Hardware Security Modules Research Articles

Enhancing Security in Low-power Wide-area (LPWA) IoT Environments: The Role of HSM, Tamper-proof Technology, and Quantum Cryptography

Low-power wide-area (LPWA) networks are integral to expanding Internet of Things (IoT) applications, offering extensive coverage with low power consumption. However, these networks face significant security challenges due to their widespread deployment and inherent constraints. In order to provide secure services in an LPWA IoT environment, important information stored in IoT devices (encryption keys, device unique numbers, etc.) must be safely protected from external hacking or theft by physical access, and it is necessary to develop tamper-proof technology to enhance physical security. Meanwhile, with so many ruggedized IoT devices processing and transmitting sensitive information, security systems are essential to protect the integrity and privacy of IoT data. This paper explores the critical role of hardware security modules (HSMs), tamper-proof technology, and quantum cryptography in enhancing the physical, network, and data security of LPWA IoT environments. We propose operational strategies for HSMs, tamper-proof technology in ruggedized LPWA IoT settings, and a quantum key distribution (QKD)-based IPsec solution for robust network and data security.

Advanced Encryption Techniques for Database Security in Cloud Environments

This technical article explores advanced encryption techniques for enhancing database security in cloud environments, addressing the growing need for robust data protection as organizations increasingly migrate to cloud-based solutions. The article covers encryption standards such as AES-256, RSA, and Elliptic Curve Cryptography, as well as key management approaches using Hardware Security Modules (HSMs) and Key Management Services (KMS). It also delves into cutting-edge concepts like homomorphic encryption and quantum-resistant algorithms. The discussion encompasses performance optimization strategies and regulatory compliance considerations, providing a comprehensive overview of the current state and future trends in cloud database security.

Multibarrier Collaborative Modulation Devices with Ultra-High Logic Operation Density.

The demands for highly miniaturized and multifunctional electronics are rapidly increasing. As scaling-down processes of transistors are restricted by physical limits, reconfigurable electronics with switchable operation functions for different tasks are developed for higher function integration based on split- or vertical-dual-gate structures. To promote the present reconfigurable electronics and exceed the function integration limit, the critical issue is to integrate complex operations into simple circuit forms by establishing more control dimensions. This work proposes a multibarrier collaborative (MBC) modulation architecture to increase the control dimension by multiple forms of potential barriers and achieves combinational and reconfigurable logic operations by a single MBC device. The MBC architecture exhibits ultrahigh logic operation density, including 58.8% area reduction for multiplexer operations and 71.4% area reduction for 4-logic reconfigurable operations. Besides, a hardware security module composed of 4 MBC devices implementing 8 types of logic operations is demonstrated. This work reveals an effective design of function integration for next-generation electronics.

Securing Cloud Environments by Analyzing Cryptographic Techniques for Data Integrity and Confidentiality

With cloud computing, you'll effectively and rapidly reach a parcel of computer assets. Usually exceptionally valuable in this computerized age. But this alter within the way things work makes it much harder to keep data secure and private. There are numerous reasons why security is critical for cloud settings. This exposition centers on ways to keep information safe from individuals who shouldn't be able to see or alter it. We see at a few of the foremost vital thoughts in cryptography, such as hashing, advanced marks, symmetric and hilter kilter encryption, and how they can be utilized to security the cloud. A few sorts of encryption, like AES and others, keep information secure whereas it's being sent. Other sorts of encryption, like RSA and others, keep information secure whereas it's being put away. Hash calculations, like SHA-256, deliver each set of information a one of a kind advanced stamp that creates it simple to spot changes. This makes beyond any doubt that the information is rectify. Indeed more security is included by computerized marks, which check the data's clarity and reliability to create beyond any doubt it wasn't changed whereas it was being sent. There are more complicated secure strategies that we see at, such as secure multi-party computation and homomorphic encryption. There is solid protection indeed in places where no one can be trusted since these let forms be done on secured information without giving out the essential data. This paper examines how these safety measures can be utilized in cloud-based systems and talks about how well they perform and any speed issues they might lead to. There are case studies from real life that show how safe methods have been used successfully in the cloud. This shows that they can be used in real life. We also talk about the issues that come up when you need to manage encryption keys, which is a key part of keeping data safe. A lot of attention is paid to strong key management tools, such as Hardware Security Modules (HSMs) and key management services (KMS).

