Download the Full Version of textbook for Fast Typing at textbookfull.

com

Network on Chip Security and Privacy Prabhat

Mishra

https://textbookfull.com/product/network-on-chip-security-
and-privacy-prabhat-mishra/

OR CLICK BUTTON

DOWNLOAD NOW

Download More textbook Instantly Today - Get Yours Now at textbookfull.com

 Recommended digital products (PDF, EPUB, MOBI) that
you can download immediately if you are interested.

System on Chip Interfaces for Low Power Design 1st Edition

Mishra

https://textbookfull.com/product/system-on-chip-interfaces-for-low-
power-design-1st-edition-mishra/

textboxfull.com

Accountability And Privacy In Network Security Yuxiang Ma

https://textbookfull.com/product/accountability-and-privacy-in-
network-security-yuxiang-ma/

textboxfull.com

Advanced Multicore Systems On Chip Architecture On Chip

Network Design 1st Edition Abderazek Ben Abdallah (Auth.)

https://textbookfull.com/product/advanced-multicore-systems-on-chip-
architecture-on-chip-network-design-1st-edition-abderazek-ben-
abdallah-auth/
textboxfull.com

Sustainable Wireless Network-On-chip Architectures 1st

Edition Murray

https://textbookfull.com/product/sustainable-wireless-network-on-chip-
architectures-1st-edition-murray/

textboxfull.com
Bio-Inspired Fault-Tolerant Algorithms for Network-on-Chip
1st Edition Muhammad Athar Javed Sethi (Author)

https://textbookfull.com/product/bio-inspired-fault-tolerant-
algorithms-for-network-on-chip-1st-edition-muhammad-athar-javed-sethi-
author/
textboxfull.com

Security And Privacy Joseph Savirimuthu

https://textbookfull.com/product/security-and-privacy-joseph-
savirimuthu/

textboxfull.com

Labs on Chip: Principles, Design and Technology Eugenio

Iannone

https://textbookfull.com/product/labs-on-chip-principles-design-and-
technology-eugenio-iannone/

textboxfull.com

Security Privacy and Forensics Issues in Big Data Advances

in Information Security Privacy and Ethics 1st Edition
Ramesh C. Joshi
https://textbookfull.com/product/security-privacy-and-forensics-
issues-in-big-data-advances-in-information-security-privacy-and-
ethics-1st-edition-ramesh-c-joshi/
textboxfull.com

Surveillance Privacy And Security Citizens Perspectives

Michael Friedewald

https://textbookfull.com/product/surveillance-privacy-and-security-
citizens-perspectives-michael-friedewald/

textboxfull.com
Prabhat Mishra
Subodha Charles Editors

Network-on-
Chip Security
and Privacy
Network-on-Chip Security and Privacy
Prabhat Mishra • Subodha Charles
Editors

Network-on-Chip Security
and Privacy
Editors
Prabhat Mishra Subodha Charles
University of Florida University of Moratuwa
Gainesville, FL, USA Colombo, Sri Lanka

ISBN 978-3-030-69130-1 ISBN 978-3-030-69131-8 (eBook)

https://doi.org/10.1007/978-3-030-69131-8

© The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland
AG 2021
This work is subject to copyright. All rights are solely and exclusively licensed by the Publisher, whether
the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse
of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and
transmission or information storage and retrieval, electronic adaptation, computer software, or by similar
or dissimilar methodology now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
The publisher, the authors, and the editors are safe to assume that the advice and information in this book
are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or
the editors give a warranty, expressed or implied, with respect to the material contained herein or for any
errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional
claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

System-on-Chip (SoC) integrates a wide variety of hardware components into a

single integrated circuit to provide the backbone of modern computing systems
ranging from complex navigation systems in airplanes to simple Internet-of-Things
(IoT) devices in smart homes. Cars are full of them, as are airplanes, satellites, and
advanced military and medical devices. As applications grow increasingly complex,
so do the complexities of the SoCs. For example, a typical automotive SoC may
include 100–200 diverse components (e.g., processor, memory, controllers, and
converters) from multiple third-party vendors. Network-on-Chip (NoC) is a widely
used solution for on-chip communication between various components in complex
SoCs.
SoCs are designed today using Intellectual Property (IP) components to reduce
cost while meeting aggressive time-to-market constraints. Growing reliance on
these pre-verified components, often gathered from untrusted third-party vendors,
severely affects the security and trustworthiness of SoC computing platforms. These
third-party components may come with deliberate malicious implants to incorporate
undesired functionality, undocumented test/debug interfaces working as a hidden
backdoor, or other integrity issues. Since NoC facilitates communication between
various components in an SoC, NoC is the ideal place for any malicious implants
(such as hardware Trojans) to hide and launch a wide variety of security attacks. Due
to the resource-constrained nature of many embedded and IoT devices, it may not be
possible to employ traditional security solutions to protect NoC against malicious
attacks. Specifically, there is a need for lightweight countermeasures that can secure
NoC without violating any design constraints such as area, power, energy, and
performance.
This book provides a comprehensive overview of NoC security attacks and
effective countermeasures for designing secure and trustworthy on-chip communi-
cation architectures. These techniques are applicable across on-chip communication
technologies (e.g., electrical, optical, and wireless) supporting a wide variety of
on-chip network topologies (e.g., point-to-point, bus, crossbar, ring, and mesh).
Specifically, this book describes state-of-the-art security solutions that satisfy a
wide variety of communication (often conflicting) requirements such as securing

v
vi Preface

packets, ensuring route privacy, meeting energy budget and real-time constraints,
finding trusted routes in the presence of malicious components, and providing real-
time attack detection and mitigation techniques. The presentation of topics has been
divided into five categories with each category focusing on a specific aspect of the
big picture. A brief outline of the book is provided as follows:
1. Introduction to NoC Security: The first part of the book includes three introduc-
tory chapters on NoC design and security challenges.
• Chapter 1 provides an overview of NoC-based SoC design methodology with
an emphasis on NoC architectures and security vulnerabilities.
• Chapter 2 describes accurate modeling and design space exploration of on-
chip communication architectures.
• Chapter 3 presents popular optimization techniques for designing energy-
efficient NoC architectures.
2. Design-for-Security Solutions: The second part of the book focuses on design-
time solutions for securing NoC architectures against attacks.
• Chapter 4 presents a lightweight encryption scheme using incremental cryp-
tography.
• Chapter 5 describes a trust-aware routing algorithm that can bypass malicious
components.
• Chapter 6 outlines a lightweight anonymous routing technique.
• Chapter 7 describes how to efficiently integrate secure cryptography to
overcome NoC-based attacks.
3. Runtime Security Monitoring: The third part of the book deals with security
solutions for runtime detection and mitigation of vulnerabilities.
• Chapter 8 describes a mechanism for real-time detection and localization of
denial-of-service attacks.
• Chapter 9 utilizes digital watermarking for providing lightweight defense
against eavesdropping attacks.
• Chapter 10 outlines a machine learning framework for detecting attacks on
NoC-based SoCs.
• Chapter 11 presents a routing technique that can provide trusted communica-
tion in the presence of hardware Trojans.
4. NoC Validation and Verification: The fourth part of the book explores methods
for verifying both functional correctness and security guarantees.
• Chapter 12 describes NoC security and trust validation techniques.
• Chapter 13 presents post-silicon validation and debug of NoCs.
• Chapter 14 describes challenges in designing reliable NoC architectures.
5. Emerging NoC Technologies: The fifth part of the book surveys security impli-
cations in emerging NoC technologies.
• Chapter 15 describes security solutions for photonic (optical) NoCs.
Preface vii

• Chapter 16 presents security solutions for on-chip wireless networks.

• Chapter 17 provides an overview of securing 3D NoCs from hardware Trojan
attacks.
6. Conclusion and Future Directions: The last chapter concludes the book with a
summary and discussion on future directions.
We hope you enjoy reading this book and find the information on attacks and
countermeasures useful in designing secure and trustworthy systems.

Gainesville, FL, USA Prabhat Mishra

Colombo, Sri Lanka Subodha Charles
January 1, 2021
Acknowledgments

This book would not be possible without the contributions of many researchers
and experts in the field of network-on-chip security and privacy. We would like to
gratefully acknowledge the contributions of Prof. Tushar Krishna (Georgia Tech),
Dr. Srikant Bharadwaj (AMD), Sumit K. Mandal (Univ. of Wisconsin-Madison),
Anish Krishnakumar (Univ. of Wisconsin-Madison), Prof. Umit Ogras (Univ. of
Wisconsin-Madison), Dr. Johanna Sepulveda (Airbus), Chamika Sudusinghe (Univ.
of Moratuwa), Manju Rajan (IIT Guwahati), Abhijit Das (IIT Guwahati), Prof.
John Jose (IIT Guwahati), Aruna Jayasena (Univ. of Florida), Sidhartha Sankar
Rout (IIIT Delhi), Mitali Sinha (IIIT Delhi), Prof. Sujay Deb (IIIT Delhi), Prof.
Sudeep Pasricha (Colorado State), Ishan Thakkar (Colorado State), Sai Vineel
Reddy Chittamuru (Colorado State), Varun Bhatt (Qualcomm), Sairam Sri Vat-
savai (Colorado State), Yaswanth Raparti (Colorado State), Prof. Amlan Ganguly
(Rochester Institute of Technology), Prof. Sai Manoj PD (George Mason), Abhishek
Vashist (Rochester Institute of Technology), Andrew Keats (Rochester Institute of
Technology), M. Meraj Ahmed (Rochester Institute of Technology), Noel Daniel
Gundi (Utah State), Prabal Basu (Utah State), Prof. Sanghamitra Roy (Utah State),
and Koushik Chakraborty (Utah State).
This work was partially supported by the National Science Foundation (NSF)
grants SaTC-1936040 and CCF-1908131. Any opinions, findings, conclusions,
or recommendations presented in this book are those of the authors and do not
necessarily reflect the views of the National Science Foundation.

ix
Contents

Part I Introduction
1 Trustworthy System-on-Chip Design Using Secure on-Chip
Communication Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Prabhat Mishra and Subodha Charles
2 Interconnect Modeling for Homogeneous and Heterogeneous
Multiprocessors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Tushar Krishna and Srikant Bharadwaj
3 Energy-Efficient Networks-on-Chip Architectures: Design
and Run-Time Optimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Sumit K. Mandal, Anish Krishnakumar, and Umit Y. Ogras

