[
attachment=10291]
HARDWARE ARCHITECTURE FOR DATA SECURITY
Introduction
In recent years, the importance of security in the information technology has increased significantly. To guarantee confidentiality and authenticity of information, there are software and hardware oriented algorithms. In addition to software solutions, hardware could be realized to increase security requirements. Naturally, hardware modules offer higher protection against unauthorized manipulations than software. In addition, they lead to higher processing speeds, which allow high speed applications. Compared to software and ASIC designs, FPGA platforms create a good compromise between high performance and maintaining the capability of reconfiguration.
The hardware implementations of resource protection schemes are significantly faster than their software realizations. Further, they are not affected by malicious tasks as is the case with software approach. This work proposes the development of hardware architecture for data and resource security using authenticated semaphore switching algorithms, design and on-chip hardware implementations. The algorithm and the architecture of the components are proposed to be designed and coded in Verilog, a popular Hardware Design Language (HDL).
The complete architecture is to be first coded in MATLAB in order to understand the concepts and methodologies proposed. In the next phase, results are to be obtained using Verilog implementation.
Literature review
Computer security is severely threatened by software vulnerabilities, such as buffer overrun, format string etc. A low overhead, software-only information flow tracking system called LIFT [1] minimizes run-time overhead by exploiting dynamic binary instrumentation and optimizations for detecting various types of security attacks without requiring any hardware changes. More specifically, LIFT aggressively eliminates unnecessary dynamic information flow tracking.
Secure program via dynamic information flow tracking [2] is a hardware mechanism to protect programs against malicious attacks by identifying spurious information flows at run time and restricting the usage of spurious information. On every operation, a processor determines whether the result is spurious or not based on the inputs and the type of the operation. With the tracked information flows, the processor can easily check whether an
instruction or a branch target is spurious or not, which prevents changes of control flows by potentially malicious inputs and dynamic data generated from them.
The General information flow tracking (GIFT) [3] is for C programs that allows application specific tags with input data, instruments the application to propagate these tags to all the other data that are control / data-dependent on them and invokes application specific processor on output data according to their tag values.
Raksha [4] is architecture for software security based on dynamic information flow tracking (DIFT). Raksha provides three novel features that allow for a flexible hardware/ software approach to security. First, it supports flexible and programmable security policies that enable software to direct hardware analysis towards a wide range of high-level and low-level attacks. Second, it supports multiple active security policies that can protect the system against concurrent attacks. Third, it supports low-overhead security handlers that allow software to correct, complement, or extend the hardware-based analysis without the overhead associated with operating system traps.
Architecture for self-healing Databases under Cyber Attacks [5] proposes five different architectures, for self-healing databases under malicious attacks. While traditional secure database systems rely on prevention controls, a self-healing database system can automatically estimate, locate, isolate, contain and repair damage caused by attacks in such a way that the database can ‘heal’ itself on-the-fly and continue delivering essential services in the face of attacks. With a focus on attacks by malicious transactions, Architecture1 can detect intrusions and locate and repair the damage caused by the intrusions. Architecture2 enhances Architecture1 with the ability to isolate attacks so that the database can be immunized from the damage caused by a lot of attacks. Architecture 3 enhances Architecture1 with the ability to dynamically contain the damage in such a way that no damage will leak out during the attack recovery process. Architecture4 enhances Architecture2 and 3 with the ability to adapt the self healing controls to the changing environment so that a stabilized level of healthiness can be maintained. Architecture5 enhances Architecture4 with the ability to deliver differential, quantitative services to customers.
Existing hardware and software security systems focus on memory corruption attacks using a single, fixed security policy. In this approach, instead of tracking each and every data and channel, it is proposed to design the tasks or channels with malicious code to access only the virtual copy of the resource. And also emphasizing on using mutex, binary and counting semaphores depending on the required security level.
Need for the study
Recent developments in information system technologies have resulted in computerizing many applications in various business areas. Data has become a critical resource in many organizations and therefore, efficient access to data, sharing the data, extracting information from the data and making use of the information has become an urgent need.
In modern computing systems, data security is becoming increasingly important. Computers store tremendous amounts of sensitive information. Personal and business computers store private data such as tax information, banking information, and credit card numbers. Computers used for military applications store extremely sensitive information where confidentiality is critical. Since these computers are often connected to potentially hostile public networks, such as the Internet, security mechanisms to protect the confidentiality of this data are vital.
In recent years, the importance of security in the information technology has increased significantly. As computer resources are affected by malicious attacks, to guarantee confidentiality and authenticity of information, it is necessary to protect them from tasks that cause malicious attacks.