Mohamed Ramadan
email: mramadan79@gmail.com

A Rezk

Amr Radwan
email: radwan.amro@gmail.com

Nahed M Salem

Mahmoud M Sakr
email: msakr@asrt.sci.eg

Manuela Tvaronavičienė
email: manuela.tvaronaviciene@vgtu.lt

FORESIGHT FOR SUSTAINABLE ENERGY POLICY IN EGYPT: RESULTS FROM A DELPHI SURVEY *

Keywords: science policy, foresight, Delphi survey, energy, sustainable development, renewable energy

This paper presents energy opportunities, particular areas of high potential and reflections on energy challenges in Egypt by the year 2040. Energy foresight significantly contributes in the effective review and formulation of national energy policies and strategies. In this work, 350 experts participated in real-time Delphi survey and responded to a set of structured and cross-linked questionnaires that aim to assess and provide future dimension to the energy sector in Egypt. Priorities are presented across 14 energy cluster-areas with 180 identified topics. The two-round Delphi study with an iterative process was performed to determine and measure the expectations of the different stakeholders with specific emphasis on the prospects of renewable energy and energy efficiency. The designed cross-linkages between survey components allowed the systematic pooling and convergence of knowledge in addition to the technical insights and different perspectives. About 50% of Egypt's energy demand was foresighted to be met by renewable energies around 2030. The results showed that all types of energy would not only provide economic and environmental benefits but also improve living standards. This work demonstrates that involving large diversity of expertise and different stakeholders, comprising heterogeneous groups, in foresight studies would potentiate the forecasting power, reduce the polarization effect, and enhance the reliability of the foresight exercise.

Introduction

At the national level, the energy policies enact in the near future in Egypt could have a significant effect on both the energy efficiency and renewable energy. Many authors consider these two folds as the twin pillars of the sustainable energy policy [START_REF] Armin Razmjoo | Development of sustainable energy indexes by the utilization of new indicators: A comparative study[END_REF]. The formulation of sustainable energy policies influences the economic development, environmental resource management and social acceptance. Many policies and strategic visions of developing countries set a long-term target for the national contribution of renewable energy and the overall energy efficiency. Despite these targets are usually perceived as highly ambitious, it requires augmentation of several policy tools to effectively anticipate challenges and opportunities [START_REF] Radwan | Science and innovation policies in North African Countries: Exploring challenges and opportunities[END_REF]Sakr 2017, Radwan 2018).

In this respect, it is important to understand how Egypt's energy matrix has evolved and it is even more important to consider this pattern of evolvement in analyzing the possible forecasted scenarios for future energy policies and national interventions [START_REF] Rezk | Innovation magnitude of manufacturing industry in Egypt with particular focus on SMEs[END_REF][START_REF] Armin Razmjoo | Development of sustainable energy indexes by the utilization of new indicators: A comparative study[END_REF]. The forecasted scenarios would help better identifying opportunities while anticipating possible policy and strategic implications [START_REF] Okoli | The Delphi method as a research tool: an example, design considerations and applications[END_REF].

While research on forecasting has mostly examined several technical aspects, technological-based forecasting research are less performed in many developing countries and hence, less contributing to national policy development [START_REF] Okoli | The Delphi method as a research tool: an example, design considerations and applications[END_REF]Pawlowski 2004, Ghinolfi, El Baz et al. 2014). Energy future studies are usually implemented on the basis of foresight method with a combination of qualitative and quantitative tools, effective participation of experts and decision-makers. Many Studies have made important contributions to explore and define energy technology future [START_REF] Lee | Government R&D investment decision-making in the energy sector: LCOE foresight model reveals what regression analysis cannot[END_REF]Yang 2018, Proskuryakova 2019). Technology foresight is a process comprising different techniques in developing mid-term future scenarios regarding the advancements in the use and production of technology and with the overall aim of identifying the areas of strategic importance and the emerging technologies are more likely to yield higher economic and social benefits [START_REF] Rowe | The Delphi technique: Past, present, and future prospects -Introduction to the special issue[END_REF]. Delphi method, one of the important forecasting techniques, is commonly used in assessing specific aspects in the future and is frequently used in many energy foresight studies [START_REF] Renzi | The Delphi Method for Future Scenarios Construction[END_REF]. Being widely used in different research fields, the Delphi method is also known for harvesting the intelligence capacity of different expertise while making unified opinions to support the decision-making process.

Egypt has high potential of natural resources including natural gas, oil, coal and high reserves of fossil fuel energy sources; about 4189 billion barrels of oil reserve and about 77200 billion cubic meters of natural gas reserve (Table 1). The reserves are in the form of both mainland and coastal deposits [START_REF] Ibrahim | Renewable energy sources in the Egyptian electricity market: A review[END_REF][START_REF] Shouman | International and national renewable energy for electricity with optimal cost effective for electricity in Egypt[END_REF]. During the time of the late 1990s and mid-2000s, Egypt experienced helpful conditions regarding the findings of enormous natural gas holds in several locations, which contributed to different developmental plans and strengthened Egypt's position as natural gas producer and exporter [START_REF] Suding | Struggling between resources-based and sustainable development schemes-An analysis of Egypt's recent energy policy[END_REF]. This might be related to the increased consumption of natural gas by 7% per year during the first decade of 2000s with noticeable decrease in production by around 3% yearly during the period of 2009-2013. Consequently, the natural gas exporting capacity

359

was limited to only 5% of its total production in 2013 and eventually driving the country to start signing importing agreements in the following years of 2014 and 2015. On the other front, phasing out energy subsidies is clearly listed among the top priorities for policy makers [START_REF] Breisinger | Energy subsidy reform for growth and equity in Egypt: The approach matters[END_REF]. Egypt is by far the largest consumer of oil and natural gas in Africa while representing 22% of petroleum and other liquids of the continent's total consumption and 37% of its dry natural gas consumption. In 2016, the Supreme Council of Energy adopted the Egyptian Energy Strategy until 2035 and selected four different scenarios to guide energy planning in Egypt for the coming years with a target of 37.2% of renewable energy contribution in 2035 (NREA 2019), see Table 1. In this respect conducting a foresight studies are paramount for effective strategic planning. In this context, the Delphi method is mainly used when long-term issues (up to 30 years) have to be assessed. It is also useful for looking at emerging developments where external factors are likely to have a determining effect and when social aspects could influence economic or technical considerations. As it implies, it supports the identification of statements (topics) that are relevant for the future through channeling the tacit and complex knowledge to a single statement and makes it possible to judge [START_REF] Di Zio | Real Time Spatial Delphi: Fast convergence of experts' opinions on the territory[END_REF], see Table 1.

Methodology

The used Delphi method in this study comprises development of quantitative with qualitative metrics and the systematic utilisation of the experts' opinions and the insights gathered althrough the process. The Delphi is a well-established methodology in futures studies with evidence going back nearly 60 years [START_REF] Gupta | Theory and applications of the Delphi technique: A bibliography (1975-1994)[END_REF]. Group of specialized experts served in the inception phase for identifying large set of topics based on literature review, existing policy briefs, strategies and Egypt vision 2030. Topics were then grouped per cluster area (table 2) and substructured to matrix of technical questions to develop specific questionnaire relevant to each target group. The Delphi method comprises iterative rounds (two or more) of the same questionnaire to the same respondents. This process continues until the answers converge to a specific line of argument. In the second round, the respondents were allowed to change their answers based on the summarized findings of the previous round. Besides, this iterative and opinion convergence process served the validation of reliability and robustness by a sensitivity analysis.

