Security Issues

May 21, 2015, Imagination Summit, Santa Clara, CA—Tony King-Smith from Imagination talked about the long-term problems for security in embedded systems. The results of a breach can be very sinister and difficult to eradicate.

Lately, the world has seen many new attack vectors like “heart bleed” and the IoT will have high consequences for consumers due to the many use cases. Individual devices will give multiple domains access through some box or gateway and through the cloud infrastructure. One problem is that there are many places where a bad payload could piggyback into a nominally secure environment.

The old architectures don’t help in this multi-domain structure, because they are CPU-centric and focus on securing the CPU. If the attack comes through other infrastructure, the CPU may still be secure even as malware works its way throughout the rest of the system. A new architecture can be implemented in a heterogeneous SoC, starting with unified memory for zero-copy inter-process communications.

This change can be to an open platform with the understanding that poor interoperability exacerbates the problems of data transfers. Changing from a CPU-centric perspective to a full platform enables security features to be active across the entire system, making a hack more difficult.

Imagination is announcing Omni-Shield, a collection of hardware and software features that will eventually protect all of the hardware and software within a multi-domain platform. The security features are hardware enforced through dynamic hardware virtualization. This architecture enables all domains to be secure and may even simplify the software by enabling closed containers for the data.

The principal elements for this IP are hardware virtualized CPU and GPU, working with a coherent fabric and a trusted hypervisor. Because everything is virtual or para-virtualized it is relative easy for the security functions to observe and detect any anomalies in device behavior. Connectivity and other data transfer functions that off-load the CPU are covered under the security umbrella. In addition, the root of trust for the system is built into the hardware to make the system ery difficult to breach.

So far the MIPS CPUs and Power VR GPUs are already converted to the new architecture. The next building blocks will be in the Enigma RPU,and the PowerVR video and vision subsystems. Other IP blocks will be built with root of trust features over time, and reference platforms and SDKs will be available for the new features. The main feature set and security functions are part of the prpl foundation, which was started by Imagination, and initial CPU is the MIPS architecture. See the press release at http://www.imgtec.com/news/detail.asp?ID=989