Issue No. 03 - March (2018 vol. 67)
Marc Fyrbiak , Horst Görtz Institute for IT Security, Ruhr University Bochum, Bochum, Germany
Simon Rokicki , IRISA, University of Rennes, Rennes, France
Nicolai Bissantz , Horst Görtz Institute for IT Security, Ruhr University Bochum, Bochum, Germany
Russell Tessier , University of Massachusetts Amherst, Amherst, MA
Christof Paar , Horst Görtz Institute for IT Security, Ruhr University Bochum, Bochum, Germany
The risk of code reverse-engineering is particularly acute for embedded processors which often have limited available resources to protect program information. Previous efforts involving code obfuscation provide some additional security against reverse- engineering of programs, but the security benefits are typically limited and not quantifiable. Hence, new approaches to code protection and creation of associated metrics are highly desirable. This paper has two main contributions. We propose the first hybrid diversification approach for protecting embedded software and we provide statistical metrics to evaluate the protection. Diversification is achieved by combining hardware obfuscation at the microarchitecture level and the use of software-level obfuscation techniques tailored to embedded systems. Both measures are based on a compiler which generates obfuscated programs, and an embedded processor implemented in an FPGA with a randomized Instruction Set Architecture (ISA) encoding to execute the hybrid obfuscated program. We employ a fine-grained, hardware-enforced access control mechanism for information exchange with the processor and hardware-assisted booby traps to actively counteract manipulation attacks. It is shown that our approach is effective against a wide variety of possible information disclosure attacks in case of a physically present adversary. Moreover, we propose a novel statistical evaluation methodology that provides a security metric for hybrid-obfuscated programs.
Program processors, Encoding, Hardware, Random access memory, Cryptography
M. Fyrbiak, S. Rokicki, N. Bissantz, R. Tessier and C. Paar, "Hybrid Obfuscation to Protect Against Disclosure Attacks on Embedded Microprocessors," in IEEE Transactions on Computers, vol. 67, no. 3, pp. 307-321, 2018.