Query: SGX FPGA trust

Candidate papers:

abstract: ion level Root of trust functionality Structural (how) examples Example Threats Typical HW design activities System and application Secure platforms e.g. Trusted Execution (Trustzone, SGX, TEE) HSM, Secure Element to support isolation, integrity, attestation, security application development Processor general purpose e.g. shadow stack SW vulnerabilities ISA, HW/SW co design Processor domain specific Crypto specific RTL Timing attacks Constant number of clock cycles Register Transfer Crypto specific Building blocks, Side Channel Attack, Logic synthesis Logic Resistance to SCA, Power, EM, fault Masking, Circuit styles Side Channel attack, fault FPGA tools, standard cell design Circuit and technology Source of entropy TRNG, PUF, Secure SRAM Temperature, glitches SPICE simulations Physical Tamper Resistance Shields, sensors Probing, heating Layout activities Table 1: Design abstraction layers linked to threat models, root of trust and design activities chip. Typical examples are co processors to support public key or secret key cryptographic algorithms. Time at the processor level is typically measured in instruction cycles. Both general purpose and domain specific processors are composed together from computational units, multipliers and ALU's, memory and interconnect. These modules are typically described at the register transfer level: constant time and resistance against side channel attacks become the focus. Time at this level is typically measured in clock cycles. Multipliers, ALU's, memories, interconnect and bus infrastructure are created from gates and flip flops at the logic level. At this design abstraction level, focus is on leakage through physical side channels, power, electro magnetic, and fault attacks. Time is typically measured in absolute time (nsec) based on the available standard cell libraries or FPGA platforms. The design of entropy sources requires knowledge and insights into the behavior of transistors and the underlying Complementary Metal Oxide Semiconductor (CMOS) technology.The design of these hardware security primitives is therefore positioned at the circuit and transistor level. Similarly the design of sensors and shields against physical tampering require insight into the technology. At the circuit and technology level it is measured in absolute time, e.g. nsec delay or GHz clock frequency. The table 1 does not aim to be complete. The idea is to illustrate each abstraction layer with an example. In the next sections, the hardware security goals and their associated threat models will be discussed in detail in relation to and relevance for each abstraction layer. KA Hardware Security October 2019 Page 6 The Cyber Security Body Of Knowledge www.cybok.org 2 MEASURING HARDWARE SECURITY Depending on the commercial application domain, several industrial and government organizations have issued standards or evaluation procedures. The most well known ones are the FIPS 140 2 (and the older FIPS 140 1) the Common Criteria (CC) evaluation and in the financial world the EMVCO. FIPS 140 2 mostly focuses on the implementation security of cryptographic algorithms. Common Criteria are applicable to IT security in general. 2.1 FIPS140 2 FIPS140 2 is a US NIST standard used for the evaluation of cryptographic modules. FIPS140 2 defines security levels from 1 to 4 (1 being the lowest) The following gives a description of the four levels from a physical hardware security point of view. Next to the physical requirements, there are also roles, services and authentication requirements (for more details see [7] and other KAs) Security level 1 only requires than an approved cryptographic algorithm be used, e.g. AES or SHA 3, but does not impose physical security requirements. Hence a software implementation could meet level 1. Level 2 requires a first level of tamper evidence. Level 3 also requires the tamper evidence, but on top requires tamper resistance. NIST defines tampering as an intentional but unauthorized act resulting in the modification of a system, components of systems, its intended behavior, or data, [8] Tamper evidence means that there is a proof or testimony that tampering with a hardware module has happened. E.g. a broken seal indicates that a device was opened. A light sensor might observe that the lid of a chip package was lifted. Tamper resistance means that on top of tamper evidence, protection mechanisms are added to the device. E.g. by extra coating or dense metal layers, it is difficult to probe the key registers. Level 4 increases the requirements such that the cryptographic module can operate in physically unprotected environments. In this context, the physical side channel attacks pose an important threat. If any of these physical components depend on sensitive data being processed, information is leaked. Since the device is under normal operation, a classic tamper evidence mechanism will not realize that the device is under attack. See later in section 6. 2.2 Common criteria and EMVCo "Common Criteria for information technology security evaluation" is an international standard for IT product security (ISO/IEC 15408) in short known as Common Criteria (CC) CC is a very generic procedure applicable to the security evaluation of IT products. Several parties are involved in this procedure. The customer will define a set of security specifications for its product. The manufacturer will design a product according to these specifications. An independent evaluation lab will verify if the product fulfills the claims made in the security requirements. Certification bodies will issue a certification that the procedure was correctly followed and that the evaluation lab indeed confirmed the claims made. The set of security specifications are collected in a so called protection profile. Depending on the amount of effort put into the security evaluation, the CC defines different Evaluation Assurance Levels (EALs) It ranges from basic functionally testing, corresponding KA Hardware Security October 2019 Page 7 The Cyber Security Body Of Knowledge www.cybok.org to EAL1, to formally verified design and tested, corresponding to the highest level EAL7. CC further subdivides the process of evaluation into several classes, where most of the classes verify the conformity of the device under test. The 5th class (AVA) deals with the actual vulnerability assessment. It is the most important class from a hardware security viewpoint as it searches for vulnerabilities and associated tests. It will assign a rating on the difficulty to execute the test, called the identification, and the possible benefit an attacker can gain from the penetration, called the exploitation. The difficulty is a function of the time required to perform the attack, the expertise of the attacker from layman to multiple experts, how much knowledge of the device is required from simple public information to detailed hardware source code, the number of samples required, and the cost and availability of equipment to perform the attack, etc. A high difficulty level will result in a high score and a high level of the AVA class. The highest score one can obtain is an AVA level of 5, which is required to obtain a top EAL score. Its usage is well established in the field of smartcards and secure elements as they are used in telecom, financial, government ID's applications. It is also used in the field of Hardware Security Modules, Trusted Platform Modules and some more [9] For certain classes of applications minimum sets of requirements are defined into protection profiles. There exists protection profiles for Trusted Platform Module (TPM) Javacards, Biometric passports, SIM cards, secure elements, etc. Since certification comes from one body, there exist agreements between countries so that the certifications in one country are recognized in other countries. As an exception EMVCo is a private organization to set the specifications for worldwide interoperability of payment transactions. It has its own certification procedure similar to CC. Please note that the main purpose of a common criteria evaluation is to verify that an IT product delivers the claims promised in the profile. It does not mean that there are no vulnerabilities left. A good introduction to the topic can be found in [10] and a list of certified products on [9] 2.3 SESIP: Security Evaluation Standard for IoT Platforms In the context of IoT security evaluation, a recent initiative is the SESIP Security Evaluation scheme [11] currently at version 1.2. IoT devices are typically small, light weight 'things' with limited accessibility via internet. Several levels of threat model for IoT are possible: from only remote internet access, over various remote software attack options, to also physical attack resistance. A comprehensive set of security functional requirements are defined: identification and attestation, product lifecycle, secure communication, software and physical attack resistance, cryptographic functionality including random number generation, and some compliance functionality to e.g. provide secure encrypted storage or provide reliable time. Similar to Common Criteria, SESIP provides several levels of assurance. Level 1 is the lowest level and consists of a self assessment. The highest level of SESIP consists of a full CC evaluation similar to smart cards or secure elements. The levels in between cover from a black box penetration testing over white box penetration testing with or without time limitations. KA Hardware Security October 2019 Page 8 The Cyber Security Body Of Knowledge www.cybok.org 3 SECURE PLATFORMS This section describes the goals and the state of the art in secure platforms. At this high level of abstraction the system designer receives a complete chip or board as trusted computing base. The system designers assume that the trusted root delivers a set of cryptographic functions, protected by the hardware and software inside
author_names: Ingrid M R Verbauwhede
title: Hardware Security Knowledge Area Issue 1 0
year: 2019

