Marc Fyrbiak
email: marc.fyrbiak@rub.de.

Simon Rokicki
email: simon.rokicki@irisa.fr.

Nicolai Bissantz
email: nicolai.bissantz@rub.de.

Russell Tessier
email: tessier@umass.edu.

Fellow, IEEE Christof Paar
email: christof.paar@rub.de.

• M Fyrbiak

• R Tessier

Hybrid Obfuscation to Protect against Disclosure Attacks on Embedded Microprocessors

Keywords: Computer architecture, ISA randomization, software obfuscation, reverse-engineering. !

The risk of code reverse-engineering is particularly acute for embedded processors which often have limited available resources to protect program information. Previous efforts involving code obfuscation provide some additional security against reverseengineering of programs, but the security benefits are typically limited and not quantifiable. Hence, new approaches to code protection and creation of associated metrics are highly desirable. This paper has two main contributions. We propose the first hybrid diversification approach for protecting embedded software and we provide statistical metrics to evaluate the protection. Diversification is achieved by combining hardware obfuscation at the microarchitecture level and the use of software-level obfuscation techniques tailored to embedded systems. Both measures are based on a compiler which generates obfuscated programs, and an embedded processor implemented in an FPGA with a randomized ISA encoding to execute the hybrid obfuscated program. We employ a fine-grained, hardware-enforced access control mechanism for information exchange with the processor and hardware-assisted booby traps to actively counteract manipulation attacks. It is shown that our approach is effective against a wide variety of possible information disclosure attacks in case of a physically present adversary. Moreover, we propose a novel statistical evaluation methodology that provides a security metric for hybrid-obfuscated programs.

INTRODUCTION

E MBEDDED microprocessors are vital resources in a wide array of low-end computing platforms. With the continuing growth of the Internet of Things (IoT), simple processors are widely found in vehicles, appliances, health sensors, and infrastructure monitors, among other systems [START_REF] Chase | The evolution of the internet of things[END_REF]. Often, these processors must operate in severely constrained environments with stringent power and performance demands. However, in many cases, predictable software security and reliability must be maintained.

Most previous efforts at providing software protection at the hardware level have included secure processors [START_REF] Lie | Architectural support for copy and tamper resistant software[END_REF], [START_REF] Suh | Aegis: A secure single-core processor[END_REF], [START_REF] Owusu | OASIS: on achieving a sanctuary for integrity and secrecy on untrusted platforms[END_REF]. Although provably secure, these implementations focus more on preventing illegal execution of code and data security than on obscuring software control flow and algorithm implementation. For many real-world embedded systems, the storage of program code in external, untrusted memories and the knowledge of the Instruction Set Architecture (ISA) provide an unfortunate attack vector [START_REF] Zaddach | AVATAR: A framework to support dynamic security analysis of embedded systems' firmwares[END_REF] regarding reverseengineering and intellectual property protection. Hence, as soon as the ISA can be concealed from an adversary, the effort level needed to disclose critical information from the program code, such as an algorithm implementation, rises.

Increasingly, microprocessors and other circuitry are implemented in devices which include field-programmable logic [START_REF] Yiannacouras | The microarchitecture of FPGA-based soft processors[END_REF] providing an attractive opportunity to customize a processor's control logic. Instruction decoding implemented in field-programmable logic offers a flexible solution to randomize instruction encoding among numerous embedded systems. Furthermore, such hardware-level alteration is agnostic to other processor architecture features.

In this paper, we focus on a hybrid approach to security via hardware-level obfuscation on the microarchitecture level and the use of software-level obfuscation techniques suited for embedded systems. Our approach tackles the shortcomings of existing state-of-the art ISA randomization defenses for an adversary with physical access to the target device. Particularly, we address various generic disclosure attacks for embedded systems that can be exploited to extract critical instruction encoding information. We categorize these information disclosure sources as ranging from general hardware access capabilities to program specific characteristics to the employed instruction encoding format. We then introduce our hybrid obfuscation design which defeats the different attacks and thus prevents reverse-engineering and software execution on an illegitimate platform. Our main contributions are:

• Hardware-level Obfuscation. We introduce an ISA randomization scheme which prevents information disclosure of a broad range of attacks. The scheme alters the microprocessor decode unit using hardwareefficient transformations. Furthermore, we restrict memory accesses using a fine-grained, hardware-level policy and actively counteract manipulation attacks using hardware-level booby traps.

• Software-level Obfuscation. In concert with the augmented hardware, we employ software-level obfuscation techniques including Control Flow Graph (CFG)level and instruction-level obfuscation to remove diverse program characteristics and thus overcome the general limitations of our cost-efficient ISA randomization.

• Coverage of Dynamic Adversaries. We provide a detailed analysis of various information disclosure sources for a physical adversary with dynamic access to the instruction bus. We also discuss the generic shortcomings of state-of-the-art ISA randomization defenses in our adversary model.

• Novel Evaluation Methodology. We present a novel metric for our hybrid obfuscation approach to express the effects of different obfuscation transformations. In particular, we incorporate statistical analysis of the instruction-level distributions and similarity analysis of the dynamic CFGs.

BACKGROUND AND RELATED WORK

Our work builds on previous research in secure and attackresistant processor design. The relationship between these works and our approach is detailed below:

Secure Processors. Over the past fifteen years, a number of secure processors have been developed. XOM [START_REF] Lie | Architectural support for copy and tamper resistant software[END_REF] protects against piracy and manipulation of application software by only allowing an application to execute code from specific memory locations. AEGIS [START_REF] Suh | Aegis: A secure single-core processor[END_REF] uses instruction set extensions to protect execution and access to segments of memory. The OASIS processor [START_REF] Owusu | OASIS: on achieving a sanctuary for integrity and secrecy on untrusted platforms[END_REF] also uses ciphered data with cryptographic keys provided by Physical Unclonable Functions (PUFs). Other processors [START_REF] Zheng | A secure and unclonable embedded system using instruction-level PUF authentication[END_REF] do not include cryptographic cores but instead use PUFs to obfuscate portions of processor function, e.g., instruction opcodes. In order to mask the memory accesses, Oblivious Random Access Memory (ORAM) can be utilized [START_REF] Goldreich | Software protection and simulation on oblivious RAMs[END_REF]. While these approaches provide provable security, the presence and use of cryptographic cores adds significant area and performance overheads and thus non-negligible costs [START_REF] Fletcher | A Low-Latency, Low-Area Hardware Oblivious RAM Controller[END_REF] for the overall system. Our processor architectural changes are considerably more modest compared to cryptographic approaches and do not impact processor performance.

Side Channel Attacks. As a consequence of physical adversarial access to embedded devices, Side-Channel Analysis (SCA) using power consumption or electromagnetic emanation can be exploited. For example, SCA attacks on market-dominating Xilinx and Altera Static Random Access Memory (SRAM)-Field Programmable Gate Arrays (FPGAs) families [START_REF] Moradi | On the vulnerability of FPGA bitstream encryption against power analysis attacks: extracting keys from Xilinx Virtex-II FPGAs[END_REF], [START_REF] Moradi | Side-channel Attacks on the Bitstream Encryption Mechanism of Altera Stratix II: Facilitating Black-box Analysis Using Software Reverse-engineering[END_REF] have been shown. SCA is not only limited to cryptographic implementations. It can be also leveraged to extract the code of embedded processors based on the electromagnetic emanation [START_REF] Strobel | Microcontrollers as (in)security devices for pervasive computing applications[END_REF], [START_REF] Strobel | Scandalee: a side-channel-based disassembler using local electromagnetic emanations[END_REF]. However, the attack technique has various limitations such as imperfect recognition rates and a restriction to opcode and not operand detection.

Reverse-Engineering and Obfuscation. A variety of software obfuscation and deobfuscation approaches have been developed over decades. Software security to hamper reverse-engineering has yielded various transformations to restrict static and dynamic analysis [START_REF] Collberg | Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection[END_REF], [START_REF] Schrittwieser | Code obfuscation against static and dynamic reverse engineering[END_REF], [START_REF] Willems | Reverse code engineering -state of the art and countermeasures[END_REF]. These transformations include code flattening, data encoding, on-demand code decryption, and virtual-machine based techniques [START_REF] Anckaert | Proteus: virtualization for diversified tamperresistance[END_REF]. To automatically reverse-engineer programs equipped with obfuscation transformations, automatic deobfuscation techniques have been developed [START_REF] Coogan | Deobfuscation of virtualizationobfuscated software: A semantics-based approach[END_REF], [START_REF] Yadegari | A generic approach to automatic deobfuscation of executable code[END_REF]. Note that these approaches generally require knowledge of the ISA to emulate or statically analyze the targeted program.

Statistical analyses of the targeted program are employed for malware detection and classification. For example, frequency analysis, entropy, and hidden Markov models of instructions are able to classify malware among several families [START_REF]Opcode graph similarity and metamorphic detection[END_REF], [START_REF] Sorokin | Comparing files using structural entropy[END_REF], [START_REF] Attaluri | Profile hidden markov models and metamorphic virus detection[END_REF]. Also, several algorithms have been proposed to measure the similarity between CFGs with the goal of malware detection [START_REF] Chan | A method to evaluate CFG comparison algorithms[END_REF]. In particular, different approaches were developed based on subgraphs [START_REF] Kr | Polymorphic worm detection using structural information of executables[END_REF] and graph edit distance [START_REF] Hu | Large-scale malware indexing using function-call graphs[END_REF]. Software exploitation [START_REF] Szekeres | SoK: eternal war in memory[END_REF] and software diversity [START_REF] Larsen | Automatic software diversity[END_REF] are related topics, but focus on different adversary models. In our evaluation, we merge the concepts of statistical analysis and CFG similarity to demonstrate the influence of obfuscation techniques and to define a security metric.

