Three Challenges of Secure
Embedded System Design:
Performance, Battery life and
Robustness
Nachiketh Potlapally
Department of Electrical Engineering
Princeton University
Princeton, NJ
Email: npotlapa@princeton.edu
Embedded System Applications
Require Security
E

wallet
Portfolio
management using
Microsoft money
Server
RFID tag
1.28

1.92 MHz,
128

512 bit ROM,
32

128 bit RAM,
10000 gate logic,
Battery (active)
Smart card
66 MHz, 240 KB ROM,
16 KB RAM,
912 KB EEPROM
Crypto co

processor,
Battery (active)
Cell

phone/PDA
200 MHz,16MB RAM,
64MB Flash,
Crypto co

processor,
Battery
Network
Sensitive embedded system applications need security protocols
to provide
confidentiality
,
integrity
and
authentication
E

passport
Cryptographic algorithms
Confidentiality, Integrity and
Authentication
Confidentiality
Integrity
Authentication

Table lookup

Permutations

Multiplication

Modular addition

Modular multiplication

Fixed shift/rotate

Variable shift/rotate

Multiplication

Addition

Logical operations

Fixed shift/rotate

Modular exponentiation

Point multiplication on
Elliptic curves
Symmetric algorithms
(DES, AES, 3DES, RC5)
Asymmetric algorithms
(RSA, ECC, DH, ECDH)
Hash algorithms
(MD4, HMAC, SHA

1)
Security protocols
Security objectives
Crypto algorithms are
computationally
intensive
Challenges in Implementing Security on
Embedded Systems
Embedded systems

Low

end processors

Battery energy supply
Security protocols
Reduced
performance
Shorter battery
life
3DES and SHA require
130 MIPS @ 2 Mbps
(Intel SA

1100 delivers
150 MIPS at 133 MHz )
Sensoria WINS node
needs 21.5 mJ/bit to
transmit. RSA imposes
overhead of 42 mJ/bit
Susceptibility to
side

channel attacks
Infer cryptographic keys
from non

invasive probing
of implementation
characteristics
Objectives in design of secure embedded systems:
Good performance
,
long battery life
and
robustness to attacks
My Research Experience
1.
“Algorithm Exploration for Efficient Public

Key Security Processing for Wireless Handsets”, DATE02
2.
“Optimizing Public

key Encryption”, ICC02
3.
“System

level Design methodologies for a Wireless Security Processing Platform”, DAC02
4.
“Analyzing the Energy Consumption of Security Protocols”, ISLPED03
5.
“Impact of Configurability and Extensibility on IPSec Protocol Execution on Embedded Processors”, VLSID06
6.
“Satisfiability

based Framework for Enabling Side

channel Attacks on Cryptographic Software”, DATE06
7.
“A Study of the Energy Consumption Characteristics of Cryptographic Algorithms and Security Protocols”,
IEEE Transactions on Mobile Computing, February 2006
8.
“Aiding Side

channel Attacks on Cryptographic Software with Satisfiability

based Analysis”,
IEEE Transactions on VLSI Systems, April 2006
9.
“Configuration and Extension of Embedded Processors to Optimize IPSec Protocol Execution”,
IEEE Transactions on VLSI Systems. (To appear)
10. “Verifying Data Integrity with Few Queries to Untrusted Memory”, (In Submission)
1.
Optimizing public

key algo. software performance
[
1,2
]
2.
Custom instruction design for public

key algo.
[
3
]
3.
Accelerating symmetric and hash algo. through custom
instructions
[
5,9
]
4.
Optimizing IPSec protocol performance
[
5,9
]
5.
Reducing performance overhead of memory checking
[
10
]
1.
Analyzing energy consumption of cryptographic
algorithms
[
4,7
]
2.
Optimize energy consumption of SSL protocol
[
4,7
]
3.
Reduce energy consumed by memory bus in memory
integrity checking
[
10
]
1. Satisfiability

