Criticality based reliability against hardware Trojan attacks for processing of tasks on reconfigurable hardware

Abstract

An important aspect of mixed critical systems is to execute tasks of varied criticality on the same platform. The property of full or partial reconfiguration at runtime of reconfigurable hardware or field programmable gate arrays (FPGAs) has satisfied this criterion and facilitated the processing of mixed critical tasks directly on hardware, with the aid of reconfigurable intellectual properties (IPs) or bitstreams procured from various third party IP (3PIP) vendors. However, the existing literature in this arena does not consider the associated hardware threats. Such threats are particularly dangerous as related malware like Hardware Trojan Horses (HTHs) remain dormant during testing and evade detection, but get activated at runtime and jeopardize mission critical applications. Though several works exist on hardware security, none focus on reliability driven mixed critical task processing on reconfigurable hardware against HTH attacks. In this work, we initially explore how HTHs implanted by 3PIP vendors in the bitstreams may cause active attacks. Then, we develop strategies to ensure reliability for processing of mixed critical tasks on reconfigurable hardware. Both periodic and non-periodic, i.e. aperiodic or sporadic tasks are considered. We also focus on resource constrained environments, where we adhere to frequency scaling to facilitate accommodation of tasks on limited resources. We experiment with a variety of bitstreams and performance evaluation is performed via metrics such as task success rate, task rejection rate and task preemption rate.

Introduction

Advent of reconfigurable hardware or field programmable gate arrays (FPGAs) has facilitated execution of varied tasks directly on the same hardware platform, via its property of full or partial reconfiguration at runtime [5]. Such flexibility was absent in prior hardware based application specific integrated circuit (ASIC) platforms, where reuse of hardware for a different task execution was not possible. Hence, FPGAs find usage in wide application arenas which range from automation to aviation to nuclear reactors [2]. Such systems are mixed critical in nature, where tasks of different criticality need to be executed on a common platform, in order to optimize resource and reduce design cost and energy consumption [3].

Tasks in a mixed critical system are strictly classified into various levels of criticality, as per the industrial standards of the associated application domain. For instance, criticality of tasks is classified into five levels from A to E, for avionics as per the DO-178B specification [4]. Likewise, ISO 26262 introduces four levels of criticality to ensure safety in automobiles [6]. Significant attention has been vested in developing approaches for classifying criticality of tasks based on the application domain [7].

The level of security must also vary as per the criticality of tasks in order to ensure reliability of mixed critical systems [3], [8]. More resource and care must be dedicated for executing high critical tasks like steering or braking operations of an automobile, than operations of lower critical tasks like the infotainment system. As a malfunction associated in the former will cost the loss of life, while vulnerability in the latter will only affect the mood of the user.

Previously, prime focus among researchers was to ensure security in software as hardware was considered trusted. The trend was similar even for mixed critical systems. Works exist which demonstrate scheduling and execution of tasks directly on FPGAs [9]. But these do not consider associated hardware threats, which have gained significant importance over the last few years [10]. Thus, it is of utmost importance to analyze effects of hardware attacks on mixed critical systems and propose effective strategies to ensure reliability for such scenarios.

The modern semiconductor industry has adopted the globalization strategy for system on chip (SoC) designing. Integrating intellectual properties (IPs) procured from various third party IP (3PIP) vendors and outsourcing different phases of SoC design to different parts of the world are commonly used in the globalization methodology. Though such techniques facilitate reduction of SoC design cost and meeting of stringent marketing deadlines, the element of hardware trust has been evicted [10]. Trustworthiness issues are related to both the 3PIP vendors who supply the design IPs, as well as with the outsourced sites like the foundries. Possibility exists in the implantation of malicious circuitry by adversaries in the foundries during chip design [11]. Even the 3PIP vendors may also pose as adversaries and introduce malicious codes during the hardware description language (HDL) phase of IP generation [22], [29]. Such malicious modifications are commonly termed as Hardware Trojan Horses (HTHs). HTHs are dangerous as they bypass detection during testing by remaining dormant, and exhibit their stealthy nature at runtime via pre-decided activation mechanisms set by adversaries and affect real time task processing [12].

Operations associated with reconfigurable hardware or FPGAs are even prone to hardware attacks. For the execution of a particular task on an FPGA, the related bitstream or reconfigurable IP (RIP) must configure fully or partially the FPGA fabric. Vulnerabilities can be present in the FPGA fabric as like other chips, development of FPGAs is also performed via the globalization strategy [13]. In addition to this, the RIPs which are procured from the 3PIP vendors may also be infected with HTHs [22], [29]. Reliability of fabricated devices like FPGAs can be ensured by standard authentication mechanism like physical unclonable functions (PUFs) [16], [17]. But reliability of RIPs is a concern as no full proof authentication strategy is available for RIPs, which are generally reused and recycled.

The existing literature on criticality based reliability driven execution of mixed critical tasks is limited to software [3]. Analysis of HTH attacks and associated reliability strategy for execution of mixed critical tasks on a reconfigurable hardware platform is still awaited.

In this work, our prime objective is to ensure reliability driven execution of tasks as per their criticality on a reconfigurable hardware or FPGA, from HTH attacks. We additionally focus on resource constrained environment to facilitate the objective, which is a greater challenge. For the present work, we consider only vulnerabilities associated with bitstreams procured from 3PIP vendors and consider the FPGA fabric secured via a PUF mechanism [17]. We first analyze in the threat model, how HTH affected bitstreams or RIPs may affect hardware related mixed critical task executions. The tasks may be periodic or non-periodic, i.e. aperiodic or sporadic in nature. For periodic tasks, a reliable task schedule must be generated offline, which needs to be strictly obeyed online. Initially, we propose a reliability driven scheduling approach as per the criticality of tasks for a normal scenario, where no resource limitation is present. Then, we adhere to frequency scaling via dynamic clock management module of FPGAs to facilitate the same objective for a resource constrained environment. For non-periodic tasks, dedicated resources are usually deployed for their execution. We propose a self aware strategy which facilitates criticality based reliable execution of non-periodic tasks from HTH attacks within suitable time frames of the periodic task schedule on the same reconfigurable hardware platform. Performance evaluation is performed via metrics, task success rate, task rejection rate and task preemption rate. A preliminary version of this article is presented in [30].

Our main contributions in this work are:

• Analyzing how vulnerability associated with RIPs or bitstreams, procured from untrustworthy 3PIP vendors may jeopardize mixed critical real time task operations (with focus on dependent tasks).

• Generation of reliability driven mixed critical periodic task schedule according to their criticality, with additional focus on resource constrained environments.

• Proposing a self aware strategy for reliable execution of non-periodic tasks within suitable time frames of the periodic task schedule, on the same reconfigurable hardware platform.

This paper is organized as follows. A related background is discussed in Section 2. Section 3 describes the system model, while threat modeling is performed in Section 4. Section 5 discusses the strategy to ensure reliability. Reliability driven periodic task scheduling, with additional focus on resource constrained environment is presented in Section 6. Section 7 provides a self aware strategy for reliability driven handling of non-periodic tasks. Experimentation and result analysis is discussed in Section 8. Finally, the article concludes in Section 9.