Firmware for Data Security: A Review

INTRODUCTION

Dedication makes the path to study precisely on the problem to bring out the result as required. This is not only true for men but also for machines. The evident statement can be obtained from the systems which encapsulate a special-purpose dedicated computer to do a set of defined tasks called embedded systems. The specialty of the embedded system is because of the highly specific requirements that it takes upon (Wang et al., 2007). Though, the task completion with perfection is an important design aspect of any embedded system it must also consider other design metrics such as low cost, size, weight, power consumption, portability, performance etc., (Tillich and Herbst, 2008). The achievable level of all design metrics during the embedded system design is mainly decided by the microcontroller chip, the main processing core of all embedded systems. Normally, the embedded systems with little memory and limited hardware resources are controlled by the code that resides on a non-volatile memory. The memory may be self contained in the microcontroller chip called on-chip memory or may reside outside the chip called off-chip memory. The set of instructions that controls the working of embedded systems called firmware.

Nowadays embedded systems are increasingly used in many distributive applications due to which the need for them to communicate among themselves and other peripherals has risen in the same magnitude. This communication essentially happens in an open media, where the data becomes vulnerable and hence, any private information communicated between any two may be known by others.


Fig. 1:	Publications on e-databases

The necessity to provide digital data security in open access channel invites the science of secret writing called cryptography (Jaberi et al., 2012; Al-Somani et al., 2006, 2009; Rabah, 2005a-c, 2006). In simple words any procedure that performs some mathematical operations between the data to be communicated (plain text) and a character string of length K-bits (key) to produce the result (cipher text) may be called as encryption and the reverse operation that brings back the plain text as decryption in the world of cryptography. The main goal of any cryptography algorithm(Schneier, 2007) is to provide confidentiality by ensuring none other than the intended recipient can read the message. In addition, the algorithm must posses other security requirements like authentication that facilitates to prove one’s identity, integrity to ensure originality of the message and non-repudiation to identify the data origin (Liu et al., 2011).

To facilitate the embedded system firmware with the feature of data security, cryptography algorithm implementations are considered with the embedded core processing unit, microcontrollers. This study focuses on the implementations that have been carried out so far for the development of security firmware for embedded systems. To identify the studies that were done over the past 16 years on the secure firmware development, a survey is made on three of the popular electronic databases SCOPUS, IEEE Xplore and Science Direct. The distribution of research article publications on various international journals and conferences related to the topic of cryptography implementations with embedded systems are shown in Fig. 1.

Cryptography methods for data security: Three foremost types of cryptographic algorithms (Abomhara et al., 2010; Muda et al., 2010) specifically Secret Key Cryptography (SKC) with common key to both encrypt and decrypt, Public Key Cryptography (PKC) using distinct keys for encryption and decryption finally, hash functions for irrevocable data transformation are frequently in use for data security. The use of symmetric set of rules with single key to encipher and decipher the data brings the name Symmetric encryption for the SKC process. The greatest intricacy of this method is the distribution of symmetric key (Abomhara et al., 2010) between sender and recipient (Hromkovic, 2009; Muda et al., 2010). Stream and Block ciphers are the two sundry procedures of Secret key algorithms. Operations on stream of bits or on a byte or on the word length of a processing unit are carried in stream ciphers at a time whereas, a block of data can be handled at a time by the block cipher (Roman et al., 2007). The complication on PKC lies on the development of two mathematically interlinked keys that denies the determination of one key from another. The magical nature of the algorithm is the order in which the keys are used to encrypt and decrypt does not affect the result giving the meaning for asymmetric cryptography.


Fig. 2:	Research publications on symmetric vs asymmetric ciphers in embedded

The purpose of Symmetric cipher implementation is mainly to serve on integrity checks, user authentication and non-repudiation (Hromkovic, 2009; Salem et al., 2011). Hash functions serve a different purpose than SKC and PKC schemes. The hash value called message digests, produced by the use of hash functions are used to dole out authenticity and integrity through digital finger print that hides the data and its length to be retrieved.

Among the security features rendered by crypto algorithms, our intention is to know only about the use of cryptography implementations on embedded processor cores for data security. As this is offered by symmetric and asymmetric procedures we limit our review in this study, SKC and PKC schemes alone (Leander et al., 2007). The graph on Fig. 2 shows the results of the year wise survey made on electronic data bases with respect to the research publications on symmetric and asymmetric embedded crypto implementations.

