What do ultra low power requirements mean for secure hardware?

Transcription

1 Gigascale Reliable Energy Efficient Nanosystem (GREEN) Lab School of Electrical and Computer Engineering, Georgia Tech Exploring reliable, energy efficient computing solutions at nanometer nodes from devices to circuits to systems What do ultra low power requirements mean for secure hardware? Saibal Mukhopadhyay School of ECE, Georgia Institute of Technology Intel Corporation Qualcomm IBM

2 Emerging Computing Applications Growth rate 80% 60% 40% 20% Source: International Data Corporation (IDC) Servers Desktop Laptop Wearables Smart Phone IoTs High performance Mobile, low power Compute small, everywhere 2

3 Emerging Computing Applications 1 13 One connected thing per person Inflection Point IoT Predictions Sensors, Smart Objects, Wearables, Healthcare Information Leakage Tablets, Laptops, Phones Side Channel Attack Billion World Population Secure Private Trustworthy Billion Objects 3

4 Power performance Spectrum Servers Performance Internet-of-things GPU Cell-phone processors Multi-core processors Wearable medical sensors Environment sensors Energy autonomous systems Growing space for ultra-low power computing Power 4

5 A critical challenge moving forward How do we secure embedded systems and SoCs operating under tight power budgets? 5

6 Low-power and Security Low-power requirements of secure hardware Challenge? Or Opportunities? Hardware Trojan Power Attack Tampering EM attack Counterfeit Cryptanalysis Reverse engineering Voltage scaling Voltage regulators Clock gating Power gating Adaptive circuits Logic design Activity control Architecture Hardware Security Vulnerabilities Low-power techniques 6

7 Focus of this Talk Low-power requirements in encryption engines and protection against side channel attack Smart Cards FPGA Processors Side Channels Leaking Encryption Specific Information: Power Trace Measurements Most commonly used side channel Electromagnetic Emissions 7

8 An Example Application: Distributed Video Surveillance with Self-power Sensors Image sensing Node Datarate reduc*on (pre- processing and compression) wireless link Limited bandwidth and dynamic channel condi*on Receiver Desirable quality of important informa*on Noise tolerance (Adap*ve modula*on) S. Mukhopadhyay, PI, Supported by Office of Naval Research, US

9 Self-powered Image Sensors Energy harvesting from sensor CMOS sensor Pre- processor MJPEG TransmiBer BaBery Other Energy transducers Power management Clock generator SRAM (edge map) 2mm x 2mm design, 130nm CMOS Energy per frame (uj) MJPEG H.264/AVC intra MJPEG + Pre-processing J. Ko, IEEE TMSCS SSIM of ROI

10 Area and Power Cost of Securing the Transmitted Image Computation Energy per frame (uj) % area +1.8% energy +6.2% area +19% energy +4.6% area +17% energy +0.6% area +1.6% energy + EncrypIon module (AES) + EncrypIon module (Simon) Area (um 2 ) Baseline MJPEG Baseline MJPEG + pre- processor (fixed QF/threshold) Variable QF MJPEG + pre- processor + system controller We need security at very low area and energy cost 10

11 Low-power requirement is a challenge to design power-attack secure crypto engines 11

12 Low Area/Power Cryptography Significant past effort exists on low-power crypto. Technique Area* Power* Adiabatic Logic Circuits 1.56X 0.24X Serialization (8-bit datapath) Using Composite Field Arithmetic Register reduction, clock gating, bus specific clock 0.5X 0.11X 1.1X 0.08X 0.9X 0.56X Sequence Switch Coding No data 0.9X RTL level low power techniques - clock gating, register reduction. SBOX function can be optimized with different mathematical realization of composite field arithmetic Serialization and hardware reuse is one of the popular way to minimize the hardware cost. *The factors are obtained from corresponding references Little quantitative analysis exists on how these techniques impact resistance against power attack. 12

13 Encryption Schemes Key 128- bit Parallel AES 128-bit datapath PlainText 128-bit SBox (128-bit) ShiftRow (128-bit) Key 128- bit Algorithmic noise for targeted byte Serial AES 8-bit datapath PlainText 128-bit SBox (8-bit) ShiftRow (8-bit) Key 128- bit No algorithmic noise for targeted byte SIMON 1-bit datapath PlainText 128-bit SIMON Round No algorithmic noise for targeted bit MixColumn (128-bit) AddRoundKe y (128-bit) MixColumn (8-bit) AddRoundKey (8-bit) Serial encryption designs are more susceptible to power attacks valid for both serial AES and SIMON 13

