Protecting the Control Flow of Embedded Processors against Fault - PowerPoint PPT Presentation

W I S S E N T E C H N I K L E I D E N S C H A F T Protecting the Control Flow of Embedded Processors against Fault Attacks Mario Werner 1 , Erich Wenger 2 , and Stefan Mangard 1 , 1 Graz University of Technology 2 Infineon Technologies AG, Munich 5th November 2015, Bochum www.iaik.tugraz.at

www.iaik.tugraz.at Context and Motivation Embedded systems are everywhere Assets in malicious environment Memory Processor Crypto System Various assets Protecting cryptographic primitives is insufficient Werner, Wenger, Mangard, 2 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? unsigned pin = read_pin(); bool auth = tpm_check(pin); if( auth ) { open_door(); } else { alert_police(); } log_event(); read_pin() tpm_check(pin) check if auth == true open_door() alert_police() log_event() Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? unsigned pin = read_pin(); bool auth = tpm_check(pin); if( auth ) { open_door(); } else { alert_police(); } log_event(); check condition perform action handle error continue Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? check_auth: // auth in R0 (1 if true) LDR R1, #1 CMP R0, R1 BNE not_authenticated authenticated: // open door // ... B next not_authenticated: // alert police next: // log event Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? check_auth: // auth in R0 (1 if true) LDR R1, #1 CMP R0, R1 BEQ not_authenticated authenticated: // open door // ... B next not_authenticated: // alert police next: // log event Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? check_auth: // auth in R0 (1 if true) LDR R1, #1 CMP R0, R0 BNE not_authenticated authenticated: // open door // ... B next not_authenticated: // alert police next: // log event Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Do we really care about the Processor? check_auth: // auth in R0 (1 if true) LDR R1, #1 CMP R0, R1 BNE not_authenticated authenticated: // open door // ... B next not_authenticated: // alert police next: // log event Werner, Wenger, Mangard, 3 5th November 2015, Bochum

www.iaik.tugraz.at Goal and Results Goal: Enforce control-flow integrity Results: Analysis and evaluation of signature functions Detect a faulty instruction with 99.9 % within 3 cycles (arbitrary fault) Resistant against at least 7 precise bit flips injected across two instructions HDL implementation for a Cortex-M3 clone LLVM based toolchain 6.4 % hardware overhead 2 % to 71 % runtime overhead Werner, Wenger, Mangard, 4 5th November 2015, Bochum

www.iaik.tugraz.at Control-Flow Integrity Execute code as programmed Perform only intended function calls Traverse control flow graph along programmed edges Execute basic blocks from start to end Preserve instructions and their order read_pin check_pin main unlock_door alert_police log_event Werner, Wenger, Mangard, 5 5th November 2015, Bochum

www.iaik.tugraz.at Control-Flow Integrity Execute code as programmed Perform only intended function calls Traverse control flow graph along programmed edges Execute basic blocks from start to end Preserve instructions and their order check auth open_door() alert_police() log_event() Werner, Wenger, Mangard, 5 5th November 2015, Bochum

www.iaik.tugraz.at Control-Flow Integrity Execute code as programmed Perform only intended function calls Traverse control flow graph along programmed edges Execute basic blocks from start to end Preserve instructions and their order check auth open_door() alert_police() log_event() Werner, Wenger, Mangard, 5 5th November 2015, Bochum

www.iaik.tugraz.at Control-Flow Integrity Execute code as programmed Perform only intended function calls Traverse control flow graph along programmed edges Execute basic blocks from start to end Preserve instructions and their order check_auth: // auth in R0 (1 if true) LDR R1, #1 CMP R0, R0 BNE not_authenticated Werner, Wenger, Mangard, 5 5th November 2015, Bochum

www.iaik.tugraz.at Concept Instruction stream integrity through derived signatures [MM88] Generalized path signature analysis (GPSA) [WS90] Optimize against fault attacks Implemented as hybrid scheme Dedicated assertions Continuous checks Werner, Wenger, Mangard, 6 5th November 2015, Bochum