The inference from the above graph makes it clear that the research publications on embedded implementations of cryptography are increasing every year. As can be seen explicitly, the number of publications on symmetric cryptography is nearly twice compared to the publications on asymmetric cryptography. Though, the features of microcontrollers make room for the design of even highly complex systems, there exists infeasibility on the implementation of public key cryptography on low-end embedded cores (Elbehiery and Abdelmouez, 2010). The accomplishment does not materialize due to their huge claim on memory and power (Ganesan et al., 2003). But also, the computational density gives hike to demand on hardware and software resources (Leander et al., 2007).

Symmetric ciphers on the other hand perform well on various microcontroller platforms. Another survey result shown in Fig. 3 manifestly tells that the study carried out on symmetric block cipher with microcontrollers during every year is more compared to the symmetric stream cipher implementations (Leander et al., 2007).

For any embedded system the choice of the microcontroller depends on the kind of application and various design metrics that needs to be satisfied in the system design. The survey shows major number of publications on cryptography implementation with microcontrollers target two applications namely Radio Frequency Idenfication (RFID) tags and Wireless Sensor Nodes (WSN) (Elbehiery and Abdelmouez, 2010; Vogt et al., 2009). The processing unit in most sensor node is a microcontroller, a highly constrained computer with memory and required interfaces that forms the base for simple applications. Depending on application needs other components like off-chip memory or cryptographic chips can also be there (Roman et al., 2007).


Fig. 3:	Research publications on block vs stream ciphers in embedded

In the remaining chapters our paper makes a review on various cryptography algorithms implemented on diverse range of microcontrollers that are widely used for WSN.

Choice on CPU and crypto algorithms for wireless sensor nodes (WSN): The features offered by the microcontrollers such as cost effectiveness, low power consumption, moderate amount of computational capabilities and memory makes it as the best choice for the development of wireless sensor nodes (Cakiroglu et al., 2010). Requirements such as peripheral interfaces, processing speed, code memory, data memory and also the kind of service to provide to the node determines the type of microcontroller to embed in a sensor node (Elbehiery and Abdelmouez, 2010). Many types of microcontrollers are produced by the same manufacturer to suite variety of applications and performance metrics. Out of them, very few are used by sensor node developers. This makes the nodes from diverse manufacturers to share the same microcontroller, though their architecture completely poles apart. As a result of this the performance of same algorithms on these nodes, will become akin (Roman et al., 2007). Considering the choice of any cryptography algorithm to implement on microcontrollers for WSN the primary optimization goal is efficient implementation. Furthermore, the demands for low power consumption, minimal footprint; low RAM usage and execution time are also to be considered for tiny embedded systems (Tillich and Herbst, 2008). In addition, compute computational intensive operations such as Parings are extremely difficult to do with wireless sensor nodes (Ramachandran et al., 2007).

Amongst the widely used microcontrollers for wireless sensor nodes, the Atmel ATmega128, Texas Instruments (TI) MSP430F14X/16X, Freescale 68HCS08, Microchip PIC18F6720, LPC2378 and Advanced RISC Machine (ARM) ARM920 are considered for most of the standard cryptography algorithm implementations. The distinct features of Advanced Virtual RISC (AVR) compared to other 8-bit microcontrollers are pre-decrement and post-increment of pointer registers that are done free of cost (without consuming additional cycles) also contribute heavily in optimized implementations (Bos et al., 2009). MSP430 being the extreme low power consuming microcontroller also shows acceptable level of performance (Gura et al., 2004).

These microcontrollers can be categorized into three different classes. Microcontrollers with 8-bit architectures belong to class one. Inspite of its limited processing abilities, class one (8-bit) processors are used nowadays since, still it holds a remarkable position in the market. The performance metrics of the class one processors are inferior to the two other classes. The 16-bit class two medium end processor architectures perform better than the lower end 8-bit class one processors but inferior compared to the higher end architectures. The third category is the 32-bit class three architectures which are the best interms of performance (Hyncica et al., 2011). Though, in general terms we categorize the performance in increasing order among low, medium and high end processors, the word length (data bus width) needed to perform the operations on the selected cryptography algorithm may reverse the above statement. For example, with its highly efficient RISC features, the low end class one ATmega processors may surpass all other architectures for small bus width (Ganesan et al., 2003). Table 1 presented list of microcontrollers used in wireless sensor nodes.