Part II Design-for-Security Solutions

4 Lightweight Encryption Using Incremental Cryptography . . . . . . . . . . . 79
Subodha Charles and Prabhat Mishra
5 Trust-Aware Routing in NoC-Based SoCs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Subodha Charles and Prabhat Mishra
6 Lightweight Anonymous Routing for On-chip Interconnects . . . . . . . . . 123
Subodha Charles and Prabhat Mishra
7 Secure Cryptography Integration: NoC-Based
Microarchitectural Attacks and Countermeasures . . . . . . . . . . . . . . . . . . . . . 153
Johanna Sepúlveda

Part III Runtime Monitoring Techniques

8 Real-Time Detection and Localization of DoS Attacks . . . . . . . . . . . . . . . . . 183
Subodha Charles and Prabhat Mishra

xi
xii Contents

9 Securing on-Chip Communication Using Digital Watermarking . . . . . 219

Subodha Charles and Prabhat Mishra
10 Network-on-Chip Attack Detection using Machine Learning . . . . . . . . . 253
Chamika Sudusinghe, Subodha Charles, and Prabhat Mishra
11 Trojan Aware Network-on-Chip Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Manju Rajan, Abhijit Das, John Jose, and Prabhat Mishra

Part IV NoC Validation and Verification

12 Network-on-Chip Security and Trust Verification . . . . . . . . . . . . . . . . . . . . . . 311
Aruna Jayasena, Subodha Charles, and Prabhat Mishra
13 NoC Post-Silicon Validation and Debug. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
Sidhartha Sankar Rout, Mitali Sinha and Sujay Deb
14 Design of Reliable NoC Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
Noel Daniel Gundi, Prabal Basu, Sanghamitra Roy,
and Koushik Chakraborty

Part V Emerging NoC Technologies

15 Securing Silicon Photonic NoCs Against Hardware Attacks . . . . . . . . . . 399
Ishan G. Thakkar, Sai Vineel Reddy Chittamuru, Varun Bhat,
Sairam Sri Vatsavai, and Sudeep Pasricha
16 Security Frameworks for Intra and Inter-Chip Wireless
Interconnection Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
M. Meraj Ahmed, Abhishek Vashist, Andrew Keats, Amlan Ganguly,
and Sai Manoj Pudukotai Dinakarrao
17 Securing 3D NoCs from Hardware Trojan Attacks. . . . . . . . . . . . . . . . . . . . . 461
Venkata Yaswanth Raparti and Sudeep Pasricha

Part VI Conclusion and Future Directions

18 The Future of Secure and Trustworthy Network-on-Chip
Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Prabhat Mishra and Subodha Charles

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
 Part I
Introduction
Chapter 1
Trustworthy System-on-Chip Design
Using Secure on-Chip Communication
Architectures

Prabhat Mishra and Subodha Charles

1.1 Introduction

We are living in the era of Internet-of-Things (IoT), an era in which the number of
connected smart computing devices exceeds the human population. Various reports
suggest that we can expect over 50 billion devices to be deployed and mutually
connected by 2025 [66], compared to about 500 million in 2003 [45]. In the past,
computing devices like phones with a few custom applications represented the
boundary of our imagination. Today, we are developing solutions ranging from
smartwatches, smart cars, smart homes, all the way to smart cities. System-on-
Chip (SoC) designs are at the heart of these computing devices, which range from
simple IoT devices in smart homes to complex navigation systems in airplanes.
As applications grow increasingly complex, so do the complexities of the SoCs.
For example, a typical automotive SoC may include 100–200 diverse Intellectual
Property (IP) blocks designed by multiple vendors. The ITRS (International Tech-
nology Roadmap for Semiconductors) 2015 roadmap projected that the increased
demand for information processing will drive a 30-fold increase in the number
of cores by 2029 [1]. Indeed, one of the most recent many-core processor
architectures, Intel “Knights Landing” (KNL), features 64–72 Atom cores and
144 vector processing units [119]. The Intel Xeon Phi processor family, which
implements the KNL architecture, is often integrated into workstations to serve
machine learning applications. The 256-core CPU—MPPA2, launched by Kalray
Corporation [107], is used in many data centers to speed up data processing.

P. Mishra ()
University of Florida, Gainesville, FL, USA
e-mail: [email protected]
S. Charles
University of Moratuwa, Colombo, Sri Lanka
e-mail: [email protected]

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2021 3

P. Mishra, S. Charles (eds.), Network-on-Chip Security and Privacy,
https://doi.org/10.1007/978-3-030-69131-8_1
4 P. Mishra and S. Charles

The increasing number of cores demands the use of a scalable on-chip inter-
connection architecture, which is also known as Network-on-Chip (NoC). As
shown in Fig. 1.1, a typical SoC utilizes NoC to communicate between multiple
IP cores including processor, memory, controllers, converters, input/output devices,
peripherals, etc. NoC IPs are used in a wide variety of market segments such as
mobile phones, tablets, automotive and general purpose processing leading to an
exponential growth in NoC IP usage. A survey done by Gartner Inc. has revealed that
NoC IP sales of Sonics, a privately-held Silicon Valley IP provider that specializes in
NoC and power-management technologies, is ranked number 7 in terms of design
IP revenue with a profit growth of 44.8% compared to 2013 [54]. Therefore, it is
evident that the NoC has become an increasingly important component in modern
SoC designs.
The drastic increase in SoC complexity has led to a significant increase in
SoC design and validation complexity [4, 35, 48, 50, 81, 84, 88, 89, 92]. Reusable
hardware IP based SoC design has emerged as a pervasive design practice in
the industry to dramatically reduce design and verification cost while meeting
aggressive time-to-market constraints. Figure 1.2 shows the supply chain of a
specific commercial SoC [91]. Growing reliance on these pre-verified hardware IPs,
often gathered from untrusted third-party vendors, severely affects the security and
trustworthiness of SoC computing platforms. These third-party IPs may come with
deliberate malicious implants to incorporate undesired functionality (e.g., hardware
Trojan), undocumented test/debug interfaces working as hidden backdoors, or other
integrity issues. Based on Common Vulnerability Exposure estimates, if hardware-
level vulnerabilities are removed, the overall system vulnerability will reduce by
43% [41, 90].
The security of emerging SoCs is becoming an increasingly important design
concern. Beyond the traditional attacks from software on connected devices, attacks
originating from or assisted by malicious components in hardware are becoming
more common. For example, Quo Vadis Labs has reported backdoors in electronic
chips that are used in weapon control systems and nuclear power plants [118],
which can allow these chips to be compromised remotely. The well-publicized
“Spectre” [73] and “Meltdown” [78] attacks highlight how sensitive data can be
stolen from threads executing on multicore processors. It is widely acknowledged
that all algorithmically secure cryptographic primitives and protocols rely on a
hardware root-of-trust that is resilient to attacks to deliver the expected protections

Fig. 1.1 An example System-on-Chip (SoC) with Network-on-Chip (NoC) based communication
fabric to interact with a wide variety of third-party Intellectual Property (IP) cores
1 Introduction to Network-on-Chip Security 5

Fig. 1.2 Supply chain of a commercial router SoC with components from multiple third-party
companies across the globe [91]

when implemented in software. Clearly, hardware platforms are at an elevated risk

for security compromises in today’s world.
In order to enable hardware-root-of-trust, we have to ensure that an SoC is
trustworthy by ensuring security of computation, communication as well as storage.
While the existing efforts have shown promising results in providing computation
and storage related security solutions [91], there is limited effort in ensuring on-
chip communication security. The ubiquity of devices using NoC-based SoCs has
made NoC a focal point for security attacks as well as countermeasures [27–33].
Therefore, in order to secure the cyberspace, it is vital to protect the NoC from
potential security threats as well as leverage the advantages given by NoC to
minimize security vulnerabilities of other system components.
A fundamental problem of NoC-based SoCs is ensuring security while preserv-
ing non-functional requirements such as performance, power, and area. Due to the
resource constrained nature of embedded and IoT devices, it may not be possible
to implement traditional security measures such as encrypting communication with
the AES cipher and using SHA hash functions. Thus, it is evident that considering
security alone will not provide conclusive results. A more holistic approach is
required that considers security among other non-functional requirements.
This chapter is organized as follows. Section 1.2 provides an overview of NoC
architectures. Section 1.3 describes the NoC security landscape. Finally, Sect. 1.4
concludes the chapter.
6 P. Mishra and S. Charles

1.2 Overview of Network-on-Chip (NoC) Architectures

Consider a designer who is responsible for designing the road network of a large
city. Roads should be laid out giving easy access to all the offices, schools, houses,
parks, etc. If all of the most common places are situated close to each other, it
is inevitable that the roads in that area will get congested and other areas will
be relatively empty. The designer should make sure that such instances do not
occur and the traffic is uniformly distributed as much as possible. Alternatively,
the roads should have more lanes and parking lots in such congested areas to cater
to the requirement. In addition to accessibility and traffic distribution, the architect
should also consider intersections, traffic lights, priority lanes, and potential detours
due to occasional road maintenance. Moreover, self-driving cars and drones that
deliver various items might come into picture in the future as well. Analogous to
this, the designer of an SoC faces a similar set of challenges when designing the
communication infrastructure connecting all the cores.
The early SoCs employed bus and crossbar based architectures. Traditional bus
architecture has dedicated point-to-point connections, with one wire dedicated to
each component. When the number of cores in an SoC is low, buses are cost
effective and simple to implement. Buses have been successfully implemented
in many complex architectures. ARM’s AMBA (Advanced Micro-controller Bus
Architecture) bus [8] and IBM’s CoreConnect [65] are two popular examples.
Figure 1.3 shows an overview of the ARM AMBA bus architecture [8]. Buses
do not classify activities depending on their characteristics. For example, the
general classification as transaction, transport, and physical layer behavior are not
distinguished by buses. This is one of the main reasons why they cannot adapt
to changes in architecture or make use of advances in silicon process technology.
Due to increasing SoC complexity coupled with increasing number of cores, buses
often become the performance bottleneck in complex SoCs. This coupled with other
drawbacks, such as non-scalability, increased power consumption, non-reusability,
variable wire delay, and increased verification cost, motivated researchers to search
for alternative solutions.
The inspiration for network-on-chip (NoC) came from traditional networking
solutions, more specifically, the Internet. The NoC, a miniature version of the wide
area network with routers, packets, and links, was proposed as the solution for on-

Fig. 1.3 Overview of the ARM AMBA bus architecture

1 Introduction to Network-on-Chip Security 7

chip communication [12, 40]. The new paradigm described a way of communicating
between IPs including features such as routing protocols, flow control, switching,
arbitration, and buffering. With increased scalability, resource reuse, improved
performance, and reduced costs, NoC became the solution for the complex SoCs
that required a scalable interconnection architecture. The remainder of this section
covers various aspects of NoC architectures.

