Root Of Trust Research Articles

Second Harmonic Generation Exploiting Ultra-Stable Resistive Switching Devices for Secure Hardware Systems

In the era of Big Data and Internet of Things (IoT), information security has emerged as an essential system and application metric. The information exchange among the ubiquitously connected smart electronic devices requires functioning reliably in harsh environments, which highlights the need for securing the hardware root of trust. In this work, by leveraging the uniform nonlinear resistive switching of emerging electroforming-free analog memristive device based on <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mathbf {BiFeO}_3$</tex-math></inline-formula> (BFO) thin film, the security-oriented hardware primitive (SoHP) system is developed and optimized with high-security level. The SoHP system utilizes the distinguishable power conversion efficiency generated at second and higher harmonics in low resistance state (memristor with diodelike behavior) and high resistance state (memristor with high resistive behavior) of memristive devices. By exploring the significant influence of writing bias and operational frequency in sourcing input voltage on the dynamic switching behavior of memristive device, the novel 2-memristor encoding scheme and 1-memristor decoding scheme are developed for SoHP system, which realizes a frequency enhancement of 4000 times in comparison to 1-memristor encoding scheme and 2-memristor decoding scheme. The encoded data bits that generated from physically implemented SoHP system pass diverse statistical test suites (i.e. ENT, BSI, and NIST SP-800.22 statistical test suites), which indicates the high randomness distribution of the encoded data and the high-security level of the proposed memristive encoding system.

Secure boot, trusted boot and remote attestation for ARM TrustZone-based IoT Nodes

With the extensive application of IoT techniques, IoT devices have become ubiquitous in daily lives. Meanwhile, attacks against IoT devices have emerged to compromise IoT devices by tampering with system pre-installed programs or injecting new malware. To mitigate these attacks, integrity enforcement of IoT systems has been proposed. The integrity of an IoT device system includes load-time integrity and runtime integrity. In this paper, we design an IoT system based on ARM TrustZone to enforce the system integrity. First, we establish the root of trust and propose a hybrid booting approach consisting of both secure boot and trusted boot to enforce the system load-time integrity. Second, we investigate a paging-based process integrity measurement method to measure the NW processes and conduct remote attestation based on the measurement results ensuring the NW runtime process integrity. We implement an IoT prototype system on a NXP i.MX6Q SABRE SD development board to assess its feasibility. Real-world experiment results demonstrate that our prototype introduces negligible performance overhead to the original system.

PCs Take a Page From Xbox With Pluton

Microsoft’s Pluton is dedicated silicon that aims to strengthen the security and integrity of PCs; it is derived from the Xbox One video game console SoC which was designed in partnership between Microsoft and AMD. Pluton implements and extends the functionality of the Trusted Computing Group’s (TCG) Trusted Platform Module 2.0, protects keys as they move around the SoC using dedicated silicon referred to as Secure Hardware Cryptography Key, and implements the TCG’s Device Identifier Composition Engine and Microsoft’s Robust Internet of Things specifications to perform strong device attestation with a hardware root of trust. While Microsoft is following Apple and Google’s lead by integrating special-purpose silicon for secure cryptographic operations, it is taking a different approach by leveraging existing open standards and technologies. Microsoft’s Windows 11 is designed for a world where all PCs feature Pluton.

Hyperledger Fabric Access Control System for Internet of Things Layer in Blockchain-Based Applications.

Blockchain-based applications are gaining traction in various application fields, including supply chain management, health care, and finance. The Internet of Things (IoT) is a critical component of these applications since it allows for data collection from the environment. In this work, we integrate the Hyperledger Fabric blockchain and IoT devices to demonstrate the access control and establish the root of trust for IoT devices. The Hyperledger Fabric is designed to be secure against unwanted access and use through encryption protocols, access restrictions, and cryptography algorithms. An attribute-based access control (ABAC) mechanism was created using Hyperledger Fabric components only to gain access to the IoT device. Single board computers based on the ARM architecture are becoming increasingly powerful and popular in automation applications. In this study, the Raspberry Pi 4 Model B based on ARM64 architecture is used as the IoT device. Because the ARM64 architecture is not supported by default, we build executable binaries and Docker images for the ARM64 architecture, using the Hyperledger Fabric source code. On an IoT device, we run the fabric node in native mode to evaluate the executable binaries generated for the ARM64 architecture. Through effective chaincode execution and testing, we successfully assess the Hyperledger fabric blockchain implementation and access control mechanism on the ARM64 architecture.