ISA Randomization. As software obfuscation suffers from the fundamental limitation of a known ISA, various approaches were developed to randomize the ISA with the goal of code injection mitigation [START_REF] Barrantes | Randomized instruction set emulation to disrupt binary code injection attacks[END_REF], [START_REF] Kc | Countering code-injection attacks with instruction-set randomization[END_REF], [START_REF] Fechner | Web server protection by customized instruction set encoding[END_REF], [START_REF] Barrantes | Randomized instruction set emulation[END_REF], [START_REF] Portokalidis | Fast and practical instruction-set randomization for commodity systems[END_REF], [START_REF] Danger | Hardware-enforced protection against software reverse-engineering based on an instruction set encoding[END_REF], [START_REF] Liu | Programmable decoder and shadow threads: Tolerate remote code injection exploits with diversified redundancy[END_REF]. These transformations modify the original instruction encoding and employ additional hardware circuitry to retrieve the original instruction prior to the decode phase. Contrary to our work, these related works focus on a different adversary model without physical access capabilities.

SYSTEM AND ADVERSARY MODEL

In the following, we specify the assumptions for our hybrid obfuscation defense and identify the generic disclosure attacks in this setup.

System Model

We assume a simple and low-cost Reduced Instruction Set Computer (RISC)-based processor architecture. In particular, we assume the use of secure internal Random Access Memory (RAM) for stored data and insecure in-system (external) Read-Only Memory (ROM) for program memory. Due to the processor's simplicity, we preclude the use of caches. We further assume Memory Mapped Input/Output (MMIO) to perform communication with external peripheral devices.

Overall, we assume that the underlying Central Processing Unit (CPU) hardware is trustworthy. In contrast, the external ROM and all external bus interfaces are untrustworthy. Hardware debugging features (e.g., JTAG) that reveal values of internal registers or RAM are excluded from the device or are disabled.

Adversary Model

We suppose that the adversary has physical access to the target device. His main goal is the reverse-engineering of high-level information from the program such as protocols, cryptographic keys, or the algorithm(s) itself. Based on the physical access, the adversary can read and write arbitrary values in the untrusted program memory. Furthermore, the adversary is capable of dynamic read/write access to the external bus interfaces via probing and tampering with lowspeed and high-speed buses. Passive side-channel analysis can be leveraged by the adversary, however, invasive attacks such as transistor level modification are outside the scope of this work.

Adversarial Disclosure Attacks

Instruction execution results in a variety of actions such as register and memory read/writes and status flag register updates. Hence, the attacker can obtain execution information even without knowledge of the instruction encoding.

Control Flow Attack. The adversary obtains the address of the next fetched instruction and thus the instruction pointer by passive access to external interfaces. Hence, all control flow instructions and thus the Dynamic Control Flow Graph (DCFG) are immediately revealed and the type (unconditional, conditional, call/return) of each executed control flow instruction is disclosed. Even in the case of an obfuscated instruction encoding, the adversary can exploit control flow instructions to reveal the encoding by manipulation of the instruction operand and observation of the next fetched instruction. Similarly, branch instructions can be exploited to check whether two register values meet a condition (depending on the specific branch opcode) at runtime through modification of the source data in the instruction operand.

Input/Output Attack. The adversary can observe communication from the CPU to peripheral devices through passive access to the external interfaces. Even if the instruction encoding is obfuscated, the adversary can exploit Input/Output (I/O) instructions to disclose internal, dynamic values by manipulation of the source data encoding in the instruction operand.

The following three attacks may not directly reveal the instruction encoding as they depend on the underlying CPU and instruction set, but they can aid the adversary's reverse engineering.

System Configuration Attack. In general, the adversary can deduce valuable system information by means of system configuration. Any displayed errors can be used to deduce sensitive information [START_REF] Molnar | The Program Counter Security Model: Automatic Detection and Removal of Control-flow Side Channel Attacks[END_REF]. Even if the instruction encoding is obfuscated, a manipulated system configuration instruction supports the adversary's reverse-engineering efforts to understand the system, e.g., sleep activation, interrupt deactivation, or timer unit configuration. For example, if a manipulated instruction leads to the CPU entering sleep mode, the adversary can deduce which bits in the obfuscated encoding belong to the opcode field. Similarly, any displayed error discloses valuable information regarding the instruction encoding to the adversary. For example, if a manipulated instruction leads to an invalid opcode error the adversary can deduce which bits belong to the opcode field.

Instruction Timing Attack. Different instruction groups can include instructions which consume a varying number of clock cycles. For example, arithmetic instructions may require more cycles than logical instructions. Based on precise measurements of the consumed clock cycles per instruction, the adversary can disclose the targeted instruction's group [START_REF] Molnar | The Program Counter Security Model: Automatic Detection and Removal of Control-flow Side Channel Attacks[END_REF]. For example, if a manipulated instruction leads to a different execution time after modification, the adversary can deduce which bits in the obfuscated encoding belong to the opcode.

Correctness Attack. The deterministic behaviour of a targeted part of a program may be determined by examining the program's output. Even if the instruction encoding is obfuscated, the adversary can gain information. In particular, if a deterministic part of program is altered in such a way that its semantic is preserved, the program output remains the same, see Sect. 9 for a detailed attack description.

The related works in Tab. 1 do not assume a physical and dynamic adversary. Thus, all publicly known ISA randomization schemes can be circumvented by use of the [START_REF] Liu | Programmable decoder and shadow threads: Tolerate remote code injection exploits with diversified redundancy[END_REF] Instr. Perm. and Operand Subst. √ √ Ours see Sect. 5 --Table 1: Overview of ISA randomization schemes and their susceptibility to control flow and I/O attacks.

attacks. For example, the key k of XOR-based schemes can be obtained via the control flow attack as follows: an unconditional control flow instruction i ⊕ k is executed and the adversary obtains the next fetched instruction and hence obtains the operand of the instruction i. For permuted instructions, the adversary simply toggles each bit per trial to obtain the manipulated next instruction address and thereby reveals the permutation.

INSTRUCTION SET ARCHITECTURE 4.1 Assembly Language

The assembly language format of a microprocessor is a crucial component for an obfuscation scheme. Lst. 1 defines a generic assembly language in Backus-Naur Form (BNF). This language can be mapped to virtually any assembly language. In general, the instructions of the assembly language can be grouped into four distinct groups:

• Control Flow ⟨CF⟩: Instructions which cause an unconditional control flow change (jmp), branch instructions (beq, bne), and function calls (call, ret).

• Data Transfer ⟨DT⟩,⟨DTC⟩: Instructions which transfer data via load (ld) and store (st) between the different memories such as the register file and the RAM.

• Arithmetic/Logical ⟨AL⟩: Instructions that modify the data contents by means of logical and arithmetic functions such as add and xor.

• Miscellaneous ⟨M⟩: All remaining instructions such as nop and sleep.

Note that the rationale for the missing registers in the branch instructions and the additional ldc and stc instructions is stated in Sect. 5.3.

Instruction Format

We employ the Microprocessor without Interlocked Pipeline Stages (MIPS) instruction format due to its wide use in embedded systems and its simplicity. The latter characteristic is particularly advantageous for security analysis and implementation.

Type

Instruction Format R opcode(6) r src1 (5) r src2 (5) r dst [START_REF] Zaddach | AVATAR: A framework to support dynamic security analysis of embedded systems' firmwares[END_REF] Each MIPS instruction is encoded in a 32-bit vector with a 6-bit opcode. There are three distinct types of instruction formats: R-type instructions encode two source registers r src1 , r src2 and a destination register r dst , each 5-bit wide, a 5-bit shift amount field shamt, and a 6-bit function field funct. The funct field further specifies instruction operation beyond the opcode. I-type instructions employ a source register r src , a destination register r dst , and a 16-bit immediate value. The operand of J-type instructions only consists of a 26-bit address field.

HARDWARE-LEVEL OBFUSCATION

A fundamental limitation of software-level obfuscation techniques is the adversary's knowledge of the instruction encoding. Our hardware-level obfuscation targets this encoding knowledge with simultaneous consideration of the disclosure attacks.

Opcode Substitution

The principle idea of our proposed opcode substitution transformation is to employ a randomized encoding of the opcode field so that the adversary does not know which opcode maps to which operation. To enhance the effect of the substitution, we consider homophonic ciphers.

Homophonic Substitution Cipher. A homophonic substitution cipher maps each plaintext symbol to one or more ciphertext symbols, called homophones, thereby flattening the ciphertext symbol distribution and obstructing ciphertext symbol frequency analysis compared to simple substitution ciphers. Since their appearance, homophonic substitution ciphers have been successfully attacked by exploiting inherent characteristics of human language [START_REF] Jakobsen | A fast method for the cryptanalysis of substitution ciphers[END_REF], [START_REF] Oranchak | Evolutionary algorithm for decryption of monoalphabetic homophonic substitution ciphers encoded as constraint satisfaction problems[END_REF], [START_REF] Dhavare | Efficient cryptanalysis of homophonic substitution ciphers[END_REF]. In contrast to the nature of human language, an instruction sequence can be arbitrarily altered to hide relevant statistical information 1 . Based on the concept of homophones, we informally define our employed opcode substitution as follows:

The opcode substitution transformation randomly replaces the native instruction opcode by a predefined relation. Particularly, the relation is righttotal and left-unique with respect to the native ISA encoding.

To obtain the native opcode during execution, the decode unit of the CPU implements the inverse mapping of the right-total, but not right-unique, and left-unique opcode substitution relation 2 . This transformation is scalable as the number of relations from one native opcode to the codomain elements can be chosen freely. For an implementation, the upper bound depends on the employed instruction format and number of supported instructions. In case of the MIPS instruction format, the 6-bit funct field is also affected by opcode substitution as it encodes opcode information (jointly with the 6-bit opcode field).

Example. We assume an ISA with a 2-bit opcode that only employs the two opcodes 00 and 01. Opcode substitution maps the original opcodes as follows: opcode 00 is related to 10 and 01, and opcode 01 is related to 11 and 00. Thus, all 2-bit values are employed through opcode substitution (right-total), and any substituted opcode relates to only one original opcode (left-unique). Since opcode 00 relates to more than one value, this relation is not rightunique.

Operand Permutation

The instruction operand field(s) encode the quantities of the operation and thus enables data flow analysis. For example, immediate values can define branch decisions, memory accesses, or constants. Even without knowledge of the opcode (which defines the interpretation of the operand), the operand field can yield meaningful information. Therefore, we apply an operand permutation transformation to the instruction operand field as follows:

The operand permutation transformation permutes the bit-indices of the operand field by a pre-defined random bit permutation. Program memory is split into chunks and each chunk of instructions uses its own randomly chosen permutation.