1.2.1 Network-on-Chip Architecture and Communication

Protocol

Figure 1.4 shows an example NoC interconnection architecture consisting of

several processing elements connected together via routers and regular sized wires
(links). A processing element can be any component such as a microprocessor, an
ASIC (application specific integrated circuit), or an intellectual property block that
performs a dedicated task as shown in Fig. 1.1. We refer these processing elements
as IPs. IPs are connected to the routers via a network interface (NI). We call the
combination of an IP, an NI and a router as a “node” in the NoC. It can be observed
that words node and “tile” are used interchangeably in existing literature to refer to
NoC components connected to one router [119, 129].
NoC interconnection architecture uses a packet-based communication approach.
A request or response that goes to a cache or to off-chip memory is divided into
packets, and subsequently to “flits”, and injected to the network. A flit is the smallest
unit of flow control in an NoC. A packet may consist of one or more flits. For
example, assume S is a processor IP, whereas node D is connected to an off-chip
memory interface (memory controller). When a load instruction is executed at S,
it first checks the private cache located in the same node and if it is a cache miss,
the required data has to be fetched from the memory. Therefore, a memory fetch
request message is created and sent on the appropriate virtual network to the NI.
The network interface then converts it into network packets according to the packet
format, divides each packet into flits, and sends the flits into the network via the

Fig. 1.4 Example of an NoC connecting 16 IPs

8 P. Mishra and S. Charles

Fig. 1.5 NoC control (memory request) and data (response data) packet formats used in the gem5
simulator. (a) Memory request packet. (b) Response data packet from memory

local router. The network is then responsible to route the flits to the destination,
D. Flits are routed either along the same path or different paths depending on the
routing protocol. The NI at D creates the packet from the received flits and forwards
the request to D, which then initiates the memory fetch request. The response
message from the memory that contains the data block follows a similar process.
Similarly, all IPs integrated in the SoC leverage the resources provided by the NoC
to communicate with each other. Figure 1.5 shows the format of a memory request
packet and a response data packet used in the gem5 architectural simulator [15].
Previous works have proposed several NoC architectures such as Nostrum [76],
SOCBUS [130], Proteo [117], Xpipes [39], Æthereal [57], etc. based on different
requirements. The choice of the parameters in the architecture depends on the
design requirements such as performance/power/area budgets, reliability, quality-
of-service guarantees, scalability, and implementation cost. Some of the existing
NoC architectures have been surveyed in literature [2, 17]. NoC architecture design
needs to consider two important factors—network topology and routing protocol.
The next two subsections describe these aspects in detail.

1.2.1.1 Network Topology

The topology defines the physical organization of IPs, routers, and links of an
interconnect. The organization in Fig. 1.4 shows a mesh topology. Crossbar, point-
to-point, tree, 3-D mesh are few other commonly used topologies. Figure 1.6
shows some examples of them. The topology is chosen depending on the cost
and performance requirements of an SoC. The topology directly impacts the
communication latency when two IPs are communicating, since it affects the
number of links and routers a flit has to traverse through to reach a given destination.
A major trade-off when deciding the topology for a given requirement is between
connectivity and cost. Higher connectivity (e.g., point-to-point) allows increased
performance, but has higher area and power overhead. The 2-D mesh is the most
common topology in NoC designs [119, 129]. Each link in a mesh has the same
length leading to ease of design, and the area occupied by the mesh grows linearly
with the number of nodes.
1 Introduction to Network-on-Chip Security 9

Fig. 1.6 NoC topologies and an example of X-Y routing in a mesh NoC

1.2.1.2 Router and Routing Protocol

The routers comprise input buffers that accept packets from the local IP via the NI
or from other routers connected to it. For example, in the mesh topology, except
for the routers in the border, each router is connected to the local IP and four other
routers. Based on the addresses in the packet header and the routing protocol, the
crossbar switch routes data from the input buffers to the appropriate output port.
Buffers are allocated for virtual channels which helps avoid deadlock. The switch
allocator handles input port arbitration for output ports [37].
The routing protocol defines the path a flit should take in a given topology.
Routing protocols can be broadly classified as deterministic and adaptive. In
deterministic routing, each packet traversing from S to D follows the same path. X-
Y routing is one common example of deterministic routing. In X-Y routing, packets
use X-directional links first, before using Y-directional links [42]. An example
including three paths taken by X-Y routing in a mesh NoC is shown in Fig. 1.6.
Adaptive routing takes network states such as congestion, security, and reliability
into account, and sends the flits through different paths based on the current state of
the network [136].

1.2.2 Emerging NoC Technologies

When NoC was first introduced, the focus was on electrical (copper) wires con-
necting NoC components together, referred to as “electrical NoC.” However, recent
advancements have demanded exploration of alternatives. With the advancement
of manufacturing technologies, the computational power of IPs have increased
significantly. As a result, the communication between SoC components have
become the bottleneck. Irrespective of the architectural optimizations, electrical
NoC exhibits inherent limitations due to the physical characteristics of electrical
wires [97].
10 P. Mishra and S. Charles

• The resistance of wires, and as a result, the resistance of NoC, is increasing

significantly under combined effects of enhanced grain boundary scattering,
surface scattering, and the presence of a highly resistive diffusion barrier
layer [122, 123].
• Electrical NoC can contribute to a significant portion of the on-chip capacitance.
In some cases, about 70% of the total capacitance [93].
• The electrical NoC is a major source of power dissipation due to the above two
factors.
Therefore, it is becoming increasingly difficult for electrical NoC to keep up
with the delay, power, bandwidth, reliability, and delay uncertainty requirements
of state-of-the-art SoC architectures [34, 121]. These challenges can only intensify
in future giga and tera-scale architectures. In fact, the International Technology
Roadmap for Semiconductors (ITRS) has mentioned optical and wireless based on-
chip interconnect innovation to be key to addressing these challenges [109].
There are various emerging NoC technologies such as “wireless NoC” [43]
and “optical NoC” [96]. While the focus of this book is on security attacks and
countermeasures in electrical NoCs, a majority of these security solutions are also
applicable for wireless and optical NoCs. This is primarily due to the fact that they
have inherent similarities in terms of network topology and routing protocols. For
example, both electrical and optical NoCs represent similar topologies using wired
connectivity. Similarly, wireless NoC always use one-hop routing, while optical
and electrical NoCs utilize one-hop or multi-hop communication depending on
the source and destination. Figure 1.7 shows an overview of how different NoC
technologies can be used to connect heterogeneous SoC components.

1.2.2.1 Wireless NoC

Wireless NoC was proposed as a solution to the latency experienced by electrical

NoCs, which are based on metal interconnects and multi-hop communication.
Wireless NoC integrates on-chip antennas and suitable transceivers that enable
communication between two IPs without a wired medium. Silicon integrated

Fig. 1.7 NoC enables communication between IPs. The network interface (NI), router (R), and
links can be implemented using optical, wireless, or electrical communication technologies
1 Introduction to Network-on-Chip Security 11

antennas communicating using the millimeter wave range is shown to be a viable

technology for on-chip communication [43].

1.2.2.2 Optical NoC

On the other hand, optical NoC, also known as photonic NoC, uses photo emitters,
optical wave guides, and transceivers for communication [135]. The major advan-
tage over electrical NoC is that it is possible to physically intersect light beams
with minimal crosstalk. This enables simplified routing and together with other
properties, optical NoC can achieve bandwidths in the range of Gbps.

1.3 Security Landscape in NoC-Based System-on-Chip

The widespread adaptation of NoCs has made it a focal point for security attacks as
well as countermeasures. There is a growing interest in the industry to use the NoC
to secure the SoC as evident from NoC-Lock [120] and FlexNoC resilience package
[7]. On the other hand, the NoC itself can be a threat when different IP blocks
come from different vendors. A compromised NoC IP can corrupt data, degrade
performance, or even steal sensitive information. NoC security is crucial for three
related reasons: (1) NoC has access to all system data, (2) NoC spans across the
entire SoC, and (3) NoC elements are repetitive in a way that any modification
can be easily replicated. In the following subsections, we discuss how SoCs can
become vulnerable to security threats (Sect. 1.3.1), why securing NoC-based SoCs
has become a hard problem (Sect. 1.3.2) and different threat models in existing
literature related to NoC security (Sect. 1.3.3).

1.3.1 Security Vulnerabilities in SoCs

SoC complexity and tight time-to-market deadlines have shifted the in-house SoC
manufacturing process to a global supply chain. SoC manufacturers outsource parts
of the manufacturing process to third-party IP vendors. This globally distributed
mechanism of design, validation, and fabrication of IPs can lead to security
vulnerabilities. Adversaries have the ability to implant malicious hardware/software
components in the IPs. Existing literature has discussed three forms of vulnera-
bilities: (1) malicious implants, (2) backdoor using test/debug interfaces, and (3)
unintentional vulnerabilities [47]. An adversary can utilize the malicious implants
(hardware Trojans) to cause malfunction or facilitate information leakage [91]. An
adversary can also exploit legitimate test and debug interfaces as a backdoor for
information leakage [118]. Many security vulnerabilities can be created uninten-
tionally by design automation/computer-aided design (CAD) tools or by designers’
12 P. Mishra and S. Charles

mistakes [131]. These vulnerabilities can lead to untrusted (potentially malicious)

IPs.
Attacks based on malicious implants, such as hardware Trojans, rely on Trojans
being integrated in the SoC without being detected at the post-silicon verification
stage or during runtime [91]. Hardware Trojans can be inserted into the design
in several places such as by an untrusted CAD tool or designer or at the foundry
via reverse engineering [13]. Even if all the IPs are tested before integration,
hardware Trojans can still go undetected because of the complexity of designs
with billions of transistors which make physical inspection or 100% coverage in
design verification/validation a costly or even impossible target [124]. Furthermore,
Trojans can mask their behavior as transient errors and can be activated only when a
specific condition or a combination of conditions are satisfied [14]. A smart attacker
can carefully craft the Trojan activation method so that it becomes difficult to
detect. Previous work has discussed external/internal Trojan activation modes [124],
software-hardware coalition [10], and triggers based on time, input sequence, traffic
pattern, and even thermal conditions [14].
The usage of third-party NoC IPs has grown rapidly over the years. Due to
the widespread use of NoC IPs, outsourcing NoC IP fabrication has become a
common practise. iSuppli, an independent market research firm, has concluded from
their research that the FlexNoC on-chip interconnection architecture [7] is used by
four out of the top five Chinese fabless semiconductor OEM (original equipment
manufacturer) companies [116]. This has led to Arteris, the company that developed
FlexNoC, achieve a sales growth of 1002% over a 3 year time period through IP
licensing [9]. Therefore, there is ample opportunity for adversaries to attack the
SoC through malicious implants in NoC IPs. Furthermore, due to the complexity of
the design, NoC IPs are ideal candidates to insert hardware Trojans [101].

