Search

This work presents a novel approach to a Hardware Root-of-Trust that leverages System-on-Chip technology for the implementation of hardware cryptographic functions. Taking advantage of the processing power of a System-on-Chip, the solution established promotes hardware-based security solutions over software-only solutions. The proposed Root-of-Trust, developed around a Xilinx Zynq-7000 SoC device, integrates components based on cryptographic algorithms and physical phenomena. This innovative Root-of-Trust is tailored to support a spectrum of security tasks within cryptographic systems, including device-specific identifiers and keys, encryption and decryption, hashing, and signature generation and verification. The study adopts a unified design methodology, capitalizing on collaborative efforts to efficiently develop hardware primitives that significantly contribute to enhancing security in computing environments. Aligned with the advantages of reconfigurable hardware, this Hardware Root-of-Trust addresses the critical need for robust hardware-level security and introduces a set of countermeasures to fortify the design against potential threats.

As quantum computing technology advances, the security of traditional cryptographic systems is becoming increasingly vulnerable. To address this issue, Post-Quantum Cryptography (PQC) has emerged as a promising solution that can withstand the brute force of quantum computers. However, PQC is not immune to attacks that exploit weaknesses in implementation, such as Side Channel Attacks (SCAs). SCAs can extract secret keys by analyzing the physical characteristics such as power consumption of the device while performing cryptographic operation. Simple Power Analysis (SPA) is a type of SCA that uses power consumption measurements to extract sensitive information. By applying SPA to a specific hardware implementation of a PQC algorithm such as the NTRU, potential vulnerabilities can appear in the Arithmetic Unit (AU) in charge of the multiplication operation. The effectiveness of this analysis to extract sensitive information has been evaluated through extensive experiments in which different countermeasures and strategies have been proposed, as well as an accelerated algorithm has been implemented. The results demonstrate that SPA can point out security breaches in the NTRU implementation, indicating an issue that can affect the PQC in the future.

A digital signature is a cryptographic technique used to generate the signature of a message and verify the signature of that particular message. This signature scheme can ensure the validation of the authenticity, integrity, and non-repudiation of a message. Nowadays, the public-key cryptosystem RSA is widely used to perform the digital signature by using a public/private key pair. This paper describes the software and hardware hybrid implementation of the RSA digital signature on a System-on-Chip (SoC) that uses a RISC-V processor as processing core. The key generation for the RSA has been done in software, and the most time-consuming mathematical operation behind the RSA algorithm, the modular exponentiation, has been implemented in hardware. The proposed approach has been validated using one Xilinx Kintex-7 FPGA on the Genesys-2 FPGA board. The acceleration factor has also been calculated by comparing the software versus hardware implementation. The designed RSA IP has the flexibility to be reconfigured with different key sizes (512, 1024, 2048 bits) as per the requirements of the security level. The proposed implementation is verified using the National Institute of Standards and Technology (NIST) test vectors.

Hash functions are a crucial part of the cryptographic primitives. So much so that in 2007 a new competition was launched to select new standards for the SHA-3 function, which was won by Keccak. Since then, many software and hardware implementations have been submitted, claiming to reduce the number of operation cycles or increase design efficiency. Thus, this work aims to present a new hardware solution for the Keccak function, which forms the core of SHA-3, that achieves a high degree of tunability and is competitive with the state of the art. In addition, this work presents the integration of these designs into a hardware IP module together with the relevant drivers and functions that allow their use in software environments. Preliminary tests have shown an acceleration of up to 10 times compared to pure software code.

This work presents the design and validation of a compact and efficient RO-PUF/TRNG module, which combines ID generation and entropy source functionalities, and can be used as an essential primitive of a hardware RoT for RISC-V based SoCs. The design was encapsulated as an IP core to provide it with a high level of configurability, flexibility, and reusability. A comprehensive SDK for online characterization, validation, and performance monitoring of PUF and TRNG quality metrics was also developed. The experimental results show that the proposed RO-PUF/TRNG IP is suitable for increasing the security of IoT applications.

