System Architecture Design

More documents

Recommendations

Info

pSHIELDSystem Architecture DesignPU2002; Kelsey et al. 1998]. Tamper resistance measures must, therefore, secure the systemimplementation when it is subject to various physical and side-channel attacks. Later in this paper (seeSection 6), we will discuss some examples of embedded system attacks and related countermeasures.Assurance Gap: It is well known that truly reliable systems are much more difficult to build than thosethat merely work most of the time. Reliable systems must be able to handle the wide range of situationsthat may occur by chance. Secure systems face an even greater challenge: they must continue to operatereliably despite attacks from intelligent adversaries who intentionally seek out undesirable failure modes.As systems become more complicated, there are inevitably more possible failure modes that need to beaddressed. Increases in embedded system complexity are making it more and more difficult forembedded system designers to be confident that they have not overlooked a serious weakness.Cost: One of the fundamental factors that influence the security architecture of an embedded system iscost. To understand the implications of a security related design choice on the overall system cost,consider the decision of incorporating physical security mechanisms in a single-chip cryptographicmodule. The Federal Information Processing Standard (FIPS 140-2) [FIPS] specifies four increasinglevels of physical (as well as other) security requirements that can be satisfied by a secure system.Security Level 1 requires minimum physical protection, Level 2 requires the addition of tamper-evidentmechanisms such as a seal or enclosure, while Level 3 specifies stronger detection and responsemechanisms. Finally, Level 4 mandates environmental failure protection and testing (EFP and EFT), aswell as highly rigorous design processes. Thus, we can choose to provide increasing levels of securityusing increasingly advanced measures, albeit at higher system costs, design effort, and design time. It isthe designer’s responsibility to balance the security requirements of an embedded system against the costof implementing the corresponding security measures.4.1.2 DependabilityThe protection and survival of networked systems and services that are running on those systems is themain concern of an SPD driven architecture. In different circumstances, different properties of suchservices are the ones that we focus on sustaining. These are, per example, the average response time ofthe service, the capability to prevent intrusions, the ability to produce the required output and the ability tosurvive a catastrophic failure.Dependability sums up those concerns under a common framework. We can identify three main parts tothe concept of dependability.• The threats• The attributes• The meansPUD2.3.2Issue 5 Page 50 of 122
pSHIELDSystem Architecture DesignPUFigure 13– Dependability concept taxonomy.The five fundamental properties of a computing system are• Functionality• Usability• Performance• Cost• DependabilityDependability is the ability of the system to deliver a service in a justifiable trusted way. The function ofthe system is the intended output of the system and is described in the functional specifications of thesystem. Correct service is delivered when the system is providing the intended function as perspecification. System failure is the incorrect service provisioning. Dependability can also be described asthe ability of a system to avoid failures that are more frequent, more severe and last longer than the user’sexpectations.4.1.2.1 The threatsA system failure can occur when either the system does not comply with the functional specification or thespecification does not describe adequately its function. An error is the part of the system state that canintroduce a failure. The actual failure occurs when the error reaches the system’s interface. The fault isthe cause of an error. The ways in which a system can fail are its failure modes and can be rankedaccording to severities.A system is the whole of interacting components; therefore a system state is the set of its componentstates. A fault causes an error on one or more system components. A system failure occurs only whenthose errors reach the service interface of the system.We identify three major fault classes• Design faults• Physical faults• Interaction faultsThe semantics of the terms fault, error and failure reflect the current usagePUD2.3.2Issue 5 Page 51 of 122
Page 1 and 2: Project no: 100204pSHIELDpilot embe
Page 3 and 4: Contents1 Executive Summary .......
Page 5 and 6: FiguresFigure 1 - A generic embedde
Page 7 and 8: Figure 45 - pSHIELD Security Agent
Page 9 and 10: MGFMIPSMLNeLNFMRFPNMPNMPSNoLNVMOLOS
Page 11 and 12: Issue 5Page xi
Page 13 and 14: pSHIELDSystem Architecture DesignPU
Page 19 and 20: pSHIELDSystem Architecture Design3.
Page 31 and 32: pSHIELDSystem Architecture Design
Page 39 and 40: pSHIELDSystem Architecture Design
Page 47 and 48: pSHIELDSystem Architecture Designen
Page 49: pSHIELDSystem Architecture DesignPU
Page 101 and 102:
pSHIELDSystem Architecture DesignPU
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
show all

System Architecture Design

Create successful ePaper yourself

Delete template?

Save as template?