based framework for enabling side

channel
attacks on embedded cryptographic software
[
6,8
]
Publications:
Design of
secure
embedded
systems
Outline
•
Part 1: Robustness of secure
embedded systems
–
Satisfiability

based side

channel attacks on
cryptographic software
•
Part 2: Battery life of secure embedded
systems
–
Analyze energy consumption of cryptographic
algorithms and security protocols
•
Future work
Part 1: Robustness
Satisfiability

based Side

channel
Attacks on Cryptographic Software
Logical Inferences on Leaked Intermediate
Values Can Expose Secret Key
Memory bus
On

chip
secure
memory
Cryptographic
algorithm software
Plaintext
Ciphertext
Secret
key
Intermediate
variables
Logical
inferences
Protect these
Variables too!
Robustness: Talk Outline
•
Information leakage in software
implementations
–
Active and passive leakage
•
Logical cryptanalysis framework
–
Satisfiability (SAT) solver
–
Proposed cryptanalysis flow
•
Experimental setup
•
Results: DES, 3DES, and AES
–
Sensitive intermediate variables
Cryptanalysis: Theoretical View
Black
Box
Cryptographic algorithm
implementation
Plaintext
Ciphertext
Secret key
Secure
storage
Cryptographic algorithms are provably secure
against mathematical cryptanalysis under the
black

box
assumption
Applications
Cryptanalysis: Software Leakage
Operating system
System library
Hardware
System calls
System
calls
Library calls
Machine instructions
Persistence of
swapped data
(Garfinkel & Shelat, S&P 03)
Memory bus
monitoring
(Anderson & Kuhn,
USENIX 96)
Sensitive residual
data in buffers
(Chow et al.,
USENIX 04)
Proactive cache
probing
(C. Percival,
Tech. Rep.)
Sensitive data
in core dumps
(Broadwell et al.,
USENIX 03)
Hacking run

time
stack
(V. Paretsky,
Dr. Dobbs 05)
Software
Plaintext
Ciphertext
On

chip
secure memory
Cryptanalysis Using Leaked Intermediate
Values
1
2
3
4
5
Data

flow graph of a crypto function
Exposed intermediate computation
Hidden computation
Implied computation
Implication path
Exposure of intermediate values may aid
computation of protected secret key bits
via logical implications
V1
V2
V3
V5
V4
V6
V7
V8
Secret key
Plaintext
Ciphertext
V9
V10
V11
6
Key is protected
from exposure
7
Logical Cryptanalysis Framework
Plaintext P
Ciphertext C
Constraints
Known plaintext +
Known ciphertext +
Exposed variables
Circuit
description
Logical
Analysis/Implication
Engine
Theorem prover,
Satisfiability
solver, ….
Secret key K
Secret Key
Satisfiability (SAT) Solvers
•
SAT solver finds satisfying Boolean assignment
to variables in a conjunctive normal form (CNF)
formula
–
Gives a proof if no such assignment exists
•
SAT solver has a powerful logical implication
engine in the form of Boolean constraint
propagation (BCP)
•
Circuits can be converted to CNF in linear time
x
y
z
(z+x) (z+y) (z+x+y)
x
y
z
(z+x) (z+y) (z+x+y)
x
y
z
(z+x+y) (z+x+y) (z+x+y) (z+x+y)
AND
OR
XOR
CNF
CNF
CNF
SAT

based Cryptanalysis Framework
(z+x+y) (z+x+y)
(z+x+y) (z+x+y)
(z+x) (z+y) (z+x+y)
….
(z+x) (z+y) (z+x+y)
Ψ
(P, C, K)
CNF formula of
cryptographic
algorithm,
Plaintext P
Secret key K
Ciphertext C
CNF
conversion
Set plaintext
and ciphertext
values in
Ψ
(P, C, K)
SAT
solver
K’ = 110..1
(consistent
with the
values set)
Timeout
Set values
of exposed
variables in
Ψ
(P, C, K)
Constraints
CNF conversion : DES
L
i
L
i+1
R
i
R
i+1
K
i
P
E
S1
S2
S7
S8
…
Converting z=F(x,y) to CNF
z = F(x,y)
(z F(x,y)) (F(x,y) z)
(z + F(x,y)) (F(x,y) + z)
≡
≡
Algorithm
Clauses
Literals
DES
3DES
20328
104928
6904
35232
..
..
Round 1
Round 2
Round i
Round 16
Plaintext
Ciphertext
K
1
K
2
K
i
K
16
K
Secret
key
Key
setup
...
...
32
32
48
Experimental Setup
CNF
generator
Cryptographic
algorithm software
Plaintext,
Ciphertext
Exposed
variable
values
Xtensa ISS
RTL
generator
xt