HSM4SSL: Leveraging HSMs for Enhanced Intra-Domain Security

In a world where digitization is rapidly advancing, the security and privacy of intra-domain communication within organizations are of critical concern. The imperative to secure communication channels among physical systems has led to the deployment of various security approaches aimed at fortifying networking protocols. However, these approaches have typically been designed to secure protocols individually, lacking a holistic perspective on the broader challenge of intra-domain communication security. This omission raises fundamental concerns about the safety and integrity of intra-domain environments, where all communication occurs within a single domain. As a result, this paper introduces HSM4SSL, a comprehensive solution designed to address the evolving challenges of secure data transmission in intra-domain environments. By leveraging hardware security modules (HSMs), HSM4SSL aims to utilize the Secure Socket Layer (SSL) protocol within intra-domain environments to ensure data confidentiality, authentication, and integrity. In addition, solutions proposed by academic researchers and in the industry have not addressed the issue in a holistic and integrative manner, as they only apply to specific types of environments or servers and do not utilize all cryptographic operations for robust security. Thus, HSM4SSL bridges this gap by offering a unified and comprehensive solution that includes certificate management, key management practices, and various security services. HSM4SSL comprises three layers to provide a standardized interaction between software applications and HSMs. A performance evaluation was conducted comparing HSM4SSL with a benchmark tool for cryptographic operations. The results indicate that HSM4SSL achieved 33% higher requests per second (RPS) compared to OpenSSL, along with a 13% lower latency rate. Additionally, HSM4SSL efficiently utilizes CPU and network resources, outperforming OpenSSL in various aspects. These findings highlight the effectiveness and reliability of HSM4SSL in providing secure communication within intra-domain environments, thus addressing the pressing need for enhanced security mechanisms.

Custody in the age of digital assets : The path to building market infrastructure fit for a tokenised economy

This paper charts the dynamic evolution of finance and capital markets amid the digital asset surge. Tracing the historical trajectory from conventional banking to the current digital era, the paper underscores the intertwined narrative of finance and technology. Distributed ledger technology (DLT) and digital assets take centre stage, driving continuous financial operations and reshaping market dynamics. Custody emerges as a pivotal factor in this digital transformation. Established financial institutions strategically invest in digital asset infrastructure, recognising the seismic potential of tokenisation. Research from major companies projects significant tokenisation of assets, prompting global banks to align their strategies accordingly. The paper explores diverse use cases, from custody and trading services for cryptocurrencies to tokenising financial securities and real-world assets. Navigating the regulatory landscape proves crucial, with varying regulations across jurisdictions posing challenges. A unified regulatory framework is advocated for fostering global adoption. The paper delves into the technological nuances of safeguarding digital assets, exploring key management solutions such as multiparty computation (MPC) and hardware security modules (HSMs). The paper anticipates a shift towards recentralisation as the digital asset market matures, with established financial institutions and custodians poised to leverage trust, balance sheets and regulatory compliance to open up commercial opportunities in the digital asset space. In essence, the paper provides a sweeping overview of the current digital asset landscape, offering insights into challenges, opportunities and technological considerations shaping the digital asset custody value chain.

Advancing Trustworthiness in System-in-Package: A Novel Root-of-Trust Hardware Security Module for Heterogeneous Integration

Advancing Trustworthiness in System-in-Package: A Novel Root-of-Trust Hardware Security Module for Heterogeneous Integration

Toward Sensor Measurement Reliability in Blockchains.