To reveal the native operand during execution in the CPU, the inverse permutation is selected based on the instruction address, see Fig. 2. This transformation is scalable as the number of permutations can be chosen freely. For the employed MIPS format, the whole 26-bit operand is permuted independent of the instruction type. As a result, the 6-bit funct field for R-type instructions is spread across the operand.

Unobfuscated Instructions. As a consequence of the disclosure attacks, we do not obfuscate the whole instruction set. The following instructions are neither affected by the opcode substitution nor the operand permutation.

• Control flow instructions: jmp, call, ret, beq, bne.

• System configuration instructions: sleep.

• Data transfer instructions: ldc, stc.

Properties of a binary relation R between the sets S and T

: Right-Total: ∀t ∈ T∃s ∈ S∶ (s, t) ∈ R Right-Unique: ∀s ∈ S∀t, t ′ ∈ T∶ (s, t) ∈ R ∧ (s, t ′ ) ∈ R ⇒ t = t ′ Left-Unique:∀s, s ′ ∈ S∀t ∈ T∶ (s, t) ∈ R ∧ (s ′ , t) ∈ R ⇒ s = s ′

Hardware-enforced Access Control

Hardware-level obfuscation of the instruction encoding does not prevent instruction tampering via the I/O or control flow attacks described in Sect. 3.3. The lack of hardware-level access control on the the data transfer interface between the CPU and peripheral devices creates the vulnerability. To protect against I/O and branch instruction manipulation, we propose a lightweight hardware-based access control mechanism. Techniques and conditions to detect and respond to tampering are described in Sect. 5.4.

Hardware-enforced access control restricts the location of operand registers and memory addresses in I/O and branch instructions to a certain memory area rather than to general purpose registers. The unobfuscated data flow (ldc, stc) and branch instructions (beq, bne) are used in conjunction with three interface registers r I O , r b0 , r b1 to transfer data to or from insecure memory areas (e.g., memory addresses used for I/O). These registers are isolated from the general purpose registers and cannot be accessed as general purpose register operands for hardware-level obfuscated instructions.

Access Control Policies. To realize access control, several hardware-level policies are employed. Internal addressable memory in the microprocessor, which includes the three interface registers, is divided into three parts: the generalpurpose GP, the border control BC, and the MMIO areas.

• Hardware-level obfuscated instructions are forced to operate on locations in the GP and BC areas, but not the MMIO area.

• Unobfuscated data-flow and branch instructions are forced to operate in the BC and MMIO area, but not the GP area.

•

The interface register r I O (accessible via an address in the BC area) is implicitly employed by ldc and stc instructions 3 . The register is accessed by the CPU using its memory address or implicitly by the ldc and stc instructions. The interface registers r b0 and r b1 (accessible via addresses in the BC area) are implicitly utilized by branch instructions. The registers are accessed by the CPU using memory addresses or implicitly by branch instructions.

I/O Instructions.

To transfer data between the CPU and peripheral devices, the following steps are used:

• Read from MMIO. To transfer data from peripheral devices to the CPU, the data is first read via an ldc instruction and placed in r I O . The data is then read from r I O and placed in the internal register file via an ld instruction.

• Write to MMIO. To transfer data from the CPU to the peripheral devices, the data is first written to r I O via an st instruction. The data is then written from r I O to a MMIO address via a stc instruction.

Control Flow Instructions.

Before a branch instruction is executed, the two values that are compared are loaded by the CPU into r b0 and r b1 via st instructions. Afterwards, the branch instruction that implicitly accesses the registers r b0 and r b1 is executed.

For the employed MIPS ISA, we augment the CPU by a further dedicated register for the call/return mechanism. The MIPS return instruction jr ra jumps to the value in the register ra which could be exploited to reveal dynamic values in the general purpose register file. Hence, the additional register is hardware-enforced to only operate on jal/jr instructions that store and restore the program counter upon execution of a call and return, respectively.

By use of hardware-level access control, the goal of the adversary is to find an appropriate obfuscated ld/st instruction to construct an attack. The key idea is that the obfuscated st and ld (that write and read data to and from the memory-mapped registers) can be hidden by softwarelevel obfuscation techniques described in Sect. 6.

Hardware-level Booby Traps

In addition to hardware-enforced access control, a hardwarelevel tamper response mechanism is needed to prevent disclosure of the ISA encoding. This response mechanism is added to our defense arsenal to protect against a variety of the attacks, see Sect. 9.

A booby trap is an active defense that is directly triggered by a detected attack. Such approaches have been developed for software protection [START_REF] Crane | Booby trapping software[END_REF] and for protection of high-security hardware devices. Hardware systems with tamper detection and response include hardware firewalls in smart cards [START_REF] Semiconductors | NXP J3A040 and J2A040 Secure Smart Card Controller[END_REF] and the erasure of cryptographic material in response to an attack [START_REF]i.MX 6Dual/6Quad Applications Processor Reference Manua[END_REF].

Booby Trap Triggers. For our system, we employ the following triggers to detect an attack:

• Invalid Memory Access. The access control unit triggers a booby trap once an invalid memory access by the ld / st or ldc / stc instructions is executed.

• Dedicated Opcodes. Several dedicated opcodes (particularly R-type instructions) are reserved to trigger a booby trap on execution.

• Malformed Operands. The instruction format is leveraged to detect malformed operands and subsequently trigger a booby trap on execution. For example, a non-shift R-type instruction that encodes a non-zero shamt value triggers a booby trap.

Booby Trap Tamper Response. To prevent the disclosure of the instruction encoding, the instruction decode unit can be cleared in a non-volatile manner to prevent further operation. For practical purposes, a counter could be employed to detect multiple attack attempts prior to the burning of a fuse to disable the unit.

SOFTWARE-LEVEL OBFUSCATION

A limitation of hardware-level obfuscation is the preservation of the program structure. Despite an obfuscated instruction encoding, the CFG and instruction sequencing provide valuable information sources as demonstrated in Sect. 10. Hence, we employ well-established software obfuscation transformations to hide these information sources.

Control Flow Graph-Level Obfuscation. The control flow of a call graph and associated basic block topology provide viable information for a reverse-engineer. Looping and conditional structures can be exploited to deduce information regarding the high-level algorithm implementation. To obscure these traces, code flattening and procedure merging are employed [START_REF] Junod | Obfuscator-LLVM -software protection for the masses[END_REF]. Code flattening inserts a switch statement and a dispatcher that controls the basic block execution sequence. Procedure merging scrambles both function and interprocedural level control by inlining functions within each other.

Basic Block-Level Obfuscation. CFG-level obfuscation effectively disrupts control flow assumptions and splits large basic blocks, however small basic blocks remain unchanged. To hide small basic blocks, we utilize basic block normalization. The number of instructions per basic block are normalized by filling space with garbage code that does not affect the semantic behavior of the basic block. A range of basic block sizes are used and basic block positioning is permuted in memory to hinder static analysis.

Instruction-Level Obfuscation. CFG and basic block level transformations do not remove all program characteristics. Dedicated instruction sequences and memory accesses are not affected by these obfuscation techniques. To remove potential code structure assumptions such as the stack clean-up after a function call, instruction substitution is used which replaces specific instruction sequences by other functional equivalent but more complicated instruction sequences [START_REF] Junod | Obfuscator-LLVM -software protection for the masses[END_REF]. This technique is a vital component for our statistical evaluation.

Instruction substitution is used to hide critical ld/st instructions employed for hardware-level access control, see Sect. 5.3. For example, an instruction substitution rule can be easily defined for (virtually) any architecture which replaces a ld instruction by a stack pointer displacement, a pop, and a subsequent original stack pointer recovery. The stack pointer displacement can be further constituted of multiple instructions so that the basic block normalization spreads this information among diverse basic blocks. Note that the register value that is added to the immediate value in the ld/st instructions can be arbitrarily changed while the sum of both values (the target address) remains the same. This effect greatly increases the number of distinct representations.

IMPLEMENTATION

To demonstrate our hybrid obfuscation approach we have developed a soft microprocessor generation framework to automatically implement protected CPUs. This framework is supported with a full compilation flow which performs our structural transformations.

Hardware Implementation. Our prototype hardware implementation employs the SPREE soft processor generation framework [START_REF] Yiannacouras | The microarchitecture of FPGA-based soft processors[END_REF]. Processors generated with the framework use the MIPS instruction format. A Register Transfer Level (RTL) description of specific processor instantiations are generated from textual descriptions of the ISA and processor data path. An RTL generator was written to include hardware for a randomized ISA encoding and the insertion of the hardware units described in Sect. 5. The number of opcode homophones and operand permutations in the processor hardware implementation are user-defined with respect to the instruction format. Similarly, the number of booby trap triggering opcodes and the memory layout are also userdefined.

Software Implementation. Our prototype compiler implementation leverages the LLVM/Clang compiler and the Obfuscator-LLVM environment developed by Junod et al. [START_REF] Junod | Obfuscator-LLVM -software protection for the masses[END_REF]. The latter framework provides transformations such as the code flattening and instruction substitution. We extended the Obfuscator-LLVM environment to implement basic block normalization.

To allow for late code address determination, we modified the GNU assembler to generate two non-linked .o object files. Each object file is created with different encoded ISAs: ISA A and ISA B. The object files are then linked to their libraries, which were also encoded with ISAs A and B. Relocatable instructions are then identified by examining instructions that differ in the two files after obfuscation is removed. Once all relocatable instructions have been processed, an object file is linked and address dependent operand permutation is applied. The final executable file is fully linked and ISA encoding is employed.

PERFORMANCE EVALUATION

In this section we present area and run-time performance results for the hardware and software obfuscation transformations.