gcc
compiler
Memory traffic
analyzer
MiniSAT
solver
Secret key &
Sensitive variables
Results: DES & 3DES
L
i
R
i
R
i +1
L
i +1
F
K
i
L
i
R
i
R
i +1
L
i +1
L
i +2
R
i +2
F
F
K
i
K
i +1
L
i
R
i
R
i +1
L
i +1
L
i +2
L
i +3
L
i +4
R
i +2
R
i +3
R
i +4
F
F
F
F
K
i
K
i +1
K
i +2
K
i +3
Sensitive
variable set
1
Sensitive
variable set
2
Sensitive
variable set
3
Results: DES and 3DES
0
200
400
600
800
1000
1200
1400
1
2
4
8
16
32
0
5
10
15
20
25
30
2
4
8
16
32
Plaintext

ciphertext pairs
Plaintext

ciphertext pairs
Time taken by SAT solver
(seconds)
Time taken by SAT solver
(seconds)
Sensitive variable set 1
Sensitive variable set 3
DES
3DES
1.
Sensitive variable sets 1 and 2:
1165 seconds
(on average) with four
plaintext

ciphertext pairs and corresponding intermediate variable values
2.
Sensitive variable set 3:
750 seconds
(on average) with four plaintext

ciphertext
pairs and corresponding intermediate variable values
Results: AES
Algorithm
Literals
Clauses
AES
10240
542432
Rounds
10
5 seconds
(on average) to get the 128

bit AES key with
one plaintext

ciphertext pair and 128

bit input and
output of any one round
CNF conversion
Results of side

channel cryptanalysis
Conclusions
•
Presented a SAT

based framework for
cryptanalysis
•
Identified the set of sensitive intermediate
variables in DES, 3DES and AES
•
Future work:
–
Improve analysis techniques to reduce the
size of sensitive variable set
–
Combine with traditional side

channel attacks
Part 2: Battery Life
Analyzing the Energy Consumption
of Cryptographic Algorithms and
Security Protocols
Impact of Security Processing on
Battery Life: Battery Gap
•
Security processing is computationally intensive
•
Drains battery faster
0
100
200
Normal
Encrypted
No. of Transactions
Battery runs
out of power
Battery runs
out of power
Mobile Node
•
Motorola DragonBall MC68328
•
Sensoria WINS NG RF Subsystem
( 10 Kbps, 10mW power )
•
Sensoria WINS NG Battery Pack
( 7.2 V supplying 26 kJ)
Source: Network Associates Inc.
There is a need for energy

efficient
security protocols
Battery life: Outline
•
Experimental setup
•
Analysis of energy consumption of
cryptographic algorithms
–
Symmetric algorithms
–
Public

key algorithms
•
Analysis of energy consumption of SSL
security protocol
•
Discussion: Optimizing SSL
•
Conclusions
Data
acquisition card
Client
Power
measurement
system
LabVIEW programming
environment
Serial
Sense
resistor
Lab
power
supply
TCP
IP
SSL
HTTPS
Linux
IPSec
Wireless
LAN/WAN
Server
iPAQ H3670
SA