Halide perovskite memristors as flexible and reconfigurable physical unclonable functions

Physical Unclonable Functions (PUFs) address the inherent limitations of conventional hardware security solutions in edge-computing devices. Despite impressive demonstrations with silicon circuits and crossbars of oxide memristors, realizing efficient roots of trust for resource-constrained hardware remains a significant challenge. Hybrid organic electronic materials with a rich reservoir of exotic switching physics offer an attractive, inexpensive alternative to design efficient cryptographic hardware, but have not been investigated till date. Here, we report a breakthrough security primitive exploiting the switching physics of one dimensional halide perovskite memristors as excellent sources of entropy for secure key generation and device authentication. Measurements of a prototypical 1 kb propyl pyridinium lead iodide (PrPyr[PbI3]) weak memristor PUF with a differential write-back strategy reveals near ideal uniformity, uniqueness and reliability without additional area and power overheads. Cycle-to-cycle write variability enables reconfigurability, while in-memory computing empowers a strong recurrent PUF construction to thwart machine learning attacks.

On their own turf? The level-specificity of political trust in multilevel political systems

Although the debate on roots of political trust is ongoing, many scholars agree on the relevance of such political factors as political/ideological distance between citizens and incumbents, political responsiveness and perceptions of performance. Less clear is to what extent such trust evaluations are generalized or specific for the three main political arenas in the European multilevel governance system (EU, national, local). With new data from the Netherlands, we demonstrate that trust in local, national and EU governments (1) is largely level-specific (i.e. is based on citizens’ perceptions of incumbents at a particular governance level) (2) and—at all three levels—is explained by level-specific political factors. This shows that political trust is a subjectively rational evaluation and that citizens develop meaningful political orientations vis-à-vis governments at different levels. Therefore, trust spillovers may be less relevant for explaining political trust in multilevel governance than assumed in previous research as executive governments at local, national and EU levels are judged “on their own turf”.

State-of-the-Art Software-Based Remote Attestation: Opportunities and Open Issues for Internet of Things

The Internet of Things (IoT) ecosystem comprises billions of heterogeneous Internet-connected devices which are revolutionizing many domains, such as healthcare, transportation, smart cities, to mention only a few. Along with the unprecedented new opportunities, the IoT revolution is creating an enormous attack surface for potential sophisticated cyber attacks. In this context, Remote Attestation (RA) has gained wide interest as an important security technique to remotely detect adversarial presence and assure the legitimate state of an IoT device. While many RA approaches proposed in the literature make different assumptions regarding the architecture of IoT devices and adversary capabilities, most typical RA schemes rely on minimal Root of Trust by leveraging hardware that guarantees code and memory isolation. However, the presence of a specialized hardware is not always a realistic assumption, for instance, in the context of legacy IoT devices and resource-constrained IoT devices. In this paper, we survey and analyze existing software-based RA schemes (i.e., RA schemes not relying on specialized hardware components) through the lens of IoT. In particular, we provide a comprehensive overview of their design characteristics and security capabilities, analyzing their advantages and disadvantages. Finally, we discuss the opportunities that these RA schemes bring in attesting legacy and resource-constrained IoT devices, along with open research issues.

How culture may nurture institutional trust: Insights from Bangladesh and Nepal

AbstractMotivationMost studies of the normative roots of political trust argue that they stem from policy performance rather than from cultural orientation. That sits at odds with the observation that institutional trust—that is, citizens’ confidence in public agencies—is high in Bangladesh and Nepal despite poor policy performance.PurposeThe article assesses the influence of policy performance and cultural orientation of citizens in Bangladesh and Nepal on institutional trust.Approach and MethodsThe article draws on country representative surveys (Governance and Trust Survey 2) in Bangladesh and Nepal carried out in 2014–15. It identifies cultural preferences and specifically authoritarian cultural orientation (ACO)—characterized by deference to authority, unquestioning obedience, and reliance on authorities—and compares this to institutional trust.FindingsHigh authoritarian cultural orientation (ACO) can lead citizens to trust public institutions. People’s submissiveness to the country’s authorities can obstruct critical thinking and even create positive impressions of the authorities, which in turn generates institutional trust. Institutions that are more visible and exert more authority may attract greater trust among citizens who exhibit ACO.Policy ImplicationsWhen assessing citizens’ perceptions of policy performance, their cultural orientations must be considered. Trust in public agencies cannot be treated as proxy for their policy performance.

Building Trust for Smart Connected Devices: The Challenges and Pitfalls of TrustZone.

