Security policy enforcement in modern SoC designs

Modern SoC designs incorporate several security policies to protect sensitive assets from unauthorized access. The policies affect multiple design blocks, and may involve subtle interactions between hardware, firmware, and software. This makes it difficult for SoC designers to implement these policies, and system validators to ensure adherence. Associated problems include complexity in upgrading these policies, IP reuse for systems targeted for markets with differing security requirement, and consequent increase in design time and time-to-market. In this paper, we address this important problem by developing a generic, flexible architectural framework for implementing arbitrary security policies in SoC designs. Our architecture has several distinctive features: (1) it relies on a dedicated, centralized, firmware-upgradable plug-and-play IP block that can implement diverse security policies; (2) it interfaces with individual IP blocks through their “security wrapper”, which exploits and extends test/debug wrappers; (3) it implements a security policy as firmware code following existing security policy languages; (4) it can implement any security policy as long as relevant observable and controllable signals from the constituent IPs are accessible through the security wrappers; and (5) it realizes a low-overhead communication link between security wrappers of IP blocks and the centralized, dedicated controller. The approach builds on and extends the recent work on developing a centralized infrastructure IP for SoC security, referred to as IIPS, that interface with IP blocks using their boundary scan based wrappers. While this architecture is generic and independent of security policy types, we provide case studies with several common policies to show the flexibility and extendibility of the architecture. We also evaluate its viability in terms of overhead in area and power.

Verification of security policies represents one of the most critical, complex, and expensive steps of modern SoC design validation. SoC security policies are typically implemented as part of functional design flow, with a diverse set of protection mechanisms sprinkled across various IP blocks. An obvious upshot is that their verification requires comprehension and analysis of the entire system, representing a scalability bottleneck for verification tools. The scale and complexity of industrial SoC is far beyond the analysis capacity of state-of-the-art formal tools; even simulation-based security verification is severely limited in effectiveness because of the need to exercise subtle corner-cases across the entire system. We address this challenge by developing a novel security architecture that accounts for verification needs from the ground up. Our framework, ArtiFact, provides an alternative architecture for security policy implementation that exploits a flexible, centralized, infrastructure IP and enables scalable, streamlined verification of these policies. With our architecture, verification of system-level security policies reduces to analysis of this single IP and its interfaces, enabling off-the-shelf formal tools to successfully verify these policies. We introduce a CAD flow that supports both formal and dynamic (simulation-based) verification, and is built on top of such off-the-shelf tools. Our approach reduces verification time by over 62X and bug detection time by 34X for illustrative policies.

Security policies by design in NoSQL document databases

Mobile devices such as smartphones and tablets are widely used for personal and business uses. Compared to personal mobile subscribers, enterprises have more concerns about mobile device security. The challenges an enterprise may face include unlimited access to corporate resources, lack of encryption on corporate data, unwillingness to backup data, etc. Many of these issues have been resolved by auditing and enforcing security policies in enterprise networks. However, it is difficult to audit and enforce security policies on mobile devices. A substantial discrepancy exists between enterprise security policy administration and security policy enforcement. In this paper, we propose a framework, MobileGuardian, for security policy enforcement on mobile devices. Security policy enforcement is further divided into four issues, i.e., sensitive data isolation, security policy formulation, security policy testing, and security policy execution. The proposed framework is secure, flexible, and scalable. It can be adopted on any mobile platforms to implement access control, data confidentiality, security, and integrity.

With the growing complexities of modern SoC designs and increasingly shortened time-to-market requirements, new design paradigms such as outsourced design services have emerged. Design abstraction level has also been raised from RTL to ESL. Modern SoC designs in ESL often integrate a variety of third-party behavioral intellectual properties, as well as intensively utilizing EDA tools to improve design productivity. However, this new design trend makes modern SoCs more vulnerable to hardware Trojan attacks. Although hardware Trojan detection has been studied for more than a decade in RTL and lower levels, it has only recently gained attention in ESL designs. In this paper, we present a novel approach for generating test cases by selective concolic testing to detect hardware Trojans in ESL. We have evaluated our approach on an open source benchmark that includes various types of hardware Trojans. The experimental results demonstrate that our approach is able to detect hardware Trojans effectively and efficiently.