Area Overhead. We evaluated the area overheads for varying hardware-level obfuscation parameters in contrast to dedicated CPU units based on the SPREE processor generation framework. Hardware designs were synthesized to an Altera Cyclone V A2 FPGA. All designs were tested via simulation to determine their accurate behavior. Tab. 2 lists the utilized hardware resources in terms of Look-up tables (LUTs) and Flip Flops (FFs) required for the different hardware units. The booby trap (BT) unit realizes the logic to trigger a booby trap based on incorrect memory accesses, malformed instructions, and for dedicated opcodes as described in Sect. 5.4. We considered two dedicated opcode triggers and one MMIO address. The opcode substitution (OS) and the operand permutation (OP) implement the hardware-level transformations described in Sect. 5.1 and Sect. 5.2, respectively. The OS designs include a homophonic substitution which employs each possible value for the opcode and funct fields, the extended register file, and support for ldc/stc instructions. OP(x) denotes that x distinct operand permutations are implemented.

The hardware overhead of the BT circuitry is lightweight in terms of additional LUTs and FFs and the overhead of the OS consists only of several LUTs. Increasing the number of operand permutations OP results in a hardware overhead of up to 14% for LUTs compared to the original SPREE processor. The 36 registers (= 32 general purpose registers + r I O + r b0 + r b1 + 1 call/ret register) are implemented in the memory blocks of the FPGA. Similarly, the internal 64 kB RAM is implemented in the memory blocks of the FPGA.

The processor speed is not affected by the hardwarelevel augmentations listed in Tab. 2. The additional elements do not affect the critical path of the design in the execute stage of the three-stage processor (ALU and regFile). Our modifications are restricted to the instruction fetch and memory stages.

Performance and Memory Overhead. We evaluated the performance overhead for the different obfuscation transformations on the SPREE embedded benchmark suite [START_REF] Yiannacouras | The microarchitecture of FPGA-based soft processors[END_REF]. The obfuscation strategies were applied to the programs and the clock cycle counts for 100 versions of each program were measured. In the following discussion, the employed obfuscation transformations are abbreviated as follows: opcode substitution (OS), opcode permutation (OP), instruction substitution (IS), code flattening (CF), and basic block normalization (BBN). Procedure merging was not considered for the evaluation as the targeted benchmark programs generally consist of only one function.

Tab. 3 lists the performance results for the different obfuscation strategies for the SPREE benchmark programs. The average performance slowdown of IS ranges between approx. 1.1× and 2× for all programs except des. For des, the influence of IS is significant as the cryptographic algorithm employs numerous xor instructions that are swapped for more complex representations. The CF transformation leads to performance slowdown based on the underlying program structure. Since the implementation of the des program is loop-free, CF does not affect performance. For non-loop-free programs, the slowdown depends on high-level program structure. Measured slowdown ranges between approx. 2× and 6×. For the combined OS+OP+CF+IS strategy the effect of both transformations is additive. The CF transformation adds a switch statement to the target program and uses a variable to control execution order. This transformation is not affected by the IS implementation. The combined obfuscation approaches OS+OP+CF+IS+BBN affect performance loss more significantly. Transformation CF splits up basic blocks which are then padded by BBN. Hence, performance is slowed down by a factor of approximately 4× to 39× compared to the unobfuscated version.

Tab. 4 states program size for the different obfuscation strategies. For the IS transformation, most targeted programs are only increased by several hundred bytes. For reasons similar to those given for performance evaluation, des is strongly influenced by IS. The CF transformation affects program size depending on the underlying program structure. Since the targeted programs in the suite contain a small number of loops and branches, program size increases by less than 1 kB compared to the OS+OP obfuscated programs. The combined obfuscation strategy OS+OP+CF+IS+BBN increases the binary size as each basic block is padded with instructions. A binary size overhead of up to 3 kB is seen for the targeted programs compared to the OS+OP obfuscated programs. The des program size increases by 4× compared to the OS+OP obfuscated program.

In summary, software protection naturally affects code performance and binary size depending on the degree of obfuscation. Our program slowdown and binary size results are in line with several other related works in this field, see Sect. 2. The performance and binary size effects of hardware obfuscation are much more limited.

SECURITY ANALYSIS

In this section, a security analysis is provided for the diverse adversary accessible attacks presented in Sect. 3.3.

Hardware-level Booby Traps. The booby trap mechanism provides a crucial anchor to prevent the disclosure of processor's instruction encoding in response to an attack. To the best of the authors' knowledge, current SRAM-FPGA families only support fuses which can be programmed via external FPGA access. Relying on this type of fuse programming risks disruption by the adversary. Alternatively, a booby trap can be used in which the adversary triggers the device to reload its entire configuration before the soft microprocessor is reactivated. This action requires a time-consuming process. For example, the smallest Cyclone V device (A2) requires 21,061,028 configuration bits [START_REF]Cyclone V Device Datasheet[END_REF]. Configuration can be performed 16 bits at a time at 125 MHz. Thus, configuration requires at least 10.5 ms per booby trap trigger.

Control Flow Attack. jmp, call, and ret instructions cannot be exploited to disclose instruction encoding information as the instructions are not affected by hardware-level obfuscation. We illustrate our resistance to the control flow attack via an example. In a possible attack, the attacker would write values from the register file to interface registers r b0 and r b1 to compare the values using an unobfuscated beq instruction. Therefore, the attacker must craft two store instructions st r0,r0,imm0 and st r0,r0,imm1, where imm0 and imm1 are the addresses of r b0 and r b1 , respectively. To accomplish the attack, the attacker must guess the opcode (2 6 -k), where k is the number of known opcodes. In addition, he must guess the operand permutation for the 16-bit immediate value ( 2616 steps) and the two addresses (2 16 ⋅ (2 16 -1) steps). To algorithmically verify the guessed instruction encoding, the attacker could attempt to transfer values from all 32 registers and check for equality. Even without consideration of the booby trap mechanism, the worst-case attack complexity for k = 10 known opcodes is approximately 2 65 . Note that for the MIPS architecture register r0 always holds a constant zero.

Input/Output Attack. Similar to the branch instruction attack, the adversary could leverage writes to MMIO addresses to reveal the instruction encoding, although the amount of time required to perform the attack is prohibitive. He must craft a store instruction st r0,r0,imm, where imm is the address of r I O . Hence, the attacker must guess the opcode (2 6k steps), the operand permutation for the 16-bit immediate value ( 2616 steps), and the address value (2 16 steps). Even without consideration of the booby trap mechanism, the worst-case attack complexity for k = 10 known opcodes is approximately 2 49 (including the 31 checks to determine if the written values are distinct).

Furthermore, the evaluation of all possible 32-bit instructions will trigger 520, 093, 696 ≈ 2 28.95 booby traps due to the invalid shamt field (for 8 non-shift R-type instructions). Hence, the reconfiguration time for an A2 FPGA is approx. 63 days as each reconfiguration requires at least 10.5 ms. Even for a randomly chosen instruction value, the probability that it triggers the shamt field booby trap is around 12%.

Correctness Attack. As a consequence of the homophones in the opcode substitution, the adversary can leverage the correctness attack to reveal parts of the instruction encoding. The homophones are mainly implemented in the funct field of R-type instructions. For simplicity, we assume that the targeted program is deterministic so that the same inputs compute the same output values and the adversary is able to observe both.

The attacker would like to substitute homophones for an instruction with just one representative value to reveal parts of the instruction encoding. If the adversary alters the funct field to a correct homophone opcode, the output of a deterministic algorithm will not change. An incorrect homophone yields an incorrect opcode or operand and hence a different output. To complete the attack, the attacker must guess the opcode (2 6k steps), the operand permutation for the 6-bit immediate value ( 26 6 steps), and the funct value (2 6 steps). Even without consideration of the booby trap mechanism, the worst-case attack complexity for k = 10 known opcodes is approximately 2 29 deterministic program executions.

System Configuration / Instruction Timing Attack. Since system configuration instructions are not affected by the hardware-level obfuscation and all obfuscated instructions consume the same number of clock cycles, both attacks cannot be exploited.

Cautionary Note. All the attack strategies noted above require the use of attacker-controlled values to perform a hypothesis test. If the targeted program deliberately contains an st ra,rb,imm instruction in which imm is the address of an interface register and rb is attacker controlled (r0 in the case of MIPS), the attack complexities are significantly reduced. The adversary only must guess the ra encoding in the operand ( 266 ≈ 2 17 steps) and analyze the register file (2 5 -1 steps). Hence, the system designer must analyze whether such an st ra,rb,imm instruction exists and obfuscate the instruction accordingly.

In summary, hardware-level obfuscation increases the adversary's efforts. A booby trap is likely to be triggered via an invalid memory access for a guessed st instruction or a dedicated opcode for R-type instructions. To increase the probability that the average-case attack also triggers a booby trap, the system designer can adjust the parameters for the booby trap triggers prior to processor generation.

SECURITY METRICS FOR OBFUSCATION

Obfuscation deters algorithm reverse-engineering and analysis of the algorithm's internal architecture. A current limitation of obfuscation is the lack of a metric to measure the degree of obfuscation for different approaches. The generic concept of indistinguishability provides a formal treatment and offers provable arguments for obfuscation from the theoretic point of view. However, cryptographic program obfuscation schemes are still far away from being deployable [START_REF] Apon | Implementing cryptographic program obfuscation[END_REF], especially for embedded systems with constrained resources. A practical measure of obfuscation degree for software-only obfuscation has been limited by the attacker's knowledge of the targeted ISA and, thus, an ability to emulate and analyze the targeted program. This situation changes for hardware-level obfuscation systems due to the concealed ISA encoding. In the following, we propose a novel evaluation methodology to provide an obfuscation metric for hybrid obfuscated systems.

Similarity Metric

A key characteristic of obfuscation is to (virtually) destroy any correlation between an obfuscated and an unobfuscated program. For example, suppose there are two distinct programs P 1 , P 2 and their obfuscated versions O(P 1 ), O(P 2 ). If there exists a significant correlation of a characteristic between P 1 and O(P 1 ), but no significant correlation for this feature between P 1 and O(P 2 ), the obfuscated program O(P 1 ) can be matched to its unobfuscated counterpart. For example, the similarity of the DCFG or the entropy of the instruction opcodes could be used as such characteristics. Thus, a goal of obfuscation is to make obfuscated programs as similar as possible so that their measurable quantities do not allow a distinction between them Methodology. To examine the program similarity created by obfuscation strategies and, thus, the degree of obfuscation, we implement the following: First, a set of programs P = {P 1 , . . . , P n } is selected. Obfuscated versions for each program in P are then generated. For an obfuscation strategy O, multiple versions per program are generated to increase the coverage of the assessment. Then, a set of similarity comparison algorithms A = {A 1 , . . . , A m } are employed and the similarities between the obfuscated and unobfuscated programs are examined.