1.3.2 Unique Challenges in Securing NoC-Based SoCs

The general problem of securing the interconnect has been well studied in the com-
puter networks domain and other related areas [24, 72, 134]. However, implementa-
tion of security features introduces area, power, and performance overhead. While
complex security countermeasures are practical in computer networks domain, the
resource constrained nature of embedded and IoT devices pose additional unique
challenges as outlined below.

1.3.2.1 Conflicting Requirements

While enabling communication between IPs, NoCs need to satisfy a wide variety
of requirements including security, privacy, energy efficiency, domain-specific
requirements, and real-time constraints. While security is the primary focus of
this book, we cannot ignore other NoC design constraints. Designers employ
1 Introduction to Network-on-Chip Security 13

a wide variety of techniques to improve energy efficiency in NoC-based SoCs

[5, 25, 26, 59, 62, 126]. It is difficult to satisfy conflicting requirements such as
security and energy efficiency. For example, it may not be possible to implement
traditional security measures such as encrypting text with the AES cipher and
using SHA hash functions in resource-constrained IoT devices. Similarly, security
and domain-specific requirements may not be compatible. For example, in an
automotive network, when a potential security breach is detected, pausing all
systems to check the malfunction is not an option since the car is moving, and
stopping it abruptly can lead to catastrophic consequences. Thus, there is a need
for innovative solutions to secure NoCs with lightweight security mechanisms
customized for application domains.

1.3.2.2 Increased Complexity

The complexity of SoC designs have made exhaustive security validation an

impossible task. Most IPs come as black boxes from vendors that do not reveal
design details in order to maintain the competitive advantage in a niche market.
As a result, the complete design is not visible to verification engineers. Modern
verification tools often try to detect missing or erroneous functionality, whereas
security vulnerabilities can be hidden in dormant functions in large and complex
designs that get triggered only by a specific set of inputs as discussed in Sect. 1.3.1.
Therefore, it is not feasible to capture all security vulnerabilities using security
validation tools during design time [3, 46, 47, 49, 86, 87, 91, 94].

1.3.2.3 Diverse Technologies

While electrical communication is widely used in designing NoC-based SoCs,

emerging NoCs can also support chip-scale photonics (optical NoC) as well as
wireless communication (wireless NoC) as shown in Fig. 1.7. Security solutions for
NoCs thus need to not only address security over electrical wires but also consider
the emerging challenges from data transfers over photonic waveguides and wireless
channels. While broadcast may be preferred for wireless NoCs, optical and electrical
NoCs need to consider a wide variety of network topologies as well.

1.3.3 Threat Models

The intention of a hardware Trojan can vary from design to design. Commonly
discussed threats include information leakage, denial-of-service, and data corrup-
tion. A recent occurrence of a hardware Trojan (spying on data) raised concerns
across top US companies and authorities including Apple, Amazon and CIA [18].
14 P. Mishra and S. Charles

Fig. 1.8 Five classes of security attacks discussed in existing literature

Fig. 1.9 An example of eavesdropping attack

In this section, we provide an overview of five classes of attacks on NoC-based SoCs

(Fig. 1.8).
These classes of attacks have been well studied in the computer networks domain
and other related areas. However, implementation of security features introduces
area, power, and performance overhead. To address this issue, we need lightweight
security countermeasures that can provide the desired security with tolerable impact
on area, power, and performance. In the remainder of this section, we provide an
overview of attacks explored in NoC-based SoCs.

1.3.3.1 Eavesdropping Attacks

Eavesdropping attack, also known as snooping/sniffing, refers to an attacker pas-

sively listening to on-chip communication in an attempt to steal sensitive infor-
mation as shown in Fig. 1.9. The intention of the attacker is to leak information
over long time periods without being detected. Recent occurrences of hardware
security breaches where hard-to-detect hardware components, that were not a part
of the original design, integrated into the original design leaking information have
attracted more attention to eavesdropping attacks [18].
As discussed in Chap. 1.1, IPs integrated on the same SoC use the NoC to
communicate between each other using message passing as well as shared memory.
Therefore, eavesdropping on the NoC allows an attacker to extract secret informa-
tion without relying on memory access (either through on-chip cache or off-chip
memory) or hacking into individual IPs. Bus-based communication (e.g., broadcast
in wireless NoCs) is inherently vulnerable to eavesdropping attacks. Existing
literature on NoC security has explored several variations of the eavesdropping
attack.
1 Introduction to Network-on-Chip Security 15

One commonly explored threat model is where the malicious NoC IP colludes
with an accompanying malicious application running on another IP to launch an
eavesdropping attack. It includes a Trojan infected router copying packets passing
through it and sending the duplicated packets to another IP running a malicious
application in an attempt to steal confidential information. This threat model has
been extensively used to study eavesdropping attacks specially since the attack is
hard to detect [10, 21, 64, 70, 114]. Trojans can also directly eavesdrop on the NoC
communication without relying on re-routing duplicated packets to an accomplice
application. This can be facilitated by external I/O pins attached to the NoC [55].
However, NoCs are generally more resistant against bus-probing attacks compared
to the traditional bus-based architectures.
Similar to the malicious router and application colluding to launch the attack, a
Trojan infected network interface and an application can work together to launch
an eavesdropping attack [101]. In the threat model presented in [101], the hardware
Trojan embedded in the NI can tamper with the flits in the circular flit queue, which
is used to store flits before sending them to the corresponding router. When a flit is
sent to the router, it waits in the queue until the next flit overwrites it. The Trojan
keeps track of such outstanding flits, modifies the header flit with a new destination
address, and updates the header pointer so that it gets re-sent to the router. The
duplicated flits are received by the malicious application. The area overhead of the
Trojan is shown to be 1.3% [101].
Common countermeasures against eavesdropping attacks include packet encryp-
tion, authentication, additional validation checks during NoC traversal and infor-
mation obfuscation. Encryption ensures that the plaintext of the secure information
is not leaked and authentication detects any tampering with the packet including
header information. Several prior studies have tried to develop lightweight encryp-
tion and authentication schemes for on-chip data communication. Ancajas et al. [10]
proposed a simple XoR cipher together with a packet certification technique that
calculates a tag and validates at the receiver. A configurable packet validation
and authentication scheme was proposed by merging two robust error detection
schemes, namely algebraic manipulation detection and cyclic redundancy check,
in [21]. Intel’s TinyCrypt—a cryptographic library with a small footprint is built
for constrained IoT devices [125]. It provides basic functionality to build a secure
system with very little overhead. It gives SHA-256 hash functions, message authen-
tication, a pseudo-random number generator which can run using minimal memory,
digital signatures, and encryption. It also has the basic cryptographic building
blocks such as entropy sources, key exchange, and the ability to create nonces and
challenges. The duplicated packets in router-application combination as well as NI-
application combination can be detected by additional validation checks. In [101],
the authors implemented a snooping invalidator module (SIM) at the NI output
queue to discard duplicate packets. On the other hand, information obfuscation can
make the attack harder to initiate. For example, hiding the source and destination
information of NoC packets can ensure that the malicious agents in the NoC are
unable to select the target application to eavesdrop. Onion routing, a well-known
mechanism in the computer networks domain, can hide the origin and target of a
16 P. Mishra and S. Charles

network packet [56]. However, implementing such complex security mechanisms is

not feasible in resource-constrained SoCs. Several previous studies tried to propose
lightweight solutions that are compatible with the NoC context [10, 27].

1.3.3.2 Spoofing and Data Integrity Attacks

SoC relies on the integrity of data communicated through the NoC for correct
execution of tasks. If a malicious agent corrupts data intentionally, it can lead to
erroneous execution of programs as well as system failures. On the other hand,
spoofing is the act of disguising a communication from an unknown source as being
from a known (trusted) source. Therefore, a malicious agent pretending to be a
trusted source can inject new packets to the network causing system to malfunction
as shown in Fig. 1.10. Spoofing can be used to bypass memory access protection
by impersonating a core that has permission to read from (or write in) prohibited
regions to steal sensitive information or disrupt execution. Spoofing may also be
leveraged to respond to legitimate requests with wrong information to cause system
failure. Spoofing can be achieved by an attacker replacing the source address of a
packet by an address of a trusted IP.
Spoofing and data integrity attacks intentionally corrupt data transferred on the
NoC to cause malfunction. Sepúlveda et al. presented “MalNoC,” a Trojan infected
NoC that can perform multiple attacks on NoC packets [114]. The infected MalNoC
router copies packets arriving at a router, replaces the packet data with the content
in a malicious register, modifies source and/or destination address in the header to
the desired IP, and injects it back into the NoC. A control register within the router
controls the Trojan operation. A similar threat model that discussed eavesdropping,
DoS, and illegal packet forwarding, all of which utilized packet corruption at a
router was presented in Sect. [64]. Kumar et al. [70] discussed a Trojan that corrupts
flits arriving at the input buffers of a router.
Trojans can also be inserted in links to corrupt NoC packets. To avoid being
detected, the Trojans change only the header flits causing deadlock, livelock, and
packet loss situations [132]. Even if hardware Trojans are not present, bit flipping
can happen when packets are transferred through the links due to other reasons.