In the age of digital systems ubiquity, designing specialized solutions requires tailored tools. Proprietary software and hardware may present limitations that hinder future adaptability, thus, open-source design tools have emerged as an alternative solution to overcome these issues. They offer benefits such as being free, flexible, customizable, and community-driven. This paper evaluates and compares the design flow of a symmetric cipher implemented on Xilinx Zynq 7000 SoC devices using Xilinx Vivado software against Lattice iCE40 LP/HX devices using APIO open-source software tools. The comparison has been made in terms of performance, functionality, and cost. The methodology involved evaluating design requirements, features, support options, and testing to provide an analysis of the advantages and disadvantages of each tool highlighting the trade-offs between open-source and proprietary design tools.

The proliferation of devices for the Internet of Things (IoT) and their implication in many activities of our lives have led to a considerable increase in concern about the security of these devices, posing a double challenge for designers and developers of products. On the one hand, the design of new security primitives, suitable for resource-limited devices, can facilitate the inclusion of mechanisms and protocols to ensure the integrity and privacy of the data exchanged over the Internet. On the other hand, the development of techniques and tools to evaluate the quality of the proposed solutions as a step prior to their deployment, as well as to monitor their behavior once in operation against possible changes in operating conditions arising naturally or as a consequence of a stress situation forced by an attacker. To address these challenges, this paper first describes the design of a security primitive that plays an important role as a component of a hardware-based root of trust, as it can act as a source of entropy for True Random Number Generation (TRNG) or as a Physical Unclonable Function (PUF) to facilitate the generation of identifiers linked to the device on which it is implemented. The work also illustrates different software components that allow carrying out a self-assessment strategy to characterize and validate the performance of this primitive in its dual functionality, as well as to monitor possible changes in security levels that may occur during operation as a result of device aging and variations in power supply or operating temperature. The designed PUF/TRNG is provided as a configurable IP module, which takes advantage of the internal architecture of the Xilinx Series-7 and Zynq-7000 programmable devices and incorporates an AXI4-based standard interface to facilitate its interaction with soft- and hard-core processing systems. Several test systems that contain different instances of the IP have been implemented and subjected to an exhaustive

As quantum computing technology advances, the security of traditional cryptographic systems is becoming increasingly vulnerable. To address this issue, Post-Quantum Cryptography (PQC) has emerged as a promising solution that can withstand the brute force of quantum computers. However, PQC is not immune to attacks that exploit weaknesses in implementation, such as Side Channel Attacks (SCAs). SCAs can extract secret keys by analyzing the physical characteristics such as power consumption of the device while performing cryptographic operation. Simple Power Analysis (SPA) is a type of SCA that uses power consumption measurements to extract sensitive information. By applying SPA to a specific hardware implementation of a PQC algorithm such as the NTRU, potential vulnerabilities can appear in the Arithmetic Unit (AU) in charge of the multiplication operation. The effectiveness of this analysis to extract sensitive information has been evaluated through extensive experiments in which different countermeasures and strategies have been proposed, as well as an accelerated algorithm has been implemented. The results demonstrate that SPA can point out security breaches in the NTRU implementation, indicating an issue that can affect the PQC in the future.

The advent of quantum computing with high processing capabilities will enable brute force attacks in short periods of time, threatening current secure communication channels. To mitigate this situation, post-quantum cryptography (PQC) algorithms have emerged. Among the algorithms evaluated by NIST in the third round of its PQC contest was the NTRU cryptosystem. The main drawback of this algorithm is the enormous amount of time required for the multiplication of polynomials in both the encryption and decryption processes. Therefore, the strategy of speeding up this algorithm using hardware/software co-design techniques where this operation is executed on specific hardware arises. Using these techniques, this work focuses on the acceleration of polynomial multiplication in the encryption process for resource-constrained devices. For this purpose, several hardware multiplications are analyzed following different strategies, taking into account the fact that there are no possible timing information leaks and that the available resources are optimized as much as possible. The designed multiplier is encapsulated as a fully reusable and parametrizable IP module with standard AXI4-Stream interconnection buses, which makes it easy to integrate into embedded systems implemented on programmable devices from different manufacturers. Depending on the resource constraints imposed, accelerations of up to 30–45 times with respect to the software-level multiplication runtime can be achieved using dedicated hardware, with a device occupancy of around 5%.