We assume that the adversary can implicitly obtain the function call graph and, hence, some functions of the program. For example, several program functions may be provided by an adversary-accessible open-source or closedsource library. Hence, the adversary is able to examine the similarity of numerous functions in a targeted program (instead of the whole program) to break the obfuscation. This examination allows for testing of function-level similarity that is more fine-grained than similarity analysis for a larger program. Furthermore, this evaluation methodology uses a concept which is similar to computational indistinguishability. Nevertheless, without the use of strong cryptographic primitives, the property of computationally indistinguishability cannot be guaranteed. Our goal is not indistinguishability from a uniform distribution, but rather eliminating similarity between obfuscated programs and their unobfuscated counterparts, which is sufficient for practical purposes.

Advantages. Our proposed evaluation methodology is particularly beneficial for hardware-level obfuscation schemes as the adversary cannot emulate and thus reverseengineer the obfuscated program without the corresponding ISA encoding. Furthermore, this assessment roadmap is generic in the sense that new algorithms can be developed and added to the set of similarity comparison algorithms. In this way we can (automatically) examine obfuscation benefits against a defined set of attacks and provide a measure of the degree of obfuscation for a specific obfuscation strategy applied to certain programs. Notably, we can identify programs for which the selected obfuscation strategy might not be sufficient to bring the program set to a specific measurable obfuscation level.

Limitations. Despite various advantages, we acknowledge that the measurability approach does have certain limitations. Similar to ORAM [START_REF] Goldreich | Software protection and simulation on oblivious RAMs[END_REF] and cryptographic obfuscation [START_REF] Garg | Two-Round Secure MPC from Indistinguishability Obfuscation[END_REF], the I/O behaviour cannot be modeled. However, embedded systems are generally equipped with less I/O than general-purpose systems with a rich-featured operating system. It can be said that we cannot conclude from the statistics that a particular obfuscation strategy avoids successful attack. However, the statistics do indicate that at least certain global properties can be successfully obfuscated and certain strategies generally lead to a poor obfuscation. A further arguable issue is the selection of our target program set. In our case, we exclude specially crafted programs that would still have measurable similarity after the obfuscation since we want to provide a measure for programs more typically deployed by users.

Similarity measures of external data memory are outside the scope of our metrics. Data randomization schemes [START_REF] Larsen | Automatic software diversity[END_REF] could be utilized to dynamically encode/decode the internal, trusted RAM before it is stored to/loaded from the external, untrusted data memory.

Case Study -SPREE Benchmark Suite

We evaluated the programs of the SPREE benchmark suite [START_REF] Yiannacouras | The microarchitecture of FPGA-based soft processors[END_REF] with the evaluation methodology described in the previous section. The statistical distributions of the instruction memory (Sect. 10.2.2) and the dynamic CFG (Sect. 10.2.3) for the different obfuscation strategies were investigated. It should be noted that almost all programs in this benchmark suite consist of only one vital function making the program set an ideal candidate suite for our evaluation methodology.

Statistical Background

To allow the reader to better interpret our results, we provide a concise summary of our measures and the rationale behind their use. Our evaluation measures are based on the number of appearances of a certain 6-bit opcode o ∈ {0, 1} 6 in a program P denoted by N P (o). Similarly, opcode triples and the number of their appearances are denoted by o 3 ∈ {0, 1} 6 × {0, 1} 6 × {0, 1} 6 and N 3 P (o 3 ), respectively. Moreover, F P (o) is the empirical distribution for the opcode o of a program P, i.e.

F P (o) = N P (o) ∑ i N P (i) , i ∈ {0, 1} 6
For completeness, we performed instruction operand analysis for our statistical measures. However, the 26-bit operand distributions did not provide meaningful results. Subsequently, we evaluated hashes of the operands using the measures. However, the results for the least significant 6-/7-/8-bit of the operand hashes were similar to the opcode results, hence we omit these results from the following discussion.

Entropy. The Shannon entropy is a measure of the information content of a random variable. In our case, we are interested in the entropy of the opcode and operand distributions as we expect that a larger entropy hints at better obfuscation (due to less pronounced peaks).

Definition 1 (Shannon Entropy). The Shannon entropy of a

program is determined by:

E(P) = -∑ o F P (o) ⋅ log 2 (F P (o))
Standard Deviation. The standard deviation is a measure of the inhomogeneity of a random variable. In our case, we evaluate the standard deviation for the frequency of opcode triples rather than a single opcode value as triplet distributions are also employed for the frequency analysis of simple cryptographic ciphers. The larger the difference in frequency of certain triples, the larger the standard deviation can be. This metric indicates which unobfuscated programs relate to an obfuscated one.

Definition 2 (Adapted Standard Deviation).

The adapted standard deviation sd 3 (P) is determined by

sd 3 (P) = 1 n + -1 ∑ o 3 (N 3 P (o 3 ) -ν(P)) 2 for N 3 P (o 3 ) > 0, n + ∶= {o 3 } , ν(P) ∶= 1 n + ∑ o 3 N 3 P (o 3 )
We additionally performed analysis for the adapted standard deviations sd 2 and sd 4 based on pairs and 4-tuples of consecutive opcodes. However, these results were similar to the results of sd 3 , hence we omit these results from the following discussion.

E-sd 3 Information. The combined information of entropy E and sd 3 was also considered. For two distinct program P 1 and P 2 , the marginal distributions of the E and sd 3 may strongly overlap so that the programs cannot be told apart. However, E and sd 3 may be strongly positively correlated for P 1 , but anticorrelated for P 2 . As a result, the programs form distinct clusters of points in an E-sd 3 diagram and hence offer a distinction between the programs P 1 and P 2 .

Correlation. The correlation of the distributions between the unobfuscated and obfuscated programs was also considered as a statistical measure. The Spearman correlation was employed as this correlation measures the amount by which two variables are connected by a monotonous trend. This measure contrasts with the more restrictive assumption of linearity in case of the Pearson correlation.

The Spearman correlation also achieves increased robustness against possible outliers which heavily impact the Pearson correlation, i.e., opcodes having a (close to) zero frequency. The Spearman correlation uses the ranks of the observations as opposed to the observations themselves (Pearson's correlation). In our case, we examined the correlation between the ranked opcode frequency distribution for obfuscated and unobfuscated programs. Entropy. Fig. 3 depicts the entropy of the instruction opcodes distribution for the increasingly sophisticated obfuscation strategies (a) -(d). The blue points below 3.0 depict the entropy of the unobfuscated programs in each figure (a) -(d). The boxes depict a sketch of the entropy distribution of the obfuscated programs, where the thick horizontal line within the box is the median and the box extends from the lower 25% to the upper 75% quantile, i.e., ≈ 25% of the programs have entropies below the lower edge and ≈ 25% have entropies above the upper edge of the box. The whiskers extend to the smallest and largest entropy and the circles outside of the region covered by the whiskers cover even more extreme entropies (only contained in some figures).

Definition 3 (Spearman Correlation

OS+OP performs the poorest with many outliers, small boxes, and a range of medians covering a range of approximately 4.1 -5.0 in entropy. For OS+OP+IS and OS+OP+CF+IS, there are sharp distributions without significant outliers (visible as the isolated points below and above the boxes). OS+OP+CF+IS+BBN combines the best of both groups: the boxes are nearly as large as OS+OP+CF+IS and there is approximately the same homogeneity of box positions (approximately 50% less variable for a large fraction of programs). This obfuscation strategy generates a significant number of outliers which complicates the determination of which program is under inspection.

The entropy provides an effective measure to quantify the extent of program information loss due to obfuscation. Here, we use the degree of homogeneity of the box locations as well as the percentage of entropy values which are far away from the typical values, i.e., the outliers.

Standard Deviation. Fig. 4 shows the boxplots of the standard deviation sd 3 of the instruction opcode distribution for the increasingly sophisticated obfuscation strategies (a) -(d). Note that a favourable obfuscation strategy should result in boxes which overlap for different programs and not allow for programs to be uniquely distinguished.

This goal is best achieved by the OS+OP+CF+IS+BBN obfuscation which produces the largest boxes and the greatest overlap in comparison to the other obfuscation methods. In contrast to the entropy metric, sd 3 considers the variability in the distribution of opcode triples. A large variability in sd 3 for different obfuscations of the same program illustrates a large variability in the homogeneity of the frequencies in which certain opcodes appear in consecutive order rather than the homogeneity of the frequencies in which certain opcodes appear overall in the code. Hence, sd 3 provides important supplementary information to entropy to quantify the extent of the information loss due to obfuscation and also to specify the variability of different obfuscations of the same program.

E-sd 3 Information. Fig. 5 combines the entropy information and the sd 3 values for the opcodes by displaying a point in an entropy-sd 3 coordinate system for each program. A small dot is shown for each obfuscated program and a star is shown for an unobfuscated program. The colors for the dots indicate the program from which the obfuscated program was generated.

We see that the point clouds and the overlap between clouds for different programs are much larger for the OS+OP+CF+IS+BBN obfuscation technique than for all others. While this effect is also discernible in the boxplots of the marginal distributions of the entropies and the sd 3 , the E-sd 3 diagram demonstrates that these quantities are not correlated or anticorrelated in a way which would allow the determination of a program under consideration. Such a correlation would show that a large entropy value coincides with a large sd 3 . This correlation would result in disjoint clusters of points (alignment parallel to the main diagonal in the diagram). Thus, the E-sd 3 diagram provides essential information of the combined measures to depict the information loss due to obfuscation.

Correlation. Fig. 6 depicts the results of the correlations for the opcodes of the fft program, a typical case. Each panel shows the correlations between the opcode frequencies for a specific obfuscation. The boxes illustrate the distribution of the correlations between the obfuscated programs and the unobfuscated fft and the stars show the correlations between the unobfuscated programs and the unobfuscated program fft.

The correlations between the obfuscated programs and the true underlying program fft are not significantly different across all obfuscation approaches. Hence, the correlations do not identify the true underlying program since the hardware-level obfuscation is sufficient to hamper program distinction.