Setting the survey topics

The database of the Academy of Scientific Research and Technology in Egypt was used to select 350 experts regarding each of the 14 energy clusters' technical areas whilst each group include 25 experts comprising different and relevant expertise and background. Pre-defined criteria were used to select experts including major 360 and minor fields of expertise while respecting the specific quota for the different stakeholders. In this context and based on the outputs of the 14 groups, a workshop was organised to scientifically discuss these topics while ensuring wide acceptance of all involved participants. Afterwards, the experts were asked to conduct macro contextual analysis using foresight cards regarding the social, technology, economic, environment and political (STEEP) influences [START_REF] Markley | A new methodology for anticipating STEEP surprises[END_REF]. STEEP cards method contributes to the better understanding of probabilities of occurrence and impact of influence in the future until 2040 by taking into account the specific topics that could lead to resolve an existing problem and achieve a desired progress [START_REF] Kononiuk | Wild Cards in Polish Foresight Practice[END_REF]. The experts selected 180 topics regarding the 14 energy cluster areas including technological and non-technological topics, see Table 2.

Real time Delphi survey

Real time Delphi was used with an online version of the structured survey to support convergence of opinion in real time [START_REF] Di Zio | Real Time Spatial Delphi: Fast convergence of experts' opinions on the territory[END_REF]. Real time Delphi is known also for its convenience when addressing large target groups with higher response rate than other similar tools [START_REF] Aengenheyster | Real-Time Delphi in practice -A comparative analysis of existing software-based tools[END_REF]. The survey was designed to evaluate the selected topics regarding: -Importance (importance at the national or international levels or both), -Governmental interventions; actions that the government should address in each topic with respect to strategy formulation, human resource, capacity building, legal system reform (including intellectual property rights), public research institution reform, industry support, social acceptance, required investment).

-Forecasted time of technological impact realization which shows the required duration for either of the technology, process or solutions to be ready at technical level.

-Forecasted time of social impact which shows the required duration for the adapted technology, service or solution to be either used, promoted or accepted by local communities.

Furthermore, participants were also asked to rank and identify sectors of technological and strategic importance i.e a specific feasible technology in the near future could contribute to a multilevel impact at social, technological and economic levels. Moreover, while considering the sensitivity of the analysis, participants were asked to assess their level of expertise for each cluster area. Each participant received personal invitation with a link to an online Delphi survey. The designed cross-linkages between survey components supported gathering of technical insights and different prospects on real time.

INSIGHTS INTO REGIONAL DEVELOPMENT

ISSN

Results and discussion

At the first round of the survey, all the experts expressed their opinions and answered all the required questions.

For the second round, a number of respondents decreased to190 experts who expressed their opinions in the view of the findings of the first round. The average response rate was 74%. Most of the participants are males (70% of the total number of participants). For all cluster-areas the number of males' participants was higher than female except in urban planning and building cluster where the percentage of females reached 56%. The results showed that 64% of participants showed a high level of expertise, while 18%, 13% and 4% showed a moderate degree of expertise, a low degree of expertise and no relevant expertise, respectively (Figure 1). Since participants represent diverse groups of multidisciplinary backgrounds covering all aspects of energy from natural sciences and engineering to the social and human sciences, it is understandable to the authors to find different experience levels, to a specific cluster area, recorded among the findings. Participants were representatives of universities, industrial sectors, civil societies and research organizations. In this respect, 52% of the participants were representatives of research institutions while industry and academia were represented by 41%. Previous studies showed that expertise and flow of exchanges are of higher importance than the number of participants [START_REF] Nguyen | A quantitative risk analysis model with integrated deliberative Delphi platform for container shipping operational risks[END_REF]). On the other front, previous empirical evidence showed that lower number of participants than the one used in the present study could have high social acceptance [START_REF] Rowe | The Delphi technique: Past, present, and future prospects -Introduction to the special issue[END_REF]Wright 2011, Proskuryakova 2019). Other studies showed that increasing the number of participants to capture more reflections and opinions could elongate the process with more dragging sessions and accordingly might increase the dropout rate of experts [START_REF] Okoli | The Delphi method as a research tool: an example, design considerations and applications[END_REF]. The diversity of participants and stakeholders involved in the present study is aligned with previous studies, which showed that the heterogenous groups 362 potentiate the forecasting power from one side while reducing the polarization effect and enhancing the accuracy of findings from the other side (Yaniv 2011).

Important future topics

The participants were asked to assess importance for each of the 180 identified topics clustered in 14 energy areas. The study shows that the topic is of high importance if reached consensus equal or higher than 70% by all participants. The results showed that 14 topics in 5 cluster areas (Bioenergy, enabling environments, energy storage, fossil Fuels, urban planning and building) achieved relative consensus for being important at the national level with an agreement of over 70% (Table 3). While regarding the topics of high importance at both the national and international levels, the results showed that 50 topics in 12 cluster areas (Bioenergy, energy efficiency, energy storage, enabling environments, hydrogen energy, materials for energy, mixed energy technologies, nuclear energy, other renewable energy, solar energy and transportation) achieved relative consensus with agreement over 70%.

To limit the inadvertently polarization effect which might result into an interdependent agreement of experts (spurious consensus), each group had to have a diverse level of expertise and different stakeholders while having iterative Delphi rounds. Within this methodological approach, the adopted consensus process is aligned with other previous studies [START_REF] Kerr | Group-based forecasting?: A social psychological analysis[END_REF], Önkal, Lawrence et al. 2011[START_REF] Proskuryakova | Foresight for the 'energy' priority of the Russian Science and Technology Strategy[END_REF].

Enabling environments

The education curriculum designers and makers and the general standards nationalism's vision was changed to increase awareness of the new concepts associated with energy alternatives and population awareness and recycling of waste 71

Enabling environments

The rationalization of waste and consumption was insured through good management of resources to overcome the gap between the increase in the population growth rate and the amount of resources 71

Enabling environments Localization for know-how for the manufacture of solar cells and solar heaters 71 Bioenergy A pilot plant was built for the production of biofuel as a nucleus for circulation in Egypt

Time of occurance

The Delphi topics and their forecasted time of occurrence were assessed by all participants and respondents were asked to assess frequent times of occurrence of all Delphi topics in the duration between 2018 to 2040. The assessment was performed with respect to, first, the time of technical realization which refers to the time when the technology, process or solutions could be ready at the technical level (Table 4). And second, the time of social acceptance which refers to the time when a particular technology, service or solution could impact the market and local communities in Egypt (Table 5). An average time of occurrence of all the captured statements was assessed after the second round of Delphi. The majority of Delphi topics were expected to be technologically realized in the duration between 2018-2022, while the reset of topics (25%) are expected to be realized after the year 2022.