abstract: ion level Root of trust functionality Structural (how) examples Example Threats Typical HW design activities System and application Secure platforms e.g. Trusted Execution (Trustzone, SGX, TEE) HSM, Secure Element to support isolation, integrity, attestation, security application development Processor general purpose e.g. shadow stack SW vulnerabilities ISA, HW/SW co design Processor domain specific Crypto specific RTL Timing attacks Constant number of clock cycles Register Transfer Crypto specific Building blocks, Side Channel Attack, Logic synthesis Logic Resistance to SCA, Power, EM, fault Masking, Circuit styles Side Channel attack, fault FPGA tools, standard cell design Circuit and technology Source of entropy TRNG, PUF, Secure SRAM Temperature, glitches SPICE simulations Physical Tamper Resistance Shields, sensors Probing, heating Layout activities Table 1: Design abstraction layers linked to threat models, root of trust and design activities In an attempt to order the topics, table 1 summarizes this organization. The different abstraction layers are identified (first column) from a hardware perspective. The highest level (system and software) sits on top of the hardware platform. E.g. a system designer assumes that a secure platform is available. Thus the secure platform is the root of trust, providing security functionality. The second column describes the functionality provided by the root of trust. The third column describes how this functionality might be implemented. E.g. at the highest abstraction layer this might be by providing a Trusted Execution Module or a secure element, etc. The fourth column describes the threat models and attack categories at that abstraction layer. E.g. at system level, the system designer assumes that they will receive a module that provides isolation, integrity, attestation, etc. The last column describes typical design activities at this particular design abstraction layer.
author_names: Ingrid M R Verbauwhede
title: Hardware Security