The proliferation of devices for the Internet of Things (IoT) and their implication in many activities of our lives have led to a considerable increase in concern about the security of these devices, posing a double challenge for designers and developers of products. On the one hand, the design of new security primitives, suitable for resource-limited devices, can facilitate the inclusion of mechanisms and protocols to ensure the integrity and privacy of the data exchanged over the Internet. On the other hand, the development of techniques and tools to evaluate the quality of the proposed solutions as a step prior to their deployment, as well as to monitor their behavior once in operation against possible changes in operating conditions arising naturally or as a consequence of a stress situation forced by an attacker. To address these challenges, this paper first describes the design of a security primitive that plays an important role as a component of a hardware-based root of trust, as it can act as a source of entropy for True Random Number Generation (TRNG) or as a Physical Unclonable Function (PUF) to facilitate the generation of identifiers linked to the device on which it is implemented. The work also illustrates different software components that allow carrying out a self-assessment strategy to characterize and validate the performance of this primitive in its dual functionality, as well as to monitor possible changes in security levels that may occur during operation as a result of device aging and variations in power supply or operating temperature. The designed PUF/TRNG is provided as a configurable IP module, which takes advantage of the internal architecture of the Xilinx Series-7 and Zynq-7000 programmable devices and incorporates an AXI4-based standard interface to facilitate its interaction with soft- and hard-core processing systems. Several test systems that contain different instances of the IP have been implemented and subjected to an exhaustive

This work presents a unified framework to design, implement and evaluate the performance of Ring Oscillator Physical Unclonable Functions (RO PUFs) on FPGAs. The design flow uses a Digital Signal Processing (DSP) tool integrated into the Matlab environment. The use of this tool eases the evaluation of the PUF performance. The DSP tool provides an environment to apply the challenges to the RO PUF, acquire the responses by using hardware (HW) co-simulation, and compute a set of metrics to quantify the stability, probability and entropy of the PIF response. Additionally, the robustness of the PUF response is proved in the generation of secret keys. The design flow was applied to evaluate the performance of RO PUFs implemented on 17 Basys 3 Artix-7 FPGA Boards.

Post-Quantum Cryptographic (PQC) algorithms have emerged to secure communication channels between electronic devices faced with the advent of quantum computers. The performance of PQC algorithms on embedded systems has to be evaluated in orderto achieve a good trade-off between required resources (area) and timing. This work presents two optimized implementations to speed up the NTRUEncrypt algorithm on a System-on-Chip (SoC). The strategy is based on accelerating the most time-consuming operation that is the truncated polynomial multiplication. Hardware dedicated modules for multiplication are designed by exploiting the presence of consecutive zeros in the coefficients of the blinding polynomial. The results are validated on a Pynq-Z2 platform that includes a Zynq-7000 SoC from Xilinx and supports a Python-based programming environment. The optimized version that exploits the presence of double, triple, and quadruple consecutive zeros offers the best performance in timing, in addition to considerably reducing the possibility of an information leakage against an eventual attack on the device, making it practically negligible