14 Correlation Power Attack Characteristics Parallel AES Serialized AES SIMON Serial designs are observed to be more prone to side-channel attack. ρ( t, k ) i j = E(( P P)( HD HD)) σ( P) σ( HD) 14

15 Design Tradeoffs Area 0.4 Power Parallel AES Serial AES SIMON 0.08 Area Power Latency MTD (#cycles) High performance parallel AES Compact serial AES SIMON MTD - minimumtracesto-disclosure Low-power achieved by serialization and hardware reuse can degrade the resistance to side-channel attack. 15

16 Counter-Measures Against Power Attacks Plain Text Switching Activity Current Pattern Key Encryption Algorithm Design Measurement Recorded Trace Insert NOPs Masking Randomizing Logic styles Current Equalizer Package PDN Noise Injection Device Noise Thermal Noise Measurement Noise 16

17 Overhead of Countermeasures Countermeasure Type Area* Perf.* Random Order 15k NA Execution Multiprocessor Arch Arch. 2X 0.4% Random Isomorphism 2.5-3X 50% PDDL/WDDL 2.3X NA MDPL Logic 4-5X 50% imdpl 18-19X 70% Current Equalizer 1.25X 50% Clock Randomization Physical 1.1X NA *The factors are obtained from corresponding references Most of the commercially used countermeasures (DDL, MDPL, imdpl etc) have appreciable cost to area, power, and/or performance 17

18 Design Challenge Area-Overhead Counter-Measure Design Domain Performance Overhead Power Overhead 18

19 Low-power requirement is a new challenge to design power-attack secure crypto engines Low-power techniques provide new avenues to improve power-attack resistance of crypto engines 19

20 Low-power Techniques for Power Attack Protection Illustrative examples Low-voltage and adaptive circuits for power attack protection Integrated voltage regulators for power attack protections 20

21 Clock Randomization for Power Attack Security CLK IN CLK OUT CLK IN CLK IN PRNG PRNG PRNG D Q CK D Q CK D Q CK XOR Random Clock D Q CK CLK IN CLK OUT o o With randomization of clock edges, the processing time/instant of critical instructions can be randomized Techniques q Random Clock q Random Phase Shift q Globally Async Locally Sync Clocking (GALS) DELAY 0 DELAY 1 CLOCK MUX CLK OUT Power (mw) AES unprotected k MTD (# of traces) DELAY n- 1 PRNG Random Clock (+20%) >300k (>30x) Random Phase Shift (+20%) >300k (>30x) No Attack CLK IN CLK 0 CLK 1 CLK n- 1 Random Phase Shift Ref: Renato Menicocci et al, Experiments on Two Clock Countermeasures against Power Analysis Attacks, MIXDES 14 Ref: Rafael L. Soares et al, A Robust Architectural Approach for Cryptographic Algorithms using GALS Pipelines, DATC 11 21

22 Exploiting DVFS for Power Attack Protection Desired V/ F Register DVFS Feedback Loop Timing Information from OS DVFS Scheduler text Encryption Engine/ CPU DVFS techniques, widely used for power management, can be exploited against SCA V/F registers store random combinations of VDD and frequency Design parameters are number of V/F pair and time interval between each transition Resistance to power attack demonstrated with increased trace entropy Energy Overhead Time Overhead Power Trace Entropy (bits) Without DVFS With DVFS -27% 16% Time Trace Entropy (bits) Ref: Shengui Yang et al, Power Attack Resistant Crypto System Design: A Dynamic Voltage and Frequency Switching Approach, DATE 05 22

23 Adaptive Circuits for Lowpower Operation under Noise VDD Mode control CK IN T CKIN AC: Adaptive Clocking power gate mode control Pipeline with Programmable Time- Borrowing CLKi CG PTDNn CKEN T CKP (w/o noise) noise T CKP (with noise) T CKP (=nt CKIN ) tracks the instantaneous noise Time-borrowing and Clock gating/stretching CKIN Clock Modulator VCO CKp... clock buffers V control K. Chae and S. Mukhoapdhyay, TCAS2014, TCAS-II 2012, TCAS-II,

24 Can Adaptive Circuits help in Power Attack Protection? Voltage (V) Tolerable Voltage Droop Min. Op. Voltage Conv. PTB PTB + AC 24

25 Low-power Techniques for Power Attack Protection Illustrative examples Low-voltage and adaptive circuits for power attack protection Integrated voltage regulators for power attack protection 25

