Secure by design Systems on Chip
Résumé
Today, systems-on-a-chip can be found in all industrial sectors. This is due to the combination of high performance and low energy footprint. These two aspects have been highly valued, particularly in the context of embedded systems, and have concentrated the bulk of development efforts, unfortunately to the detriment of security. Indeed, Security has only been considered relatively recently, through retrofitting. However, there have been some remarkable pioneering efforts, such as ARM's TrustZone technology, to make systems more secure. TrustZone separates processes into two worlds: a “secure” world and a ‘rich’ world with limited privileges, which cannot access the resources of the “secure” world. The main weakness of these approaches is the lack of security continuity when moving from software to hardware and back, making these solutions ill-suited to the integration of potentially unreliable devices into systems-on-a-chip, i.e. most embedded systems. In concrete terms, the pressure of time-to-market, but also of reduced development costs, motivates the re-use of non-certified, potentially even “black-box” hardware Ips; this puts the whole system at risk. The challenge is therefore to propose a low-cost – a key factor for adoption - approach to securing systems by design. Among the solutions available in the literature is the “TrustSoc” proposal. TrustSoc provides an end-to-end security framework that prevents process/node spoofing (for example, rich-world and safe-world processes are identified and separated), while providing a fine-grained rights management policy. The software component of the solution is based on seL4, a formally verified, high-performance operating system microkernel, which enables resources to be allocated while ensuring their proper use. As part of TrustSoc, it guarantees non-usurpation of identity from the requestor application when writing to the bus, hence proper rights analysis. At the hardware level, TrustSoc relies on the insertion of rights controllers at the I/O level of both slave (e.g. memory) and master (e.g. processor, IP block) devices. These controllers are dedicated to rights checking, and implement various policies (filtering, penalty). This solution has been proven portable to both ARM and RISC-V processors, both of which are widely used in embedded applications. The whole system supports a devops approach, for tailoring/debugging/verification purposes, with the Qemu simulator acting as an execution engine. Our reference implementation testing on an AMD-Xilinx Zynq-7000 SoC-FPGA showed the penalty of the proposed isolation strategy to be small, up to 1% in LUT and 0.7% Flip Flop utilizations, making it an efficient security solution.