This paper focuses on the implementation of a hardware coprocessor intended to speed up multiplications over the F p 2 finite field extension in the context of bilinear pairings. Being aware of the high degree of parallelism present at different levels of pairings computation, especially in the case of F p 2 multiplications, we propose a hardware architecture based on internal and external pipeline structures allowing both, to accelerate a single multiplication and perform several multiplications in parallel. This enables the development of a hybrid hardware/software solution on a SoC-FPGA for computing bilinear pairings that improves the performance of equivalent state-of-the-art implementations up to a 22.5 %, El presente trabajo aborda el desarrollo de un coprocesador hardware para acelerar aquellas operaciones de multiplicación en la extensión de campo Fp2 involucradas en el cálculo de un emparejamiento bilineal. A partir de identificar el alto grado de paralelismo presente en los diferentes niveles de procesamiento aritmético de un emparejamiento, sobre todo para el caso de la multiplicación en Fp2, se propone una arquitectura hardware para el coprocesador basada en estructuras de pipeline tanto internas como externas que permiten acelerar el cálculo de una operación de multiplicación y habilitar, además, la ejecución de varias multiplicaciones de manera solapada. Gracias a esto ha sido posible desarrollar una solución híbrida hardware/software sobre un SoC-FPGA para el cálculo de emparejamientos bilineales que logra mejorar hasta en un 22.5% los resultados de soluciones equivalentes en el estado del arte.

Concern for the security of embedded systems that implement IoT devices has become a crucial issue, as these devices today support an increasing number of applications and services that store and exchange information whose integrity, privacy, and authenticity must be adequately guaranteed. Modern lattice-based cryptographic schemes have proven to be a good alternative, both to face the security threats that arise as a consequence of the development of quantum computing and to allow efficient implementations of cryptographic primitives in resource-limited embedded systems, such as those used in consumer and industrial applications of the IoT. This article describes the hardware implementation of parameterized multi-unit serial polynomial multipliers to speed up time-consuming operations in NTRU-based cryptographic schemes. The flexibility in selecting the design parameters and the interconnection protocol with a general-purpose processor allow them to be applied both to the standardized variants of NTRU and to the new proposals that are being considered in the post-quantum contest currently held by the National Institute of Standards and Technology, as well as to obtain an adequate cost/performance/security-level trade-off for a target application. The designs are provided as AXI4 bus-compliant intellectual property modules that can be easily incorporated into embedded systems developed with the Vivado design tools. The work provides an extensive set of implementation and characterization results in devices of the Xilinx Zynq-7000 and Zynq UltraScale+ families for the different sets of parameters defined in the NTRUEncrypt standard. It also includes details of their plug and play inclusion as hardware accelerators in the C implementation of this public-key encryption scheme codified in the LibNTRU library, showing that acceleration factors of up to 3.1 are achieved when compared to pure software implementations running on the processing systems included in the progra

The generation of unique identifiers extracted from the physical characteristics of the underlying hardware ensures the protection of electronic devices against counterfeiting and provides security to the data they store and process. This work describes the design of an efficient Physical Unclonable Function (PUF) based on the differences in the frequency of Ring Oscillators (ROs) with identical layout due to variations in the technological processes involved in the manufacture of the integrated circuit. The logic resources available in the Xilinx Series-7 programmable devices are exploited in the design to make it more compact and achieve an optimal bit-per-area rate. On the other hand, the design parameters can also be adjusted to provide a high bit-per-time rate for a particular target device. The PUF has been encapsulated as a configurable Intellectual Property (IP) module, providing it with an AXI4-Lite interface to ease its incorporation into embedded systems in combination with soft- or hard-core implementations of general-purpose processors. The capability of the proposed RO-PUF to generate implementation-dependent identifiers has been extensively tested, using a series of metrics to evaluate its reliability and robustness for different configuration options. Finally, in order to demonstrate its utility to improve system security, the identifiers provided by RO-PUFs implemented on different devices have been used in a Helper Data Algorithm (HDA) to obfuscate and retrieve a secret key. © 2022 by the authors.