The topics that are expected to be realized after 2027 addressed issues regarding the use of electric and hybrid cars, use of advanced material in hydrogen storage, hybrid unit of wind and solar and hydrogen PV, nuclear reactors components and the treatment of nuclear wastes. Table 3 and 4 list these specific topics regarding the technology realization time and social realization time. For the topics achieved high social realization with either market impact or high local community acceptance in Egypt (Table 3), the majority of topics (75% of all topics) are expected to be realized during the years 2018-2027, while the reset of topics (25%) are expected to be realized after the year 2027. The topics that could be realized after year 2027 addressed issues related to specific areas of nuclear energy, bio-energy, energy efficiency, energy storage and hydrogen energy.

The actions that the government should address in the near future

The respondents were asked to select the actions needed to realize the topics in the future with respect to strategy formulation, human resources, capacity building, legal system reform, academia and public research institution reform, industry support, public acceptance and the required investment. The results showed four actions with the highest consensus among the respondences which represent the actions of high priority at both the technological and social levels. The intervention for strategy formulation has achieved a consensus of 49% of all participants and it is followed by investment requirements (47%), reform of higher Education establishments and public research institution (41%) and Industry support action (40%). Figure 2 shows the actions that the government shall address in all 14 energy areas.

INSIGHTS INTO REGIONAL DEVELOPMENT

Sectors that will make the identified Delphi topics realized in future

The respondents were asked to select the sectors that will make technological and social realization possible for each of the Delphi topics and across all the 14 cluster areas with respect to stakeholder type including higher education establishment, public research organization, private enterprise, a collaboration of multiple sectors or through the support of international organizations. Results indicate that the first priority (highest consensus percentage) shall focus on the need for collaboration among multiple sectors for topics to be realised at technological and social level and more specifically for the subtopics of the areas of bio-energy, energy efficiency, energy storage, environment impact, enabling environments, materials for energy, renewable energy, solar energy, transportation and urban planning and building (Figure 3).

Figure 1 .

 1 Figure 1. Distribution of Respondents by degree of expertise per cluster area

Figure 2 .

 2 Figure 2. Specific actions require government interventions

Table 1 .

 1 Egypt's Production of Different Energy Sources during the 2000s.

		2005	2012	2013	2014	2015	2016	2017
	Coal	14	0	0	0	0	0	0
	Crude Oil	30111	32142	29537	32825	33210	30835	31885
	Natural gas	35901	54839	50143	39084	34763	34763	35362
	Electricity from Fossil Fuels	8211	12250	12250	13431	14355	14514	14679
	Hydro Electricity	1087	1112	1113	1188	1155	1171	1187
	Electricity from Renewables	47	139	139	145	137	150	165
	Refinery/Oil Porducts	28561	24754	21836	25348	25676	26357	270565
		Source: African Energy Commission (AFREC 2017)

Table 2 .

 2 Energy cluster-areas Bioenergy including biomass, waste, bioethanol, biodiesel and biogas. Energy efficiency including energy conversion, energy efficiency, distribution networks and energy transportation. Enabling environments including social environment, energy pricing, enabling legislation and energy culture. Energy storage including batteries and storage of solar energy Environment Impact including environmental concerns with respect to air and water pollution, damage to public health, wildlife and habitat loss, water use, land use and global warming. Fossil Fuels including coal, oil and natural gas. Hydrogen energy including production and installation. Materials for energy including material use, composite, raw materials and manufacturing. Mixed energy technologies including solar wind energy, solar-bio energy and bio-hydro energy. Nuclear Energy including nuclear fusion and nuclear stations. Renewable energy (1) including wind, geothermal energy, wave power and hydropower. Renewable energy (2) including concentrated solar power, solar heating, photovoltaics, solar thermal energy, solar architecture, molten salt power plants. Transportation including roads and smart transportation. Urban planning and Buildings including housing, technology codes and laws.

Table 3 .

 3 Topics importance for Egypt with highest degree of consensus among the respondents (70% consensus or higher)

			Precentage degree of
	Area	Topic	consensus of
			respondents
		A legislation was developed for a fair distribution of natural resources in terms
	Enabling environments	of use and energy pricing by doing a fair population survey	100
		A system of recycling garbage is created that is easy & simple to reuse this
	Urban planning and	garbage in the production of energy, this does not need labor as each member of
	Building	the family can manage it.	89
		Human behavior and environmental ethics were modified through education -
	Enabling environments	culture -media	86
		the general and technical education curriculum technical had included new
	Enabling environments	topics about the use of green energy and energy management technology	86
		Issued Laws for the construction of new housing on the installation of solar
	Enabling environments	water heaters as a condition of the construction license terms	86
		Proper development plans were set for improving and developing refinery
	Fossil Fuels	plants in Egypt	82
	Urban planning and	Transparent solar cells (Integrated solar cells) in curtain walls and opening and
	Building	skylight	78
		Established the targeted collaboration projects with South Asian countries,
	Energy storage	China, Japan & Korea.	75
	Energy storage	Establishment of centers of excellent for improving energy storage media.	75

Table 4 .

 4 Allocation of topics according to technological realization time

	Area	Number of topics per Technological Realization Time 2018-2022 2022-2027 2027-2032 2032-2037	Already realized	Total Number of topics
	Bioenergy	13	0	0	1	1	15
	Energy efficiency	7	2	1	0	3	13
	Enabling environments	9	6	1	0	0	16
	Energy storage	11	4	1	0	0	16
	Environment Impact	12	2	0	0	0	14
	Fossil Fuels	5	3	0	0	1	9
	Hydrogen energy	14	0	1	0	0	15
	Materials for energy	8	2	0	0	0	10
	Mixed energy technologies	14	1	0	1	0	16
	Nuclear Energy	3	3	1	3	0	10
	Other Renewable energy	6	0	0	0	1	7
	Solar Energy	13	1	0	0	0	14
	Transportation	4	1	0	0	3	8
	Urban planning and Building	16	0	0	0	1	17
	Total	135	25	5	5	10	180

Table 5 .

 5 Allocation of topics according to Social realization time

			Number of topics per Social Realization Time		Total
	Area	2018-2022	2022-2027	2027-2032	2032-2037	2037-2042	Already realized	Number of topics
	Bioenergy	7	5	2	0	1	0	15
	Energy efficiency	0	7	3	0	2	1	13
	Enabling environments	6	4	6	0	0	0	16
	Energy storage	6	6	3	0	1	0	16
	Environment Impact	8	6	0	0	0	0	14
	Fossil Fuels	4	5	0	0	0	0	9
	Hydrogen energy	9	0	5	1	0	0	15
	Materials for energy	3	4	3	0	0	0	10
	Mixed energy	7	8	1	0	0	0	16
	technologies
	Nuclear Energy	0	0	10	0	0	0	10
	Other Renewable energy	2	2	3	0	0	0	7
	Solar Energy	6	5	3	0	0	0	14
	Transportation	3	4	1	0	0	0	8
	Urban planning and	16	1	0	0	0	0	17
	Building
	Total	77	57	40	1	4	1	180

Conclusions

In this work large data set of topics were screened based on a literature review, existing policy briefs, strategies and relevant components of Egypt vision 2030. Topics were then grouped per cluster area and sub-structured to a matrix of technical questions to develop specific questionnaire relevant to each target group. Real time survey was performed through an iterative process. About 50% of Egypt's energy demand was foresighted to be met by renewable energies around 2030. The results showed that all types of energies would not only provide economic and environmental benefits but also improve living standards. This work demonstrates that involving large diversity of expertise and different stakeholders, comprising heterogenous groups, would potentiate the forecasting power, reduce the polarization effect, and enhance the reliability of the foresight exercise. The amalgamation of social, economic and political aspects in technology-based foresight ensures relevance of the findings to a wide range of beneficiary. This work utilised findings of "Egypt leaps" project that is funded by the Academy of Scientific Research in Egypt.