1100 StrongARM
@206MHz
64MB RAM, 16MB ROM
SCB

68
I/O connector
Experimental Set

up
Battery life: Outline
•
Experimental setup
•
Analysis of energy consumption of
cryptographic algorithms
–
Symmetric algorithms
–
Public

key algorithms
•
Analysis of energy consumption of SSL security
protocol
•
Discussion: Optimizing SSL
•
Conclusions
Symmetric Algorithms
…
Round 1
Round 2
Round N
Plaintext P
Ciphertext C
Key
setup
Secret key
K
K
1
K
2
K
N
Implements
confusion
and
diffusion
operations
...
Round i
K
i
....
…..
Energy Consumption Results:
Impact of Symmetric Algorithm Parameters
Symmetric algorithm parameters influence system energy consumption

Number of rounds of execution
RC5
•
Cipher parameters
affect energy and
security
•
Energy

security
trade

offs possible
in symmetric algos.
2
47
2
95
2
119
>
>
Cryptanalytic difficulty
0.1
1
10
100
1000
10000
Key Setup
Enc/Dec
Key Setup
27.53
87.04
7.96
37.63
7.87
32.94
95.97
66.54
3166.3
Enc/Dec
2.08
6.04
1.47
1.47
1.21
1.73
3.93
0.79
0.81
DES
3DES
IDEA
CAST
AES
RC2
RC4
RC5
BLOW
FISH
Energy consumption
(logarithmic scale)
(µJ)
(µJ/byte)
Energy Consumption Results:
Symmetric Algorithms
Symmetric algorithms have widely varying energy consumption values

BLOWFISH has the greatest key setup cost, but very low enc/dec cost

3DES has the highest enc/dec cost
Symmetric Algorithm Block Cipher Modes
Symmetric
algorithm
Plaintext
Ciphertext
Symmetric
algorithm
Plaintext_0
Ciphertext_0
Initialization
vector
Symmetric
algorithm
Ciphertext_1
Plaintext_1
….
ECB modes
CBC mode
Symmetric
algorithm
Plaintext_0
Ciphertext_0
Symmetric
algorithm
Ciphertext_1
Plaintext_1
….
Key
Key
Key
Initialization
vector
Key
Key
OFB
/
CFB
mode
128
192
256
Energy consumption (uJ)
(uJ)
(uJ/Byte)
2
4
6
8
10
12
Key setup
ECB
CBC
CFB
OFB
Key size
AES
Energy Consumption Results:
Impact of Symmetric Algorithm Modes
Symmetric algorithm parameters influence system energy consumption

Key size

Cipher mode (ECB, CBC, CFB, OFB)
Energy Consumption Results:
Impact of Table Lookups & Loop Unrolling
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
Zero
One
Four
Full unroll
No unroll
Partial unroll
Energy consumption (J)
Number of tables per round
Degree of unrolling
•
Many tables and full loop unrolling increase the
number of memory accesses
•
Optimal energy with one table and partial unrolling
Maximum
energy
Minimum
energy
60KB file,
128

bit key AES
Energy Consumption Results:
Processor vs. Memory Energy in AES
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
Zero
One
Four
Memory
Processor
Energy consumption (J)
Number of tables per round
•
Table lookups replace arithmetic instructions with loads and stores
•
Energy consumption rises when tables affect caching behavior
Partial loop unrolling
60KB file,
128

bit key AES
•
Constructed using trap

door one way functions
–
Computationally infeasible to invert without ‘trap

door’
information
•
Security is based on hard mathematical
problems
–
Integer factorization (RSA)
–
Discrete logarithm in Integer field (DH, DSA)
–
Discrete logarithm in Elliptic fields (ECDH)
•
Two applications of public

key algorithms
–
Authentication using digital signatures
–
Key exchange for symmetric algorithms
Public

key Algorithms
0
100
200
300
400
500
600
RSA
DSA
ECDSA
Key Gen
Sign
Verify
Energy consumption (mJ)
(1024

bit)
(1024

bit)
(160

bit)
Energy Consumption Results:
Public

key Algorithms (Digital Signature)
•
RSA and ECDSA exhibit complementary energy
consumption for sign and verify operations
Energy Consumption Results:
Public