This paper presents the validation of a novel approach for a true-random number generator (TRNG) based on a ring oscillator–physical unclonable function (RO-PUF) for FPGA devices. The proposal takes advantage of the different noise sources that affect the electronic implementation of the RO-PUF to extract the entropy required to guarantee its function as a TRNG, without anything more than minimal changes to the original design. The new RO-PUF/TRNG architecture has been incorporated within a hybrid HW/SW embedded system designed for devices from the Xilinx Zynq-7000 family. The degree of randomness of the generated bit streams was assessed using the NIST 800-22 statistical test suite, while the validation of the RO-PUF proposal as an entropy source was carried out by fulfilling the NIST 800-90b recommendation. The features of the hybrid system were exploited to carry out the evaluation and validation processes proposed by the NIST publications, online and on the same platform. To establish the optimal configuration to generate bit streams with the appropriate entropy level, a statistical study of the degree of randomness was performed for multiple TRNG approaches derived from the different implementation modes and configuration options available on the original RO-PUF design. The results show that the RO-PUF/TRNG design is suitable for secure cryptographic applications, doubling its functionality without compromising the resource–efficiency trade-off already achieved in the design.

Programmable devices combine powerful processing systems with a rich infrastructure of general-purpose and specific logic blocks, making it possible the efficient implementation of embedded systems to perform complex tasks by facilitating hardware acceleration of critical stages to improve their performance. Based on these characteristics, a hardware implementation of a genetic algorithm for circle detection in digital images is described in this paper. The detection system has been designed for Xilinx Zynq-7000 and Zynq UltraScale+ family devices and implemented on two low-cost development boards that reach acceleration factors of 33.12 and 37.3, respectively, when compared to the fully software implementation. Detection results from both development boards have been compared using synthetic and real images from different scenarios. The accuracy and performance achieved demonstrate the suitability of this proposal to design embedded systems with restricted size, resources and energy consumption for applications in Internet of Things, Industry 4.0 and other related paradigms.

Concern for the security of embedded systems that implement IoT devices has become a crucial issue, as these devices today support an increasing number of applications and services that store and exchange information whose integrity, privacy, and authenticity must be adequately guaranteed. Modern lattice-based cryptographic schemes have proven to be a good alternative, both to face the security threats that arise as a consequence of the development of quantum computing and to allow efficient implementations of cryptographic primitives in resource-limited embedded systems, such as those used in consumer and industrial applications of the IoT. This article describes the hardware implementation of parameterized multi-unit serial polynomial multipliers to speed up time-consuming operations in NTRU-based cryptographic schemes. The flexibility in selecting the design parameters and the interconnection protocol with a general-purpose processor allow them to be applied both to the standardized variants of NTRU and to the new proposals that are being considered in the post-quantum contest currently held by the National Institute of Standards and Technology, as well as to obtain an adequate cost/performance/security-level trade-off for a target application. The designs are provided as AXI4 bus-compliant intellectual property modules that can be easily incorporated into embedded systems developed with the Vivado design tools. The work provides an extensive set of implementation and characterization results in devices of the Xilinx Zynq-7000 and Zynq UltraScale+ families for the different sets of parameters defined in the NTRUEncrypt standard. It also includes details of their plug and play inclusion as hardware accelerators in the C implementation of this public-key encryption scheme codified in the LibNTRU library, showing that acceleration factors of up to 3.1 are achieved when compared to pure software implementations running on the processing systems included in the progra

In recent years, the strategy of co-designing Hardware/Software (HW/SW) systems has been widely adopted to exploit the synergy between both approaches thanks to technological advances that have led to more powerful devices providing an increasingly better cost–benefit trade-off. This paper presents an HW/SW system for the detection of multiple circles in digital images based on a genetic algorithm. It is implemented on an Ultra96-v2 development board, which contains a Xilinx Zynq UltraScale+ MPSoC device and supports a Linux operating system that facilitates application development. The design is powered by developing an interactive computing environment by means of the Jupyter Notebook platform, in which different programming languages coexist. The specific advantages of each of these languages have been used to describe the hardware component that accelerates the evolutionary computation for circle detection (VHDL), to execute SW-HW interaction functions, as well as the pre- and post-processing of the images (ANSI-C) and to code, evaluate, and document the system execution process (Python). As a result, a computationally efficient application was obtained, with high accuracy in the detection of circles in synthetic and real images, and with a high degree of reconfigurability that provides the user with the necessary tools to incorporate it in a specific area of interest.