abstract: ion level Root of trust functionality Structural (how) examples Example Threats Typical HW design activities System and application Secure platforms e.g. Trusted Execution (Trustzone, SGX, TEE) HSM, Secure Element to support isolation, integrity, attestation, SW development Processor general purpose e.g. shadow stack SW vulnerabilities HW/SW co design Processor domain specific Crypto specific RTL Timing attacks Behavioral synthesis Register Transfer Crypto specific Building blocks, SCA attack, Logic synthesis Logic Resistance to SCA, Power, EM, fault Masking, Circuit styles SCA attack, fault FPGA tools, standard cell design Circuit and technology Source of entropy TRNG, PUF, Secure SRAM Temp, glitches SPICE simulations Physical Tamper Resistance Shields, sensors Probing, heating Layout activities Table 1: Design abstraction layers linked to threat models, root of trust and design activities In an attempt to order the topics, table 1 summarises this organisation. The different abstraction layers are identified (first column) from a hardware perspective. The highest level (system and software) sits on top of the hardware platform. E.g. a system designer assumes that a secure platform is available. Thus the secure platform is the root of trust, providing security functionality. The second column describes the functionality provided by the root of trust. The third column describes how this functionality might be implemented. E.g. at the highest abstraction layer this might be by providing a Trusted Execution Module or a secure element. The fourth column describes the threat models and attack categories at that abstraction layer. For instance, at the system level, the system designer assumes to receive a module that provides isolation, integrity, attestation, etc. The last column describes typical design activities at this particular design abstraction layer. This exercise is repeated for each abstraction layer and described in detail in each of the following sections. At the processor level, one can distinguish general purpose programmable processors and domain
author_names: Ingrid M R Verbauwhede
title: HARDWARE SECURITY KNOWLEDGE AREA DRAFT FOR COMMENT

abstract: Platforms combining Central Processing Systems (CPUs) with Field Programmable Gate Arrays (FPGAs) have become popular, as they promise high performance with energy efficiency. This is the result of the combination of FPGA accelerators tuned to the application, with the CPU providing the programming flexibility. Unfortunately, the security of these new platforms has received little attention: The classic software security assumption that hardware is immutable no longer holds. It is expected that attack surfaces will expand and threats will evolve, hence the trust models, and security solutions should be prepared. The attacker model should be enhanced and consider the following three basic entities as the source of threats: applications run by users, accelerators designed by third party developers, and the cloud service providers enabling the computation on their platforms. In our work, we review current trust models and existing security assumptions and point out their shortcomings. We survey existing research that target secure remote FPGA configuration, the protection of intellectual property, and secure shared use of FPGAs. When combined, these are the foundations to build a solution for secure use of FPGAs in the cloud. In addition to analysing the existing research, we provide discussions on how to improve it and disclose various concerns that have not been addressed yet.
author_names: Furkan Turan

Ingrid M R Verbauwhede
title: Trust in FPGA accelerated Cloud Computing
venue: ACM Comput. Surv.
year: 2021

abstract: This paper proposes a method to protect DMA data transfer that can be used to offload computation to an accelerator. The proposal minimizes changes in the hardware platform and to the application and SW stack. The paper describes the end to end scheme to protect communication between an application running inside a SGX enclave and a FPGA accelerator optimized for bandwidth and latency and details the implementation of AES GCM hardware engines with high bandwidth and low latency.
author_names: Santosh K Ghosh

Luis S Kida

Soham Jayesh Desai

Reshma Lal
title: A >100 Gbps Inline AES GCM Hardware Engine and Protected DMA Transfers between SGX Enclave and FPGA Accelerator Device
venue: IACR Cryptol. ePrint Arch.
year: 2020