Dynamic Control Flow Graph Similarity

Since the adversary has access to the DCFG, the similarity between obfuscated and unobfuscated DCFGs was evaluated for the SPREE benchmark suite. For each obfuscation strategy, we generated 100 programs per benchmark and extracted each DCFG. As described in Sect. 2, several algorithms have been proposed to measure the CFG similarity. In a recent evaluation, Chan et al. [START_REF] Chan | A method to evaluate CFG comparison algorithms[END_REF] demonstrated that the graph edit distance algorithm proposed by Hu et al. [START_REF] Hu | Large-scale malware indexing using function-call graphs[END_REF] is most efficient in terms of accuracy and run time. This approach was used to determine the similarity score of our recorded DCFGs. Fig. 7 shows the results of our DCFG similarity evaluation. Obfuscated programs are compared to their unobfuscated versions in (a) and (b). A similarity score close to 1 implies that the graphs are similar, whereas a score close to 0 implies the opposite. The figure shows that a targeted program can be uniquely distinguished among the set of obfuscated programs if the DCFG is not affected by the obfuscation (Fig. 7 (a)). DCFG similarity between obfuscated and unobfuscated programs decreases as more obfuscation techniques are combined, hampering unique identification (Fig. 7 (b)). For example, the factorial program in Fig. 7 (b) cannot be distinguished from the set of programs.

Based on the statistical and DCFG evaluation results, it is apparent that the information characteristic for the des cryptographic algorithm stands out compared to other general-purpose embedded programs. Overall, we see that just using hardware-level obfuscation is not sufficient to hide crucial program characteristics. It must be combined with software-level transformation in order prevent unique distinction by the various measures.

DISCUSSION

In the following we analyze the diverse properties of our hybrid obfuscation scheme and discuss its security.

In general, hardware I/O mechanisms and instruction encoding format have crucial impacts on the security of hardware-level obfuscation. Our proposed lightweight processor augmentations mitigate generic adversary accessible attacks to hide the vital ISA encoding from a physical adversary. Furthermore, we are able to detect and respond to tampering attempts by the use of a booby trap mechanism. We have demonstrated how ISA encoding diversification can be implemented so that processors augmented with hardware-level features can be automatically generated. As a consequence of the randomized ISA encoding, the adversary is not able to directly disassemble and reverse-engineer a targeted program. Nevertheless, the ISA encoding itself is not sufficient in our adversary model as crucial program characteristics and hence we employ diverse software-level obfuscation transformations ranging from the CFG-level to the instruction-level.

Note that this approach does not affect testability during development as the obfuscation can be selectively turned off, so that general-purpose user code can be debugged. Since we employ an integrated and automated compilation flow for the hardware-level and software-level obfuscation, a developer has full access to all compiler log files as well as the hardware-level instruction encoding mapping.

Perhaps most importantly, the benefits of hybrid obfuscation transformations have been evaluated with statistical evaluation metrics. It has been demonstrated that it is not possible to match an obfuscated program to one of a group of unobfuscated ones by considering a selection of statistical metrics (Sect. 10.1). The hardware overhead of our approach is about 14% of processor logic area.

FUTURE WORK

Hardware Issues. The underlying concept of an obfuscated ISA encoding could potentially be applied to Application Specific Integrated Circuits (ASICs) that provide several field-programmable hardware elements, e.g., the WISC concept [START_REF] Koopman | Writable Instruction Set, Stack Oriented Computers: The WISC Concept[END_REF]. For example, such a device could include a userdefined ISA encoding, memory layout, and access control.

In particular, an ASIC could be generated by using just one mask to reduce the manufacturing costs. Thus, a fleet of embedded systems could be diversified to counteract the "break one break all" principle. A further interesting direction is dynamic instruction encoding update. This approach would be particularly attractive as a moving target defense.

The disabling of an FPGA-based soft processor in response to an attack is challenging since current SRAM-FPGAs do not offer the ability to permanently set one or more nonvolatile fuses at run-time. The addition of this feature would help in preventing deobfuscation attacks. The security analysis of our approaches for processors with dedicated cache memories is left for future research.

Software Issues. The performance overhead of softwarelevel obfuscation is significant for embedded systems. However, our evaluation results are in line with reported results from other work published in this area, e.g. [START_REF] Junod | Obfuscator-LLVM -software protection for the masses[END_REF]. The analysis of further obfuscation transformations such as anti-emulation, code tamper proofing, and self-modifying code [START_REF] Willems | Reverse code engineering -state of the art and countermeasures[END_REF], [START_REF] Junod | Obfuscator-LLVM -software protection for the masses[END_REF] in combination with Application Specific Instruction-Set Processor techniques to decrease software performance overhead are left for future research.

Security Metric Issues. Our security metrics could be expanded to include new statistical tests that evaluate hybrid obfuscation systems. A new metric which considers the limited I/O of embedded systems would be particularly advantageous.

CONCLUSION

ISA randomization provides a viable approach for obfuscation and exploit mitigation for embedded processors. However, for embedded systems, various disclosure sources can be leveraged to reveal crucial ISA information. Once the ISA is revealed, the targeted software can be reverseengineered. This issue is particularly worrisome for low-cost IoT systems with limited cryptographic protection.

In this work, we have presented a hybrid obfuscation scheme consisting of hardware-level and software-level obfuscation transformations to prevent a variety of disclosure attacks. We combined the obfuscation transformations with dedicated hardware booby traps to detect and respond to manipulation attempts. Finally, we demonstrated a novel evaluation methodology to assess the twofold diversification. This methodology provides a quantitative method to qualify the benefits of our approaches. The lack of quantitative metrics has been a long-standing issue in the software obfuscation domain. A performance evaluation of our prototype implementation demonstrates a lightweight hardware overhead of up to 14% for a simple, low-cost embedded processor.

  ⟨Program⟩ ::= ⟨Program⟩ ⟨Inst⟩ ⟨Inst⟩ ::= ⟨M⟩ | ⟨CF⟩ ⟨imm⟩ | ⟨DT⟩ ⟨reg⟩ ⟨reg⟩ ⟨imm⟩ | ⟨DTC⟩ ⟨imm⟩ | ⟨AL⟩ ⟨reg⟩ ⟨reg⟩ ⟨val⟩ ⟨M⟩ := 'nop' | 'sleep' ⟨CF⟩ ::= 'call' | 'ret' | 'jmp' | 'beq' | 'bne' ⟨DT⟩ ::= 'ld' | 'st' ⟨DTC⟩ ::= 'ldc' | 'stc' ⟨AL⟩ ::= 'and' | 'or' | 'not' | 'xor' | 'sll' | 'srl' | 'slt' | 'add' | 'sub' | 'mul' | 'div' ⟨val⟩ ::= ⟨imm⟩ | ⟨reg⟩ Listing 1: Generic RISC-based assembly language in BNF clustered into instruction groups.

Figure 2 :

 2 Figure 2: CPU datapath augmented with the hardware-level obfuscation features (marked in orange).

3 .

 3 For example, a ldc 0xabcd instruction loads the value from address 0xabcd to the register r I O . A stc 0xabcd instruction stores the value from the register r I O to address 0xabcd.

  •

Figure 3 :

 3 Figure 3: Entropy of the opcode distributions for the different obfuscation strategies.

Figure 4 :

 4 Figure 4: sd 3 -distributions for the different obfuscation strategies.

Figure 5 :

 5 Figure 5: E-sd 3 -diagrams for the different obfuscation strategies. The colour legend for all figures is specified in (d).

Figure 6 :

 6 Figure 6: Correlations of the opcodes for fft program for the different obfuscation strategies.

Figure 7 :

 7 Figure 7: Dynamic control flow graph similarity evaluation for the benchmark programs and different obfuscation strategies.

Table 2 :

 2 Hardware area overhead for the additional obfuscation elements.

	Design	LUTs	FFs Mem. Bits
	SPREE + BT	915	204	2048
	SPREE + BT + OS + OP(1)	933	204	2304
	SPREE + BT + OS + OP(2)	936	204	2304
	SPREE + BT + OS + OP(4)	976	204	2304
	SPREE + BT + OS + OP(8)	1015	204	2304
	SPREE	889	202	2048
	Available Resources 18868 112960	1802000

Table 3 :

 3 Software performance evaluation for the obfuscation strategies. Each result indicates the number of cycles arithmetically averaged over 100 programs.

		bubbl.	crc	CRC32	des	fact.	fft	fir iquant quant
	OS+OP	8012	24611	568886 1097	139	3067	1085	3401	3697
	OS+OP+IS	8308	45930 1085654 4428	143	3784	1286	4485	4425
	OS+OP+CF	36687	41514 1165379 1097	454	18187	7519	11217	10020
	OS+OP+CF+IS	38105	61237 1641889 4429	455	19659	7801	12710	11854
	OS+OP+CF+IS+BBN	48293 191189 6609719 4439 1732 119486 22160	35451	42932
	Unobfuscated	8012	24611	568886 1097	139	3067	1085	3401	3697
		bubbl.	crc CRC32	des fact.	fft	fir iquant quant
	OS+OP	1.42 1.40	1.56	5.92	1.35 2.04 1.94	1.93	1.98
	OS+OP+IS	1.44 1.57	1.92 20.62	1.36 2.20 2.07	2.12	2.15
	OS+OP+CF	1.87 1.73	2.03	5.92	1.86 2.95 2.68	2.62	2.71
	OS+OP+CF+IS	1.89 1.90	2.34 20.50	1.86 3.15 2.83	2.96	3.03
	OS+OP+CF+IS+BBN	2.39 2.77	3.33 20.69	2.33 4.83 3.73	4.11	4.33
	Unobfuscated	1.42 1.40	1.56	5.92	1.35 2.04 1.94	1.93	1.98

Table 4 :

 4 Software size evaluation for the obfuscation strategies. Each result indicates the program memory size in kB arithmetically averaged over 100 programs.