The generation of unique identifiers extracted from the physical characteristics of the underlying hardware ensures the protection of electronic devices against counterfeiting and provides security to the data they store and process. This work describes the design of an efficient Physical Unclonable Function (PUF) based on the differences in the frequency of Ring Oscillators (ROs) with identical layout due to variations in the technological processes involved in the manufacture of the integrated circuit. The logic resources available in the Xilinx Series-7 programmable devices are exploited in the design to make it more compact and achieve an optimal bit-per-area rate. On the other hand, the design parameters can also be adjusted to provide a high bit-per-time rate for a particular target device. The PUF has been encapsulated as a configurable Intellectual Property (IP) module, providing it with an AXI4-Lite interface to ease its incorporation into embedded systems in combination with soft- or hard-core implementations of general-purpose processors. The capability of the proposed RO-PUF to generate implementation-dependent identifiers has been extensively tested, using a series of metrics to evaluate its reliability and robustness for different configuration options. Finally, in order to demonstrate its utility to improve system security, the identifiers provided by RO-PUFs implemented on different devices have been used in a Helper Data Algorithm (HDA) to obfuscate and retrieve a secret key.

El presente trabajo explora diferentes estrategias de diseño enfocadas en acelerar el cálculo de emparejamientos bilineales sobre curvas elípticas en el contexto de los sistemas empotrados. Como punto de partida se proponen tres soluciones software para procesadores ARM basadas en la optimización de operaciones en lenguaje ensamblador, el empleo de instrucciones vectoriales y la paralelización de operaciones mediante procesamiento doble núcleo. Seguidamente se presentan dos implementaciones basadas en diseño híbrido hardware/software que aprovechan la capacidad de procesamiento hardware para explotar en mayor medida el alto grado de paralelismo que exhiben las formulaciones algorítmicas involucradas en el cálculo de un emparejamiento. El desarrollo de estas variantes se ha enfocado además en la obtención de soluciones flexibles que admitan implementar varios tipos de emparejamientos sin que ello implique modificaciones a nivel de hardware. Así, la primera alternativa se basa en acelerar la operación crítica en tiempo que mayor incidencia tiene en el cálculo de un emparejamiento mediante su implementación en hardware, mientras que el resto de la pirámide de procesamiento permanece en software. Por su parte, la segunda variante extiende el aprovechamiento del hardware mediante el diseño de un criptoprocesador aritmético dotado de un conjunto de coprocesadores que aceleran el cálculo de varias operaciones básicas. Estos coprocesadores se integran en un bloque funcional encargado de establecer diferentes secuencias de operación. Cada secuencia determina una acción concreta que se codifica en forma de instrucción. De esta manera, la arquitectura hardware del criptoprocesador permite implementar cualquier funcionalidad que pueda ser descrita mediante su repertorio de instrucciones, el cual ha sido especialmente diseñado para calcular emparejamientos bilineales. Además, la arquitectura programable del criptoprocesador permite implementar diferentes tipos de emparejamientos

The implementation of true random number generators is of vital importance to preserve the reliability of cryptographic systems. The lack of entropy can compromise their integrity, affecting the security of the entire chain of applications. Ensuring the effectiveness of a random number generator can be understood as reducing the risk of information loss due to possible attacks by third parties. This paper presents a novel approach for a true random number generator based on a Ring Oscillator-Physical Unclonable Function. Since the principle of operation of physical unclonable functions is based on the physical properties of each device, they can be used for security applications such as device identification, counterfeit prevention, and increase the robustness of cryptographic functions. In addition, increasing the versatility of the design to use them as a source of entropy, they can also fulfill tasks such as generation of initialization vectors or nonces and keys for symmetric cryptography. The system incorporates multiple operating configurations, which allows a complete analysis of its performance to adapt it to different application scenarios. The randomness and correct operation of the proposed design have been evaluated online, by incorporating it into a hybrid HW/SW embedded system able to run the official test suite published by the National Institute of Standards and Technology without any need for post-processing. The architecture has been designed for Xilinx Zynq-700 family devices and implemented on the Pynq-Z2 development board.