Cryptology ePrint Archive: Report 2015/651

Secure Execution Architecture based on PUF-driven Instruction Level Code Encryption

Stephan Kleber and Florian Unterstein and Matthias Matousek and Frank Kargl and Frank Slomka and Matthias Hiller

Abstract: A persistent problem with program execution, despite numerous mitigation attempts, is its inherent vulnerability to the injection of malicious code. Equally unsolved is the susceptibility of firmware to reverse engineering, which undermines the manufacturer's code confidentiality. We propose an approach that solves both kinds of security problems employing instruction-level code encryption combined with the use of a physical unclonable function (PUF). Our novel Secure Execution PUF-based Processor (SEPP) architecture is designed to minimize the attack surface, as well as performance impact, and requires no significant changes to the development process. This is possible based on a tight integration of a PUF directly into the processor's instruction pipeline. Furthermore, cloud scenarios and distributed embedded systems alike inherently depend on remote execution; our approach supports this, as the secure execution environment needs not to be locally available at the developers site. We implemented an FPGA-based prototype based on the OpenRISC Reference Platform. To assess our results, we performed a security analysis of the processor and evaluated the performance impact of the encryption. We show that the attack surface is significantly reduced compared to previous approaches while the performance penalty is at a reasonable factor of about 1.5.

Category / Keywords: implementation / implementation, instruction-level code encryption, physical unclonable function (PUF), Secure Execution PUF-based Processor, OpenRISC, code injection prevention, code confidentiality, CPU architecture

Date: received 30 Jun 2015

Contact author: stephan kleber at uni-ulm de

Available format(s): PDF | BibTeX Citation

Version: 20150701:011200 (All versions of this report)

Short URL: ia.cr/2015/651

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]