Fig. 1.10 An example of data integrity attack

1 Introduction to Network-on-Chip Security 17

Error correction codes are used to correct such bit flips. The Trojan in the link
attempts to mask its malicious behavior as an error rather than a security attack
to avoid being detected. The authors have explored the impact of Trojans embedded
in different links (boundary links versus center links) in a 5 × 5 Mesh NoC [132].
Authenticated encryption schemes provide data confidentiality through encryp-
tion and data integrity through authentication [71, 108, 114]. If the authentication
tag is calculated using the entire packet (header as well as payload), any packet
corruption can be detected at the receiver’s side when the packet is validated using
authentication. Hussain et al. [64] argued that since the Trojan is rarely activated
to avoid detection, authenticating each packet can lead to reduction in energy
efficiency. In their work, they proposed an efficient Trojan detection design where
the authentication gets activated only when the hardware Trojan has been triggered
in the system. A combination of security modules placed at the IPs as well as at the
routers provided attack detection as well as Trojan localization capabilities [64].
Error correcting codes (ECC) are widely used in the telecommunications
domain [63]. ECCs have been used in NoCs to correct bit errors due to particle
strikes, crosstalk, and spurious voltage fluctuation in NoCs. Yu et al. introduced a
method to detect Trojan induced errors using ECCs in [132]. Their method consisted
of two main components. (1) Link reshuffling: to avoid the Trojan from affecting
the same bit in an attempt to create deadlocks/livelocks, the odd and even bits are
switched in the retransmitted flit in case of an error detected by the ECC. This is
effective for scenarios where the Trojan is triggered by specific flits. If the Trojan
gets activated by a certain input, reshuffling the bits during the retransmission can
make the Trojan inactive again. (2) Link isolation: an algorithm to isolate links that
are suspected to have Trojans. Trojans that are triggered by external signals can
remain active for a long time. In such cases, wire isolation is used to reduce the
number of retransmissions.

1.3.3.3 Denial-of-Service Attacks

Denial-of-service (DoS) in a network is an attack that prevents legitimate users

from accessing services and information. The most common example is an attacker
flooding a network with information as shown in Fig. 1.11. When a user is trying
to access a website, the request is sent to that web server to view the page. The
server has a certain bandwidth and can only serve a limited number of requests at a
time. If the attacker overloads the server with requests, it will not be able to process
the user’s legitimate request. This is “denial-of-service.” In the context of an NoC,
several threat models have been explored. In general, DoS in NoC-based SoCs are
attacks that overwhelm the network resources in an attempt to cause performance
degradation, real-time guarantee violations, and reduction of battery lifetime.
Several threat models related to DoS attacks have been studied in prior work. One
common threat model is where malicious IPs manipulate the availability of on-chip
resources by flooding the NoC with packets. The performance of an SoC can heavily
depend on few components. For example, a memory intensive application is likely
18 P. Mishra and S. Charles

Fig. 1.11 An example of denial-of-service attack

to send many requests to memory controllers, and as a result, routers connected to

them will experience heavy traffic. If a malicious IP targets the same node, the SoC
performance will suffer significant degradation [28, 29, 52, 99]. This is known as a
flooding-type DoS attack.
Continuous corruption of packets can also lead to a DoS attack [53, 70].
In [70], hardware Trojans tamper flits arriving at the input buffer of a router
causing performance degradation. Performance degradation is caused by dropped
packets, wastage of NoC resources such as buffer space, response delays, and
retransmissions. Boraten et al. [20] discussed a similar threat model where hardware
Trojans influenced resource allocations and corrupted data to degrade performance.
The same authors further explored possible DoS attacks in [22]. Compared to
router-based packet corruption, they discussed a Trojan that performs deep packet
inspection on links and inject faults when the target is identified. The injected faults
trigger retransmissions from the error correcting mechanism. Therefore, repeated
injection of faults causes repeated retransmission to starve network resources and
create deadlocks capable of rendering single application to full chip failures.
Rajesh et al. [100] discussed a threat model where the packets are unfairly treated
at the router to cause a DoS attack. The malicious NoC IP, once integrated on the
SoC, picks a victim IP that is an important SoC component and manipulates the
traffic flow to/from the victim IP. The traffic flow is manipulated by denying fair
access to the allocator and arbiter units in the router. The allocator is responsible
for granting flits access to the crossbar. DoS is achieved by the allocator delaying
packets to/from the victim IP. At the arbiter, the Trojan infected router gives least
priority to the flits that have the victim IP as the source/destination. Both these
scenarios lead to flits to/from one IP getting significantly delayed.
To address these different threat models, researchers proposed several solutions.
As a countermeasure to denial-of-service through packet corruption, Kumar et al.
proposed a bit shuffling method that makes flits less sensitive to the attack [70].
The authors proposed to shuffle the critical bit fields of the flits among themselves
and others so that the Trojan is attacking on randomly shuffled data and not on the
critical fields within the packets such as flit indication bits, source and destination
1 Introduction to Network-on-Chip Security 19

addresses. While fuzzing can make the attack difficult, it does not guarantee
prevention. Furthermore, the attack is not detected, and as a result, future attacks
are not prevented either. Boraten et al.’s work was motivated by this, where they
coupled switch-to-switch scrambling, inverting, shuffling, and flit reordering with a
heuristic-based fault detection model [22]. Their solution addresses the challenge
of differentiating fault injections from transient and permanent faults. Another
technique that exhibits similar defense characteristics as fuzzing—partitioning,
tries to reduce interference of communication between different applications/packet
types. As a result, overwhelming the NoC with DoS attacks becomes difficult [128].
Monitoring the traffic flow to detect abnormalities is another common defense
against DoS attacks. Rajesh et al. [100] proposed a defense against their traffic
flow manipulation threat model that is based on identifying the latency elongation
of packets caused by the DoS attack. Their method relied on injecting additional
packets to the network and observing their latencies. SoC firmware then examines
the latencies of the injected packets. If two packets are injected at the same time
and traverse paths with significant overlap, they are expected to exhibit comparable
latencies. If not, it will be flagged as a potential threat. Similar methods that
profiled normal behavior of traffic during design time and monitored NoC traffic
to detect deviations from normal behavior were proposed in [16, 52]. Exploring
another orthogonal direction, work in [20, 53, 99, 110] proposed additional formal
verification and runtime checks integrated in to the NoC to prevent and detect DoS
attacks.

1.3.3.4 Buffer Overflow and Memory Extraction Attacks

The goal of a buffer overflow attack is to alter the function of a privileged program
so that the attacker can gain access and execute his own code. A program with high
privileges (root programs) typically becomes the target of buffer overflow attacks.
To accomplish this, the adversary has to insert malicious code and make the program
execute it. “Code injection” is the first step to accomplish this where the malicious
code is inserted into the privileged program’s address space. This can be achieved by
providing a string as input to the program which will be stored in the program buffer.
The string will contain some root level instructions which the adversary wants the
program to execute [38]. Then, the adversary creates an overflow in the program
buffer to alter states of the program. For example, it can alter a return address
of a function so that the program will jump to that location and start executing
the malicious code [79]. This can be accomplished when buffers have weak or no
bound checking. Buffer overflow attacks can also be used to read privileged memory
locations from the address space. In an NoC context, the threat gets aggravated due
to memory spaces being shared between multiple cores.
Similar to the buffer overflow attacks in the computer networks domain, execu-
tion of malicious code can launch a buffer overflow attack in NoC-based SoCs. If
a malicious IP writes on the stack and modifies the return address of a function to
point at the malicious code, the malicious code will be executed. Return address
20 P. Mishra and S. Charles