In this work, a secure architecture to send data from an Internet of Things (IoT) device to a blockchain-based supply chain is presented. As is well known, blockchains can process critical information with high security, but the authenticity and accuracy of the stored and processed information depend primarily on the reliability of the information sources. When this information requires acquisition from uncontrolled environments, as is the normal situation in the real world, it may be, intentionally or unintentionally, erroneous. The entities that provide this external information, called Oracles, are critical to guarantee the quality and veracity of the information generated by them, thus affecting the subsequent blockchain-based applications. In the case of IoT devices, there are no effective single solutions in the literature for achieving a secure implementation of an Oracle that is capable of sending data generated by a sensor to a blockchain. In order to fill this gap, in this paper, we present a holistic solution that enables blockchains to verify a set of security requirements in order to accept information from an IoT Oracle. The proposed solution uses Hardware Security Modules (HSMs) to address the security requirements of integrity and device trustworthiness, as well as a novel Public Key Infrastructure (PKI) based on a blockchain for authenticity, traceability, and data freshness. The solution is then implemented on Ethereum and evaluated regarding the fulfillment of the security requirements and time response. The final design has some flexibility limitations that will be approached in future work.

Heterogeneous Integration Supply Chain Integrity Through Blockchain and CHSM

Over the past few decades, electronics have become commonplace in government, commercial, and social domains. These devices have developed rapidly, as seen in the prevalent use of system-on-chips rather than separate integrated circuits on a single circuit board. As the semiconductor community begins conversations over the end of Moore’s law, an approach to further increase both functionality per area and yield using segregated functionality dies on a common interposer die, labeled a System in Package (SiP), is gaining attention. Thus, the chiplet and SiP space has grown to meet this demand, creating a new packaging paradigm, advanced packaging, and a new supply chain. This new distributed supply chain with multiple chiplet developers and foundries has augmented counterfeit vulnerabilities. Chiplets are currently available on an open market, and their origin and authenticity consequently are difficult to ascertain. With this lack of control over the stages of the supply chain, counterfeit threats manifest at the chiplet, interposer, and SiP levels. In this article, we identify counterfeit threats in the SiP domain, and we propose a mitigating framework utilizing blockchain for the effective traceability of SiPs to establish provenance. Our framework utilizes the Chiplet Hardware Security Module to authenticate a SiP throughout its life. To accomplish this, we leverage SiP information including electronic chip identification of chiplets, combating die and IC recycling sensor information, documentation, test patterns and/or electrical measurements, grade, and part number of the SiP. We detail the structure of the blockchain and establish protocols for both enrolling trusted information into the blockchain network and authenticating the SiP. Our framework mitigates SiP counterfeit threats including recycled, remarked, cloned, overproduced interposer, forged documentation, and substituted chiplet while detecting of out-of-spec and defective SiPs.

Hardware Implementations of Elliptic Curve Cryptography Using Shift-Sub Based Modular Multiplication Algorithms

Elliptic curve cryptography (ECC) over prime fields relies on scalar point multiplication realized by point addition and point doubling. Point addition and point doubling operations consist of many modular multiplications of large operands (256 bits for example), especially in projective and Jacobian coordinates which eliminate the modular inversion required in affine coordinates for every point addition or point doubling operation. Accelerating modular multiplication is therefore important for high-performance ECC. This paper presents the hardware implementations of modular multiplication algorithms, including (1) interleaved modular multiplication (IMM), (2) Montgomery modular multiplication (MMM), (3) shift-sub modular multiplication (SSMM), (4) SSMM with advance preparation (SSMMPRE), and (5) SSMM with CSAs and sign detection (SSMMCSA) algorithms, and evaluates their execution time (the number of clock cycles and clock frequency) and required hardware resources (ALMs and registers). Experimental results show that SSMM is 1.80 times faster than IMM, and SSMMCSA is 3.27 times faster than IMM. We also present the ECC hardware implementations based on the Secp256k1 protocol in affine, projective, and Jacobian coordinates using the IMM, SSMM, SSMMPRE, and SSMMCSA algorithms, and investigate their cost and performance. Our ECC implementations can be applied to the design of hardware security module systems.

