Security in MPSoCs: A NoC Firewall and an Evaluation Framework
| Autor: | George Kornaros, Antonis Papagrigoriou, Ioannis Christoforakis, Kyprianos Papadimitriou, Othon Tomoutzoglou, Marcello Coppola, Miltos D. Grammatikakis, George Tsamis, Polydoros Petrakis |
|---|---|
| Rok vydání: | 2015 |
| Předmět: |
Engineering
business.industry Network delay Network interface MPSoC computer.software_genre Computer Graphics and Computer-Aided Design Context-based access control Firewall (construction) Physical address Stateful firewall Embedded system Operating system Application firewall Electrical and Electronic Engineering business computer Software |
| Zdroj: | IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems. 34:1344-1357 |
| ISSN: | 1937-4151 0278-0070 |
| DOI: | 10.1109/tcad.2015.2448684 |
| Popis: | In multiprocessor system-on-chip (MPSoC), a CPU can access physical resources, such as on-chip memory or I/O devices. Along with normal requests, malevolent ones, generated by malicious processes running in one or more CPUs, could occur. A protection mechanism is therefore required to prevent injection of malicious instructions or data across the system. We propose a self-contained Network-on-Chip (NoC) firewall at the network interface (NI) layer which, by checking the physical address against a set of rules, rejects untrusted CPU requests to the on-chip memory, thus protecting all legitimate processes running in a multicore SoC. To sustain high performance, we implement the firewall in hardware, with rule-checking performed at segment-level based on deny rules. Furthermore, to evaluate its impact, we develop a novel framework on top of gem5 simulation environment, coupling ARM technology and an instance of a commercial point-to-point interconnect from STMicroelectronics (STNoC). Simulation tests include scenarios in which legitimate and malicious processes, running in different CPUs, request access to shared memory. Our results indicate that a firewall implementation at the NI can have a positive effect on network performance by reducing both end-to-end network delay and power consumption. We also show that our coarse-grain firewall can prevent saturation of the on-chip network and performs better than fine-grain alternatives that perform rule checking at page-level. Simulation results are accompanied with field measurements performed on a Zedboard platform running Linux, whereas the NoC Firewall is implemented as a reconfigurable, memory-mapped device on top of AMBA AXI4 interconnect fabric. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|