modification in the stack is done by writing more data to a buffer located on the
stack than what is actually allocated for that buffer. This is known as “smashing the
stack” [77]. Even if the stack memory is made non-executable, or kept separate, it
is possible to overwrite both the return address as well as the saved registers. Work
done in [79] explored this threat model. Buffer overflow attacks pose a significant
threat in NoC-based SoCs where the memory is shared among multiple cores.
Kapoor et al. in their work considered some IPs on the SoC to contain
confidential information (secure/trusted IP cores) and some untrusted IPs which
can potentially carry hardware Trojans (non-secure/untrusted IP cores) [71]. The
information inside secure IP cores should be protected from non-secure IP cores.
Since all IPs are integrated on the same NoC, non-secure cores can communicate
with secure cores. Non-secure cores can try to install Trojans in the secure cores and
try to extract information. The confidential information in registers in the secure
cores such as cryptographic keys, configuration register information, and other
secure data can be compromised in such an attack [71]. This threat model of non-
secure IP cores trying to access secure IP cores has been used in several other work
as well [44, 51, 52, 106, 108].
Lukovic et al. proposed two methods to counter buffer overflow attacks. The first
method focused on protecting the processing cores by embedding additional security
in the network interface (NI) [79]. In their work, a data protection unit, which is
similar to a firewall sits on the NI attached to the shared memory block. It secures
the memory by filtering unauthorized memory access requests. A stack protection
unit (SPU) is developed which protects the stack from attacks that targets the
return addresses. The SPU is developed as a part of the processor protection system
which combines software and hardware units that replicate return addresses stored
in the stack and protects it against code injection attacks. These countermeasures
also stopped the attack from getting propagated to other parts of the NoC. Their
second method extends the solutions proposed in [79] to a hierarchical security
architecture [80]. The authors introduced four levels of security working at system
level, NoC cluster level, per core, and in a layer specific to the attack (e.g., code
injection). Similar to software protection mechanisms and the data protection unit
in [79], many existing works provide access control by monitoring the incoming
requests [51, 52, 106]. For example, Saeed et al. introduced a method to mitigate
buffer overflow attacks in an NoC-based shared memory architecture by deploying
an ID and address verification unit (IAV) [106]. This minimizes the threats caused
by malicious IPs in the NoC because the IAV verifies each incoming packet by its
ID and address.
Adding an extra layer of security to access authorization, commercial products
such as Sonic SMART Interconnect [120] and ARM TrustZone [6] divide memory
blocks into different protection regions and isolate secure and normal execution
environments from each other. If the non-secure cores access secure cores, requests
are validated by access authorization techniques [71, 108]. It is possible that security
zones have to be modified due to task migration, new applications starting and
ending. Therefore, security zones have to be created, modified and eliminated
during runtime. Sepúlveda et al. [111] achieved this by using a partitioning method
Random documents with unrelated
content Scribd suggests to you:
has been done with my prisoner that I brought in last night, or, rather,
this morning?"
"I put him in a safe place," returned the outlaw. "The poor devil was
nearly dead this morning. You put him with his head down hill, and I
really believe that another hour would have finished him."
"'Twouldn't be a very great pity," muttered Poynter, his mouth full of
meat, "after I have got out of him what I want to know. And that
makes me think—where's Jack?"
"Off on a hunt, I believe; a gang of turkeys passed down the creek
this morning, and he's after them. But why?"
"Nothing; only from a hint that he dropped last night about one
Meagreson—"
"What! Meagreson, did you say?" excitedly exclaimed the outlaw,
bending forward, clutching Poynter with his long, bony fingers by the
arm, until the young man winced with pain.
"Thunder! yes, but I ain't made of wood, nor steel either. Do you
want to take off my arm?"
"Pardon, Poynter; but that name made me forget myself. Where did
you hear of him?"
"From Sprowl; he told Polk Redlaw a long yarn yesterday that I
overheard, and enough in it to show me that my secret foe was this
Meagreson, or John Dement, as he called himself here."
"Tell me all, just as he said it. I have good reasons for wanting to
hear it," added the outlaw, impressively.
Poynter gave a hasty outline, and to his great surprise Crees bowed
his head to the earth, his strong form working and writhing as if in
mortal agony. But when he would have stopped, a hoarsely-
whispered "Go on" from the old man was his only answer.
"And now you know as much as I do," added Clay, arising. "But
come, show me where you put Sprowl, and I will see if he can tell me
any thing more."
Crees arose without a word, and passed a short distance up the
hillside, pressing through some bushes until he stood at the foot of a
good-sized tree, in a tiny glade. To the trunk of this, and in an upright
position, was bound the form of the wretched Sprowl.
Poynter started back in half-alarm at the fearful change a few hours
had made in the man's appearance. Dreadfully haggard and sickly
looking, with his eyes protruding, his tongue lolling from his parched
jaws, the drops of cold sweat rolling over his face, Sprowl looked as
if about to give up the ghost in earnest.
"My God! he's dying," cried Poynter, as he sprung forward and
severed the cords that bound the poor devil, laying him down upon
the ground.
"Give me your flask; mine's empty," as he turned to Crees, who
silently handed it to him, while his eyes were fixed intently upon the
wretch's face.
A few swallows were poured down Sprowl's throat, and thus bathing
his face and neck with the pungent liquor, Poynter soon uttered a
glad cry. In truth, the patient appeared to be recovering, and in a few
minutes the light of reason once more shone in his eyes.
"I know that man," slowly ejaculated Crees, not once removing his
gaze, that appeared to attract the other's attention much the same
as the fascination exercised by the rattlesnake.
"My God! who are you?" almost yelled the wretch, as he suddenly
sat up, staring at Crees, wildly.
"Who should know better than you, Wesley Sprowl?" sternly said the
outlaw.
"I know you now. You are—"
"Hold!" commanded Crees, "that name is dead now. If you as much
as whisper it before I tell you, by all that's holy I'll treat you as I would
a snake! Do you understand?"
"Yes, sir," faltered Sprowl, once more sinking back.
"Here," interrupted Poynter, checking this by-play, that not a little
excited his curiosity. "Here, Sprowl, take another sup of brandy. I
want you to answer me some questions, and you'll need your
strength before we're through."
"Yes—yes—the brandy!" eagerly muttered the prisoner, clutching at
the bottle, and not drawing breath until it was emptied. "There! now I
can talk; only I am hungry," he added, wistfully.
"Well, I will get you something, for I am going to treat you a deuced
sight better than you deserve, after your lies about me."
"They were lies, all of them; but I will confess—yes, I will confess!"
"Just stick to that, old fellow, and my word for it, you'll never have
cause to repent doing so," cheerily replied Poynter. "Now, Mr. Crees,
if you'll just stay here to keep our friend company, like, I'll go get
something for him to eat."
"Gladly; for I, too, have something to ask Mr. Sprowl," returned the
outlaw. "And, if you will, please give a whistle when you come back;
won't you?"
"Certainly, if you wish it."
"I do. But don't be offended," he added, appealingly. "I will explain it
all to you soon. And any thing else that may appear strange, that you
wish to know. Will that do?"
"Finely," cordially replied Poynter, pressing his strange friend's hand,
and then dashing down the hillside to the encampment-fires.
He cut some venison steaks, and soon had them broiling merrily,
after which he prepared hot water for coffee, and stirred up a "hoe-
cake," standing it upon a strip of elm-bark to bake before the glowing
embers. Evidently he meant to keep his word to Sprowl, of treating
that worthy better than he deserved.
When his cookery was completed, Poynter gave the desired signal,
and when he reached the tree found that the outlaw was sitting in the
same spot, while Sprowl had bowed his head between his hands,
evidently deeply moved by some emotion, either of fear or remorse.
But the young man quelled the curiosity he felt, for he knew that
Crees' word might be trusted, and that ere long all would be
explained.
"Well, old fellow, here you are," cheerily cried Poynter, as he placed
the food and drink before Sprowl, with not a trace of rancor in his
tones. "And do you see how fast you can demolish them, while I do a
little talking. But mind you, don't answer before you've weighed well
what you say, as you may have to swear to it. Do you hear?"
"Yes, sir, I do hear, and so help me God, I'll tell the honest truth if it
hangs me!" solemnly exclaimed the prisoner. "You treat me and talk
to me like a gentleman, while I have treated you and yours worse
than a dog. I shall say nothing but the truth, and if it must be, will
swear to it before any court."
"Now I begin to know you again," cried Clay, gladly; "and I tell you
that, guilty as you have been, unless you have helped commit one
deed—"
"Your father, you mean?" interrupted Sprowl.
"Yes."
"As God hears me, I never raised a hand or a finger against his life. I
falsely swore against his honor, I do not deny, but of any thing
further, I am innocent."
"Well, go on and eat. I will tell you my terms, although I frankly tell
you that were it not for your wife and helpless family, I would
demand, not request. Now, however, we will let that pass.
"First, I wish you to tell me the plot against my father; who concocted
it, and who were the prominent actors in it. Also their reasons for so
doing, so far as you are aware of them.
"Then what you know of myself; who it was that has hunted me from
'pillar to post,' to use your own language? Also what you know about
one Meagreson, alias John Dement, his character, crimes, and, in
short, every thing.
"I warn you, however, that I am not to be deceived; that I know far
more than you have any idea of, so that any attempt of that kind will
only injure yourself. Do you fully comprehend me?" queried Poynter.
Sprowl answered by a double nod; his mouth being crammed so full
of the juicy deer-steak, that speech was impossible.
"Very well. Now, I will tell you further. If you make a clean breast of it,
however guilty you may have been, with that one exception, I will let
you go free, and in addition give you such a start that, if you
endeavor to do so, you can live an honest, comfortable life.
"I will pay for your farm, will build you a house and stock them both,
so that you can have no further excuse for going to the bad. But
mark me—this is not on your account; it is for your patient, long-
suffering wife, and the deeds will be given in her name. Now, what
do you say to the bargain?"
"Well, sir, what can I say," muttered Sprowl, brokenly, "but that while I
have acted like a dog, you treat me as a white man? Perhaps 'twould
be a better job if you put me beyond the way of doing any more
harm; I do think so. I have always been a cursed, cowardly fool, and
if at times I would try—and God knows that I have tried for Mary's
sake and the children's—to break off, here would come a temptation,
and down I'd go, worse than ever," gloomily replied the prisoner.
"Well," heartily responded Poynter, "better times are coming now,
and if you will only help yourself, others will lend a hand. Cheer up,
old fellow, and hold your head up like an honest man; there's a heap
of good left in you yet, or you'd never talk as you do now."
"If I ever do get on my feet again, it is to you and him that I must give
thanks, after God," solemnly uttered Sprowl. "But where shall I
begin?"
"Tell me first about my father; why and how it was that you acted
against him as you did."
And then Wesley Sprowl repeated the tale he had briefly outlined to
Polk Redlaw, giving every detail in full; but enough has been said to
enlighten the reader. It was a terrible tale of revenge and injustice, in