www.iaik.tugraz.at Derived Signatures [MM88] R e s e t _ H a n d l e r 0 x 0 0 0 0 0 0 0 0 0 x 0 0 0 0 b 5 b 0 b 5 b 0 : p u s h { r 4 , r 5 , r 7 , l r } 0 x 0 0 0 1 6 4 b 2 a f 0 2 : a d d r 7 , s p , # 8 0 x 0 0 0 1 a c b f 4 8 0 d : l d r r 0 , [ p c , # 5 2 ] 0 x 0 0 0 1 f 5 c d 4 9 0 e : l d r r 1 , [ p c , # 5 6 ] 0 x 0 0 0 2 3 8 5 5 4 2 8 8 : c m p r 0 , r 1 0 x 0 0 0 3 0 a 6 2 d 2 0 d : b h s # 2 6 R e s e t _ H a n d l e r : 1 R e s e t _ H a n d l e r : 2 0 x 0 0 0 3 0 a 6 2 0 x 0 0 0 3 0 a 6 2 0 x 0 0 0 3 5 4 6 f 4 a 0 d : l d r r 2 , [ p c , # 5 2 ] 0 x 0 0 0 3 5 6 6 8 4 c 0 6 : l d r r 4 , [ p c , # 2 4 ] . . . . . . ??? Werner, Wenger, Mangard, 7 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 ( i f ) / / . . . % 2 % 3 / / . . . / / . . . / / . . . % 4 / / . . . / / . . . Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 ( i f ) / / . . . % 2 % 3 / / . . . / / . . . update(sig1) / / . . . % 4 / / . . . / / . . . Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 ( i f ) / / . . . % 2 % 3 / / . . . / / . . . update(sig1) / / . . . % 4 / / . . . / / . . . check(sig2) Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 ( i f ) / / . . . % 2 % 3 / / . . . / / . . . update(sig1) / / . . . % 4 / / . . . / / . . . check(sig2) Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 / / . . . % 2 ( w h i l e ) / / . . . % 6 / / . . . % 3 ( i f ) r e t u r n / / . . . % 5 % 4 / / . . . / / . . . r e t u r n Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 / / . . . % 2 ( w h i l e ) / / . . . % 6 / / . . . % 3 ( i f ) r e t u r n / / . . . % 4 % 5 / / . . . / / . . . update(sig1) r e t u r n Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Generalized Path Signature Analysis [WS90] % 1 / / . . . % 2 ( w h i l e ) / / . . . % 6 update(sig2) % 3 ( i f ) / / . . . / / . . . r e t u r n % 4 % 5 / / . . . / / . . . update(sig1) r e t u r n Werner, Wenger, Mangard, 8 5th November 2015, Bochum

www.iaik.tugraz.at Signature Functions against Fault Attacks Compression function Avoid collisions within one cycle Qualitative Requirements for GPSA: Reliability: S j + 1 ⊕ ∆ S j + 1 = f ( S j , I j ⊕ ∆ I j ) Error preservation: S j + 1 ⊕ ∆ S j + 1 = f ( S j ⊕ ∆ S j , I j ) Non associativity: f ( f ( S j , I j ) , I k ) � = f ( f ( S j , I k ) , I j ) Invertibility: S j = f − 1 ( S j + 1 , I j ) → single faulty instructions detectable Werner, Wenger, Mangard, 9 5th November 2015, Bochum

www.iaik.tugraz.at Quantitative Evaluation MISRs and CRCs with various polynomials How hard is it to bypass the protection? Quality function: q ( j , t ) = HW (∆ I j ) + HW (∆ I j + t ) Worst case behavior min ( q ) matters → CRCs are better than MISRs against faults → min ( q ) = 8 for CRC-32C and CRC-32Q Werner, Wenger, Mangard, 10 5th November 2015, Bochum

www.iaik.tugraz.at Implementation Hardware: Monitor for derived signatures Extended fetch unit Software: Compiler for ... GPSA signature updates ... assertions Post-processing tool for ... update and check constants ... continuous signature monitoring (CSM) Werner, Wenger, Mangard, 11 5th November 2015, Bochum

www.iaik.tugraz.at Hardware Modifications Cortex-M3 System Address Space Fetch Decode Execute RAM DataOut Fetched CodeIn Instructions Register File DataIn Controller Peripherals Reference Signature Signatures Monitor for CSM MUL/ ALU DIV Address signature Code Generation Addr. Fetch Unit Controller f u Address Werner, Wenger, Mangard, 12 5th November 2015, Bochum

www.iaik.tugraz.at Evaluation Hardware: CPU Core: 37 kGE Monitor: 1.5 kGE (4 %) Monitor + Core with CSM: 39 kGE (6.4 %) Benchmarks: Modified vs stock LLVM Coremark AES-256 Elliptic Curve Cryptography in C and with ASM Werner, Wenger, Mangard, 13 5th November 2015, Bochum