FoC: The Firewall-on-Chip Project: High-Grade Security for Middleware-Based Distributed Real-Time Embedded Systems
Keywords: Middleware Security, Application-Level Security, Multilevel Security, Security Gateway, Security Enforcement Hardware, FPGA, ASIC, CORBA, SOAP, Embedded Firewall
Motivation: More and more highly security-critical information is processed in distributed real-time embedded (DRE) IT systems. Typically, such critical information is security-classified. The interactions among the applications deployed over multiple nodes are often interactions among systems and subsystems of different classification, trustworthyness, or security administration. Such interactions must be security-controlled, and these controls must be non-bypassable, evaluatable, always invoked, and tamper-proof (NEAT). Even though the security controls must work at a protocol level that is specific and fine-grained enough to deal with information at the application level, any solution must be generically applicable to all DRE applications operated in a DRE environment.
Goals:
A security solution that
(1) is suitable (cost, size, weight, power consumption)
for typical embedded systems,
(2) is generally applicable,
(3) supports multilevel security models for confidentiality
as well as integrity, and
(4) guarantees NEAT characteristics.
Approaches:
This project explores a combination of the following approaches:
(1) Implementation of security controls between nodes as
security gateways (non-bypassable, evaluatable,
always invoked),
(2) Fine-grained (application-specific), yet generic security controls
of interactions through the detailed inspection of all messages
of the supported middleware technologies (CORBA etc.),
(3) Hardware implementation of the security control functions
(field-programmable gate arrays and tamper-proofness).
Results:
The firewall-on-chip has been implemented as a proof-of-concept,
which incorporates the following components:
(1) fully developed concept of a security architecture
(2) a secured memory controller
(3) a high-performance content check module
(4) integrated high-performance hashed-message authentication code
Research Team: Enrico Heinrich, Marian Lüder, Sebastian Staamann, and Ralf Salomon
Contact: Ralf Salomon
Selected Publications:
- Heinrich, E., Lüder, M., Joost, R., Salomon, R. FPGA-based Implementation Alternatives for Keyed-Hash Message Authentication Code in Networked Embedded Systems. In Proceedings of the 14th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA 2009), 2009.
- Heinrich, E., Staamann, S., Joost, R., Salomon, R. Comparison of FPGA-based Implementation Alternatives for Complex Algorithms in Networked Embedded Systems - the Encryption Example. In Proceesings of the 13th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA 2008), pp. 1449-1456, 2008.
Partners:
