Fast Implementation of Elliptic Curve Cryptographic Algorithm on GF(3M) Based on FPGA

As quantum computing and the theory of bilinear pairings continue being studied in depth, elliptic curves on GF(3m ) are becoming of an increasing interest because they provide a higher security. What’s more, because hardware encryption is more efficient and secure than software encryption in today's IoT security environment, this article implements a scalar multiplication algorithm for the elliptic curve on GF(3m ) on the FPGA device platform. The arithmetic in finite fields is quickly implemented by bit-oriented operations, and then the computation speed of point doubling and point addition is improved by a modified Jacobia projection coordinate system. The final experimental results demonstrate that the structure consumes a total of 7518 slices, which is capable of computing approximately 3000 scalar multiplications per second at 124 Mhz. It has relative advantages in terms of performance and resource consumption, which can be applied to specific confidential communication scenarios as an IP core.

Physically Unclonable Functions with Confidential Computing for Enhanced Encryption of EHRs

Continual exploitation of Electronic Health Records (EHRs) has led to increasing amounts of ransomware and identity theft in recent years. Existing cryptosystems protecting these EHRs are weak due to their inherently transparent software that allows adversaries to extract encryption keys with relative ease. I designed a novel cryptosystem that employs Physically Unclonable Functions (PUFs) to securely encrypt user EHRs in a protected SGX enclave. The CPU-attached PUF provides a secret, device-unique value or a ‘digital fingerprint’ which is used to derive a symmetric key for subsequent AES-NI hardware encryption. Since the cryptographic operations, from key derivation to encryption, transpire in a confidential SGX enclave, the keys are always protected from OS-privileged attacks- a capability lacking in most existing systems. I used my system APIs to evaluate the performance of various hash and encryption schemes across multiple EHR block sizes. SHA512 and AES-NI-256-GCM were selected for cryptosystem implementation because they demonstrated high performance without compromising on security.

Physically Unclonable Functions with Confidential Computing for Enhanced Encryption of EHRs

Continual exploitation of Electronic Health Records (EHRs) has led to increasing amounts of ransomware and identity theft in recent years. Existing cryptosystems protecting these EHRs are weak due to their inherently transparent software that allows adversaries to extract encryption keys with relative ease. I designed a novel cryptosystem that employs Physically Unclonable Functions (PUFs) to securely encrypt user EHRs in a protected SGX enclave. The CPU-attached PUF provides a secret, device-unique value or a ‘digital fingerprint’ which is used to derive a symmetric key for subsequent AES-NI hardware encryption. Since the cryptographic operations, from key derivation to encryption, transpire in a confidential SGX enclave, the keys are always protected from OS-privileged attacks- a capability lacking in most existing systems. I used my system APIs to evaluate the performance of various hash and encryption schemes across multiple EHR block sizes. SHA512 and AES-NI-256-GCM were selected for cryptosystem implementation because they demonstrated high performance without compromising on security.

Anti-Counterfeit Technologies for Microfluidic “Lab-on-a-Disc” Systems

Non-genuine medical products, including diagnostic devices, have become a lucrative business for fraudsters, causing significant damage to revenues and reputation of companies, as well as posing a significant risk to the health of people and societies. Along a “digital twin” representing centrifugal microfluidic flow control on exemplary “Lab-on-a-Disc” (LoaD) systems, a novel, two-pronged strategy to safeguard miniaturized point-of-care devices by means of secret features and manufacturing challenges is outlined; such “hardware encryption” is flexibly programmed for each chip during production, and deciphered from a secure, local or online database at the time of use. This way, unlicensed copying may be efficiently deterred by an unfavourable economy-of-scale, even in absence of legal prosecution.

Client-Aware Negotiation for Secure and Efficient Data Transmission

In Wireless Sensor Networks (WSNs), server clusters, and other systems requiring secure transmission, the overhead of data encryption and transmission is often not negligible. Unfortunately, a conflict exists between security and efficiency in processing data. Therefore, this paper proposes a strategy to overcome this conflict, called Client-Aware Negotiation for Secure and Efficient Data Transmission (CAN-SEAT). This strategy allows a client with different security transmission requirements to use the appropriate data security transmission without modifying the client. Two methods are designed for different clients. The first method is based on two-way authentication and renegotiation. After handshakes, the appropriate data security transmission scheme is selected according to the client requirements. Another method is based on redirection, which can be applied when the client does not support two-way authentication or renegotiation. For the characteristics of different architecture, this paper classifies and discusses symmetric key algorithms, asymmetric key algorithms, and hardware encryption instructions. In four application scenarios, the CAN-SEAT strategy is tested. Compared with the general transmission strategy, when only software encryption is used, the data processing and transmission cost can be reduced by 89.41% in the best case and by 15.40% in the worst case. When supporting hardware encryption, the cost can be reduced by 85.30% and 24.63%, respectively. A good effect was produced on the experimental platforms XiLinx, FT-2000+, and Intel processors. To the best of our knowledge, for Client-Aware Negotiation (CAN), this is the first method to be successfully deployed on a general system. CAN-SEAT can be easily combined with other energy-efficient strategies.

Analyses and Encryption Implementation of a New Chaotic System Based on Semitensor Product

Semitensor product theory can deal with matrices multiplication with different numbers of columns and rows. Therefore, a new chaotic system for different high dimensions can be created by employing a semitensor product of chaotic systems with different dimensions, so that more channels can be selected for encryption. This paper proposes a new chaotic system generated by semitensor product applied on Qi and Lorenz systems. The corresponding dynamic characteristics of the new system are discussed in this paper to verify the existences of different attractors. The detailed algorithms are illustrated in this paper. The FPGA hardware encryption implementations are also elaborated and conducted. Correspondingly, the randomness tests are realized as well, and compared to that of the individual Qi system and Lorenz system, the proposed system in this paper owns the better randomness characteristic. The statistical analyses and differential and correlation analyses are also discussed.

On-Device Power Analysis Across Hardware Security Domains.

Side-channel power analysis is a powerful method of breaking secure cryptographic algorithms, but typically power analysis is considered to require specialized measurement equipment on or near the device. Assuming an attacker first gained the ability to run code on the unsecure side of a device, they could trigger encryptions and use the on-board ADC to capture power traces of that hardware encryption engine.This is demonstrated on a SAML11 which contains a M23 core with a TrustZone-M implementation as the hardware security barrier. This attack requires 160 × 106 traces, or approximately 5 GByte of data. This attack does not use any external measurement equipment, entirely performing the power analysis using the ADC on-board the microcontroller under attack. The attack is demonstrated to work both from the non-secure and secure environment on the chip, being a demonstration of a cross-domain power analysis attack.To understand the effect of noise and sample rate reduction, an attack is mounted on the SAML11 hardware AES peripheral using classic external equipment, and results are compared for various sample rates and hardware setups. A discussion on how users of this device can help prevent such remote attacks is also presented, along with metrics that can be used in evaluating other devices. Complete copies of all recorded power traces and scripts used by the authors are publicly presented.

Hardware/Software Adaptive Cryptographic Acceleration for Big Data Processing

Along with the explosive growth of network data, security is becoming increasingly important for web transactions. The SSL/TLS protocol has been widely adopted as one of the effective solutions for sensitive access. Although OpenSSL could provide a freely available implementation of the SSL/TLS protocol, the crypto functions, such as symmetric key ciphers, are extremely compute-intensive operations. These expensive computations through software implementations may not be able to compete with the increasing need for speed and secure connection. Although there are lots of excellent works with the objective of SSL/TLS hardware acceleration, they focus on the dedicated hardware design of accelerators. Hardly of them presented how to utilize them efficiently. Actually, for some application scenarios, the performance improvement may not be comparable with AES-NI, due to the induced invocation cost for hardware engines. Therefore, we proposed the research to take full advantages of both accelerators and CPUs for security HTTP accesses in big data. We not only proposed optimal strategies such as data aggregation to advance the contribution with hardware crypto engines, but also presented an Adaptive Crypto System based on Accelerators (ACSA) with software and hardware codesign. ACSA is able to adopt crypto mode adaptively and dynamically according to the request character and system load. Through the establishment of 40 Gbps networking on TAISHAN Web Server, we evaluated the system performance in real applications with a high workload. For the encryption algorithm 3DES, which is not supported in AES-NI, we could get about 12 times acceleration with accelerators. For typical encryption AES supported by instruction acceleration, we could get 52.39% bandwidth improvement compared with only hardware encryption and 20.07% improvement compared with AES-NI. Furthermore, the user could adjust the trade-off between CPU occupation and encryption performance through MM strategy, to free CPUs according to the working requirements.