Although, AVR microcontroller is an outstanding candidate for most of the algorithm implementations, the main problem is porting the code to very limited amount of SRAM. As an elucidation for reducing critical SRAM, moving s-boxes and large static data arrays into flash memory. The wise way to implement any data size greater than 8-bit with AVR is to convert all variables to standard integer sizes of AVR. When using low or medium end microcontroller the mismatch between wide bus width required to implement arithmetic for security (32 bit) and available bus width (8 or 16 bits) in addition to lack of convinced operations (e.g., multiply) in the Instruction Set Architecture (ISA) creates other challenges. Also, the presence of native features like variable sized bit wise shift, CISC vs RISC and memories like caches in ISA characteristics aids the performance of specific embedded cores (Ganesan et al., 2003).

From the survey, we found the widely implemented and analyzed block based cryptography algorithm implementations on one or some of the microcontroller architecture categories mentioned above are AES (128/192/256) (Daemen and Rijmen, 2003), Twofish (128/192/256), DES, IDEA, Blowfish, RC2, RC5, RC6, XTEA (Wheeler and Needham, 1995), SEA (Standaert et al., 2006), Sosemanuk. In general, apart from the demand on resources that makes asymmetric cryptography less appropriate for low-end microcontroller implementations also, the lifetime of nodes gets ruthlessly limited due to massive power consumption (Ganesan et al., 2003).

In terms of SRAM consumption, SEA takes much less memory compared to AES and RC6 turns out to be the winner taking less memory size than SEA. Considering the aspect of performance, although AES does better than SEA, still SEA can perform better than RC6 taking less amount of execution time. Another feature that SEA offers is it supports better implementation feasibility on many type of processors with various word size (8-bit, 16-bit and 32-bit) (Cakiroglu et al., 2010). Table 2 presented list of standard algorithms tested on various microcontroller platforms.

As proved by Elbehiery and Abdelmouez (2010), AES was a real performer compared to DES on implementation with the low end microcontroller ATmega32. Both in terms, of execution time as well as key space AES results were well ahead the DES (Fig. 4). On implementing IDEA and RC5 in ATmega128L, the encryption and decryptions timings were found to be identical for both algorithms. Performance of IDEA was well ahead the RC5.

Table 1:	List of microcontrollers used in wireless sensor nodes

Table 2:	List of standard algorithms tested on various microcontroller platforms


Fig. 4:	Execution time (clock cycles)

During the execution on multiple blocks of plaintext, the variation in performance of IDEA was highly acceptable compared to RC5 since, the execution time was not a multiple of the number of blocks encrypted (Choi and Song, 2006).

The instruction set extensions to AVR proposed by Tillich and Herbst (2008) to enhance the speed and code occupancy for implementing AES-128 which could not be achieved even by highly optimized assembly code with native instructions alone.

Steps were taken to enhance the speed of the AES-128 implemented on 8-bit AVR using the optimization techniques. Here, programming was done using Compute Unified Device Architecture (CUDA) which is an extension to the C language that facilitates parallel programming through Single Instruction Multiple Thread (SIMT) (described in NVIDIA CUDA-Programming Guide). CUDA allows the programmers to define kernel functions and thereby, supports SIMT. Two versions of implementations namely fast and compact were tried. The compact version took less area in RAM whereas, the fast version made a trade-off with RAM usage by consuming RAM area for the storage of S-box (Bos et al., 2009).

LIGHT WEIGHT CRYPTOGRAPHY

Light weight cryptography is emerging as a counterpart for the well known statement that says about the infeasibility in the implementation of asymmetric cryptography with low end microcontrollers. It offers an attractive asymmetric-key cryptosystem for use with resource constrained devices, specifically when sufficient cryptographic operations cannot be guaranteed to provide ample security (Tillich and Herbst, 2008). Trade-offs plays a vital role in the design of light weight cryptography to optimize design metrics of embedded systems namely security, cost and performance. Though, the compromise is possible, always any two metrics security and cost or security and performance, or cost and performance; may contradict each other. Optimizing all the three at once is physically impossible. Pipelined hardware implementation can provide high-performance consequently increasing the cost, through high area requirement. Utilizing the bit permutations that are virtually free in hardware can result in a low-cost design. As a metric for evaluation on firmware implementations, code and data memory requirements and the clock cycles taken for execution are taken. Another important metric, the power consumption on firmware implementations can be arrived as a rough estimate by multiplying the processing cycles by the average power consumption of the target device.