* This research was supported by the project, which has received funding from the European Union's Horizon 2020 research and innovation programme European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme Marie Sklodowska-Curie Research and Innovation Staff Exchanges ES H2020-MSCA-RISE-2014 CLUSDEVMED (2015-2019) Grant Agreement Number 645730730

 ISSN 2669-0195 (online)http://jssidoi.org/jesi/ 2019 Volume 1 Number 4 (December) http://doi.org/10.9770/IRD.2019. 1.4(6) 366 On the other front, participants expected higher education establishments to address that the topics of fossil fuels areas to be impactful while the contribution of public research organization could significantly topics of nuclear energy and mixed energy technologies areas.


Abderrahmane Sensaoui

David Hely

Oum-El-Kheir Aktouf

Toubkal: A Flexible and Efficient Hardware Isolation Module for Secure Lightweight Devices

Regular Paper

Abstract-Toubkal is a new hardware architecture which provides secure, efficient and flexible hardware isolation. It is a modular system that offers strong separation of different hardware modules within a system. Lightweight devices use mainly a Memory Protection Unit (MPU) to protect the memory and create an isolation architecture. However, the MPU offers only a memory control access for the software running on the system. This scheme does not prevent other hardware components from accessing system memories. Toubkal aims to enhance these MPU architectures by adding a new hardware layer to create different access environments for different hardware components.

Toubkal has been designed in such a way that it can easily be adapted to the system needs in terms of security, safety and performances. It does not require any change in the existing hardware modules. We present a detailed description of the architecture, then we compare and discuss run-time, area overhead as well as security limitations using different policies and options. The first experimental hardware module increases between 0.08% and 8.5% a single core Rocket Chip cells area.

Index Terms-Isolation, Hardware Security, Trusted Computing

I. INTRODUCTION

With the rise of lightweight devices use in healthcare, autonomous vehicles and smart factories, protection of lightweight devices must be strengthened while offering good performances. Memory isolation could be a good solution to add more resilience to an embedded system. Memory isolation is based on the principal of least privilege and privilege separation. It can create different execution contexts, so each program can be executed safely in its context. The industry proposes solutions for lightweight devices to achieve such security protection. One of the most known is the Arm MPU [START_REF] Arm | Arm the architecture for the digital world[END_REF].

A lightweight device is a low-cost device that does not need complex memory management. Therefore, it lacks a Memory Management Unit (MMU), and its memory model is referred to as a flat memory model because its memory appears as one contiguous address space.

Modern lightweight embedded systems have become more complex and contain different hardware components with access to a system memories. The Arm MPU and the likes [START_REF] Stecklina | Design of a tailor-made memory protection unit for low power microcontrollers[END_REF]- [START_REF] Koeberl | Trustlite: a security architecture for tiny embedded devices[END_REF] are optional hardware components in some cores used to protect the memory in lightweight devices. These MPUs are less complex than the MMUs and have security and safety limitations. First, the privileged modes have access to the whole memory mapping which can be critical to the system security and dependability. Many researchers [START_REF]Freertos tcp/ip stack vulnerabilities put a wide range of devices at risk of compromise: From smart homes to critical infrastructure systems[END_REF]- [START_REF] Szekeres | Sok: Eternal war in memory[END_REF] have shown flaws in Operating Systems (OS) and how an attacker can escalate the privileges, and so, they can access all secrets stored in memories, change the MPU configuration, etc. Second, they only offer controlled memory accesses to the Control Processing Unit (CPU). Unfortunately, the CPU is not the only hardware component connected to memories. In this paper, we refer such components as Masters. Other Masters, such as the Direct Memory Access (DMA) peripheral, can access memory too. Neither MPUs nor MMUs can protect the memory from such accesses. Therefore, an additional layer of isolation is needed.

Interesting solutions [START_REF]Direct memory access (dma) address translation in an input/output memory management unit (iommu)[END_REF]- [START_REF] Arm | Arm system memory management unit architecture specification[END_REF] have been proposed by some academic papers and patents to add a special MMU for peripherals such as DMA. The so called In Out MMUs (IOMMU) or System MMU (SMMU) offer solutions similar to the traditional MMU. They add address translation and permissions for IO components.

However, these solutions are subject to a major limitation in this paper context. They are destined to high performance computer systems and require lots of cells area and memories as they use page tables and caches. Moreover, the IOMMUs and SMMUs are interfaced with one IO component (such as DMA). Therefore, if there are two IO components of which accesses must be controlled, the device will need two IOMMUs or SMMUs.

Another limitation they suffer from in this context, is the latency introduced into the devices. According to [START_REF] Ben-Yehuda | The price of safety : Evaluating iommu performance[END_REF], they impose an extra performance penalty. This penalty is caused by the frequent mapping and un-mapping calls to create translation entries in the IO component address space.

Contrary to high performance systems, lightweight devices have strong power consumption and size constraints, and most of their applications are time critical. The use of any cited solution will add very high overheads, power consumption, cells area and run-time.

Others [START_REF] Evtyushkin | Flexible hardware-managed isolated execution: Architecture, software support and applications[END_REF], [START_REF] Costan | Sanctum: Minimal hardware extensions for strong software isolation[END_REF]- [START_REF] Levy | Multiprogramming a 64kb computer safely and efficiently[END_REF] offer a DMA transfer filter where they define a safe region in the memory controller for the DMA. The DMA can only access the defined region. However, this solution does not offer a real and complete separation. It limits the DMA access to a contiguous memory space.

While the need of a strong spacial separation becomes clear, we observe this level of isolation has been neglected in modern lightweight devices. We present Toubkal, a novel hardware module which overcomes previous work limitations to create low-cost and efficient spacial separation between Masters. Toubkal is an experimental parameterizable block with multiple-ready policies. This hardware block is responsible of controlling memory accesses of different IO components within the device to create a strong isolation between these components. Toubkal is compatible with existing Arm and RISC-V based Instruction Set Architectures (ISA) with an Advanced High-performance Bus (AHB) without changing the existing Masters.

The contributions of this paper are summarized as follows:

• We present an overview of MPUs limitations and the motivations behind designing Toubkal. • We present Toubkal design and implementation. We implement Toubkal in Chisel3 [START_REF] Bachrach | Chisel: Constructing hardware in a scala embedded language[END_REF] and offer a flexible design with multiple ready options to generate the right block for a given device. • We evaluate Toubkal run-time performances, cells area and its own resiliency. We compare the impact of each option on Toubkal design and system security. The rest of the paper is structured as follows. In section II, we give an example to motivate our solution and discuss limitations of the existing MPUs. Then, in section III we present Toubkal, a description of its major components, the way it communicates with the software, and different parameters and policies included in the package. We evaluate the overheads of Toubkal in section IV, execution time, cells area and security, and we draw a comparison of the impact of each parameter and policy on Toubkal design and behavior. In section V, we discuss related work. Finally, in section VI, we conclude this paper.

