Nowadays, embedded systems become more and more complex: the hardware/software codesign approach is a method to create such systems in a single chip which can be based on reconfigurable technologies such as FPGAs (Field-Programmable Gate Arrays). In such systems, data exchanges are a key point as they convey critical and confidential information and data are transmitted between several hardware modules and software layers. In case of an FPGA development life cycle, OS (Operating System) / data updates as runtime communications can be done through an insecure link: attackers can use this medium to make the system misbehave (malicious injection) or retrieve bitstream-related information (eavesdropping). Recent works propose solutions to securely boot a bitstream and the associated OS while runtime transactions are not protected. This work proposes a full boot-to-runtime protection flow of an embedded Linux kernel during boot and confidentiality/integrity protection of the external memory containing the kernel and the main application code/data. This work shows that such a solution with hardware components induces an area occupancy of 10% of a xc6vlx240t Virtex-6 FPGA while having an improved throughput for Linux booting and low-latency security for runtime protection.

Dynamic partial reconfiguration is a growing need for SRAM FPGA-based embedded systems. This feature allows reconfiguring parts of the FPGA while others continue to run. But it may introduce security breaches affecting FPGA configuration. In this paper, a secure protocol to ensure confidentiality, integrity, authenticity and up-to-dateness is described and applied to dynamic partial reconfiguration. Two common threat models are addressed for industrially-driven use cases. The implementation can perform both secure update and reconfiguration without significantly affecting performances.

The main goal of this chapter is to study FPGA devices in the field of secured applications. We mainly address data protection based on a well defined threat model. When dealing with FPGAs at the system level, two kinds of data are of paramount importance: bitstream and external memory. To cover these topics, we first review state of the art FPGA security mechanisms and good practices, followed by performance analysis achievable using hardware implementation of cryptographic algorithms in current FPGAs. We then tackle external memory protection and how FPGAs can provide an efficient solution. Next, we highlight security issues specific to FPGAs, bitstream replay attacks, for example, and suggest solutions to improve bitstream management security, focusing on secure remote updating of FPGA bitstreams. Finally we give the results of a concrete case, i.e., a platform based on an FPGA device. This last section provides both a practical and an industrial point of view that will enable readers to evaluate the pertinence of the solutions proposed.

The growing complexity of embedded systems makes reconfiguration and embedded OSs (Operating Systems) more and more interesting. FPGAs (Field-Programmable Gate Arrays) are able to perform such a feature with success. With most of the FPGAs, the OS is stored into an external memory (usually Flash) and running on a processor embedded into the FPGA. We consider that FPGA embedded processor is able to process the OS update through, for instance, an insecure network. However, these features may give rise to security flaws affecting the system integrity or freshness. Integrity can be altered by spoofing or modifying data in order to introduce malicious code. In the same way, freshness can be affected by replaying an old configuration in order to downgrade the system. This work proposes a trusted computing mechanism taking into account the whole security chain from bit stream-to-kernel-boot ensuring, both hardware and software, integrity while preventing replay attacks. This paper summarizes the current counter-measures ensuring integrity, confidentiality and freshness of the bit stream. Then we propose a solution to protect OS kernel against malicious modifications thanks to already trusted bit stream power-up. We also evaluate the area and performance overhead of the proposed architecture and its improvement using asymmetric cryptography. Adding security and increasing performances, this solution generates between 0 and 40% of area overhead depending on the re-usability consideration.

Nowadays, there are lot of applications where remote update is an essential service. Indeed, in high volume sale products or space-based systems it is too expensive to retrieve the device in order to update it. Field Programmable Gate Arrays (FPGAs) are able to perform that with success through a network. However, this feature may give rise to security flaw like spoofing and replay attacks. These attacks consist in tampering the update of the hardware configuration or in replaying an old bitstream to downgrade the system. Several security schemes providing encryption and integrity checking of the bitstream have been proposed in the literature. However, they do not detect the replay of old FPGA configurations. Considering FPGA with embedded non-volatile memory, we propose a new protocol ensuring bitstream confidentiality, integrity and preventing old bitstreams replay. This work is the improvement and the implementation of previous presented ideas [1] in order to achieve more flexibility. That is why we insist on the way to manage bitstream versions. We also evaluate the area and performance overhead of the proposed architecture.