|
1 Introduction and Motivation |
|
|
1 | (26) |
|
1.1 The Growing Reliance on FPGAs |
|
|
1 | (5) |
|
1.1.1 FPGAs for Aerospace |
|
|
2 | (2) |
|
1.1.2 FPGAs for Supercomputing |
|
|
4 | (1) |
|
1.1.3 FPGAs for Video Analysis |
|
|
5 | (1) |
|
1.1.4 FPGAs for High-Throughput Cryptography |
|
|
5 | (1) |
|
1.1.5 FPGAs for Intrusion Detection and Prevention |
|
|
6 | (1) |
|
|
6 | (10) |
|
1.2.1 The Attractiveness of Reconfigurable Hardware |
|
|
7 | (1) |
|
1.2.2 The Internals of an FPGA |
|
|
8 | (5) |
|
|
13 | (3) |
|
1.3 The Many Facets of FPGA Security |
|
|
16 | (5) |
|
|
17 | (1) |
|
1.3.2 Complexity and Abstraction |
|
|
18 | (1) |
|
1.3.3 Baked in Versus Tacked on |
|
|
19 | (1) |
|
1.3.4 Separation of FPGA Cores |
|
|
20 | (1) |
|
1.4 Organization of This Book |
|
|
21 | (6) |
|
|
22 | (5) |
|
2 High Assurance Software Lessons and Techniques |
|
|
27 | (44) |
|
|
27 | (1) |
|
|
27 | (3) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (1) |
|
2.4 Commensurate Protection |
|
|
31 | (3) |
|
|
32 | (2) |
|
2.5 Security Policy Enforcement |
|
|
34 | (17) |
|
|
34 | (5) |
|
2.5.2 Policy Enforcement Mechanisms |
|
|
39 | (11) |
|
2.5.3 Composition of Trusted Components |
|
|
50 | (1) |
|
2.6 Assurance of Policy Enforcement |
|
|
51 | (20) |
|
|
52 | (3) |
|
2.6.2 Configuration Management |
|
|
55 | (1) |
|
2.6.3 Independent Assessment |
|
|
56 | (2) |
|
2.6.4 Dynamic Program Analysis |
|
|
58 | (2) |
|
2.6.5 Trusted Distribution |
|
|
60 | (1) |
|
|
61 | (1) |
|
2.6.7 Static Analysis of Program Specifications |
|
|
62 | (3) |
|
|
65 | (6) |
|
3 Hardware Security Challenges |
|
|
71 | (16) |
|
|
71 | (4) |
|
3.1.1 Categories of Malicious Hardware |
|
|
71 | (1) |
|
|
72 | (2) |
|
|
74 | (1) |
|
3.2 Covert Channel Definition |
|
|
75 | (3) |
|
3.2.1 The Process Abstraction |
|
|
76 | (1) |
|
3.2.2 Equivalence Classes |
|
|
76 | (1) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
78 | (1) |
|
3.3 Existing Approaches to Limiting Covert and Side Channel Attacks |
|
|
78 | (2) |
|
3.3.1 Shared Resource Matrix Methodology |
|
|
78 | (1) |
|
|
79 | (1) |
|
3.3.3 FPGA Masking Schemes |
|
|
79 | (1) |
|
3.4 Detecting and Mitigating Covert Channels on FPGAs |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
81 | (1) |
|
3.5 Policy State as a Covert Storage Channel |
|
|
81 | (6) |
|
|
81 | (1) |
|
3.5.2 Covert Channel Mechanism |
|
|
81 | (1) |
|
|
82 | (1) |
|
3.5.4 Covert Storage Channel Detection |
|
|
83 | (1) |
|
3.5.5 Covert Channel Mitigation |
|
|
83 | (1) |
|
|
84 | (3) |
|
4 FPGA Updates and Programmability |
|
|
87 | (10) |
|
|
87 | (1) |
|
4.2 Bitstream Encryption and Authentication |
|
|
87 | (3) |
|
|
88 | (1) |
|
4.2.2 Defeating Bitstream Encryption |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
91 | (1) |
|
4.4 Partial Reconfiguration |
|
|
91 | (6) |
|
4.4.1 Applications of Partial Reconfiguration |
|
|
91 | (1) |
|
4.4.2 Hot-Swappable vs. Stop-the-World |
|
|
92 | (1) |
|
4.4.3 Internal Configuration Access Port |
|
|
92 | (1) |
|
4.4.4 Dynamic Security and Complexity |
|
|
92 | (1) |
|
|
93 | (1) |
|
4.4.6 Integrity Verification |
|
|
94 | (1) |
|
|
95 | (2) |
|
5 Memory Protection on FPGAs |
|
|
97 | (30) |
|
|
97 | (1) |
|
5.2 Memory Protection on FPGAs |
|
|
98 | (1) |
|
5.3 Policy Description and Policy |
|
|
99 | (5) |