The main features of the public key infrastructure

Trust is the basis of any communication, whether it is built in the physical world or in the digital environment. Establishing trust in the physical world does not pose any particular challenges because communication subjects can identify each other through biometric features, identity card or other identification documents. In the digital environment, a number of difficulties arise for the identification and authentication procedure. The communicating parties do not meet face-to-face and can be at a significant distance from each other. As a result, they cannot identify uniquely and verify each other's identity using the identity verification methods used in the material world. To ensure the security of electronic communications, it is necessary for communication systems to be equipped with technical means of information protection and an additional mechanism that will contribute to the establishment of trust between the parties to the communication. The Public Key Infrastructure is used to solve problems related to trust, authentication, identity, and security on a network. A digital certificate is a fundamental element for establishing trust in the digital world. It plays a crucial role in ensuring security and identification on the Internet and when working with electronic resources. The Public Key Infrastructure is a trusted system used to ensure the security and privacy of information across networks and platforms. This system is based on public key cryptography. It implements the management of public keys and digital certificates of various entities, such as companies, corporations, organizations, individuals, websites, servers, etc. The Public Key Infrastructure is widely deployed in government portals and systems. It is used in the electronic government system to guarantee the transparency of the provision of electronic services and to ensure the security of communication links between authorities and society. The Public Key Infrastructure represents a multifaceted structure that includes a set of standards, technologies, and procedures for managing, storing, and distributing keys and digital certificates. A certificate authority is a key component of a public key infrastructure and is an independent third party that manages digital certificates. Various technical and cryptographic means of information security are used in the Public Key Infrastructure, such as digital signatures, encryption, hash functions, hardware security modules, key management software, etc. The main purpose of this article is to analyze the main features and aspects of public key infrastructure.

An Innovative Strategy Based on Secure Element for Cyber–Physical Authentication in Safety-Critical Manufacturing Supply Chain

The accurate tracking of every production step and related outcome in a supply chain is a stringent requirement in safety-critical sectors such as civil aviation. In such a framework, trusted traceability and accountability can be reliably and securely managed by means of blockchain-based solutions. Unfortunately, blockchain cannot guarantee the provenance and accuracy of the stored information. To overcome such a limitation, this paper proposes a secure solution to strongly rely on the tracking information of the physical assets in the supply chain. The proposed solution exploits Hardware Security Modules (HSMs) to provide required cryptographic primitives through a Near-Field Communication (NFC) connection. In our approach, each transfer of the assets is authenticated, verified, and recorded in the blockchain through the HSM. Transaction entries are signed, thus providing a guarantee of ownership and authenticity. The proposed infrastructure has been subject of an exhaustive security analysis and proved resilient against counterfeiting attempts, stakeholder repudiations, and misleading information.

Fortified-Grid: Fortifying Smart Grids through the Integration of the Trusted Platform Module in Internet of Things Devices

This paper presents a hardware-assisted security primitive that integrates the Trusted Platform Module (TPM) into IoT devices for authentication in smart grids. Data and device security plays a pivotal role in smart grids since they are vulnerable to various attacks that could risk grid failure. The proposed Fortified-Grid security primitive provides an innovative solution, leveraging the TPM for attestation coupled with standard X.509 certificates. This methodology serves a dual purpose, ensuring the authenticity of IoT devices and upholding software integrity, an indispensable foundation for any resilient smart grid security system. TPM is a hardware security module that can generate keys and store them with encryption so they cannot be compromised. Formal security verification has been performed using the random or real Oracle (ROR) model and widely accepted AVISPA simulation tool, while informal security verification uses the DY and CK adversary model. Fortified-Grid helps to validate the attested state of IoT devices with a minimal network overhead of 1984 bits.

Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles

The importance of vehicle security has increased in recent years in the automotive field, drawing the attention of both the industry and academia. This is due to the rise in cybersecurity threats caused by (1) the increase in vehicle connectivity schemes, such as the Internet of Things, vehicle-to-x communication, and over-the-air updates, and (2) the increased impact of such threats because of the added functionalities that are controlled by vehicle software. These causes and threats are further amplified in autonomous vehicles, which are generally equipped with more electronic control units (ECUs) that are connected through controller area networks (CANs). Due to the holistic nature of CANs, attacks on the networks can affect the functionality of all vehicle ECUs and the whole system. This can lead to a breach of privacy, denial of services, alteration of vehicle performance, and exposure to safety threats. Although cryptographic encryption and authentication algorithms and intrusion detection systems (IDS) are currently being used to detect and prevent CAN bus attacks, they have certain limitations. Therefore, this study proposed a mitigation scheme that can detect and prevent such attacks at the ECU level, which could address the limitations of existing algorithms. This study proposed the usage of a secure boot scheme to detect and prevent the execution of malicious codes, as the presence of one or more ECUs with a malicious code is the root cause of most CAN bus attacks. Secure boot schemes apply cryptographic data integrity algorithms to ensure that only authentic and untampered software can run on the vehicle’s ECUs. The selection of an appropriate cryptographic algorithm is important because it affects the secure boot schemes’ security level and performance. Therefore, this study also tested and compared the performance of the proposed secure boot scheme with five different data security algorithms implemented using the hardware security module (HSM) of the TC399 32-bit AURIX™ TriCore™ microcontroller through an electric autonomous vehicle’s control unit. The tests showed that the two most favorable schemes with the selected hardware are the secure boot scheme with the cipher-based message authentication code (CMAC), because it possesses the highest performance with an execution rate of 26.07 (ms/MB), and the secure boot scheme with the elliptic curve digital signature algorithm (ECDSA), because it provides a higher security level with an acceptable compromise in speed. This study also introduced and tested a novel variation of the ECDSA algorithm based on the CMAC algorithm, which was found to have a 19% performance gain over the standard ECDSA-based secure boot scheme.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

Secure Sensor Prototype Using Hardware Security Modules and Trusted Execution Environments in a Blockchain Application: Wine Logistic Use Case

The security of Industrial Internet of Things (IIoT) systems is a challenge that needs to be addressed immediately, as the increasing use of new communication paradigms and the abundant use of sensors opens up new opportunities to compromise these types of systems. In this sense, technologies such as Trusted Execution Environments (TEEs) and Hardware Security Modules (HSMs) become crucial for adding new layers of security to IIoT systems, especially to edge nodes that incorporate sensors and perform continuous measurements. These technologies, coupled with new communication paradigms such as Blockchain, offer a high reliability, robustness and good interoperability between them. This paper proposes the design of a secure sensor incorporating the above mentioned technologies—HSMs and a TEE—in a hardware device based on a dual-core architecture. Through this combination of technologies, one of the cores collects the data extracted by the sensors and implements the security mechanisms to guarantee the integrity of these data, while the remaining core is responsible for sending these data through the appropriate communication protocol. This proposed approach fits into the Blockchain networks, which act as an Oracle. Finally, to illustrate the application of this concept, a use case applied to wine logistics is described, where this secure sensor is integrated into a Blockchain that collects data from the storage and transport of barrels, and a performance evaluation of the implemented prototype is provided.

Fine-Grained Access Control with User Revocation in Smart Manufacturing

Collaborative manufacturing is a key enabler of Industry 4.0 that requires secure data sharing among multiple parties. However, intercompany data-sharing raises important privacy and security concerns, particularly given intellectual property and business-sensitive information collected by many devices. In this paper, we propose a solution that combines four technologies to address these challenges: Attribute-Based Encryption for data access control, blockchain for data integrity and non-repudiation, Hardware Security Modules for authenticity, and the Interplanetary File System for data scalability. We also use OpenID for dynamic client identification and propose a new method for user revocation in Attribute-Based Encryption. Our evaluation shows that the solution can scale up to 2,000,000 clients while maintaining all security guarantees.

