Secure admission and execution of applications in noc-based many-cores systems
The adoption of many-cores systems introduces the concern for data protection as a critical design requirement due to the resource sharing and the simultaneous executions of several applications on the platform. A secure application that processes sensitive data may have its security harmed by a mal...
| Author: | |
|---|---|
| Format: | doctoral thesis |
| Status: | Published version |
| Publication Date: | 2019 |
| Country: | Brasil |
| Institution: | Pontifícia Universidade Católica do Rio Grande do Sul (PUCRS) |
| Repository: | Biblioteca Digital de Teses e Dissertações da PUC_RS |
| Language: | English |
| OAI Identifier: | oai:tede2.pucrs.br:tede/8917 |
| Online Access: | http://tede2.pucrs.br/tede2/handle/tede/8917 |
| Access Level: | Open access |
| Keyword: | NoC-based Many-core System Security Mutual Authentication Application Admission Secure Zones Sistema many-core baseado em rede intra-chip Segurança Autenticação Mútua Admissão de Aplicações Zonas Seguras CIENCIA DA COMPUTACAO::TEORIA DA COMPUTACAO |
| Summary: | The adoption of many-cores systems introduces the concern for data protection as a critical design requirement due to the resource sharing and the simultaneous executions of several applications on the platform. A secure application that processes sensitive data may have its security harmed by a malicious process. The literature contains several proposals to protect many-cores against attacks, focusing for example in the protection of the application execution or the access to shared memories. However, a solution covering the application lifetime, including its admission, execution and peripheral access, is a gap to be fulfilled. This Thesis discusses three security-related issues: the secure admission of applications, the prevention of resource sharing during their execution, and the safe access to external devices. This Thesis proposes a set of protocols and mechanisms, executed at runtime, to tackle these issues. The application admission authenticates trusty entities. An entity authenticated might deploy applications, requiring only a Message Authentication Code (MAC) verification to guarantee the application integrity. Secure applications are mapped into Opaque Secure Zones (OSZ), with the reservation of all Processing Elements (PEs) and communication resources. All traffic flows that should cross the OSZ are rerouted to the outside of the OSZ. Such isolation approach avoids Denial-of-Service (DoS), timing, and spoofing attacks and guarantees data confidentiality and integrity. External devices are also authenticated, enabling the use of a dedicated shared key to encrypt the peripheral exchange messages. Concerning the application admission, the dominant overhead corresponds to the MAC computation and verification steps, that results in the latency to start a secure application by a few milliseconds. Concerning the application execution, the evaluation shows a insignificant impact on the execution time of secure and non-secure applications, even in the presence of several broken paths and the respective rerouting and retransmission of messages. Protection of message header and payload during the peripheral access correspond to the main overhead in the communication latency. The concern is the trade-off between the cryptography cost (hardware or software) versus the additional latency in the communication. This Thesis advances the state-of-the-art on the NoC-based many-core systems research area since that encompasses security mechanism to entire application lifetime. The lightweight mechanism to mutual authentication between external entities and the many-core, and a Message Authentication Code to protect the application’ source code are innovations proposed in the Thesis. The protection of application execution without cryptographic mechanisms through the OSZ, avoiding both communication and computational resources sharing represent another contribution of this Thesis. |
|---|