Two ciphers namely the Tiny Encryption Algorithm (TEA) (Wheeler and Needham, 1995) family and the International Data Encryption Algorithm (IDEA), which consists only of arithmetic operations is the ones that are especially optimized for software architectures. IDEA uses 16-bit words and TEA uses 32-bit words. Simple operations like addition, XOR addition and multiplication are present in IDEA whereas, TEA family needs shifts along with addition and XOR addition. Both algorithms can perform well on low end 8-bit platforms. They both do not need huge memory since there is no substitution box (S-box), present in them (Leander et al., 2007).

The renowned asymmetric algorithm RSA (Mousa, 2005), which is known to be suitable for signing and well as encryption, is widely used on numerous applications. It is due high demand on resources for its operation, it is considered as an expensive candidate for resource-constrained devices. This is the reason for the development of new algorithms with more optimizations, such as Elliptic Curve Cryptography (ECC) (Gura et al., 2004; Rabah, 2005a; Al-Somani et al., 2006; Olorunfemi et al., 2007; Roman et al., 2007; Al-Somani et al., 2009). The ECC is a great opponent in the field of light weight cryptography algorithms. In comparison with the traditional public key cryptosystems like RSA, offers superior speed, less power consumption, memory, bandwidth and smaller key sizes without degradation in security (Tillich and Herbst, 2008). Also as a matter of implementing ECC on microcontrollers with small word length, its performance raises over RSA (Gura et al., 2004). When accelerated by appropriate cryptographic hardware though it is an asymmetric implementation ECC on embedded may seem to perform slightly better but still may take excessive time compared to standard symmetric implementations such as Advanced Encryption Standard (AES) performance (Leander et al., 2007; Muda et al., 2010; Zaidan et al., 2010a). Another cipher designed for embedded applications with low cost microcontrollers is Scalable Encryption Algorithm (SEA), belongs to symmetric block cipher approach. Implementation of this can be made with less memory size, limited instruction set and small footprint. To design, is quite simple as it can be performed using simple bit manipulation operations such as XOR, bit/word rotations, modulo addition and s-box (Cakiroglu et al., 2010).

Some of the well known light-weight ciphers like Data Encryption Standard (http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf) Light Weight Extension (DESL) (Leander et al., 2007), HIGHT (Hong et al., 2006), SEA, Tiny Encryption Algorithm (TEA) and Extension to TEA (XTEA) were implemented on AVR ATmega128 and analyzed (Table 3).

Table 3:	Specification of light weight algorithms

As the implementation results depicts, optimization on the highly constrained resource (memory) is achievable with light-weight cryptography but, the algorithms fails to claim in terms of throughput (Rinne et al., 2007).

Though called as weak, the extremely constrained 4-bit microcontrollers are still being used much in today’s applications. It was proven that, even a 4-bit microcontroller can also be an optimal target for the implementation of ultra-lightweight block cipher. To prove this the LWC PRESENT was implemented on ATAM893D microcontroller of ATMEL’s MARC4 family. In order to keep the execution time of a block to be 200 ms, the operating frequency is limited to 500 KHz though 2 MHz is the maximum that can be handled by the device (Vogt et al., 2009). On comparison with PRESENT, Hummingbird gives 4-7 times improved performance when speed-optimized and 147 times for size-optimized implementations on similar platforms (Engels et al., 2010).

For the implementation of symmetric ciphers, the use of a non-conventional method called Bit-slicing can be used with an n-bit processor, where it is considered as a collection of n 1-bit execution units operating in SIMD mode. Light-weight Instruction Set Extensions (ISEs) focused on implementation with bit-slicing can be used with any of the above said algorithm to reduce the footprint on code memory, to improve the performance and also which in turn makes the execution time predictable (Grabher et al., 2008).

While, there are several implementation proofs exists, showing the feasibility to create firmware for data security, there exists few exceptions like PIC12F675 microcontroller, the one used in the design of WSN. Being in the category of weak this core requires a separate cryptographic chip so as to provide a nominal protection for data (Roman et al., 2007).