II. TOUBKAL USE CASE AND MOTIVATIONS

This section presents a brief Use Case and the requirements for an ideal protection system. Note that the use of Toubkal is not limited to this example. Consider a device with three Masters: a CPU, a DMA and a Cryptography Engine (CE). The CE can access the SRAM to read/write values for intermediate cryptographic operations. While usually the Keys are protected, an attacker can take advantage of a vulnerability like a buffer overflow or uses the DMA [START_REF] Stewin | Understanding dma malware[END_REF], [START_REF] Sang | I/o attacks in intel pcbased architectures and countermeasures[END_REF] to access the intermediate cryptographic results. This way, the attacker can find the values of the keys from intermediate operations. Toubkal prevents the CPU and the DMA from reading the concerned memory region while the CE is processing its cryptographic operations.

To implement the protection system in such a way, Toubkal requires to be:

• Flexible: Toubkal has to be flexible. Flexibility in this paper means that the solution has to offer different strate-gies and options to achieve hardware separation. In the previous example, designers can opt for different policies depending on the existing tools and device constraints. Some would prefer to forbid all the time the region for all other masters. Others would prefer to forbid the access temporarily and then clean and re-use the same region for other operations by other Masters because of memory area constraints. For example, we can imagine a CPU writes in that region a plain text. This plain text will be read by the CE. Toubkal then forbids the access of the CPU and DMA to this region while the CE is cyphering the data, and then in the same region, the CE cleans intermediate values and writes the resulting encrypted data. Finally, Toubkal grants access again to the CPU to read the result. • Efficient: Toubkal must be transparent but also small.

Transparent, because Toubkal will catch all communications between the concerned Masters and memories, therefore the latency inside Toubkal must be negligible, and does not affect device timing. Small, because we are targeting principally lightweight embedded systems. • Resilient: A protection domain guarantees a certain protection. Therefore, it must be itself resilient. Toubkal has to be configured at some point. Different approaches could be in place. Some approaches guarantee more resiliency than others, like for example hardware-only solutions are usually more resilient than hardware-software or software-only solutions. The chosen approach has to take in consideration the chosen policy and make sure not to weaken Toubkal. Previous works [START_REF]Direct memory access (dma) address translation in an input/output memory management unit (iommu)[END_REF]- [START_REF] Arm | Arm system memory management unit architecture specification[END_REF], [START_REF] Costan | Sanctum: Minimal hardware extensions for strong software isolation[END_REF], [START_REF] Costan | Intel sgx explained[END_REF] fail in flexibility and efficiency requirements. They add high overheads in terms of power consumption, hardware cells area and run-time execution and they control access to a specific IO component.

Previous MPUs such as ARM MPU, Intel EA-MPU, Rocket Chip Physical Memory Protection (PMP) and Mondrian are limited, and fail in one or more of these requirements. All the cited MPUs are interfaced with the core. This results in controlling memory accesses of the core alone. All other memory accesses are not controlled.

Another limitation of these MPUs is that the OSes, even if not trusted, they run in privileged mode, and thus have access to the whole memory space even MPUs memory mapped registers. [START_REF]Freertos tcp/ip stack vulnerabilities put a wide range of devices at risk of compromise: From smart homes to critical infrastructure systems[END_REF], [START_REF] Arm | uvisor[END_REF] depict weaknesses in OSes. Some of these vulnerabilities lead to privilege escalation. Therefore, an attacker can access any memory address, or, sometimes, completely turn off the protection of the MPU.

The aim of Toubkal is not to replace these MPUs but to enhance them. It offers a new layer of security and can work with any cited MPU. It is expected to overcome the above limitations while guaranteeing good performances and acceptable hardware cost.

Figure 1 illustrates a visual of the memory protection. Each column represents a protection domain. Here the protection domain is a given Master. Each Master can be prohibited or not from accessing memory regions. There can be different policies to manage protection domains. Therefore, an ideal system would allow flexibility for both designers to generate the hardware block with the right size and policy, and developers to use it easily statically or dynamically. Toubkal is a parameterizable block written in Chisel3. It generates a block design in Verilog ready to include in a given system design. This block is responsible of creating a spacial separation between Masters. The size of Toubkal depends on the needs and policies. Designers can choose between three policies, static, semi-static and dynamic policies. They can also choose, among many other parameters, the address space (32bits or 64-bits etc.) and the granularity of memory regions (size of each region is a power of two or a multiple of 32 bytes).

The next section presents in detail the design of Toubkal. We describe Toubkal major components and the different options and policies to choose to generate the tailored design.

III. TOUBKAL DESIGN

The major challenge of Toubkal is to develop a flexible design and to keep it small with a negligible run-time overhead. This section starts with describing our initial analysis of the design, then presents our proof-of-concept implementation.

A. Toubkal Requirements

Toubkal needs to control all memory accesses of the concerned Masters. Therefore, the position choice of Toubkal is crucial. Communication between Masters and Memories is done via a communication bus. In this paper, we focus on systems with an Advanced High-performance Bus(AHB). The AHB [START_REF] Arm | Arm amba 5 ahb protocol specification[END_REF] is a bus that connects hardware components with high bandwidth speed needs. Such components are Masters, Interconnect interfaces and Slaves. For example, CPUs, DMAs and Memories (external or internal) are connected with an AHB. The AHB looks like the perfect spot to catch communication between Masters and memories. Although, working in this spot requires Toubkal to control the access instantly, within the clock cycle. The design has to avoid any sequential processing.

The second requirement is the flexibility of the design. We suppose that depending on the application field, size and policies may vary. This is why Toubkal was designed as parameterizable design. In the design's top, designers choose the compatible configuration such as the address width, the granularity and the policy. Then they can generate the corresponding Verilog code to embed it in their design. To do so, we write our block in Chisel3, which is a new hardware description language that supports advanced hardware design. Chisel is embedded in Scala programming language and takes advantage of it to offer a high level hardware description language with concepts like object-oriented programming, polymorphism and functional programming.

The third requirement is resiliency. This point depends on the chosen policy. For a static policy, there is no need for Toubkal to include a software part. However, for a semi-static or dynamic policy, Toubkal must include a micro-code to manage configurations. This introduces a new attack surface to Toubkal. Section IV discusses in details this aspect.

B. Toubkal Major Components

Toubkal is composed mainly of the Master Look-aside Buffer (MLB) the uCode block, in addition to some logic for the look-up and match, security checks and Toubkal configuration (see figure 2). In this work, Toubkal is interfaced with the AHB but it can be positioned in any other position that catches communication between Masters and memories. The abstraction layer aims to facilitate the integration of Toubkal in different systems and positions.