  ). The Spearman correlation for two program P x and P y is determined by ρ(N P x , N P y ) = 2 -6 ⋅ ∑ Py for the mean μP ∶= 2 -6 ⋅ ∑ o∈{0,1} 6 rk(N P (o)) and the standard deviation S P ∶= 2 -6 ⋅ ∑ o∈{0,1} 6 (rk(N P (o)) -μP ) 2 , where the pairs (rk(N P x (o)), rk(N P y (o))) are the ranks of the observed numbers of appearances N P y (o) which are determined separately for each program.

	o∈{0,1} 6 S 10.2.2 Statistical Analysis of the Instruction Memory rk()N Px (o))-μ Px S Px rk(N Py (o))-μ Py ⋅
	Using the above statistical measures, evaluation results for
	the instruction memory were generated. Hybrid obfuscation
	was applied to each program. A total of 100 different ISA
	encodings per obfuscation technique were applied. The
	obfuscation transformations in the following discussion are
	abbreviated as in Sect. 8.

For example, the instruction add r1,r2,2 can be split up into an arbitrary combination of multiple add, sub, or shift instructions so that the semantic is preserved.

ACKNOWLEDGEMENT

The authors would like to thank Philipp Koppe, Andre Pawlowski, Georg Becker and Ulrich R ührmair for the fruitful discussions and valuable suggestions throughout this work. Furthermore, we would like to thank the anonymous reviewers for their valuable comments. The research was supported in part through NSF grants CNS-1318497 and CNS-1421352, SFB823 (sub-project C4), INRIA Associate Team HARDIESSE, and ERC Advanced Grant 695022.


M Liu

P Benzo

H Tang

M Castiella

B Warot-Fonrose

N Tarrat

C Gatel

M Respaud

J Morillo

M J Casanove

epl draft

Keywords: 81, 07, Bc -Nanocrystalline materials 75, 75, -c -Magnetic properties of nanostructures 68, 35, -p -Solid surfaces and solid-solid interfaces: structure and energetics

Whereas bulk equiatomic FeRh alloy with B2 structure is antiferromagnetic (AFM) below 370K, we demonstrate that surface configuration can stabilize the low-temperature ferromagnetic (FM) state in FeRh nanoparticles in the 6-10 nm range. The most stable configuration for FM nanoparticles, predicted through first principles calculations, is obtained in magnetron sputtering synthesized nanoparticles. The structure, morphology and Rh-(100) surface termination are confirmed by aberration-corrected (scanning) transmission electron microscopy. The FM magnetic state is verified by vibrating sample magnetometry experiments. This combined theoretical and experimental study emphasizes the strong interplay between surface configuration, morphology and magnetic state in magnetic nanoparticles.

Close to the equiatomic composition, the chemically ordered FeRh alloy with B2 cubic structure (B2-FeRh), presents a remarkable magnetic phase transition from an antiferromagnetic (AFM) state at low temperature to a ferromagnetic (FM) state above 370K [1][2][3][4][5]. In recent years, there has been a strong interest for this alloy for applications in microelectronics [6,7], heat-assisted magnetic recording [8][START_REF] Thiele | Magnetics[END_REF][10] or magnetic random access memories. [11] While the FM-AFM transition is sharp in the bulk alloy, the persistence of a FM component at low temperature in FeRh thin films raised important questions about the effect of size reduction [12,13], interfaces [14][15][16][17] and surface termination [18,19] on their magnetic properties. Incomplete transitions upon cooling were also reported in FeRh nanoparticles [20][START_REF] Ko | Magnetics[END_REF][22]. However, whereas pure size effects were studied in nanoparticles (NPs), [23] the role of surface termination remains to be addressed. In contrast with thin epitaxial films, NPs expose different types of surfaces. In principle, their equilibrium morphology can be predicted from the hierarchy of the facet energies. [24] In chemically ordered NPs, the energy of a facet (a) E-mail : casanove@cemes.fr can also depend on its chemical termination. Moreover, in the case of FeRh NPs, both AFM and FM states should be considered for the volume in combination with different magnetic configurations at the surface. In this letter, we demonstrate the complex interplay between magnetic state, surface-termination and morphology in B2-FeRh nanoparticles, through a combined theoretical and experimental study. First, we present the density-functional-theory (DFT) calculations of the surface energies of AFM and FM FeRh films, for different surface magnetic configurations and terminations. These calculations reveal that Rh-terminated (100) and (111) monometallic surfaces usually have lower energies than the Fe-terminated ones, for both FM and AFM films. Remarkably, the Rh-terminated (100) surface has lower energy than the (110) surface in FM films, whereas in AFM films, the priviledged surface is the bimetallic (110) (as in body-centered cubic systems). These findings suggest a magnetic dependency of the FeRh NPs morphology. To go further, FeRh NPs, in the 6-10 nm range, were grown in a UHV device. Atomically resolved (scanning) transmission electron microscopy experiments (TEM and STEM) reveal their faceted morphology with mainly (100) and (110) facets and provide the first experimental evidence of the preferred Rh-termination of the (100) facets. Magnetometry measurements demonstrate the FM properties of these NPs down to 5K. Consistently, the grown FM NPs present the morphology predicted by the DFT calculations, i.e. larger Rh-terminated (100) facets compared to (110) facets, emphasizing the close relation between surface termination and magnetism.

Spin-polarized DFT calculations were performed using the VASP package [25][26][27] in periodic boundary conditions to study the (100), ( 111) and (110) surfaces. Projected augmented wave (PAW) pseudopotentials [28] were used together with the Perdew-Burke-Ernzerhoff (GGA-PBE) exchange-correlation functional [29][30][31] and a plane wave kinetic energy cutoff of 550 eV was employed. These calculations give the following values for bulk AFM (FM in parenthesis) B2-FeRh : lattice parameter 2.996 (3.012) Å, Fe magnetic moment 3.14 (3.19) µ B , Rh magnetic moment 0.0 (1.04) µ B . The cohesive energy per unit cell is 40 meV lower in the AFM state than in the FM state . These values compare well with experimental results [4] and previously published calculations [5,[32][33][34] performed with different exchange-correlation functionals. Three symmetric slabs, respectively ended by (100), ( 111) and (110) surfaces, were used. In order to use a same slab for the different magnetic states that must be considered for both the bulk (AFM or FM) and the surface layers, the lateral dimensions of the three slabs were those of the AFM unit cell, as described by Moruzzi and Marcus [5] : a square surface cell a 0 √ 2×a 0 √ 2 for the (100) slab where a 0 is the B2 cubic cell parameter; a hexagonal cell with a = b = a 0 √ 2 and (a, b) = 120 • for the (111) slab and a rectangular surface cell a 0 √ 2 × 2a 0 for the (110) slab. The different slabs with proportionally sized k-points grids, 15 × 15 × 1 for (100), 13×13×1 for (111) and 9×12×1 for (110) , respectively contain 15, 19 and 15 layers, and thus 30, 19 and 60 atoms. The five central atomic layers were kept fixed while the other layers were allowed to relax. To avoid the interaction between periodic slabs in the surface normal direction, the size of the vacuum region was set at 12 Å. Whatever the surface orientation, two different magnetic states, the AFM and FM states, were considered for the bulk. Different magnetic initial states of the topmost bilayer (surface magnetic configurations) were investigated. By convention, FM↑ refers to the state of the FM bulk and the magnetic state at the surface is defined with reference to the magnetic state of the bulk alloy underneath. For the (100) surface, five different magnetic configurations were calculated for each surface termination (Rh or Fe), two for the AFM bulk (AFM and FM surface bilayers) and three for the FM↑ bulk (AFM, FM↑ and FM↓ surface bilayers). A scheme of these different configurations is displayed in Figure 1. For the bimetallic (110) surface, we investigated the same five magnetic configurations as for the Rh-(or Fe) terminated (100) surface. For the (111) surface, four different magnetic configurations were calculated for each The relaxation of the initial structures does not change the surface and bulk magnetic states but slightly modifies the magnetic moments of Fe and Rh atoms located at the surface or in the topmost bulk layers. The surface energy per unit area for a symmetric slab is simply defined as half the energy necessary to break an infinite crystal into two pieces:

γ = 1 2S (E slab -E bulk ), (1)
where S denotes the surface area at equilibrium. As the slabs expose the same top and bottom surfaces, they are off-stoichiometry in the case of (100) and (111) films. As a consequence, the bulk energy E bulk must be calculated in each different slab using :

E bulk = N F e µ F e + N Rh µ Rh (2)
where N F e and N Rh are the numbers of Fe and Rh atoms in the alloy and µ F e and µ Rh their chemical potentials at 0K. The chemical potentials have been calculated in both AFM and FM states following the combined ab initio and statistical mechanics approach1 described in [35][36][37].

The computed surfaces energies as a function of the magnetic configurations are gathered in Table 1. Independently of the bulk magnetic state, the Rhterminated FM surface configuration is much more favorable for the (100) surface. This result is consistent with both theoretical predictions [18] on ultrathin free-standing films and recently reported experimental studies of the surface of a Rh-terminated (100) FeRh films. [38] For (111) surfaces, our calculations show mixed results but the Rh-termination remains slightly more favorable in most cases. Most interestingly, comparing several low-index surfaces allows us to reveal a magnetic order dependency of the hierarchy of the surface energies. Indeed, in films with AFM bulk, the surface with lower energy is the dense (110) bimetallic surface, whatever the magnetic configuration of the surface and its chemical termination. This is not the case for the FM bulk state as the Rh-terminated (100) surface becomes more favorable than the (110) surface in all the different magnetic surface configurations. Experiments have been conducted in order to investigate the interplay between facet competition and magnetic properties in nanoparticles.