key Algorithms (Key Exchange)
0
200
400
600
800
1000
1200
DH
DH
ECDH
Key Gen
Key Exch
(1024

bit)
Energy consumption (mJ)
(160

bit)
(512

bit)
•
Increasing key size drastically affects the
energy consumption
•
ECDH is more energy efficient than DH
Battery life: Outline
•
Experimental setup
•
Analysis of energy consumption of cryptographic
algorithms
–
Symmetric algorithms
–
Public

key algorithms
•
Analysis of energy consumption of SSL
security protocol
•
Discussion: Optimizing SSL
•
Conclusions
Secure Sockets Layer (SSL)
IP
TCP
SSL Record Protocol
SSL
Hand

shake
SSL
Change
Cipher
SSL
Alert
Application data
Fragment
Compressed
Fragment
MAC trailer
Padding
Encrypted
data
SSL record
SSL header
Compression
Message Integrity
Padding
Encryption
SSL Record Assembly
Confidentiality,
Integrity
Authentication,
Key exchange
Protocol
Asymmetric
Symmetric
Hash
Energy consumption
breakup
60%
40%
80%
20%
100%
1K
100K
1M
Transaction size (bytes)
0%
41%
44%
46%
Energy Break

up of SSL Processing
•
For small transactions, asymmetric algorithm energy dominates
•
For large transactions, symmetric algorithm energy dominates
•
Non

crypto processing accounts for more than 40% of the energy
Battery life: Outline
•
Experimental setup
•
Analysis of energy consumption of cryptographic
algorithms
–
Symmetric algorithms
–
Public

key algorithms
•
Analysis of energy consumption of SSL security
protocol
•
Discussion: Optimizing SSL
•
Conclusions
0
200
400
600
800
1000
1200
RSA
ECC
RSA
ECC
Client authentication
overhead
No client
authentication
Energy consumption
(mJ)
Client operations
Server operations
Optimizing SSL Handshake
SSL Handshake Optimizations

Presence/absence of security services (such as client authentication)

Choice of asymmetric cipher (RSA vs ECC)
Optimizing the SSL Record Stage
SSL Record Optimizations

Choice of cipher suite (e.g., ECC

AES

MD5 vs. ECC

BLOWFISH

MD5) is influenced
by the size of the data transmitted.

Choice of cipher parameters (key size, number of rounds)
Key
setup
Enc/
Dec
AES
7.87
1.21
Blowfish
3167
0.81
Key
setup
Enc/
Dec
3DES
87
6.04
RC5
66.54
0.8
Conclusions
•
Comprehensive analysis of energy consumption of
cryptographic algorithms and security protocols
•
Energy

security trade

offs possible in security protocols
–
Will tolerate lower security for reduced energy
consumption
–
Parameters identified include
•
Symmetric algorithm used in record stage
•
Asymmetric algorithm used in handshake
•
Key

size of asymmetric algorithms
•
Number of rounds in symmetric algorithms
•
Size of data to be transmitted
Future Work
Future Research: Robust, Light

weight
Security
Security objectives
Security protocols
Cryptographic
algorithms
Hardware

software
architectures
Layered Security Implementation
Scalable security protocols
with variable rounds and
per round complexity

Scalable Fiat

Shamir
identification protocol
1.
Devise novel algorithms based
on hard problems with simpler
operations

Learning parity with noise
2.
Algorithms based on energy
efficient operations

LFSR

based hashing

Polynomial arithmetic

based
algorithms
1.
Efficient embedded architectures for
newer crypto algorithms

NTRU
2. Low

cost architectures for
side

channel attack resistance

Can leakage current provide
side

channel information?
3. Hardware measures to tackle
malware (viruses, worms)
Acknowledgements
•
Princeton University
–
Prof. Niraj Jha and Prof. Ruby Lee
–
Group members
•
NEC Labs America
–
Dr. Anand Raghunathan
–
Dr. Srivaths Ravi
Thank you!
Comments 0
Log in to post a comment