TrustZone-based Trusted Execution Environments (TEEs) have been utilized extensively for the implementation of security-oriented solutions for several smart intra and inter-connected devices. Although TEEs have been promoted as the starting point for establishing a device root of trust, a number of published attacks against the most broadly utilized TEE implementations request a second view on their security. The aim of this research is to provide an analytical and educational exploration of TrustZone-based TEE vulnerabilities with the goal of pinpointing design and implementation flaws. To this end, we provide a taxonomy of TrustZone attacks, analyze them, and more importantly derive a set of critical observations regarding their nature. We perform a critical appraisal of the vulnerabilities to shed light on their underlying causes and we deduce that their manifestation is the joint effect of several parameters that lead to this situation. The most important ones are the closed implementations, the lack of security mechanisms, the shared resource architecture, and the absence of tools to audit trusted applications. Finally, given the severity of the identified issues, we propose possible improvements that could be adopted by TEE implementers to remedy and improve the security posture of TrustZone and future research directions.

A Taxonomy and Review of Remote Attestation Schemes in Embedded Systems

Embedded systems that make up the Internet of Things (IoT), Supervisory Control and Data Acquisition (SCADA) networks, and Smart Grid applications are coming under increasing scrutiny in the security field. Remote Attestation (RA) is a security mechanism that allows a trusted device, the verifier, to determine the trustworthiness of an untrusted device, the prover. RA has become an area of high interest in academia and industry and many research works on RA have been published in recent years. This paper reviewed the published RA research works from 2003-2020. Our contributions are fourfold. First, we have re-framed the problem of RA into 5 smaller problems: root of trust, evidence type, evidence gathering, packaging and verification, and scalability. We have provided a holistic review of RA by discussing the relationships between these problems and the various solutions that exist in modern RA research. Second, we have presented an enhanced threat model that allows for a greater understanding of the security benefits of a given RA scheme. Third, we have proposed a taxonomy to classify and analyze RA research works and use it to categorize 58 RA schemes reported in literature. Fourth, we have provided cost benefit analysis details of each RA scheme surveyed such that security professionals may perform a cost benefit analysis in the context of their own challenges. Our classification and analysis has revealed areas of future research that have not been addressed by researchers rigorously.

Metis: An Integrated Morphing Engine CPU to Protect Against Side Channel Attacks

Power consumption and electromagnetic emissions analyses are well established attack avenues for secret values extraction in a large range of embedded devices. Countermeasures against these attacks are approached at different levels, from modified logic styles, to changes in the software implementations. In this work, we propose a microarchitectural modification to a compact RISC-V SoC, the OpenTitan open source silicon root of trust, providing a code morphing countermeasure against power and electromagnetic emissions side channel attacks. Our approach allows the countermeasure to be applied transparently, without the need for any software modification to the cryptographic primitive running on OpenTitan. Our microarchitecture integration of a morphing engine also allows us to provide transparent protection to memory operations. We validate our approach through measurements on an actual FPGA prototype on a Xilinx Artix-7. Our integrated morphing engine increases the FPGA resource consumption by less than 8%, plus the resources required by an RNG of choice, with respect to the original OpenTitan SoC. Our design shows a side channel attack resistance improvement of at least $250\times $ in the Measurements-To-Disclose metric with respect to the unprotected design. We benchmark the performance of our proposed architecture on all the ISO/IEC standard symmetric block ciphers, including, among the other AES, reducing the execution time overhead by $21\times $ to $141\times $ with respect to a continuously morphing software solution.

Heterogeneous identity trust management method based on risk assessment

The cross-trust domain environment in which heterogeneous identity alliances are located often does not have a completely trusted centralized trust root, and different trust domains and entities also have specific security requirements. In view of the above problems, we believe that trust measurement of cross-domain identities based on risk assessment is an effective method to achieve decentralized proof of user identities in heterogeneous cyberspace. There are various risk assessment models. We choose the more mature attack graph theory in the existing research to apply to the new field of cross-trust domain management of heterogeneous identities. We propose an attribute attack graph evaluation model to evaluate cross-domain identities through risk measurement of attributes. In addition, heterogeneous identity alliances also have architectural risks, especially the risk of decentralized underlying structures. In response to this problem, we identify the risk of the identity alliance infrastructure, and combine the risk assessment and presentation system design to verify the principle.