|
5.3.1 Memory Access Policy |
|
|
99 | (3) |
|
|
102 | (2) |
|
5.4 A Higher-Level Specification Language |
|
|
104 | (2) |
|
|
106 | (10) |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
109 | (1) |
|
5.5.4 Bell and LaPadula Confidentiality Model |
|
|
110 | (1) |
|
|
111 | (1) |
|
5.5.6 Biba Integrity Model |
|
|
112 | (1) |
|
|
113 | (3) |
|
|
116 | (1) |
|
|
116 | (1) |
|
5.8 Using the Policy Compiler |
|
|
117 | (3) |
|
5.9 Constructing Mathematically Precise Policies |
|
|
120 | (5) |
|
5.9.1 Cross Product Method |
|
|
120 | (1) |
|
|
121 | (2) |
|
5.9.3 Monotonic Policy Changes |
|
|
123 | (1) |
|
5.9.4 Formal Aspects of Hybrid Policies |
|
|
124 | (1) |
|
|
125 | (2) |
|
|
125 | (2) |
|
6 Spatial Separation with Moats |
|
|
127 | (12) |
|
|
127 | (1) |
|
|
128 | (1) |
|
6.3 Physical Isolation with Moats |
|
|
128 | (1) |
|
|
128 | (4) |
|
|
129 | (1) |
|
6.4.2 The Inspection Method |
|
|
130 | (1) |
|
6.4.3 Comparing the Gap and Inspection Methods |
|
|
130 | (2) |
|
6.5 Secure Interconnect with Drawbridges |
|
|
132 | (5) |
|
6.5.1 Drawbridges for Direct Connections |
|
|
132 | (3) |
|
6.5.2 Route Tracing with Partial Reconfiguration |
|
|
135 | (1) |
|
6.5.3 Drawbridges for Shared Bus Architectures |
|
|
135 | (2) |
|
6.6 Protecting the Reference Monitor with Moats |
|
|
137 | (2) |
|
|
138 | (1) |
|
7 Putting it all Together: A Design Example |
|
|
139 | (14) |
|
7.1 A Multi-Core Reconfigurable Embedded System |
|
|
139 | (1) |
|
7.2 On-Chip Peripheral Bus |
|
|
140 | (1) |
|
|
141 | (1) |
|
7.4 Logical Isolation Compartments |
|
|
141 | (1) |
|
|
141 | (1) |
|
|
142 | (3) |
|
7.7 Secure Interconnect Scalability |
|
|
145 | (1) |
|
|
145 | (1) |
|
7.9 Incorporating Moats and Drawbridges |
|
|
146 | (1) |
|
7.10 Implementation and Evaluation |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
148 | (1) |
|
7.13 More Example Security Architectures |
|
|
148 | (3) |
|
7.13.1 Classes of Designs |
|
|
148 | (2) |
|
|
150 | (1) |
|
|
151 | (2) |
|
|
152 | (1) |
|
8 Forward-Looking Problems |
|
|
153 | (8) |
|
|
153 | (1) |
|
8.2 Formal Verification of Secure Systems |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
8.6 Configuration Management |
|
|
156 | (1) |
|
8.7 Securing the Supply Chain |
|
|
156 | (1) |
|
8.8 Physical Attacks on FPGAs |
|
|
157 | (1) |
|
8.9 Design Theft and Failure Analysis |
|
|
157 | (1) |
|
8.10 Partial Reconfiguration and Dynamic Security |
|
|
158 | (1) |
|
|
158 | (3) |
|
|
160 | (1) |
|
A Computer Architecture Fundamentals |
|
|
161 | (14) |
|
A.1 What do Computer Architects do all Day? |
|
|
161 | (1) |
|
A.2 Tradeoffs Between CPUs, FPGAs, and ASICs |
|
|
162 | (1) |
|
A.3 Computer Architecture and Computer Science |
|
|
163 | (1) |
|
|
164 | (4) |
|
A.4.1 The Science of Processor Simulation |
|
|
164 | (1) |
|
A.4.2 On-Chip Profiling Engines |
|
|
165 | (1) |
|
A.4.3 Binary Instrumentation |
|
|
166 | (1) |
|
A.4.4 Phase Classification |
|
|
167 | (1) |
|
A.5 Novel Computer Architectures |
|
|
168 | (2) |
|
A.5.1 The DIVA Architecture |
|
|
168 | (1) |
|
A.5.2 The Raw Microprocessor |
|
|
169 | (1) |
|
A.5.3 The WaveScalar Architecture |
|
|
169 | (1) |
|
A.5.4 Architectures for Medicine |
|
|
169 | (1) |
|
|
170 | (3) |
|
A.7 Superscalar Processors |
|
|
173 | (1) |
|
|
174 | (1) |
References |
|
175 | |