510-565 [4]
References: [23] pp.510-565 [4], [26] 8.2.4Risk analysisTo estimate the security of complex systems, usually risk analysis procedure is carried out. The outcome of this procedure is the list of risks that are consequences of the threats identified, which is used as a basis for mitigation techniques and establishment of the test cases for testing. 
Figure - Steps of test planning 8.2.4.1Preparation and scopingThe first step in risk analysis is information gathering. All accessible relevant information has to be collected. Studying the architecture, design documents and specifications is required to succeed. Under this learning phase stakeholders, assets and security requirements are identified, the attack surface is defined. The aim of scoping is to determine what should be checked and what not – it may take several iterations. 8.2.4.2Threat modelingFigure shows the classical CIA classification of security properties and their threat counterparts in the more modern STRIDE model. 
Figure - The STRIDE model along with the extended CIA model In the followings some artifacts that are considered useful for testing will be mentioned. Threat modeling identifies documents and rates threats. It is based on attack trees and misuse cases. The threat model helps to pinpoint exact test cases and sections of code that need close attention. The attacker profiles describe possible internal and external agents that might want to realize the threats. Internal roles are going to be enlisted. Agents have malicious intent, so understanding their motivations are the most important step. Attack trees (see Figure ) are one of the bases that threat modeling relies on. They provide a good overview on security by systematically revealing possible attacks and risks. The starting point is a set of high level attack scenarios, the main goals of the attacker. Then preconditions (sub-goals) are identified step-by-step with AND / OR relationships between conditions, then the preconditions of sub-goals are identified and so forth. Iteration stops when all low level leafs are elementary conditions. 
Figure - Attack tree of a hypothetical medical device With an attack tree in our hands, we can prepare test cases that check if the system is vulnerable to the identified threats. Beside or instead of attack trees, threat modeling can be based on use-case models also. A classification of traditional use-cases from security perspective:
Figure - A misuse/abuse case example Mitigation objectives are addressing identified threats to an application design. Approaches to threat mitigation are redesigning the application, using standard and unique mitigation techniques and accept risk in accordance with policies. Validation objectives are helping to ensure that threat models accurately reflect the application design and potential threats. The model, the enumerated threats, mitigations, assumptions or dependencies should be validated. The threats uncovered by risk analysis are based on threat likelihood, severity and other factors. The goal of risk analysis is to focus the evaluation to the most relevant risks. Categories of risks are design flaws/weaknesses, conceptual error, weak or missing control, implementation bugs and operational vulnerabilities.
Vulnerabilities are side effects or extra functionalities that the attackers can exploit for their own purposes. Security requirements should come from “The system shall” and it must declare “The system shall not” items. This procedure is not just simple verification, because it needs specially trained staff and the security engineer should have the ability to think with the head of an attacker. During this procedure it is always needed prioritization between the possible test cases and the found vulnerabilities. A possible security vulnerability classification’s elements are bugs and flows.
Attackers nevertheless do not really care about if vulnerability stemmed from a bug or a flaw. In the following, we also show how security auditing and security testing are different, besides the similarities in their notions.
8.2.5.1Security auditAims of a security audit are:
8.2.5.2Security testingAims of security testing
8.2.6Testing techniquesThere are lots of approaches of testing: 
Figure - Concluding the tests
Once the test results are available, we can identify the vulnerabilities, reveal missing protections and refine the set of revealed threats. We can make recommendations as feedback to the developers. After framing the recommendations we repeat our risk analysis on identified threats to prioritize the assembled action list. 8.2.6.1Code reviewCode review needs a trained eye for security problems. It should be performed for all high-priority code. This review is very effective, but also very labor-intensive. It can be supported by automated tools. Possible approaches:
8.2.6.2Penetration testingPenetration testing is testing an application remotely. The goal is to simulate actual attacks and measure how well the application is able to withstand them. For testing the application as a malicious user, manual techniques are used. 8.2.6.3Manual run-time verificationDuring this verification we
8.2.6.4Automated security testingThere are also automated solutions for testing, such as source code/design analyzers, binary analysis tools and run-time analyzers (e.g. fuzzing tools). Directory: images images -> Pelan pentaksiran kursus images -> Military callsign list as of dec 2010 images -> For Date: 02/01/2013 Friday Call Number Time Call Reason Action 13-768 0008 motor vehicle stop warning Issued images -> Creating Buy-In – Building Relationships images -> Deadline: Saturday, March 12th, 2016 images -> News items from Raising Our Voices images -> Last year four of the best Afrikaans Christian singers joined forces to tour Down Under with the production ‘Manne wat Glo’ images -> World-renowned vocal ensemble sweet honey in the rock images -> Peoples Voice Café History images -> Simon Mckeown Artist C. V. DaDaFest International Artist of the Year 2010 Download 1.14 Mb. Share with your friends:
|