Despite their importance to the implementation of security and defence policy, less dramatic and more incremental events remain relatively overlooked in the study of security policymaking. Framing these as mid-range instances of security policymaking and applying a norm-dynamics framework, this article addresses that gap. It aims to elucidate how strategic culture, institutionalized norms, and discursive strategies interact to shape this layer of policymaking, drawing on an analysis of the Swedish parliament’s ratification of NATO’s Partnership for Peace programme in 1994 and the Host Nation Support agreement in 2016. The study shows how underlying mechanics in norm dynamics continue to be instrumental for policy transformation in the absence of crisis and war. The findings suggest that institutional inertia rooted in enduring norms acts as a brake on more radical security policy shifts, even when a nation’s security landscape is in flux. The study offers insights relevant for the analysis of the subtler norm dynamics in other parliamentary democracies facing similar mid-range security policy questions. Studying these more modest, incremental forms of policymaking is valuable in a context of shifting power alliances and normative uncertainty in global politics.

Trust represents a fundamental pillar of contemporary security policy, influencing decision-making processes, institutional stability, and the effectiveness of security measures at both national and international levels. This article explores trust as a key precondition for the formulation and implementation of security policy, emphasizing its role in relations between states, within security institutions, and between public authorities and society. The analysis focuses on trust as a multidimensional concept encompassing political legitimacy, transparency, accountability, and the credibility of security actors. Particular attention is paid to the consequences of declining trust, including increased social polarization, weakened resilience of democratic systems, and reduced effectiveness of collective security arrangements. The article argues that building and maintaining trust is not merely a normative objective, but a strategic necessity for ensuring long-term security and stability in an increasingly complex and uncertain security environment.Through comparative analysis of selected European states (Finland, Germany, Czech Republic, Poland, Hungary, France, and Estonia), the paper identifies critical determinants of trust, including transparency, institutional neutrality, crisis communication, and historical path-dependence. The findings demonstrate that trust acts as both an input to and an output of security policy, reinforcing legitimacy through reciprocity between citizens and the state.The article concludes that sustained trust-building must be recognized as a strategic dimension of security governance. Trust-based security strengthens societal resilience, mitigates polarization, and enhances adaptive capacity in hybrid threat environments.

The main objective of this study is to explain managing complexity through the resource-based view as a strategy for the implementation of food security policy. Because the study so far still focused on the form, type, and its dimensions. The study uses a qualitative design and case study strategy to explain the implementation of food security policy. Techniques of data collection used were observation, depth-interviews, and documentation. Based on the matching patterns and time series analysis, managing the complexity of resource sharing in the implementation of food security policy is not effective. This happens because the resources owned by them are not integrated through the governance network. Besides, the governance network organization does not have a clear vision, so they also behave in a changing manner and controlling their resources. This is shown by each government agency controlling the funds for this program and the extension workers do not have the necessary expertise in the food diversification, rice, and animal food programs. Therefore, resource sharing strategies that have value, rareness, imperfect imitability, and organization can achieve successful implementation of this policy.

Security policies are enforced through the deployment of certain security functionalities within the applications. Applications can have different levels of security and thus each security policy is enforced by different security functionalities. Thus, the secure deployment of an application is not an easy task, being more complicated due to the existing gap between the specification of a security policy and the deployment, inside the application, of the security functionalities that are required to enforce that security policy. The main goal of this paper is to close this gap. This is done by using the paradigms of Software Product Lines and Aspect-Oriented Programming in order to: (1) link the security policies with the security functionalities, (2) generate a configuration of the security functionalities that fit a security policy, and (3) weave the selected security functionalities into an application. We qualitatively evaluate our approach, and discuss its benefits using a case study.