Toubkal is composed of uCode which is responsible of memory mapping all Toubkal registers and configuring Toubkal. uCode can be configured from a software called micro-code. The MLB is a set of registers to store regions configurations or look-up&match some address. This paper presents and discusses two different implementations of the MLB. uCode is connected to MLB registers to store regions configurations. And then, there is the abstraction layer. This layer is customizable and aims to facilitate the integration of Toubkal in different systems and spots.

C. Master Look-aside Buffer

The MLB is designed to store memory regions configurations, it looks-up&matches addresses. To store configurations, Toubkal uses registers, which are costly, but guarantee rapid access. Toubkal proposes different ways to store configurations. As shown in figure 3, designers can choose the number of memory region slots, the granularity, the address width, the number of concerned Masters and the method to attribute slots to Masters. Fig. 3. MLB slots: The figure presents the different ways to store configurations in the MLB for a 32 bits address space. N represents the number of masters. The first method, called UMLB (U for Unique) stores one configuration per Master per slot, while the second method, called SMLB (S for Shared), stores one configuration per slot but for multiple masters. In the SMLB, there is no need for a valid bit as each Master has a corresponding bit in the first column from the left. The value 0 means the configuration is not valid for that master and vice versa. The third column from the left refers to size in case of coarse-grained granularity, and to end address in case of fine-grained one.

The first important decision to make in Toubkal is to choose between configuring memory regions white-list or memory regions black-list. This choice is strategic and depends on which case would lead to fewer slots to configure. We added this option as we believe for isolation at this level, contrary to MPUs and MMUs, it is more interesting to create a black-list rather than a white-list. It is more likely to prohibit a memory region rather than allowing it. Indeed, the way of thinking at this level is different compared to the application level. Thus, in the rest of the paper we will be more talking about prohibiting memory regions to Masters rather than allowing them.

Toubkal offers two ways to organize slots (see figure 3). The first method is called Unique MLB (UMLB) because each slot is unique to a Master, and the second method is called Shared MLB (SMLB) because a slot can be shared between multiple Masters. The UMLB consists in storing in each slot a memory region configuration for a specific Master. While the SMLB consists in storing in each slot a memory region configuration for multiple Masters. Each way has its advantages and its drawbacks, and each is more suitable to specific use cases. While the UMLB requires less logic to match or insert the Master Id, the SMLB can require fewer slots (therefore fewer cells area) in case some Masters share some common permissions. In the SMLB, there is a bit for each Master. When the bit is up, it means that the configuration is valid for the corresponding Master and vice-versa.

Concerning the number of slots, Toubkal accepts up to 16 slots. Because of the high cost of registers, we limited the number of slots to 16 slots. Designers can choose between 4, 8, 12 or 16 slots. The size of Toubkal grows proportionally to this number. Section IV-B shows how the area is impacted by the number of slots.

The other parameter is the granularity of Toubkal. This paper proposes two granularities. For fine-grained granularity, Toubkal proposes regions multiple to 32 bytes and the region address start is aligned to 32 bytes. And for coarsegrained granularity, Toubkal proposes regions power of two and the region address start is aligned to its size. The second granularity is more constraining in comparison to the first one. However, as figure 4 shows, the coarse-grained requires less logic than the fine-grained to match addresses.

To configure memory regions in Toubkal, MLB registers can be hard-coded for more resiliency and less flexibility, or memory mapped and then the uCode is responsible in configuring them during software execution for more flexibility and dynamism. Making Toubkal accessible from the running software adds its attack surface. We discuss this point in the next section. Fig. 4. A fine grained match is more complex than a coarse grained match. The second one compares the address with the base address and the limit address, while the first one compares the logical combination of the address and the mask corresponding to the size of the region with the base address.

D. uCode and Toubkal configuration

The uCode permits to a certain part of the software (microcode) to configure Toubkal. uCode contains registers to store the start address and the end address of the micro-code in the memory, as well as the Id of the Master allowed to run this code. Once Toubkal is enabled, these registers have to be set and then locked until system reset. The micro-code is the only software part that can configure Toubkal MLB. Toubkal saves the Program Counter (PC) and whenever a read/write of MLB registers occurs, it checks if the PC is inside the micro-code region.

To make sure the micro-code is running in privileged mode without changing the CPU, we propose to map the MLB registers to the system memory region. In our case, as we are working on RISC-V and Arm cores, there are memory spaces [START_REF]Cortex-m3 devices generic user guide[END_REF], [START_REF] Sifive | Sifive e31 core complex manual[END_REF] for each core that can only be accessed by program code running in privileged mode. We take advantage of these spaces to memory map the uCode and MLB registers.

Toubkal is configurable either once or through a unique trusted Master. For the second case, uCode is mandatory, and is the only one responsible in configuring Toubkal during runtime. Each slot can be configured and locked independently. If a slot is set locked, it can only be reconfigured after the system reset. If the slot is not locked, then it can be reconfigured as many time as needed by the micro-code. Toubkal is controlled by its own set of memory-mapped registers. Figure 5 shows an example of memory-mapped registers. The base address for these registers varies depending on which core is used. For Arm for example, the base address has to be between 0xE0000000 and 0xE003FFFF [START_REF]Cortex-m3 devices generic user guide[END_REF] to make sure that they are accessible only by code running in privileged mode. Toubkal mapped registers can change in terms of the chosen options.

E. Toubkal Policies

We put in place different policies to generate different designs of Toubkal. These choices impact the hardware area cost. Section IV compares between all the options. We implement three policies, static, semi-static and dynamic.

The static policy is a security policy that focuses on resiliency rather than flexibility. In this policy, memory regions configurations are hard-coded, or loaded using the Read Only Memory (ROM) or a One Time Programmable (OTP).

The semi-static policy is a little more flexible than the first one. Like the static policy, some configurations can be fixed from the beginning, but it offers the possibility to add other configurations during execution. To do so, we add a uCode that has to be run in privileged mode and we memory map some registers. These registers are only accessible from privileged mode. The uCode must be a predefined memory region, which means that outside this region Toubkal will not configure itself. Once a configuration is added, it cannot be modified or removed, although, this policy works only with the SMLB configuration, therefore, it is possible to validate or invalidate the configuration for each Master by flipping the corresponding bit. This can be useful in the use case presented in section II. It is also possible to lock a configuration so no one can change it until system reset.

The dynamic policy is the most flexible but the less secure of the three policies. From the uCode, it is possible to add, remove or change all configurations. The uCode runs under the same condition as in the semi-static policy. There is also a lock bit to lock a configuration so it cannot be modified until system reset.

In the next section, we evaluate Toubkal, compare and discuss the differences between each policy in terms of performances, cells area and security.

IV. TOUBKAL EVALUATION

Toubkal proposes different options and policies. Some options and policies offer more flexibility to developers than other. For example, fine grained option is more flexible and user-friendly for developers than the coarse grained one. But it comes at a cost. The same observation can be done for policies, the more a policy is flexible, the more the surface area of Toubkal grows.

Policies can also impact the device security. For example, the dynamic and semi-static policies introduce the microcode which is a software run to configure Toubkal. Adding a software exposes Toubkal to software attacks such as Return Oriented Programing (ROP) attacks. While the static one does not need a software, it eliminates the risk of such attacks.