Blockchain-based authentication and authorization for smart city applications

The platforms supporting the smart city applications are rarely implemented from scratch by a municipality and/or totally owned by a single company, but are more typically realized by integrating some existing ICT infrastructures thanks to a supporting platform, such as the well known FIWARE platform. Such a multi-tenant deployment model is required to lower the initial investment costs to implement large scale solutions for smart cities, but also imposes some key security obstacles. In fact, smart cities support critical applications demanding to protect the data and functionalities from malicious and unauthorized uses. Equipping the supporting platforms with proper means for access control is demanding, but these means are typically implemented according to a centralized approach, where a single server stores and makes available a set of identity attributes and authorization policies. Having a single root of trust is not suitable in a distributed and cooperating scenario of large scale smart cities due to their multi-tenant deployment. In fact, each of the integrated system has its own set of security policies, and the other systems need to be aware of these policy, in order to allow a seamless use of the same credentials across the overall infrastructure (realizing what is known as the single-sign-on). This imposes the problem of consistent and secure data replicas within a distributed system, which can be properly approached by using the blockchain technology. Therefore, this work proposes a novel solution for distributed management of identity and authorization policies by leveraging on the blockchain technology to hold a global view of the security policies within the system, and integrating it in the FIWARE platform. A detailed assessment is provided to evaluate the goodness of the proposed approach and to compare it with the existing solutions.

THE INFLUENCE OF CARICATURE ARTS ON THE ELECTION OF THE PRESIDENT OF FRANCE 2017

The tradition of political caricature in the culture of France, its influence on the specifics of worldview and analysis of phenomena by society is analyzed. Mass, clarity, accessibility of content as characteristic features of the phenomenon of caricature in French art is considered. The uniqueness of the phenomenon and its dynamics in terms of time is emphasized. The author studies the art of satire and caricature as an active tool in the political struggle, its impact on the outcome of the 2017 election campaign in France. After researching this topic, the author comes to some conclusions. The phenomenon of political caricature actually finds a response in modern French society and is an extremely important, accessible and mass source of information. The real phenomenal nature of this phenomenon evidenced by the situation with the 2017 election process. The roots of trust and understanding of society go back to the Middle Ages, in the XII century, namely during the period of active development of the art of book miniature. During the reign of Napoleon Bonaparte, the French Revolution, acute sociopolitical affairs in the life of the country, the First and Second World Wars and the post-war period, political caricature received significant incentives for development and spread.The key quality of political caricature is the transfer of the real and the fantasy, through metaphor - a metaphorical process, which is realized in visual manifestation, through grotesque and satirical stylistic means. The polychrome nature of the caricature with the development of publishing houses and mass circulation ceases to be a significant factor in its implementation, but during the development of political caricature within the poster graphics, the color returns to its influence. Caricature in the history of France is a reflection of exciting processes in the country, society and his life. France is one of the few countries where the satirical and caricature tradition still has fans and is a relevant cultural phenomenon that needs to be studied.

2.5D Root of Trust: Secure System-Level Integration of Untrusted Chiplets

Dedicated, after acceptance and publication, in memory of the late Vassos Soteriou. For the first time, we leverage the 2.5D interposer technology to establish system-level security in the face of hardware- and software-centric adversaries. More specifically, we integrate chiplets (i.e., third-party hard intellectual property of complex functionality, like microprocessors) using a security-enforcing interposer. Such hardware organization provides a robust 2.5D root of trust for trustworthy, yet powerful and flexible, computation systems. The security paradigms for our scheme, employed firmly by design and construction, are: 1) stringent physical separation of trusted from untrusted components, and 2) runtime monitoring. The system-level activities of all untrusted commodity chiplets are checked continuously against security policies via physically separated security features. Aside from the security promises, the good economics of outsourced supply chains are still maintained; the system vendor is free to procure chiplets from the open market, while only producing the interposer and assembling the 2.5D system oneself. We showcase our scheme using the Cortex-M0 core and the AHB-Lite bus by ARM, building a secure 64-core system with shared memories. We evaluate our scheme through hardware simulation, considering different threat scenarios. Finally, we devise a physical-design flow for 2.5D systems, based on commercial-grade design tools, to demonstrate and evaluate our 2.5D root of trust.

Secure Boot for Reconfigurable Architectures

Reconfigurable computing is becoming ubiquitous in the form of consumer-based Internet of Things (IoT) devices. Reconfigurable computing architectures have found their place in safety-critical infrastructures such as the automotive industry. As the target architecture evolves, it also needs to be updated remotely on the target platform. This process is susceptible to remote hijacking, where the attacker can maliciously update the reconfigurable hardware target with tainted hardware configuration. This paper proposes an architecture of establishing Root of Trust at the hardware level using cryptographic co-processors and Trusted Platform Modules (TPMs) and enable over the air updates. The proposed framework implements a secure boot protocol on Xilinx based FPGAs. The project demonstrates the configuration of the bitstream, boot process integration with TPM and secure over-the-air updates for the hardware reconfiguration.