Fe-Rh NPs were grown by dc magnetron co-sputtering from two elemental targets in a ultra-high vacuum (UHV) chamber. The growth temperature was set to 730 • C. A 5 nm thick amorphous alumina layer (a-Al 2 O 3 ) was used as a substrate (itself deposited on a thin NaCl crystal). After metal deposition, the temperature was slowly decreased to room temperature and maintained at this temperature to deposit a 5 nm thick a -Al 2 O 3 cover layer in order to prevent oxidation and NPs coalescence. [39] The FeRh NPs embedded in the alumina matrix were transferred on copper grids for TEM-STEM investigations, after dissolution of the NaCl support. Their analyses were conducted using Cs-corrected instruments (for objective lens or probe), a FEI Tecnai F20 and a Jeol cold FEG ARM200F microscopes. Energy x-ray dispersive spectroscopy (EDS) performed on a large assembly of nanoparticles revealed a mean composition of Fe 47 Rh 53 , which agrees with the composition range for AFM B2-FeRh, 0.44 < x F e < 0.52. [40] Figure 2 summarizes the findings of the TEM analysis. The low magnification image and associated size histogram show that the NPs have a narrow size dispersity (standard deviation of 1.5 nm) with a mean diameter of 8.4 nm. The NPs appear fully cristalline as the one displayed in the inset in figure 2-a and display neat (100) and (110) facets when observed along a [001] direction. The numerical diffractogram (figure 2-c) recorded from the Fourier transform of a high resolution image of an assembly of these NPs (not shown) displays a set of reflexions fully consistent with B2-FeRh, in particular a strong 100 reflexion (forbidden in bcc). Contrary to room-temperature grown NPs (see for instance [20,22,23]), no annealing step is thus required to achieve the B2 order in the present case, the growth temperature being high enough to favor atomic diffusion and chemical order.

The chemical nature of the atomic columns in the FeRh NPs is analyzed in HAADF-STEM mode. Thanks to the Z-dependency of the contrast, the Rh atomic columns appear much brighter than the Fe ones in Figure 3. Our analysis of the exposed facets on suitably oriented NPs provides the first experimental evidence for the Rhtermination of the (100) facets in FeRh NPs. This preferred termination is clearly observed in profile 3 of Figure 3. In this orientation, the NPs present large (100) facets and small (110) bimetallic facets. According to the Wulff theorem, γi hi = constant, where γ i refers to the surface energy per unit area of the i facet and h i refers to the distance of the i-facet to the nanoparticle center. The ratio h exp 100 /h exp 110 of the distances from the center of the nanoparticle to the two different facets thus provides a rather good estimate of the ratio of their surface energies: γ exp 100 /γ exp 110 ≃ 0.91. This value is very close to the ratio of the calculated surface energies corresponding to the more stable (i.e. F M ↑) surface configuration in the F M ↑ bulk case (see Table 1), with Rh-terminated (100) surface: γ calc 100 /γ calc 110 = h calc 100 /h calc 110 = 0.946 . Note that all the investigated NPs present a h exp 100 /h exp 110 ratio lower than 1. The inset in Figure 3 displays the Wulff polyhedron built using these calculated values. In contrast, the observed morphology poorly agrees with the one that can be derived from the surface energies hierarchy in the most stable case of the Rh-terminated AF M bulk configuration (first column in Table 1) with γ calc 100 /γ calc 110 greater than 1. As our NPs present a slight Fe under-stoichiometry, we also calculated the surface energies for a 4% deviation from stoichiometry by replacing in equation ( 2), the T = 0 K chemical potentials of the equiatomic alloy by the ones calculated for the Fe 0.48 Rh 0.52 alloy. Table 2 presents the corresponding surface energies for the FM bulk state. The F M ↑ with Rh-termination remains the more favorable surface configuration and the γ ratio is now closer to the one deduced from experiments γ calc 100 /γ calc 110 = 0.89. Moreover, assuming that the main contribution to the difference of surface free energy between the two surfaces comes from the chemical potentials, the γ ratio calculated with the T = 300 K chemical potentials reaches 0.91, i.e. the experimental value. The facet competition thus strongly privileges the Rh-terminated (100) facets over other facets in FM bulk and the effect is reinforced by a slight Rh enrichment. The reported morphology thus strongly suggests the presence of the FM state in the analyzed NPs.

The magnetic properties of an assembly of these NPs were measured using vibrating sample magnetometry (VSM) in a PPMS Quantum Design system. Magnetization data were recorded along the sample plane. Figure 4-a presents magnetization measurements according to a zero-field cooling (ZFC)-field cooling (FC) procedure for different applied magnetic fields. They give evidence for a superparamagnetic behavior of the assembly with a blocking temperature about 150K. The blocking temperature decreases when increasing the magnetic field, which is characteristic for a superparamagnetic nanomaterial. Some representative isothermal M (H) hysteresis loops measured at different temperatures from 390K to 5K are presented in Figure 4-b. All these measurements were performed after a FC from 390K down to 2.5K under a field of 6T. None of the M (H) displayed an exchange bias phenomena that could be expected for a ferromagnetic / antiferromagnetic interface. The evolution of the coercive field H c with temperature is plotted in the inset. It confirms the superparamagnetic transition above 150K, as H c goes to zero. The saturation magnetization (M S ) is obtained in moderate magnetic fields, below 1T, and [4] for instance), the magnetization reaches around 4µ B per FeRh unit cell in the FM state and thus around 1370 emu/cm 3 . This value is however usually not reached in thin films. Our estimate of M S , (1050 (±200)emu/cm 3 ) is in reasonable agreement with the magnetization in the bulk alloy even if more precise measurements are foreseen to reduce the uncertainty of our estimate. These results confirm without any ambiguity the persistence of the FM state down to 5K in equiatomic B2-FeRh nanoparticles in the 6-10 nm range, without any evidence for an even partial FM to AFM transition upon cooling in the range of field (up to 8T) and temperature experienced.

In summary, using DFT calculations, we compared the energies of low-index surfaces in different magnetic configurations for both the surface and the bulk in equiatomic FeRh. While confirming the enhanced stability of Rhterminated FM surface configuration for the (100) surface, as reported for thin FeRh films, our results strongly emphasize the influence of the bulk magnetic order on the exposed surface hierarchy. In particular, the mentioned facet is much more stable than the other facets in case of a FM bulk state. Consistently, we provide the first evidence for the occurrence of large Rh-terminated (100) facets in grown NPs with B2 structure. Our magnetic measurements demonstrate that the synthesized NPs are ferromagnetic despite their relatively large size (≃ 8 nm). There is presently an agreement on the role played by the Rh magnetic moment, induced by a spin-dependent hybridization with surrounding Fe atoms, in the stabilization of the FM state in the bulk alloy above a given temperature [33,34]. The stabilization of the FM state in our nanoparticles can be accounted for the enhanced polarization of Rh at the large Rh-terminated (100) surface facets, as observed in thin films [18,38], which favors the formation of a FM shell. Clearly, the magnetic state at the surface impedes the stabilization of the AFM state in the nanocrystal core, at this size range. Our results thus strongly suggest the important role played by the surface configuration in the morphology of FeRh NPs and in the stabilization of the FM state. It also opens perspectives for tuning the finite-size properties of this remarkable alloy and suggests new strategies for designing AFM-core-FM shell nanoparticles through size and morphology control. * * *

Fig. 1 :

 1 Fig. 1: Scheme of the five magnetic surface configurations considered for the calculation of the Rh-terminated (100) surface: two for AFM bulk (top) and three for FM bulk (bottom). The + and -signs in the atoms (Fe:light blue; Rh: dark blue) indicate parallel or antiparallel coupling of the magnetic moments.

Fig. 2 :

 2 Fig. 2: a) TEM view of the grown Fe-Rh NPs together with a HREM image of a NP in the inset ; b) Corresponding histogram of size distribution fitted with a gaussian distribution; c) Intensity profile of the numerical diffraction pattern (shown in the inset), displayed with and without the amorphous background due to alumina.

Fig. 3 :

 3 Fig. 3: HAADF-STEM image of a NP observed along a [001] direction of B2-FeRh. Intensity profiles along different lines are presented on the right. Profiles 1 and 2 respectively correspond to a [100] raw of Rh atomic columns and a [110] raw showing alternate Fe and Rh columns. Profile 3 displays the projected intensities of two adjacent raws (Fe and Rh raws) along a [100] direction drawn from the surface of the NP to its center. The scheme in inset corresponds to the calculated Wulff polyhedron.

Fig. 4 : 5 M

 45 Fig. 4: a) ZFC/FC magnetization measurements of the FeRh NPs for different applied fields ; b) Isothermal M (H) hysteresis loops recorded from 5K to 390K after a FC under 6T from 390K. The inset shows the evolution of the coercive field Hc with temperature.

Table 1 :

 1 Calculated T = 0 K surface energies (J.m -2 ) in equiatomic FeRh as a function of the magnetic surface configurations for the two different bulk magnetic orders AFM and FM Rh or Fe): two for the AFM bulk (the AFM and the FM surface bilayers in which the Fe plane is either antiparallel (AFM) or parallel (FM) to the topmost Fe plane in the bulk) and two for FM bulk (FM↑ and FM↓ surface to mention here also the parallel or antiparallel alignment of the two most external Fe planes, one belonging to the surface bilayer and one to the bulk).

		AFM bulk	FM↑ bulk
	Surface	FM	AFM	FM↑ FM↓ AFM
	(100) Rh 2.174 2.274	1.775 1.980 2.034
	(100) F e 2.649 2.567	2.559 2.628 2.646
	Surface	FM	AFM	FM↑ FM↓
	(111) Rh 2.374 2.431	2.082 2.252
	(111) F e 2.366 2.491	2.181 2.273
	Surface	FM	AFM	FM↑ FM↓ AFM
	(110)	2.095 2.090	1.876 2.147 2.038
	surface termination (

Table 2 :

 2 Calculated T = 0 K surface energies (J.m -2 ) in F M bulk Fe0.48Rh0.52.

	Surface	F M ↑	F M ↓	AF M
	(100) Rh	1.677	1.882	1.936
	(100) F e	2.657	2.725	2.744
	(110)	1.876	2.147	2.038
	slowly and monotonically decreases upon increasing the
	temperature. This set of data is a clear indication of the
	FM state in the NPs, even at very low temperature. Ac-
	cording to the experimental values (see

The statistical model uses as input data the grand canonical DFT formation energies of the four elementary point defects, i.e. vacancy and antisite defects on both Fe and Rh sublattices. These formation energies have been calculated with large simulation periodic supercells containing the considered defect.

This work was supported by the French Ministry of Foreign and European Affairs (M.L. PhD grant). It was performed using HPC resources from CALMIP (Grant 2015-P0933). We gratefully acknowledge for their assistance, Lucien Datas and Teresa Hungria with the ARM200F at Centre de Microcaracterization R. Castaing and Sebastien Pinaud for the magnetization measurements at LPCNO.