We realized Toubkal design in Chisel3. Toubkal is written in around 480 Chisel3 lines of code and generates up to 3400 optimized and synthesizable Verilog lines of code. The generated Verilog codes are then synthesized. Synthesizing is compiling the Verilog code into a set of gates and wires to build a block of an Application-Specific Integrated Circuit (ASIC).

In this section we evaluate Toubkal from three different aspects: performances, cells area and security. We compare for each aspect the impact of each option and policy.

A. Run-time evaluation

To evaluate the run-time behavior, we evaluate the latency inside Toubkal. As seen above, we have two main parts in Toubkal, the uCode and the MLB. The uCode is responsible of decoding the data sent from the micro-code and then stores it into the right MLB slot. This operation is done in one clock cycle. Concerning the look-up&match, the result is instantly obtained for both granularities. Toubkal intercepts communication in the AHB. Therefore, it requires a negligible latency. The configuration of MLB is considered as read/write in a Static Random Access Memory (SRAM). The address checking must be done in less than a clock cycle. Toubkal uses parallel look-up. The implementation for the coarse granularity is less complex than the fine granularity. In the first one, only a match of a logical combination of the address and a mask is needed. While the second one needs more logical elements as we compare the address with the base and the limit.

To make sure Toubkal runs in less than a clock cycle, we synthesize the design with temporal constraints. The temporal constraints consist in delaying the Input and Output ports. Defining the input delay port value means that the data would reach the input ports after the defined value. And defining the output delay value means that the data should be present on the output port before the specified clock edge.

We synthesize our design in different clock periods up to 1GHz for a 90nm Low Power technology. The objective is to determine the fastest clock speed within the defined temporal constraints, which are 0.4 of clock period as an input delay and as output delay, by determining delay of the critical path inside Toubkal. If the delay is positive, then Toubkal assures data at the output ports in time. Otherwise, there are cases, e.g. the critical path, where Toubkal needs more than a clock cycle to deliver data.

The result of synthesis differs from a policy to another. For the static policy, even at 1GHz, the delay is always positive. For the semi-static and dynamic policies, the delay equals 0 at 200 MHz, and for more than 200MHz, the delay is negative. The critical path where the delay is negative matches the path done to configure a slot in the MLB. Assuming that Toubkal needs more than a clock cycle to configure the whole slot, we can add a timing exception for uCode module. During Toubkal configuration, the communication might be blocked for two or three cycles for each slot, depending on the granularity of the design as seen in section III.

As we target lightweight devices, a positive delay at 200MHz and less for 90nm Low Power technology is a good result. For the rest of the paper, all our syntheses are done in 100MHz for a 90nm Low Power technology.

B. Cells area evaluation

In this section, we evaluate the cells area of Toubkal targeting a 90nm Low Power technology for a clock frequency of 100MHz and compare between the different options and policies. In this experiment, tests are limited to a 32 bit address space. Toubkal surface is stated in Gates Equivalents (GE). kGE refers to thousands of GE. A GE is retrieved from the surface of a NAND2 gate.

1) Comparison between configuration methods: Section III-C presents two different configuration methods to store Masters Id, UMLB where the slot is valid for one Master and the SMLB where the slot is valid for multiple Masters. Table I shows the impact of each method on Toubkal area. In the UMLB, for n Masters, Toubkal needs log2Ceil(n) bits to store all possible values of Masters Ids. While in the SMLB, Toubkal needs n bits because it flips the p bit to activate a region for Master number p (see section III-C). However, n is greater than or equals to log2Ceil(n) for n strictly positive, therefore Toubkal needs more registers for SMLB comparing to UMLB. Here, the test was done for 2 Masters, and log2Ceil(2) equals 1.

Registers are not the only thing impacted. The combinational logic is impacted too. In the SMLB, Toubkal needs more logic than in the UMLB. To flip the p bit is more complex than just writing the value p in a register. The same is correct for the look-up&match. Toubkal has to look if the bit number p is up or not.

The choice between the two possibilities is strategic. In case there are more common regions between different Masters, it is more interesting to use the SMLB rather than the UMLB. This can save many slots. The use case presented in section 2) Comparison between coarse grained and fine grained granularities: Table II shows results of different syntheses for coarse and fine granularities. The fine grained option requires more area than the coarse grained one. The gap between the two is proportional to the number of available slots. This is due to two factors that were discussed in section III-C. The first factor is the growing size of the MLB registers. For the coarse granularity, the size of a region is a power of two and is on 5 bits. While for the fine grained granularity, instead of the size of a region we have the limit of the region which is on 27 bits for a 32 bit address space and an alignment to 32 bytes. Therefore for each slot, there are 22 additional bits in the fine grained granularity. Added to this the logic behind the look-up&match. The implementation of the parallel look-up in this case is more complex and requires more logical elements to correctly answer to the timing constraints.

Nevertheless, the coarse grained option is constrained. The user needs to configure regions with a size power of two, and the base address is aligned with the size. While the fine grained requires only that the size is multiple of 32 bytes and the base address is aligned to 32 bytes.

At this level of isolation, we believe that the coarse grained option would not be very constraining for developers. Depending on the device resources, some designers would opt for the coarse grained option to save some hardware area, other would opt for the fine grained one for more user-friendliness and less engineering. However, such advantage comes with a surface cost.

3) Comparison between policies: Here, we compare between the three policies, static, semi-static and dynamic. We fix granularity into the coarse one, configuration method into the second method, then for each policy we vary the number of slots.

Table III shows the results of our syntheses. Static policy results catch our eyes immediately because of the huge gap between this policy and the others. In fact, static policy results are normal. As seen in section III-E, the MLB configuration is hard-coded. Therefore, when Chisel3 generates the optimized and synthesizable Verilog code, it transforms all registers into simple wires and assigns values. And there is less and less combinational logic in Toubkal. Chisel3 compiler also removes all redundant values. For example if some regions have the same size value, it will just assign the value once, and use it for all the concerned regions while looking-up&matching. Meanwhile, the gap is smaller between the semi-static and dynamic policies. The semi-static policy cells area is a little bigger than the dynamic one because Toubkal needs more combinational logic. In semi-static policy, slots cannot be fully modified. Developers can only modify the Masters Ids registers, and activate or deactivate the configuration for a specific Master.

For the semi-static policy, some slots can be hard-coded. For each hard-coded slot, the reduction of Toubkal cells area is not negligible at all. Table IV shows some results. The size of Toubkal is reduced proportionally to the number of hardcoded slots. This reminds us of the static policy. The hardcoded slots are not stored in registers anymore. Hence, the surface area is reduced.

C. Security evaluation

In this part, we discuss how Toubkal helps protecting the device from a variety of attacks as well as its security limitations.

1) Direct Memory Access (DMA): Until today, the DMA has been a very serious weakness for many devices that make use of it. For example, the Nintendo switch attack was performed [START_REF] Kate Temkin | Fusee gelee exploit[END_REF], [START_REF]Shofel2 exploit[END_REF] by taking advantage of a buffer overflow vulnerability found in the USB stack. This allowed an attacker, using the DMA, to extract secrets from memory or to execute arbitrary code. Toubkal can stop the DMA from accessing certain memory regions.