abstract: Intel SGX is a security solution promising strong and practical security guarantees for trusted computing. However, recent reports demonstrated that such security guarantees of SGX are broken due to access pattern based side channel attacks, including page fault, cache, branch prediction, and speculative execution. In order to stop these side channel attackers, Oblivious RAM (ORAM) has gained strong attention from the security community as it provides cryptographically proven protection against access pattern based side channels. While several proposed systems have successfully applied ORAM to thwart side channels, those are severely limited in performance and its scalability due to notorious performance issues of ORAM. This paper presents TrustOre, addressing these issues that arise when using ORAM with Intel SGX. TrustOre leverages an external device, FPGA, to implement a trusted storage service within a completed isolated environment secure from side channel attacks. TrustOre tackles several challenges in achieving such a goal: extending trust from SGX to FPGA without imposing architectural changes, providing a verifiably secure connection between SGX applications and FPGA, and seamlessly supporting various access operations from SGX applications to FPGA.We implemented TrustOre on the commodity Intel Hybrid CPU FPGA architecture. Then we evaluated with three state of the art ORAM based SGX applications, ZeroTrace, Obliviate, and Obfuscuro, as well as an end to end key value store application. According to our evaluation, TrustOre based applications outperforms ORAM based original applications ranging from 10x to 43x, while also showing far better scalability than ORAM based ones. We emphasize that since TrustOre can be deployed as a simple plug in to SGX machine's PCIe slot, it is readily used to thwart side channel attacks in SGX, arguably one of the most cryptic and critical security holes today.
author_names: Hyunyoung Oh

Adil Ahmad

Seonghyun Park

Byoungyoung Lee

Yunheung Paek
title: TRUSTORE: Side Channel Resistant Storage for SGX using Intel Hybrid CPU FPGA
venue: CCS
year: 2020

author_names: Melanie D Berg
title: ASIC/FPGA Trust Assessment Framework
year: 2018

abstract: Field programmable gate arrays (FPGAs) are widely used in real time, data intensive, and mission critical system designs. In the space of trusted computing, FPGA based security modules have appeared in a number of widely used security conscious devices. The Cisco Trust Anchor module (TAm) is one such example that is deployed in a significant number of enterprise network switches, routers, and firewalls. We discuss several novel direct FPGA bitstream manipulation techniques that exploit the relative simplicity of input and output pin configuration structures. We present an analysis of the efficacy of Cisco TAm and discuss both the high level architectural flaws of the TAm as well as implementation specific vulnerabilities in a TAmprotected Cisco router. By combining techniques presented in this paper with other recent advancements in FPGA bitstream manipulation, we demonstrate the feasibility of reliable remote exploitation of all Cisco TAms implemented using Xilinx Spartan 6 FPGAs. The TAm exploit described in this paper allows the attacker to fully bypass all Trust Anchor functionality, including hardware assisted secure boot, and to stealthily inject persistent malicious implants within both the TAm FPGA and the application processor. Lastly, we discuss the applicability of our bitstream manipulation techniques to other FPGA based devices and propose several practical mitigations.
author_names: Jatin Kataria

Rick Housley

Joseph Pantoga

Ang Cui
title: Defeating Cisco Trust Anchor: A Case Study of Recent Advancements in Direct FPGA Bitstream Manipulation
venue: WOOT USENIX Security Symposium
year: 2019

abstract: Data provenance refers to records of the inputs, entities, systems, and processes that influence data of interest, providing a historical record of the data and its origins. Secure data provenance is vital to ensure accountability, forensics investigation of security attacks and privacy preservation. In this paper, we propose Prov Trust, a decentralized and auditable SGX based data provenance system relying on highly distributed ledgers. This consensually shared and synchronized database allows anchored data to have public witness, providing tamper proof provenance data, enabling the transparency of data accountability, and enhancing the secrecy and availability of the provenance data. Prov Trust relies on Intel SGX enclave to ensure a trusted execution of the provenance kernel to collect, store and query provenance records. The use of SGX enclave protects data provenance and users' credentials against malicious hosting and processing parties. Prov Trust does not rely on a trusted third party to store provenance data while performing their verification using smart contracts and voting process. The storage of the provenance data in Prov Trust is done using either the log events of Smart Contracts or blockchain's transactions depending on the provenance change event, which enables low storage costs. Finally, Prov Trust ensures an accurate privacy preserving auditing process based on blockchain traces and achieved thanks to events' logs that are signed by SGX enclaves, transactions being registered after each vote session, and sealing the linking information using encryption schemes.
author_names: Nesrine Kaaniche

Sana Belguith

Maryline Laurent-Maknavicius

Ashish Gehani

Giovanni Russello
title: Prov Trust: Towards a Trustworthy SGX based Data Provenance System
venue: ICETE
year: 2020

author_names: Luis S Kida

Soham Jayesh Desai

A N Trivedi

Reshma Lal

Vincent Scarlata

Santosh K Ghosh
title: HCC: 100 Gbps AES GCM Encrypted Inline DMA Transfers Between SGX Enclave and FPGA Accelerator
venue: ICICS
year: 2020