Methods and tools for analysis: To enable the calculation and execution of time in terms of number of clock cycles for the total number of instructions in the firmware program often, we convert the code in high level language like ‘C’ to assembly (Elbehiery and Abdelmouez, 2010). To analyze the speed of the algorithm on any platform, the use of maximal available operating clock frequency of the core to be used. This may not result in optimal energy consumption but clearly defines the upper bound for performance at each individual platform. Footprint occupied by LWC are presented in Fig. 5. Information on footprint can be the size of the implemented cipher algorithm reported by the linker. The presence of auxiliary functions overhead from library, a varying factor for various algorithms, aids for rise in code size and makes the code size evaluation unfair. As far as block ciphers are concerned, the time taken to encrypt the complete block can be taken. The frequently used method to measure the time is to run the internal timer and to exclude the overhead produced by interrupt.


Fig. 5:	Footprint occupied by LWC

The easiness of this way makes it to suits well for various platforms (Hyncica et al., 2011). Also, the time to load the plain text from a source in to the memory of the microcontroller and the time taken at the end of encryption to store the cipher text in to memory may get exempted while calculating the execution time of any block cipher in embedded core (Tillich and Herbst, 2008).

Open source tools which are available free of cost are the better choice as it also provides guidelines for operations, addresses problems and updates from the open source community. In this regard AVR provides the well known Integrated Development Environment (IDE) called AVR Studio software platform accompanied with a popular c compiler for AVR micro-controllers, AVR GCC that can be used to evaluate the performance of the cryptography algorithms (Cakiroglu et al., 2010). Another, powerful tool for AVR with enriched features is MikroC PRO development tool. Inclusion of libraries can be done in this to dramatically raise the execution speed. The HEX generated by the MikroC PRO for AVR is compatible with all programmers. The integrated Software Simulator gives us the way to inspect program flow by debugging the executable logic (Hyncica et al., 2011).

The CrossWorks studio IDE for MSP430 comprises of ANSI C compiler, macro assembler, linker/locator, libraries, core simulator, flash downloader, JTAG debugger. Optimizations on code for the smallest size or fastest speed can also be set through this (Engels et al., 2010). IAR Embedded Work Bench offers a sophisticated IDE with debugger. Even, the entire microprocessor designs can also be simulated through PROTEUS, a complete electronics design system, with capabilities to run actual processor machine code in real-time (Elbehiery and Abdelmouez, 2010).

Recommendations: Cryptography and steganography are the well known twins in the world of security. To incorporate security as a firmware on resource constrained devices, the term cryptography is well analyzed by many researchers with low, medium and high end microcontrollers. Due to its high demand on memory for the storage of cover such as image, audio or video; Steganography is considered rarely to provide security using microcontrollers. Microcontrollers are the best candidate to do bit and byte level operations that are needed for the steganography methods like LSB substitution used in spatial domain. Image steganography on spatial domain was suggested by Stanescu et al. (2009) with NXP Phillips LPC-2294, an ARM 7 based high end microcontroller unit. They were able to implement simple LSB substitution (Amirtharajan and Balaguru, 2009, 2011; Rajagopalan et al., 2011; Padmaa et al., 2011) on a various sizes of RGB images that can be accommodated in the external memory of 1 MB mapped with LPC 2294. This implementation suggested a new dimension to provide data security in mobiles devices without significant rise in cost. As improvement in execution time which is a desirable factor for all, eliminating the need for external memory, the major factor that limits the performance is our primary recommendation for future study. Numerous steganography algorithms (Amirtharajan and Balaguru, 2009; Rajagopalan et al., 2011; Padmaa et al., 2011; Zaidan et al., 2010b; Amirtharajan et al., 2011, Amirtharajan and Rayappan 2012a,b) on spatial and on frequency domains (Thanikaiselvan et al., 2011) has also been tried with medium and low end microcontrollers. This challenging endeavor will figure out a wise way to establish greater security in wireless sensor nodes without substantial rise in cost.

CONCLUSION

The survey clearly shows that the study on firmware development for embedded system facilitating data security is increasing dramatically in recent years. Although, all kinds of cryptography algorithms were considered by various researchers on a wide spread only block based symmetric ciphers were the major choice for implementation with microcontrollers. Inspite of its higher security, the higher demand on the constrained resources of microcontrollers raised by the asymmetric algorithms made them as least choice in most applications. The article summarizes the different kind of standard and light weight algorithms implemented on various classes of microcontrollers appropriate for wireless sensor nodes. After analyzing the feasibility on security implementations with microcontrollers through cryptography, this paper proposes possible recommendations on using image steganography with microcontrollers for images sensor nodes.