2) Heterogeneous systems: Considering a system with two different cores. An attacker can make use of a vulnerability to access data processed by the other core. An MMU can be a solution here, but it has a real impact on time critical devices. Toubkal can create a real separation between the two cores so each core cannot access the other core memory space without impacting run-time execution.

3) Hardware interrupts limitation: An application code can be interrupted by a certain interrupt. The CPU elevates the privilege. An attacker could take advantage of a vulnerability and attempt a code reuse attack to divert the control path and execute the micro-code. Therefore, the attacker can modify non locked regions. This is a current limitation that concerns the semi-static and dynamic policies.

To mitigate this weakness, some security development habits or the use of a security hypervisor such as uVisor [START_REF] Arm | uvisor[END_REF] and the likes [START_REF] Brasser | Tytan: Tiny trust anchor for tiny devices[END_REF]- [START_REF] Echronos | echronos[END_REF] could make it harder for an attacker to break into the micro-code. One way to make sure the microcode is run according to the initial program flow is to add a Control Flow Integer (CFI). The CFI will not only make sure that the micro-code is run properly but the whole device. There are lots of works in this area, but there is still room for improvement, especially for lightweight devices.

V. RELATED WORK

In this section we compare Toubkal to related existing work. There has been several works, academic and industrial, that have explored this problematic. Some works have tried to solve the issue for all Masters. Others just tried to solve the DMA issue.

In the first category, such works are IOMMUs and the IOMPU. Several works have been published about the IOMMU. For example, [START_REF]Direct memory access (dma) address translation in an input/output memory management unit (iommu)[END_REF] presents a solution that offers an MMU-like for peripherals. Therefore, addresses for components such as DMA are translated too and controlled. In this work, the IOMMU is embodied in a processor which connects the IOMMU with memories and peripherals using bridges. The IOMPU [START_REF] Münch | Iompu: Spatial separation for hardware-based i/o virtualization for mixed-criticality embedded real-time systems using non-transparent bridges[END_REF] takes advantage of the Non-Transparent Bridge (NTB) which isolates two hosts or memory domains yet allowing the exchange of data. Using the NTB, IOMPU can offer spacial isolation for I/O devices.

Arm proposes System Memory Management Unit [START_REF] Arm | Arm system memory management unit architecture specification[END_REF] (SMMU) to complement its MMU. The SMMU is Arm version of the IOMMU. It works based on the same principles of the IOMMU.

The IOMMUs, the IOMPUs and the likes [START_REF]Direct memory access (dma) address translation in an input/output memory management unit (iommu)[END_REF]- [START_REF] Evtyushkin | Flexible hardware-managed isolated execution: Architecture, software support and applications[END_REF] intercept IO communications and perform address translation from device addresses to machine's physical addresses. They are similar to a classic MMU. They have page tables to translate addresses and caches frequent entries in a Translation Look-aside Buffer (TLB). However, this is unsuitable with lightweight devices as they have resources constraints and are time critical. Moreover, the above solutions are only interfaced with the concerned components. For example, if there are two IO components, the device will need two IOMMUs or SMMUs to control accesses of each component. In the mean time, Toubkal controls accesses of multiple IO components.

[29] offers a solution to protect communication between a secure Master and a secure Slave. They propose to add two hardware blocks, one in front of the secure Master and the other in front of the Secure Slave. We call the block in front of the secure Master MB and the block in front of the secure Slave SB. The SB defines a protected region. When the secure Master tries to access the protected region, the MB sends a signal to the SB to let the secure Master access the protected memory. If the SB does not receive a signal from an MB, it blocks the access for the protected memory region. This is limited comparing to Toubkal. First, each concerned Master and for each Slave need MBs and SBs respectively, and for each Slave, the SB protects only one memory space. Second, once the Master has an MB, it can access all the protected memory regions, while Toubkal offers a real separation between all Masters.

In the second category, there are works such as Intel SGX [START_REF] Costan | Intel sgx explained[END_REF], Sanctum [START_REF] Costan | Sanctum: Minimal hardware extensions for strong software isolation[END_REF]. The two solutions tackle the DMA problem. Intel SGX for example offers a DMA filtering based on black-list approach. This joins Toubkal idea in proposing a black-list, except that Toubkal offers a black-list for different IO Masters and not only the DMA. Sanctum proposes a simple DMA filtering where there are two additional registers in the DMA arbiter (memory controller) to define the start address of a DMA safe region and end address.

TrustZone Arm can also join the list of related work, as their Secure/NonSecure bit propagates to all hardware modules. TrustZone proposes a binary protection where there are two worlds, secure world and non secure world. We believe that Security in general is not binary, especially in isolation. A flaw in the secure world can lead to serious damages. Added to this, this paper [START_REF] Benhani | On the security evaluation of the arm trustzone extension in a heterogeneous soc[END_REF] presents relevant attack scenarios in heterogeneous systems where a third-party hardware module exploits some failures of the TrustZone technology. First, Toubkal offers different protection domains for each Master. And second, Toubkal can help mitigate these attack scenarios. It provides memory protection to isolate Masters from each other and limit their address space.

VI. CONCLUSION

In this paper we emphasized on the need of a strong hardware isolation in lightweight devices. Traditional MPUs offers limited isolation that will become dangerous when an attacker escalates a privilege or succeeds in making use of a peripheral that accesses memory. Related work requires lots of resources and processing time. Furthermore, most of them are limited to DMA issue and need to be cloned for each concerned Master. For this purpose, we presented Toubkal, a first experimental hardware isolation module for lightweight devices. Toubkal is written in Chisel3 and provides a Verilog generator of hardware isolation modules. It offers many options and policies to generate the right design. Regarding the evaluation, Toubkal achieves a spacial separation with inexistent run-time overhead and tailored hardware area, from 0.08% to 8.5% of a single core Rocket Chip total area.

Fig. 1 .

 1 Fig. 1. A visual of how a single contiguous memory space is segmented between different Masters.

Fig. 2 .

 2 Fig. 2. Major components of hardware block of Toubkal: The uCode module contains information to recognize the micro-code which is responsible of configuring Toubkal. This module is linked to the MLB. The MLB is a set of registers to store regions configurations. The abstraction layer is customizable and aims to facilitate the integration of Toubkal in different systems and at different spots.

Fig. 5 .

 5 Fig.5. Toubkal example of memory mapped registers. The example corresponds to a 32 bits address space with the UMLB configuration.

TABLE I TOUBKAL

 I CELLS AREA FOR A DYNAMIC POLICY.(IN KGE)

		4 slots	8 slots	12 slots	16 slots
	UMLB	3,36	6,21	9,10	12,04
	SMLB	3,35	6,31	9,19	12,11

  would work perfectly with the SMLB. Three Masters CPU, DMA and CE share the same region. Here the SMLB saves two slots. But in case Masters do not share regions, the UMLB is suitable.

		TABLE II
	TOUBKAL CELLS AREA FOR A DYNAMIC POLICY. (IN KGE)
		4 slots	8 slots	12 slots	16 slots
	Coarse granularity	3,36	6,21	9,10	12,04
	Fine granularity	4,84	8,90	13,49	17,76

II