Randomization for Safer, More Reliable and Secure, High-Performance Automotive Processors
Total Page：16
File Type：pdf, Size：1020Kb
Randomization for Safer, more Reliable and Secure, High-Performance Automotive Processors David Trillay;z, Carles Hernandezy, Jaume Abellay, Francisco J. Cazorla?;y y Barcelona Supercomputing Center (BSC). Barcelona, Spain z Universitat Politecnica` de Catalunya (UPC), Barcelona, Spain ? Spanish National Research Council (IIIA-CSIC). Barcelona, Spain. Abstract—The automotive domain is witnessing a relentless As an illustrative example, for security, randomization tech- transition to autonomous cars demanding high-performance niques reduce the possibility of inferring information from processors to timely execute complex, critical, decision-making software. The other side of the coin is that high-performance experimentation since execution time does not correlate any processors include hardware features like shared multilevel longer with the particular values of sensitive data, thus chal- caches and multiple cores that expose the system to significant lenging malicious attempts to obtain information. For the case security threats, challenge time predictability, and jeopardize of cache side-channel attacks, memory layout randomization reliable operation due to the use of advanced process technology. In this paper, we discuss how introducing randomization in the avoids inter-task conflicts in the cache between the victim and non-functional behavior of certain hardware components helps to the attacker processes, preventing these conflicts from leaking achieve a three-fold objective while preserving high-average per- information since the memory layout, and so cache conflicts, formance capabilities of high-performance processors: improving is different and random for every re-execution. the security of complex processors, favoring time predictability via probabilistic analysis, and enhancing reliability against aging In this paper, with focus on the future computing platforms and voltage noise. that will be deployed in the automotive domain, we make the Index Terms—Real-Time Embedded Systems, Security, Relia- following contributions: bility, Time-Predictability 1) From a conceptual point of view, we show how inject- I. INTRODUCTION ing randomization in hardware/software non-functional The design of processors for the automotive domain has behavior can together protect against certain security been traditionally driven by safety constraints. This is defined threats, improve hardware reliability, and time pre- in domain-specific standards, e.g. ISO26262, that specify for dictability of complex processors in automotive, with each automotive safety integrity level (ASIL) the maximum minimum effects on average performance. failure rate that is tolerated as well as the safety requirements. 2) From a practical point of view, we discuss how random- The advent of autonomous driving cars is forcing automo- ization techniques align with the automotive industry tive industry to adopt massively-parallel processors delivering requirements. We also illustrate the associated average much higher performance to timely execute complex data- performance and implementation costs of randomization management and decision-making software, which already by respectively analyzing the performance and modifi- comprises more than 100 million lines of code [12]. Recently, cations applied to a commercially available multicore some high-performance processor designs have been proposed processor targeting the space domain. for the automotive domain such as those in the NVIDIA Overall, we show that injecting randomization in future DrivePX and the RENESAS R-Car H3 platforms. Unfortu- high-performance processor designs for cars (Section II) is a nately, high-performance processors do not only bring higher promising solution to cover automotive security (section III), computational capabilities, but an associated unprecedented time predictability (Section IV), and reliability (Section V) complexity that creates difficulties in the verification of the needs of future automotive chips while its implementation and security, reliability, and time predictability properties of the average-performance overheads can be contained (section VI). system. To make things worse, despite some synergies, the typical countermeasures to handle complexity for each of these II. HARDWARE AND SOFTWARE EVOLUTION IN metrics are to some extent mutually exclusive. For instance AUTOMOTIVE COMPUTING SYSTEMS verifying reliability properties requires detailed information about processor internals (observability) while security de- The demand for higher levels of automation carries huge mands for the opposite (opacity). Likewise, hardware features changes on the software side. Software implements critical like caches help to improve the average performance of the functionalities such as learning and adaptation to the envi- system but challenge predictability and security due to the ronment, and manages huge and diverse sets of data. In fact, existing dependence between input data and execution time. software is becoming one of the main competitive factors in Interestingly, injecting randomization at different layers of every car generation. This has resulted in the software footprint the computing system has been shown beneficial in different in cars already reaching hundreds of millions of lines of code, domains to optimize metrics such as security, resilience to and an increase in software’s performance needs. According software bugs, hardware reliability and even timing analysis. to ARM prospects achieving fully autonomous cars requires © 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes,creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. DOI 10.1109/ MDAT.2019.2927373 execution time variability and interferences between different software components, that can be used by external attackers to extract sensitive information such as cryptographic keys through side-channel attacks. Complex computing hardware prevents managing auto- motive security, time-predictability and reliability with per- component ad-hoc solutions requiring specific verification means given that verification cost is already huge in much simpler platforms. Instead, a global strategy is needed to address security, time-predictability and reliability holistically without significantly increasing verification costs. III. SECURITY Connected vehicles have become one of the major goals of Fig. 1. Illustrative example of chip complexity evolution in automotive. car makers given their potential to, for instance, provide the user with new software updates that add new features and an unprecedented increase in computing power, up to 100X enhance existing functionality. These interconnection capa- with respect to that achievable in 2016. bilities compounded with the utilization of high-performance At hardware level, the integration of new functionalities processor, can be used by malicious software to perform in cars forces manufacturers to include not only a higher several types of attacks. In particular, we focus on: side number of on-board electronic control units (ECU), but also channel attacks, unauthorized control information tampering replacing some of these relatively simple microcontrollers by and denial of service. much more complex processor designs as a way to contain their number. However, one of the most critical aspects of A. Unauthorized control information tampering (UCIT) using high-performance processor designs in the automotive UCIT vulnerabilities include many common software- domain relates to the increase of the complexity and cost related security problems such as buffer overflow, format of the verification process that aims at showing that designs string, integer overflow, and double-freeing of heap buffer. comply with the robustness criteria specified in the ISO26262 Attackers exploit these vulnerabilities by changing control standard. Figure 1 shows an illustrative architecture of today’s information with the purpose of pointing to the attacker’s lock-step ECU devoted to ASIL-D applications, a complex malicious code. These attacks do not depend on the potential processor used for driving assistance systems, and a comput- actions on the user side but simply exploit existing program ing platform proposed for autonomous cars. As shown, the bugs to attack the system. degree of hardware complexity and parallelism – reaching its Benefits of Randomization. Randomization offers a path to maximum exponent with Graphics Processing Units (GPUs) – address UCIT attacks by relocating both position independent increases significantly to respond to the exponential increase in and dependent regions either by software or hardware means. performance demands. In lock-step CPUs, critical applications Different randomization schemes based on memory layout are relatively simple and low-performance demanding. In randomization can effectively protect the system from UCIT the data-fusion chip, critical applications require some more vulnerabilities by randomizing the locations of critical data performance – provided by the ASIL-D AURIX processor – elements and thus, making difficult, if at all possible, for an while high-performance applications execute on a lower ASIL attacker to exactly determine the runtime locations of vulnera- (e.g. ASIL-B) hardware. Finally, in the chip