RISC-V嵌入式内核中GPSA保护的提前生成.pdf

1、Ahead of Time Generation Ahead of Time Generation for GPSAGPSA Protectionin RISCRISC-V V Embedded CoresEmbedded CoresLouis Savary,Simon Rokicki and Steven Derrien/20Context2Embedded Systems Energy constrained Everywhere,for every usage Remote,mobile allows invasive attacks/20Context3Fault Injection

2、Attacks(FIA)Alter transistors state by external means laser,clock,power,EM Can propagate and cause errors:Data corruption Control flow errors Instruction skip/repeat Branch faultingInria/C.Morelconditional branch basic blockbasic blockbasic block/20Context4Countermeasures against Fault Injection Tec

3、hniques for fault detection redundancy,signatures Multiple implementations modifying program modifying architecture/20 Verifying the Control Flow Signature processing At compile time Each instruction has a signature f function:,+1=+1 control flow instructions:patch to correct signature Dynamically i

4、nstructions are encoded with f verification against reference signature patches are used on edges to get target signatureGPSA and CSM5Global Path Signature Analysis&Continuous Signature Monitoringbasic blockbasic blockbasic blockconditional branch basic blockbasic blockbasic block+patchM.Werner et a

5、l.“Protecting the Control Flow of Embedded Processors against Fault Attacks”.CARDIS 2016Requirements(usually)(micro)architecturedynamic signature computation and comparisoncompilerreference signature and patch generation/20 GPSA and CSM implementation microarchitecture modification to a pipeline CSI

6、:ensures pipeline execution integrity CCFI:dynamic signature processingSCI-FI6CountermeasureT.Chamelot,D.Courouss,and K.Heydeman“SCI-FI,Code,and Control Flow Integrity against Fault Injection Attacks,”in DATE,2022SCI-FIPipelineFetchDecodeExecuteMemoryWriteBackCCFICSI compiler modification:store in t