A Threat Monitoring and Control Unit for Secure Embedded Systems

Continuous monitoring of the security status of connected devices is essential as Zero Trust Architectures (ZTAs) become more prevalent in enterprise networks. For this, it is necessary to have real-time threat monitoring within the devices connected to the network. Ensure continuous monitoring in current devices available on the market is a challenge, especially in resource-constrained settings. TMC (Threat Monitoring and Control Unit) addresses this challenge by providing real-time monitoring and a trust score that can’t be tampered with for devices connected to the ZTA network. Real-time hardware monitoring of CPU micro-architectural signals has been used to determine the trust score of a security coprocessor separated from the device computing architecture. We examined TMC on an open-source RISC-V processor-based architecture against ransomware, ROP, and cache-based micro-architectural attacks. The framework was implemented on an AMD Virtex XC7V2000T FPGA module to demonstrate area overheads.