A Scalable and Configurable Architecture for Hardware Authenticated Encryption Modules Compliant with the CCSDS Security Specifications

Cybersecurity is one of the most challenging aspects in the modern Information and Communications Technology (ICT) era, including space applications. The Consultative Committee for Space Data Systems (CCSDS) is issuing and updating reports and standards to address this problem in the space sector. It defined the format of secure frames to protect data with different security features and the corresponding cryptographic algorithms to be applied. Among them, the Galois/Counter Mode (GCM) of the Advanced Encryption Standard (AES) is the only one that constitutes a comprehensive solution for the simultaneous confidentiality, integrity, and authentication of data (i.e. authenticated encryption). In this work, we present a configurable and scalable architecture for implementing hardware AES-GCM modules aimed at securing space applications compliant with the CCSDS specifications. The proposed architecture was designed using SystemVerilog and characterized in terms of trade-offs between resource utilization and maximum frequency by analyzing the implementation results on a space-grade KU060 FPGA. Indeed, the configurability at the synthesis level of the proposed architecture supports different approaches that can be exploited to find the most efficient solution for the target application. For this reason, we present two use cases for the integration of the proposed security module in a transmitter for CCSDS-compliant telemetry (TM) applications. The corresponding results confirm the adaptability of our solution in different application scenarios thanks to its configurability. In addition, they show that our module offers long-term protection in terms of classical and post-quantum security for modern space applications with a minimum resource cost of 672 Configurable Logic Blocks (CLBs), i.e. 1.6% of the FPGA resources.