which an innocent man was made the victim of a villain's plottings,
aided by such unscrupulous coadjutors as Sprowl and Jonathan
Green.
As the sad incidents of his parent's sorrow and ruin were detailed,
Clay Poynter (as we must still call him) bowed his head and wept
bitter tears of grief and anguish. Had he glanced toward his
companion, he would have seen that "White Crees," the outlaw
leader, had bowed his stalwart form, and it shook as if with mortal
agony.
"About your being driven from Arkansas," said Sprowl, "I know
nothing save that this same man followed you in his hatred for your
father; that he had sworn you, too, should die a felon's death. But
you fled from him, and it was years before he found you here.
"He saw me, also, and knowing that I was poor, tempted me to aid
him, as I had done once before. For weeks before he made his
appearance openly, he was undermining your reputation, by covert
hints and innuendoes, that only too easily found holding-ground in
the troubled state of the country; and this was increased by your
reticence regarding your affairs and previous life.
"I helped him in this, as did Green, Wigan, Redlaw, Dalton and
Gibson. Then you were arrested. Sam Gibson and Frank Dalton
were bribed to conceal the dies and counterfeit coin in your house,
then to swear to the finding it.
"Jonathan Green was bought over, as I was, to swear as we did. For
fear one charge should fail, he arranged that of the murder of John
Dement, by which name he had made the acquaintance of Neil
McGuire, as they both were fellow Masons.
"He made himself popular in the neighborhood by his friendly
manner and the freedom with which he spent his money. He wished
the excitement to be great and deadly when you were charged with
his death.
"He gave me the diamond cluster-pin that was so well known and
told me what to swear. I was poor; he threatened to denounce me as
one of the gang unless I performed his bidding, and I consented. It
was hard, though, although you may not believe me.
"You had acted the generous friend to me and mine; had furnished
food, clothing and medicine, when I was sick and unable to work; all
this you did, and yet I would have sworn away your life!" and for a
few moments he remained silent.
"Had it not been for the firmness of Neil McGuire our plans would
have been fully carried out, and that next morning's sun would have
shone upon your corpse, as we fully expected. But then you
escaped; how, I never learned.
"Meagreson was in Leavenworth awaiting the message that I had
promised to send or bring him, of your death, but instead it was that
you were once more a free man. Still he thought and hoped that you
would be taken, and had set the police of the city on the alert for you
in case you should go there; but it was useless.
"He was fully disguised, as he had been while here, for as he is now
over fifty years of age, his hair is naturally almost snow-white. But he
wore his years well, and he was not suspected for other than he
seemed.
"You know how I attempted to fire your house—it was that mongrel
cur, Polk Redlaw, that tempted me; and that I was captured in the
endeavor, I now sincerely thank God! It is one crime the less upon
my soul; and He knows that there are enough there already,"
concluded Sprowl, in a broken tone, as he bowed his head, while the
hot, scalding tears trickled freely adown his wrinkled cheeks.
There was no affectation about this, as his hearers were fully
convinced. He was really moved at the kind and honorable manner
in which he had been treated by those whom he had wronged so
deeply and terribly.
They knew that it was sincere repentance, and that from then,
henceforth, if his life was spared, he would be a different man. The
truer depths of his nature were touched; the crust of wickedness was
broken, never again to heal over.
"And this Meagreson—do you know nothing of his future plans?" at
length asked Poynter, looking up.
"Unless he should hear from me, he was to meet me at the 'Twin
Points' Friday night."
"Then you think he will come?"
"I have no doubt of it," was the assured reply. "He will be too anxious
to learn the latest news not to come."
"Good! he will probably meet visitors he does not expect," cried
Crees.
"That he will! Unless he fails, we will have him at our own terms, and
then—"
"And then!" echoed the outlaw.
 CHAPTER XI.
FYFFE SOUNDS HIS NOTE.
"Hark!"
It was Poynter who made the exclamation, abruptly checking the
outlaw's words. The three men slightly bowed their heads, as if
listening intently, while their eyes sought each other's faces. The
sound came again.
It was the loud exclamation of a man—such as one would make in
driving a refractory yoke of oxen. And yet it could scarcely be that,
for the ground surrounding, whence the alarm proceeded, was rough
and broken, difficult even for a man to traverse upon foot.
"What is it?" whispered Crees.
"'S-sh! Listen."
"Dod-rot y'ur ongainly copperossyty, kain't you walk chalk? Gee, that
—gee, you 'tarnal critter! Dod burn ef I don't rouse you up wi' a
saplin'. G'long, now, you creepin' snake!"
A tirade of such adjurations, followed by what sounded like the crack
of a whip, and then a strange sort of muffled howl. Such were the
noises that aroused the curiosity of the trio, in the little glade.
"Scratch dirt, now, you'd better. 'Tain't much furder, or durned ef I
b'lieve we'd git thar to-day, the way you does creep. Wuss'n any
jackass I ever see'd! Git up an' git, now, less I'll go ahead an' snipe
you 'long arter me. How'd thet suit, eh, ole stick-in-the-mud? Shoot
at an honest feller ag'in, w'u'd ye? Guess ye won't, no more. Hoop-
la!" and then came several more cracks, accompanied by groans
and half-choked howls.
"It's Jack," whispered Crees. "Wonder what he's up to?"
"Look!"
As Poynter uttered this exclamation, the bushes parted, and a
miserable-looking object broke out into full view. It was a man, but so
tattered and begrimed that little else could be guessed. Whether
white, black or red, a stranger or an acquaintance, could only be
surmised.
His arms were tightly drawn back and secured at the elbows, while a
slack withe ran from ankle to ankle. His draggled and matted hair
overhung his face, but was not long enough to entirely conceal the
existence of a strange freak upon his captor's part. He was bitted!
A good-sized stick was secured between his jaws, about two feet in
length. To either end of this a supple vine of grape was attached, so
that a jerk, right or left, by the driver, would effectually turn the
prisoner, if not quite throw him down.
Holding fast to the opposite ends was the grinning Jack Fyffe, who
bore a long, supple hickory rod, with which he occasionally "touched
up" the captive. Upon his back were two rifles.
"Good Lord, Jack!" cried Poynter, in amazement, at this truly unique
"turnout," "what under the sun do you mean treating the poor devil
that way? Who is he, anyhow?"
"Hellow, square, you thar?" returned the rough borderer, appearing
not a whit abashed, giving his captive the twitch necessary to turn
his head up the hill, and then adroitly applying the whip, that made
him spring nimbly forward. "How air you, anyhow, this mornin'?
Kinder fotched along a fri'nd to call on you, sorter permiscuous, like.
Git up, thar, you critter; step lively, now, an' show the gen'lemen y'ur
paces. Hy—ah!"
"For mercy's sake, Jack, let the poor devil loose!"
"Not ef I knows it," retorted Fyffe, coolly; "I hed too much trouble a-
gearin' him up, fer thet. An' marcy—the skunk don't know what thet
means. He didn't hev no marcy onto you nor the ole man, nor
likewise on me, when he tried to shoot me, a little back yon'."
"Who is it?" queried Crees.
"Why, don't you know? It's Jim Meagreson, John Dement, or Snakey,
as I call him," declared Fyffe, exultantly.
Poynter stared in amazement, but not so the outlaw leader. With a
half-stifled howl of rage and vindictive joy, he drew his knife and
leaped forward. Jack Fyffe thought he meant murder, and caught
him by the arm.
"Dang it, boss, he's bad enough; but don't butcher him in thet way!"
"Stand off!" yelled Crees, throwing the other violently from him.
"Stand off, I say. I am not mad. He is of more use to me living than
dead, you fool!"
"All right, then," returned Fyffe, rubbing his shoulder dolefully. "I
know thet, but was kinder afeard thet you'd fergit when y'ur mad was
up. Thar he is; I turn him over to you fellers, an' dog-goned glad to
git shet on him, I am, the onmannerly cuss!"
"'Tis him, Poynter; look!" and Crees held back the captive's head so
as to more fully expose the wretch's features.
"It is, indeed," gladly exclaimed Clay, as he beheld the man whom he
had been falsely accused of murdering. "And an hour since I would
have given ten years of my life if this could have been assured me."
"Wal, square, thar he is, 'thout any o' thet. You're welcome to my
shar'."
"But how'd you chance upon him, Jack?"
"Thet's a long yarn—too long fer a feller to spin what hain't had no
breakfast," added Fyffe.
"True; I forgot. Go get something and then come up. We may need
you;" and then, as the borderer hastened down the hill, the young
man turned to the captive.
He was in a truly pitiable condition; but those who beheld him had
been far too deeply injured by him to indulge in any such feeling.
True, they gave him brandy and bathed his head, but it was only to
restore him so that they could gain his confession.
He soon revived and stared around at the two men, Sprowl having
taken a position out of sight behind the tree, where he had not yet
been seen by Meagreson. The men eyed him in silence, but he only
vouchsafed them a look of angry defiance.
"Well, James Meagreson," at length said the outlaw leader, "we meet
once again!"
"My name is not Meagreson, and I don't know you—never set eyes
on you before," sullenly responded the captive.
"Do you know me, then?" put in Poynter.
"Know you? Yes; for a vile horse-thief and counterfeiter!"
"Do you mean to say—" began Crees, when he was interrupted by
the other.
"I mean to say that I am plain John Dement, an honest trader, and
that you shall dearly rue this outrage."
"Bah! that's played out. You may as well own up now, for your
accomplice and tool has betrayed you; has exposed all your plots
and crimes. If you are obstinate, we will just hand you over to the
vigilance committee, whose aid you are so fond of invoking, and let
them deal with you."
"Am I a fool?" sneered Meagreson. "Don't I know that you dare no
more show your face to one of them than to kiss a rattlesnake? The
only answer you'd get would be a hempen cord and swinging
bough!"
"Now that's nonsense, old man," put in Sprowl. "You're the fool.
They've got you in a corner, and you may as well come down. Green
and the rest of the boys have owned up, and unless you make terms
as we did, it'll be all night with you."
"Who's that?" faltered the prisoner, a gray shade settling upon his
florid features.
"Sprowl," replied that worthy. "I've told all I know and am going to
swear to it, if you are obstinate; and, as you very well know, it's
enough to hang you a dozen times over."
"The others—"
"I tell you they've 'peached, and you're a spotted man, if these
gentlemen are only a mind to press the matter," glibly said Sprowl.
A deep groan was his only answer, as Meagreson fell forward, his
form trembling like a leaf.
"Let him be, Poynter," said Crees, "and when he thinks it all over,
he'll see that it's of no use holding out further. Here comes Fyffe."
"Hellow, what you fellers bin a-doin' to my hoss?" cried that worthy,
as he leisurely strolled up the hill, wiping his greasy mouth upon his
shirt-sleeve, and smacking his lips. "Make a bully quarter-hoss, he
would, ef he was a leetle better trained. Stumbles an' kicks over the
traces now, kinder; but he'll do."
"Never mind now, Jack," interrupted Poynter. "He's thinking."
"Yas; needs it, I reckon. While y'ur hand's in, jest think a leetle how
all-fired nigh you come to killin' a feller-critter-man. Sp'ilt my ha'r,
anyhow," at the same time tugging at the shaggy lock that grew
beside his ear, trying to bring it before his eyes. "See thar."
It did indeed look as though a bullet had cut a jagged passage
through it, as he had hinted. Then Poynter seated himself beneath
the tree, motioning Jack to do the same, saying:
"There's nothing else just now, Fyffe; sit down and tell us how you
chanced upon this fellow, and all about it."
"Don't care 'f I do, square," quoth Jack, gnawing off a huge mouthful
of "niggerhead," and then passing the plug to Sprowl. "Don't chaw,
b'lieve?"
"No."
"I do. Wal, I allus war fond o' tellin' stories. Mam, she used to dress
my trowsers with her ol' slipper purty nigh the hull time, 'cause of this
