Boost MCU security AND performance with hardware accelerated crypto
In contemporary computer and communication systems, cryptography is employed to secure data and achieve four purposes:
1. Confidentiality – Data is protected by hiding its meaning, often within nonsensical data.
2. Authentication – The person or party providing the data, document or content has been verified.
3. Data integrity – When data is received, the receiver is assured that the data has not been tampered with or changed.
4. Non-repudiation – When an individual takes responsibility for an action, such as a commitment to purchase something, that commitment cannot be denied or repudiated at a later time.
These different purposes for data security figure prominently in a wide variety of end user applications deployed extensively all over the world, including Web browsing, e-commerce, secure wireless communication links, virtual private networks (VPN) and many others.
Building on security
Many embedded systems are based on the Linux open source operating system and there are a number of specialized security frameworks that can be implemented in Linux systems. In addition, several open source cryptographic algorithms will plug into these security frameworks and provide them with cryptographic capabilities. Here are a few:
1. Specialized security frameworks . Some of the most prevalent open source security frameworks include the following:
* OpenSSL – Implements two secure communications protocols, the Transport Layer Security (TLS) and Secure Socket Layer (SSL) protocols.
* WPA Supplicant – Implements the IEEE 802.11i security mechanisms for wireless local area networks (Wi-Fi).
* Dropbear – Implements a secure server and client.
* OpenSSH – Implements a secure server, client and file transfer protocol (FTP) server.
* OCF-Linux – Implements a cryptographic framework and an application programming interface (API) that eases development with high-level cryptographic software.
2. Cryptographic algorithms. Some of the common cryptographic algorithms which are integrated into security applications are the following:
* Data Encryption Standard (DES) – The DES encryption algorithm was developed in the 1970s. Although it has been widely deployed over the years, it has subsequently been superseded by other algorithms.
* 3Data Encryption Standard (3DES) – 3DES performs DES encryption three times to strengthen the protection of the encrypted data and overcome some of vulnerabilities of the DES algorithm.
* Advanced Encryption Standard (AES) – AES is one of the most advanced cryptographic algorithms in widespread use today.
3. Hashing functions. Another type of cryptographic algorithm is known as “hashing” or a “hash function.” A hash function is applied to data to create a hash value or “digest”. Surreptitious or accidental changes to the data will change the hash value.
Hashing is particularly useful in certain cryptographic operations such as digital signatures, data integrity, non-repudiation, message authentication and other forms of authentication. Several hashing algorithms have been standardized and are in common use today, including the following:
* Message Digest Algorithm (MD5) – Although this hashing function has been widely deployed, it has certain vulnerabilities in some applications.
* Secure Hash Algorithm (SHA) – SHA has gone through several generations, the strongest of which is a 256-bit function.
4. Random number generators. Another important aspect of many security applications is a random number generator. Random numbers are used by several of the functions which comprise a security subsystem, including encryption algorithms and hashing functions.
It should be noted that random numbers generated in software are not always true random numbers. Hardware-generated random numbers are more often truly random.
5. Hardware acceleration vs. software execution. How and where cryptographic algorithms are processed is another important consideration for developers. Saddling the system’s main CPU with the burden of processing computationally-intense cryptographic code will siphon processing cycles away from the system’s user applications and possibly detract from the user experience.
Some embedded processors, such as several of TI’s Sitara devices, have been equipped with hardware-based accelerators dedicated to cryptographic processing.
These specialized accelerators offload the bulk of the cryptographic processing from the system’s CPU so that the CPU’s processing bandwidth is retained for end user application processing. As a result, the overall throughput of the system is optimized.
Loading comments... Write a comment