26 Power Delivery and Lowpower Operation Current or voltage Voltage droop Current step Time 26

27 Advantages of Integrated Voltage Regulators 3.3V or higher IVR 1.2V Encryption Engine Integrated Circuit Buck (Down-Conversion) IVRs eliminate R/L/C parasitic of power traces in package and PCB DC-DC conversion on-the processor chip (buck converter) Less current through package traces => less power loss in PCB Faster transient response reduces power supply noise Need less voltage margin => better power efficiency Faster output voltage transition Allow more frequent power-state transitions 27

28 Existing Systems with Off-chip Voltage Regulators 3.3V Mount power attack at Vdd/GND pins VRM 1.2V Encryption Engine Integrated Circuit Off-chip Voltage Regulation Module (VRM) 28

29 Power Attack Protection using Integrated Voltage Regulators 3.3V or higher Mount power attack at IVR inputs 20mV - 100mV IVR 1.2V Encryption Engine Energy Harvester IVR 1.2V Encryption Engine Integrated Circuit Buck (Down-Conversion) Inductive IVR Integrated Circuit Boost (Up-Conversion) Mount power attack at LDO inputs VRM 1.3V LDO 1.2V Encryption Engine Integrated Circuit 29 Integrated Low-Dropout-Regulator (Analog/Digital) 29

30 IVR for Power Attack Protection Plain Text Key Encryption Algorithm Physical Design Package Measurement 30

31 Leveraging IVR for Power Attack Protection Plain Text Key Encryption Algorithm Physical Design Raw Current Transformed Current Measurement Low-Drop-Out Regulators Voltage Regulator Package Inductive VR Integrated Voltage Regulator 31

32 An Example of Fully Integrated Inductive Voltage Regulator M. Kar et. al, CICC 2014, GOMACTECH 2014, TCAD (under prep) Frequency dependent transfer function of the loop changes small signal load current Addition of pulsating current at the switching frequency 32

33 Why IVR-based Countermeasure? Case-study of an 128-bit AES Engine Current (A) Current (A) Load Current for one AES Encryption Relevant Information (1 st SBOX op n ) Measured IVR input current (with package) Pulsating Current at Switching Frequency F SW) Correlation with load current, µ:0.048 σ:0.02 IVR introduces non-linear transformation in the load current before the trace is measured at the inputs. The input current is weakly correlated with the AES load current. However low correlation > no attack M. Kar et. al, CICC 2014, GOMACTECH 2014, IEEE TCAD (under prep) 33

34 Correlation Power Attack (CPA) Raw AES Current MTD ~ 500 Transformed AES Current through PDN MTD ~ 500 CPA attack was successful without IVR 34

35 CPA with IVR Design 2 Design 2, BW 55MHz Design 1, BW 62MHz No attack was possible with traces Design 1 MTD ~ 500 IVR design can be tuned to enhance 35

36 Inductive IVR Design Space Exploration Normalized Power Loss Power Loss: Summation of conduction, ripple and switching losses in IVR PL vs BW Bandwidth (MHz) Power Efficiency Improved Power Efficiency Normalized SeBling Time IVR Design Space SeBling Time vs BW Transient Performance Improved Transient response Bandwidth (MHz) Settling time: Time the IVR output takes to settle after a sharp load transient (10mA to 500mA) Information Leakage Cost of Integration Improved Power Attack Resistance BW(MHz) L (nh) C (uf) Increasing difficulty of integration 36

37 Countermeasure using Analog Low-Drop-Out Regulator A. Singh et. al., ISLPED 2015 Overhead Analysis of Analog LDObased Protection Area Power Performance 1.4% 5% (active) 500nW (stby) 0.4% No Attack for 20k traces AES Input Current MTD ~25 LDO Input Current 37

38 Conclusion Securing power constrained devices is a major challenge for current and future embedded systems. Low power constraints can be a bottleneck to enable strong encryption scheme and/or countermeasures. Low-power techniques provide new avenues to enhance countermeasures to attacks. What do low power requirements mean for secure hardware? New opportunities for embedded systems security 38

39 Acknowledgement PhD Students Monodeep Kar, GREEN Lab, ECE, Gatech, Arvind Singh, GREEN Lab, ECE, Gatech, Industrial Collaborators Vivek De, Intel Labs, Hillsboro, OR Anand Rajan, Intel Labs, Hillsboro, OR Academic Collaborators Marilyn Wolf, ECE, Gatech Swarup Bhunia, ECE, UFL 39