Security policy management is critical to meet organizational needs and reduce potential risks because almost every organization depends on computer networks and the Internet for their daily operations. It is therefore important to specify and enforce security policies effectively. However, as organizations grow, so do their networks increasing the difficulty of deploying a security policy, especially across heterogeneous systems. In this paper, we introduce a policy framework called Chameleos-x which is designed to enforce security policies consistently across security-aware systems with network services-primarily operating systems, firewalls, and intrusion detection systems. Throughout this paper, we focus on the design and architecture of Chameleos-x and demonstrate how our policy framework helps organizations implement security policies in changing, diversity-rich environments. We also describe our experimentation of Chameleos-x to demonstrate the feasibility of the proposed approach.

Since the Internet of Things (IoT) will be entwined with everything we use in our daily life, the consequence of security flaws escalates. Smart objects will govern most of the home appliances and car engines yielding potential disaster scenarios. In this context, successful attacks could lead to chaos and scary scenarios (www.darkreading.com). Unprotected personal information may expose sensitive and embarrassing data to the public and attacks may threaten not only our computers and smart devices, but our intimacy and perhaps our lives too. Because persons and objects will be bonded with each other, user consent becomes critical. Therefore, thing, object, and user Identity will be the focus of future IoT security solutions, yielding a Trust, Security, and Privacy (TSP) paradigm, which may constitute the Achilles' heel of IoT. While security issues are quite straightforward, mainly from background knowledge, privacy issues are far more complex. Privacy constitutes a rather challenging task, even for the m...

Despite increasing investment in information security and its strategic role in today’s business success, effective implementation of information security strategies still remains one of the top challenges facing global organizations. This study investigated Information Security Policy compliance of staff members of a municipality in South Africa. Factors such as information security policy, security policy strategic planning, policy implementation and compliance were considered. A questionnaire was distributed to 80 staff members from different sections in this municipality and a response rate of 100% was achieved. The study findings showed that the majority of employees are largely in support of the municipality’s efforts to develop and implement a security policy framework. They also concur that compliance to security policy safeguards and prevents intrusion information, theft and "denial of service". Among other issues, it is recommended that more training and awareness campaigns should be done to all employees in order to improve security of information in this municipality. The study results can be limited by the small number of the population as indicated that the sample was equal to the population (N=n).

The enforcement of security policies in outsourced environments is still an open challenge for policy-based systems. On the one hand, taking the appropriate security decision requires access to the policies. However, if such access is allowed in an untrusted environment then confidential information might be leaked by the policies. Current solutions are based on cryptographic operations that embed security policies with the security mechanism. Therefore, the enforcement of such policies is performed by allowing the authorised parties to access the appropriate keys. We believe that such solutions are far too rigid because they strictly intertwine authorisation policies with the enforcing mechanism. In this paper, we want to address the issue of enforcing security policies in an untrusted environment while protecting the policy confidentiality. Our solution ESPOON is aiming at providing a clear separation between security policies and the enforcement mechanism. However, the enforcement mechanism should learn as less as possible about both the policies and the requester attributes.

Embedded memories have been used extensively in modern SoC designs. In order to estimate the power consumption of an entire design correctly, an accurate memory power models are needed. However, the memory power model that is commonly used in commercial EDA tools is too simple to estimate the power consumption accurately. In this work, we develop two methods to improve the accuracy of memory power estimation. Our enhanced memory power model can consider not only the operation mode of memory access, but also the address switching effects with scaling capability. The proposed approach is very useful to be combined with the memory compiler to generate accurate power model for any specified memory size without extra characterization costs. Then the proposed dummy modular approach can link our enhanced memory power model into the existing power estimation flow smoothly. The experimental results have shown that the average error of our memory power model is only less than 5%.

In modern SoC designs, more and more application specific instruction-set processors (ASIPs) are used. They enable a trade off between the flexibility due to the software implementation of algorithms and hardware efficiency arising from the ASIP architecture which is optimized with respect to the application. In this paper, it is shown that the total power dissipation could be reduced by distributing the software tasks on several identical ASIP instances although the throughput of a single ASIP would be sufficient for all tasks. In addition, it is shown that for power comparisons of processor instances, the number of executed lines of code is a parameter which gives more insight into power comparisons than the clock rate.