430991
Attacks and risk analysis for hardware supported software copy protection systems
<i>Recently, there is a growing interest in the research community to use tamper-resistant processors for software copy protection. Many of these tamper-resistant systems rely on a specially tailored secure processor to prevent, 1) illegal software duplication, 2) unauthorized software modification, and 3)unauthorized software reverse engineering. The published techniques primarily focused on feasibility demonstration and design details rather than analyzing security risks and potential attacks from an adversary's perspective. The uniqueness of software copy protection may lead to some potential attacks on such a secure environment that have been largely ignored or insufficiently addressed in the literature. One should not take security for granted just because it is implemented on a tamper-resistant secure processor. Detailed analysis on some proposed ideas reveal potential vulnerability and attacks. Some of the attacks are known to the security community, nevertheless, their implications to software copy protection are not well understood and discussed. This paper presents these cases for designers to improve their systems and circumvent the potential security pitfalls and for users of such systems to be aware of the potential risks</i>
34371681
Static Techniques to Improve Power Efficiency of Branch Predictors
Current power-efficient designs focus on reducing the dynamic (activity-based) power consumption in a processor through different techniques. In this paper, we illustrate the application of two static techniques to reduce the activities of the branch predictor in a processor leading to its significant power reduction. We introduce the use of a static branch target buffer (BTB) that achieves the similar performance to the traditional branch target buffer but eliminates most of the state updates thus reducing the power consumption of the BTB significantly. We also introduce a correlation-based static prediction scheme into a dynamic branch predictor so that those branches that can be predicted statically or can be correlated to the previous ones will not go through normal prediction algorithm. This reduces the activities and conflicts in the branch history table (BHT). With these optimizations, the activities and conflicts of the BTB and BHT are reduced significantly and we are able to achieve a significant reduction (43.9% on average) in power consumption of the BPU without degradation in the performance.
1373345
Leakage-proof program partitioning
Due to limited available memory (of the order of Kilobytes) on embedded devices (such as smart cards), we undertake an approach of partitioning a whole program. The program partitions are down-loaded from the server on demand into the embedded device just before execution. We devise a novel method of partitioning the code and data of the program such that no information regarding the control flow and behavior of the program is leaked out. In other words, by observing the program partitions that are down-loaded from the server, one is unable to guess which branches are taken in the program. The partitioning scheme generates minimal safe program regions which do not reveal the control flow information when transmitted on demand but any further partitioning of which will reveal such an information. Minimal safe regions allow minimal usage of memory on the embedded device and thus enable maximal number of multiple applications to simultaneously reside on the embedded device. The minimal safe regions can be merged on demand to create larger safe regions to improve runtime efficiency. The larger the number of regions to be downloaded on the device, the lower is the performance of the application and vice-versa. Our approach handles this tradeoff between the number of simultaneous applications that would reside on the embedded device and the performance of each application. This approach is scalable both to the number of simultaneous applications and to the amount of memory available. The worst case performance degradation is shown to be below 10% with the benefit of allowing arbitrarily large/multiple applications to be deployed.
2589663
Hardware assisted control flow obfuscation for embedded processors
With more applications being deployed on embedded platforms, software protection becomes increasingly important. This problem is crucial on embedded systems like financial transaction terminals, pay-TV access-control decoders, where adversaries may easily gain full physical accesses to the systems and critical algorithms must be protected from being cracked. However, as this paper points out that protecting software with either encryption or obfuscation cannot completely preclude the control flow information from being leaked. Encryption has been widely studied and employed as a traditional approach for software protection, however, the control flow information is not 100% hidden with solely encrypting the code. On the other hand, pure software-based obfuscation has been proved inefficient to protect software due to its lack of theoretical foundation and considerable performance overhead introduced by complicated transformations. Moreover, even though obfuscation can prevent static reverse engineering, attacker can still successfully bypass the obfuscation by monitoring the dynamic program execution.To address all of these shortcomings, this paper presents a hardware assisted obfuscation technique that is capable of obfuscating the control flow information dynamically. Dynamic obfuscation changes memory access sequence on-the-fly and conceals recurrent instruction access sequences from being identified. Our scheme makes it provably difficult for the attacker to extract any useful information. Our results show that a high-level security protection is possible with only minor performance penalty. Finally, we show that our scheme can be implemented on embedded systems with very little hardware overhead.
2269011
Compiler optimizations to reduce security overhead
In this work, we present several compiler optimizations to reduce the overhead due to software protection. We first propose an aggressive rematerialization algorithm which attempts to maximally realize non-trusted values from other trusted values thereby avoiding the security cost for those non-trusted values. We further propose a compiler technique to utilize the secure storage in our machine model efficiently. To optimize the security cost on data that has to be stored in non-trusted storage, we propose a data grouping technique. Security operations can be performed over the group of data instead of over each piece separately. We show an interesting application of the data grouping technique to reduce the security cost. We test the effectiveness of our optimizations on a recently proposed software protection scheme that involves large overhead. Our results show that the above optimizations are effective and reduce the security overhead significantly.