habit o' mine; but, Lord, thet didn't do no good. Only driv' it back
ag'in, like. But dad, he was a yarner, now I tell you! I kain't hold a
kendle to him when he'd got a good streak on. Jest about half-
cocked, an' then stan' from under! He'd allus got a bigger one back,
too, ef anybody'd top his'n, fer a cap-sheaf. I tuck arter him, I consait,
though the ol' coon 'd offen say 'at he's 'shamed of me, 'cause I
couldn't lie better; but thet's nyther hyar nor thar.
"When I 'gun winkin' this daylight airly, I got up an' begun sorter
swoopin' 'round fer grub. But blamed the bit could I find, 'cept some
wenzun, an' I swore I'd hev none o' thet. Fact is, my appertite is
sorter delacut, like, an' won't b'ar plain grub, like you bigger fellers.
"So, as I went down to the crick fer a drink, I see'd lots o' gre't big
turkey-tracks in the mud, toes a-p'intin' downarts; an' so I jest
shoulders shooter an' shakes moccasin sorter lively, 'cause I'd made
up my mind to hev a gobbler fer breakfust, an' nothin' shorter. Ef I
says a thing, even ef it be jest to myself, sorter, it's gwine to be did,
ef so be it kin.
"But I trailed them dratted birds so fur thet I'd e'ena'most gi'n up all
hups o' drappin' one, an' hed 'bout made up my mind thet wenzun
was a heap better, enyhow, when I sot blinkers on as fine a strutter
as ever gobbled to a hen. Up goes my gun, slip goes my fut, an'
down I rolls inter the crick, while the dratted bird flops off through the
bushes, tail on eend, like a quarter-hoss wi' a jimson burr fer a
crupper.
"Didn't I cuss some, sorter, as I got out? Mebbe not; 'tany rate, off I
put ag'in arter thet turkey, fer I swore I'd hev it ef it tuck all day. No
'tarnal two-legged bird sh'u'd fool me like thet, not by no manner o'
means, ef I knowed myself, an' I rayther thunk I did. So on I
splurges, lickety-split.
"But I stopped ag'in, mighty sudden, though 'twa'n't a turkey I see'd.
It was a man kinder strollin' along, fer his health, I reckon, an' he
pulled up too. Thar we stud, a-gawpin' at each other like looneys,
when he spluttered out sunkthin' thet kinder smelled o' brimstone,
and then took to his heels like the devil was arter him.
"An' ef he wasn't, I was, 'cause I never yet see'd a feller thet run
'thout takin' arter 'im jest like blazes. It's a kinder 'farmity like, I
reckon; anyhow it's a fact. Wal, he put an I put, jest a-scratchin' dirt
an' a-kickin' up the leaves the beatinest kind you ever did hyar tell
on.
"I'm purty hefty on the run, as ye know, but blamed ef he wasn't
mighty nigh my master. But I'd never say die tell the bellers clean
bu'sted, an' at last he jumped for kiver, a-swingin' his shooter mighty
keerless like. I did ditto, an' thar we war. I sorter grinned, 'cause it
'minded me of ol' times when ha'r went wild.
"But then I peeked out, mighty keerful like, 'cause I didn't want
another hole in my brush-patch overly much, when I hope I may
never see the back o' my neck, ef thar he wasn't a-streakin' it
through the woods, his coat tails a-streamin' out wuss'n the tag eend
to a comet. Lord, wasn't I gritty then? Mebbe not!
"I jest set my grinders like a clamp, pulled the slouch furder on my
head an' then set ol' toad-smashers to work. The ground jest fa'rly
smoked about me, I run so fast, and I overhauled ol' smarty like fun.
He pecked 'round an' see'd it, then whirled 'round to'rds me, yellin'
out he'd shoot fer shore.
"But my Ebenezer was up like a mice, an' I kept on, wild fer bitin' an'
gougin'. The dratted imp did shoot shore enough, but it jest clipped
my ha'r a leetle, an' then I downed him. I was mad at the feller's
impedence in burnin' powder when I was jest in fun, all the time, an'
drawed my knife to finish up the job.
"I had her raised all ready, when I caught his eye, an' helt my han'. I
knowed him in a minute, though he'd changed a heap sence we met
last. I knowed how tickled the ol' man 'uld be, ef he see'd him, 'cause
he kinder 'lowed he kicked the bucket long ago.
"But thar he was, an' I 'tarmined to fotch him inter camp. So I started,
but the bugger tried to run onc't or twic't, an' so I thought I'd see how
he'd work in a single gear. He cut up rusty a leetle, an' n'arly nipped
off my thumb, the onmannerly brute; but when I once got him fa'rly
bitted he done purty well, barrin' the kickin' an' stumblin'," concluded
Fyffe, with a long-drawn yawn.
"It'll turn out the best day's work you ever done, Fyffe," said Crees,
extending his hand.
"And I will not forget it very soon, either, old fellow," warmly added
Poynter.
"Wal, ef so be you fellers is satisfied, I'm shore I be," grunted Jack,
lying back upon the grass.
"But what do you think I'd best do next, Mr. Crees?" asked Poynter,
after a slight pause, a little anxiously. "I think, with Sprowl's evidence,
here, I need not hesitate about showing myself openly once more."
"You have a good deal to work against down there, yet, and I think
you'd best wait a little, and see what we can get out of our friend,
yonder," responded Crees, thoughtfully.
"Well, I suppose I must, though it's hard to be lying idle when such
charges are hanging over me," sighed Poynter.
 CHAPTER XII.
POYNTER FINDS SOMETHING.
It was in the afternoon of the same day which Fyffe had so
signalized by his turkey-hunt. The prisoner, James Meagreson, was
occupying the same position in which Sprowl had done penance
some hours before. He had been left here by his captors to ponder
upon his situation and reflect as to which should be his future
course, whether to persist in his denials or acknowledge defeat and
submit to his triumphant enemies with such grace as he could
muster.
That his meditations were far from being the most pleasant
imaginable, one glance at his sullen, stern features would evidence,
and there was a fiery, vindictive glow in his small black eyes that
boded ill for Poynter's hopes—a look that had proclaimed a
determination to "die game," and to hold them in defiance while
breath lasted. Only at intervals a softening tinge would appear, as if
his heart failed him, or a desire to remedy the wrongs that he had
committed, so far as lay in his power, had assailed his mind.
But these moments were few and far-between, and then, as if the
tightly-drawn cords began to pain him yet more intensely, the scowl
deepened, and he gritted his teeth in the excess of his fury. The
moment had passed, and the deadly hate now raged without alloy.
In the mean time the three friends were gathered together, smoking
or conversing idly, or buried deep in thought. Presently Jack Fyffe lay
back, dropped his pipe, and then his stertorous breathing announced
that he was in a deep, sound slumber.
The remainder of the band had either long since done the same, or
went off upon business of their own; the scouts sent out having
reported that all was quiet among the vigilantes, those worthies
having disbanded and returned to their daily occupations, no doubt
highly edified by their midnight wild-goose chase.
Save the regular sentinels, none appeared to be upon the alert
excepting Poynter and Crees. The latter was covertly but intently
regarding his younger companion with a strange, far-away look in his
deep black eyes, while an unconscious sigh would now and then
heave up from his massive chest, as if engendered by some painful
memory of bygone days.
Poynter suddenly aroused himself, and glancing hastily around,
uttered:
"Why, where's Sprowl?"
"Yonder," returned Crees, pointing to the ragged form of the man
inquired after, lying under a bush, sleeping. "Poor devil, his last night
was a hard one."
"True, but he had no one to thank for it save himself. However, I
have some hopes of him yet. He is not all bad, and for the sake of
his family I am willing to lend him a helping hand. His wife, poor
thing, has seen hard times of late years. The entire support of the
family, and of this shiftless, lazy brute into the bargain, has fallen
upon her. And she is a perfect lady, too, for all she's uneducated. It's
strange what choices women will make sometimes!" exclaimed
Poynter.
The outlaw leader only grunted, "Just so."
"But that isn't what I wanted to talk to you about just now. You have
several times promised to tell me your story, and why not fulfill it
now? 'Tis as well as to wait longer."
"You are right, and I will do so; although I had intended to wait until
after Meagreson had acknowledged his guilt. But what Sprowl has
said is enough," slowly replied Crees, passing a hand across his
brow, as if to chase away some painful reflection.
"But I have not heard him mention your name!" cried Poynter, in
surprise.
"Yes, you have heard him tell my whole story, or nearly so. Henry
Duaber, my son, have you no greeting for your father?"
"Son—father!" faltered the young man, gazing in bewilderment upon
the outlaw leader, at this strange appeal.
"Your father, Henry," continued the elder man, in a choked tone; "can
you not believe me?"
"But my father was—is dead!"
"No, not dead—only in name; he escaped with life. I am your father.
By your dead mother—by my sainted wife, boy, I swear it!" solemnly
said Crees.
"Is it—can it be true? I will believe it—father!" brokenly exclaimed the
young man, bending forward to meet the proffered embrace.
It was a holy scene, this strange meeting of long-parted kindred; and
their tears were mingled together, tears such as strong men need not
be ashamed to shed. They were deeply affected, as well they might
be, and when the first gush of emotion had passed, they sat beside
each other, hand clasped in hand, gazing kindly and affectionately at
each other.
"It is strange—passing strange!" at length uttered Henry, (as we
must now call him, Clay Poynter no longer). "More like a romance
than any thing in real everyday life. I have mourned you as dead
since my childhood, and now find you my kindest friend, while I still
thought you a stranger. How long since you first recognized me?"
"Not until to-day, although your story awoke strange fancies, it was
so like mine; but I, too, thought you were dead. I had heard so, and
saw what purported to be your grave."
"My grave!"
"Yes. They told me you had died at nearly the same time with your
mother. Why, I know not. It could not have been from malice, for they
knew me not. I was a stranger in my native home."
"But you—how were we deceived, and why did you not tell us of
your escape, and our dear one might still have been alive?"
"Listen, and I will tell you all," replied James Duaber, in broken tones.
"It is a sad, sad story of cruel wrong and sorrow; but I was the victim
—I and mine! You know the first, or sufficiently well as to render a
résumé unnecessary. But it was James Meagreson—the wretch
yonder—who caused it all for revenge, because your mother chose
me in preference to him.
"A man named Frank Soutar was confined in the same apartment
with me, upon a charge identical with the one for which I was to
suffer; but as he acknowledged to me, deeming me of the same
gang, he was guilty. The mob knew nothing of his having been
changed to my cell, as it had only been done that same day; and
when they broke open the doors in the dead of night, he was seized
for me in the confusion and darkness, while I hid beneath the pallet.
"And the error was never discovered by the mob; they hung him,
thinking they were doing as they had been bribed by Meagreson,
who took that way to insure my death, fearing lest I should eventually
escape his revenge, if he left the law to decide. He was hung, but I
took advantage of the open door to flee, and during the excitement,
managed to effect my escape unmolested.
"A staunch friend of mine, Jack Fyffe, yonder—who was also under
the ban, and in hiding, managed to secure his two horses, and upon
them we rapidly fled the country. He had joined the mob with the
hope of assisting me to escape, and he alone discovered the error,
in time to return and assist me.
"We rode hard all that night, and lay hid at day, for we feared that the
error would be discovered in the morning, at least, and then the
hounds would be hot upon our trail. We traveled in this way until out
of the State, and far into the wilds of Arkansas. But even then we did
not feel secure, and thought it best to lie concealed until the storm
had blown over.
"Still, I wrote, and managed to post two letters to my wife, telling of
my safety, and that I would soon return to remove her and you to our
new refuge. Besides this, I counted upon her knowing of my escape,
else I would have dared all to have seen her.
Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade

Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.

Let us accompany you on the journey of exploring knowledge and

personal growth!

textbookfull.com