Hardware Root-of-Trust-based integrity for shared library function pointers in embedded systems

Many security measures designed for large-scale compute hardware (e.g., workstations and servers) are not optimized for embedded systems. One such measure, Relocation Read-Only (RelRO), protects binary relocation sections from tampering after dynamic linking; however, RelRO depends on the presence of memory management hardware that not all embedded systems include. More generally, the latest hardware modifications to processor architectures may not always be available to provide security in small-scale embedded systems. In this paper, we propose another solution for relocation protection for use in embedded systems that have a field-programmable gate array (FPGA) on chip. Our solution prevents relocation section overwrites from diverting control flow as they would in an unprotected binary by implementing a hardware Root of Trust into which to store and out of which to retrieve shared library function pointers. We offer two system variations which provide designers with flexibility to choose a lighter or a more robust protection. We also demonstrate a proof of concept implemented on a popular FPGA development board and provide comparison with RelRO. Our work provides embedded system developers with a security measure like RelRO without requiring a customized memory management unit. Our work is useful on computer systems that include embedded reconfigurable logic on chip. The authors believe this is the first paper in which reconfigurable logic is used to provide security functionality previously implemented in a custom instruction set or other computer architecture modifications. Our work points toward a future where FPGA logic embedded on chip can be adapted to improve the security of software.

Detecting a security breach and pinpointing its source

Abstract There are many rapidly emerging technologies to embed a “Root of Trust” (RoT) in silicon or in assembled packages and PCBs further down the supply chain. These all aim to provide an un-hackable proof of device identity and uncompromised firmware. Despite these efforts we can, and should, assume that bad actors will succeed to counterfeit devices, install malware, etc. So how do we detect and respond to these attacks in time before they cause too much harm? This is, of course, of particular concern for defense and aerospace applications. We will discuss an initiative at SEMI to provide asset traceability through the supply chain. The intention is to detect counterfeits and security attacks quickly, track them back through the supply chain and identify the culprit. The threat of capture and penalties is expected to reduce the incentive for the bad actors in future. The proposed SEMI standard will define the transactions and data required to record chain of custody for electronic assets as they flow through the supply chain. These transactions will be recorded on Hyperledger Fabric, a blockchain platform which offers an immutable transaction ledger, maintained within a distributed network of peer nodes. The ledger will not be public (like bitcoin), nor will it be private to one organization. Instead it will follow a consortium model and be permissioned to support flexible trust assumptions. The SEMI standard will facilitate supply chain members to form one or more consortiums and host the Hyperledger nodes. This will enable the early detection and response to counterfeit and security threats to electronic assets that the supply chain members manufacture or distribute. The standard takes care not to expose any confidential technical or commercial information. However, Hyperledger offers the concepts of private data collections and channels to allow for the sharing of private data between specific members. This could become an enabler to realize the data sharing required to meet Smart Manufacturing 4.0 objectives. There are a number of similar chain of custody ledger initiatives underway both in the commercial and standards arena. The hope is that the SEMI standard will encourage these systems to merge into an industry wide consortium with increased interoperability, performance, reliability and security.

Z15 selfboot and secure boot

The IBM Z central processor (CP) and storage controller (SC) chips contain hardware and firmware to serve selfboot and secure boot needs. Selfboot initializes the CP/SC chips from hardware and firmware, which reside in each chip module. This establishes a core root of trust and also guarantees a boot time that is independent of the system configuration, which is key for large enterprise class systems consisting of multiple drawers and chips. Secure boot is built on this core root of trust and is used to authenticate the firmware loaded from system memory prior to execution of that firmware. Selfboot and secure boot also guarantee the integrity of the CP and SC chips by restricting hardware and memory accesses through debug or service interfaces during boot, runtime, and code update phases. In this article, we describe the basic hardware and firmware concepts that are implemented and enabled for the z15 CP and SC chips.

The economics of hardware trojans: An expert’s opinion

ABSTRACT The US-China face-off over allegations of Huawei’s equipment being compromised has brought the subtle art of hardware trojan warfare right into the open spotlight. This paper focuses on cyberattacks at the root of trust – IT hardware trojans (HT), primarily the most malicious of these trojans, the one which is surreptitiously implanted inside a semiconductor System on Chip (SoC) or Integrated Circuit (IC) for sabotage. Though a thoroughbred trojan of this kind is yet to be found in the wild, hardware trojans continue to shape public policies and fund technical research on their possibilities, detection and avoidance. This paper explores a highly under-researched area, the economics of real hardware trojans, including examples from the Syrian radar breach to iPhone trojans sold on Amazon.com.