17916955
Hardware-managed register allocation for embedded processors
Most modern processors (either embedded or general purpose) contain higher number of physical registers than those exposed in the ISA. Due to a variety of reasons, this phenomenon is likely to continue especially on embedded systems where encoding space is very limited. Saving the encoding space leads to lower power consumption in the I-cache; on the other hand, harnessing more physical registers saves power in the memory subsystem and reduces latency as well. These design decisions however result in the difficulty of register allocation for a compiler due to limited number of exposed registers at ISA level.In this paper, we therefore propose a hardware managed register allocation scheme to allocate more physical registers at runtime and to utilize them. As a byproduct, we also show that hardware managed register allocation has other merits such as better exploitation of low register pressure regions, more flexible management of caller-save/callee-save registers, etc.Our approach consists of both compiler and hardware enhancements. On the compiler side we assign variables at various stack offsets such that the offsets indicate the relative allocation priorities at runtime. The hardware is modified to identify such spills and make decisions whether they should be put in the (invisible) physical registers based on their relative priorities. Finally, our results show slight improvement in the instructions per cycle counts (IPC) but significant power consumption reduction in the cache.
1202850
Anycast Algorithms Supporting Optical Burst Switched Grid Networks
In this paper we consider implementing optical burst switching as a technology for building grids with computationally intensive requirements. This architecture has been referred to as grid-over-OBS (GoOBS). First, we briefly describe the proposed layered grid architecture and show how OBS can be positioned within the grid architecture. Then, we present a generic framework for anycast routing in the context of GoOBS when requests don't have an explicit destination address and they can be serviced by any appropriate grid resource. We also develop several algorithms to support anycasting when only a single copy of a request is transmitted. Through simulation analysis, we show the performance of our anycast algorithms and compare them with traditional shortest-path unicast routing in which all jobs have specific addresses. Our performance analysis focuses on blocking probability of requests and average end-to-end delay
6256698
Parallel high-throughput limited search trellis decoder VLSI design
Limited search trellis decoding algorithms have great potentials of realizing low power due to their largely reduced computational complexity compared with the widely used Viterbi algorithm. However, because of the lack of operational parallelism and regularity in their original formulations, the limited search decoding algorithms have been traditionally ruled out for applications demanding very high throughput. We believe that, through appropriate algorithm and hardware architecture co-design, certain limited search trellis decoding algorithms can become serious competitors to the Viterbi algorithm for high-throughout applications. Focusing on the well-known T-algorithm, this paper presents techniques at the algorithm and VLSI architecture levels to design fully parallel T-algorithm limited search trellis decoders. We first develop a modified T-algorithm, called SPEC-T, to improve the algorithmic parallelism. Then, based on the conventional state-parallel register exchange Viterbi decoder, we develop a parallel SPEC-T decoder architecture that can effectively transform the reduced computational complexity at the algorithm level to the reduced switching activities in the hardware. We demonstrate the effectiveness of the SPEC-T design solution in the context of convolutional code decoding. Compared with state-parallel register exchange Viterbi decoders, the SPEC-T convolutional code decoders can achieve almost the same throughput and decoding performance, while realizing up to 56% power savings. For the first time, this work provides an approach to exploit the low power potential of the T-algorithm in very high throughput applications.
17846455
Systematic Design of Original and Modified Mastrovito Multipliers for General Irreducible Polynomials
This paper considers the design of bit-parallel dedicated finite field multipliers using standard basis. An explicit algorithm is proposed for efficient construction of Mastrovito product matrix, based on which we present a systematic design of Mastrovito multiplier applicable to GF(2/sup m/) generated by an arbitrary irreducible polynomial. This design effectively exploits the spatial correlation of elements in Mastrovito product matrix to reduce the complexity. Using a similar methodology, we propose a systematic design of modified Mastrovito multiplier, which is suitable for GF(2/sup m/) generated by high-Hamming weight irreducible polynomials. For both original and modified Mastrovito multipliers, the developed multiplier architectures are highly modular, which is desirable for VLSI hardware implementation. Applying the proposed algorithm and design approach, we study the Mastrovito multipliers for several special irreducible polynomials, such as trinomial and equally-spaced-polynomial, and the obtained complexity results match the best known results. Moreover, we have discovered several new special irreducible polynomials which also lead to low-complexity Mastrovito multipliers.
579951
Improving performance of distribution tracking through background mismatch
This paper proposes a new density matching method based on background mismatching for tracking of nonrigid moving objects. The new tracking method extends the idea behind the original density-matching tracker, which tracks an object by finding a contour in which the photometric density sampled from the enclosed region most closely matches a model density. This method can be quite sensitive to the initial curve placements and model density. The new method eliminates these sensitivities by adding a second term to the optimization: the mismatch between the model density and the density sampled from the background. By maximizing this term, the tracking algorithm becomes significantly more robust in practice. Furthermore, we show the enhanced ability of the algorithm to deal with target objects, which possess smooth or diffuse boundaries. The tracker is in the form of a partial differential equation, and is implemented using the level-set framework. Experiments on synthesized images and real video sequences show our proposed methods are effective and robust; the results are compared with several existing methods.
14645298
Verifying Balanced Trees
Balanced search trees provide guaranteed worst-case time performance and hence they form a very important class of data structures. However, the self-balancing ability comes at a price; balanced trees are more complex than their unbalanced counterparts both in terms of data structure themselves and related manipulation operations. In this paper we present a framework to model balanced trees in decidable first-order theories of term algebras with Presburger arithmetic. In this framework, a theory of term algebras (i.e., a theory of finite trees) is extended with Presburger arithmetic and with certain connecting functions that map terms (trees) to integers. Our framework is flexible in the sense that we can obtain a variety of decidable theories by tuning the connecting functions. By adding maximal pathand minimal pathfunctions, we obtain a theory of red-black trees in which the transition relation of tree self-balancing (rotation) operations is expressible. We then show how to reduce the verification problem of the red-black tree algorithm to constraint satisfiability problems in the extended theory.