Design of programmable hardware security modules for enhancing blockchain based security framework

Globalization of the chip design and manufacturing industry has imposed significant threats to the hardware security of integrated circuits (ICs). It has made ICs more susceptible to various hardware attacks. Blockchain provides a trustworthy and distributed platform to store immutable records related to the evidence of intellectual property (IP) creation, authentication of provenance, and confidential data storage. However, blockchain encounters major security challenges due to its decentralized nature of ledgers that contain sensitive data. The research objective is to design a dedicated programmable hardware security modules scheme to safeguard and maintain sensitive information contained in the blockchain networks in the context of the IC supply chain. Thus, the blockchain framework could rely on the proposed hardware security modules and separate the entire cryptographic operations within the system as stand-alone hardware units. This work put forth a novel approach that could be considered and utilized to enhance blockchain security in real-time. The critical cryptographic components in blockchain secure hash algorithm-256 (SHA-256) and the elliptic curve digital signature algorithm are designed as separate entities to enhance the security of the blockchain framework. Physical unclonable functions are adopted to perform authentication of transactions in the blockchain. Relative comparison of designed modules with existing works clearly depicts the upper hand of the former in terms of performance parameters.

Revisiting Multiple Ring Oscillator-Based True Random Generators to Achieve Compact Implementations on FPGAs for Cryptographic Applications

The generation of random numbers is crucial for practical implementations of cryptographic algorithms. In this sense, hardware security modules (HSMs) include true random number generators (TRNGs) implemented in hardware to achieve good random number generation. In the case of cryptographic algorithms implemented on FPGAs, the hardware implementation of RNGs is limited to the programmable cells in the device. Among the different proposals to obtain sources of entropy and process them to implement TRNGs, those based in ring oscillators (ROs), operating in parallel and combined with XOR gates, present good statistical properties at the cost of high area requirements. In this paper, these TRNGs are revisited, showing a method for area optimization independently of the FPGA technology used. Experimental results show that three ring oscillators requiring only three LUTs are enough to build a TRNG on Artix 7 devices from Xilinx with a throughput of 33.3 Kbps, which passes NIST tests. A throughput of 50 Kbps can be achieved with four ring oscillators, also requiring three LUTs in Artix 7 devices, while 100 Kbps can be achieved using an structure with four ring oscillators requiring seven LUTs.

HARDWARE SECURITY OVERVIEW OF FOG COMPUTING END DEVICES IN THE INTERNET OF THINGS

The subject of the study is possible means of increasing the hardware security of end devices of fog computing in Internet of Things (IoT) networks, the spread of which is growing rapidly every year and requires a high level of of protection against all types of attacks. The goal of the work is to review available COTS (commercial off-the-shelf) and/or conceptual hardware solutions for protecting low-end devices in Internet of Things networks based on fog technologies. To achieve the goal, the following tasks were solved: the concept of fog computing and the advantages it will bring to IoT networks are presented; cyber threats and hardware attacks on IoT networks are considered; the consequences of using IoT networks based on fog computing are presented; hardware security tools such as TRM, PUF, HSM, etc. are considered. When performing the tasks, such research methods were used as: theoretical analysis of literary sources; comparative analysis of cloud, fog and mobile computing; analysis of existing security hardware. The following results were obtained: fog computing provides most of the advantages of cloud computing by additionally allowing data to be processed on end devices without burdening the central server. Conclusions: hardware security in IoT systems is no less important than software security. This issue is especially important for systems based on fog computing, where data will be processed on the periphery, without being transferred to the cloud. To increase the level of hardware security of fog computing devices, it is suggested to use standard hardware security platforms, such as: Physically Unclonable Functions, Hardware Security Module, System On a Chip, etc. The hardware components of the system using fog computing are less prone to cyber-attacks/hacking/intrusions/manipulation.