$\mathrm {DD\text {-}MPU}$: Dynamic and Distributed Memory Protection Unit for Embedded System-on-Chips.

The integration of potentially untrustworthy intellectual property (IP) blocks into a System-on-Chip (SoC) poses significant risks, including data exfiltration and corruption due to unauthorized writes to memory or peripheral devices. Conventional countermeasures, such as memory protection or management units, tend to provide coarse protection granularity and impose substantial hardware overhead for embedded devices. In this paper, we introduce $$\mathrm {DD\text {-}MPU}$$ , a custom memory protection unit specifically designed for individual third-party IPs. Our proposed solution features low area overhead and fine protection granularity while automatically adapting to dynamic system states by actively monitoring bus transfers and switching between different protection rules. In our evaluation, we demonstrate the efficacy of the $$\mathrm {DD\text {-}MPU}$$ by integrating it into an SoC to isolate a potentially malicious accelerator block from the rest of the system. The area overhead of our approach for a single instance in a 22 nm technology ASIC node is a mere 0.3%.