DynaPoMP: dynamic policy-driven memory protection for SPM-based embedded systems

Today's embedded systems are often used to access, store, manipulate, and communicate sensitive data. Embedded system security risks are exacerbated by emerging trends (e.g., network connectivity, application download service, migration to multiprocessors). To preserve data confidentiality, various memory encryption schemes have been proposed, however, the overhead of encryption and decryption operations that precede memory access are very high and can lead to significant performance degradation, particularly for embedded systems. In this paper, we propose DynaPoMP, a novel dynamic policy-driven scratchpad memory allocation methodology that ensures data confidentiality while minimizing the memory access latency overhead. We define three allocation policies to ensure confidentiality of sensitive data. The first policy, called SensitivityFirst, retains sensitive data in trusted on-chip SPM as long as possible, thereby minimizing the number of encryption/decryption operations due to off-chip memory accesses. The second policy, called AccessFirst, protects data mapped to off-chip memory via selective encryption/decryption, while mapping data sets with highest utilization to on-chip memory space and reducing number of off-chip memory accesses. Finally, the third policy, referred to as Hybrid, trades-off space given to sensitive data and non-sensitive data, with the goal of reducing the execution time of the given application. Our results on a set of security-enhanced embedded benchmarks from Mediabench II show that DynaPoMP reduces the total latency by up to 42.82% when compared to conventional dynamic scratchpad allocation schemes without considering encryption latency.