Sofiane Takarabt, K. Chibani, A. Facon, S. Guilley, Y. Mathieu, L. Sauvage, Youssef Souissi
{"title":"Pre-silicon Embedded System Evaluation as New EDA Tool for Security Verification","authors":"Sofiane Takarabt, K. Chibani, A. Facon, S. Guilley, Y. Mathieu, L. Sauvage, Youssef Souissi","doi":"10.1109/IVSW.2018.8494881","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494881","url":null,"abstract":"The security evaluation of embedded systems becomes clear and mandatory. Up today, the evaluation process is limited to certification labs that conduct the analysis on real target devices. This requires appropriate measurement platforms and equipment in addition to real chip analysis skills. In this paper, we put forward a pre-silicon evaluation methodology and tools that allow the security verification at an early stage (virtual target) and running it hands in hands with the functional verification. As of today, such approach can be used as new Electronic Design Automation (EDA) tool to properly satisfy the basics of Design for Security (DFS) concept. From a practical viewpoint, we show a study case to illustrate and provide a better understanding of that approach. Moreover, we propose new evaluation metrics based on Signal to Noise Ratio (SNR) computation, and verified on virtual and real targets respectively based on a comparative study. Likewise, the tool identifies vulnerabilites (thereby anticipating complete families of otherwise numerous, complex and many undiscovered attacks), and returns accurate feedack to the user on the precise line of code (LoC) where the vulnerability lays along with its characterization, including an identification of its severity. This allows the design to input source code to the tool, and to get back in return annotated source code with a collection of LoCs which deserve careful analysis and/or subsequent modification aiming at patching vulnerabilities.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"102 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115288578","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Thao Le, Lucas Weaver, J. Di, Shaojie Zhang, Yier Jin
{"title":"Hardware Trojan Detection and Functionality Determination for Soft IPs","authors":"Thao Le, Lucas Weaver, J. Di, Shaojie Zhang, Yier Jin","doi":"10.1109/IVSW.2018.8494891","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494891","url":null,"abstract":"Due to the increasing complexity of hardware designs, third-party hardware Intellectual Property (IP) cores are often incorporated to alleviate the burden on hardware designers. However, the prevalent use of third-party IPs has raised security concerns such as hardware Trojans. These Trojans inserted in the soft IPs are very difficult to detect through functional testing and no single detection methodology has been able to completely address this issue. Based on a Register- Transfer Level (RTL) soft IP analysis method named Structural Checking, this paper presents a hardware Trojan detection methodology and tool by detailing the implementation of a Golden Reference Library for matching an unknown IP to a functionally similar Golden Reference. The matching result is quantified in percentages so that two different IPs with similar functions have a higher percentage match. A match of the unknown IP to a whitelist IP advances it to be identified with a known functionality, while a match to a blacklist IP causes it to be detected as Trojan-infested.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123332656","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mosabbah Mushir Ahmed, D. Hély, E. Perret, N. Barbot, R. Siragusa, M. Bernier, F. Garet
{"title":"Authentication of Microcontroller Board Using Non-Invasive EM Emission Technique","authors":"Mosabbah Mushir Ahmed, D. Hély, E. Perret, N. Barbot, R. Siragusa, M. Bernier, F. Garet","doi":"10.1109/IVSW.2018.8494883","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494883","url":null,"abstract":"Counterfeiting of integrated circuits (IC) has become a serious concern for electronics manufacturers, system integrators, and end users. It is necessary to find a robust solution which is both efficient and low cost in terms of implementation in order to detect and avoid the counterfeiting of ICs. To combat the counterfeiting of ICs in this paper we have extended our previous work on utilizing radiated EM emission for authentication of IC on microcontroller boards. Our proposed scheme exploits manufacturing based process variation (PV), which continues to dominate in the nanoscale technologies. We have focused our work on authentication of microcontrollers which are one of the main targets of counterfeiting. The proposed work emphasizes on being non-intrusive and does not require any internal modification of the system on chip, it can be used on already deployed ICs. Generated EM response is treated to different encoding metrics to quantize it as a fingerprint for the IC. To validate our proposed scheme, measurements are carried out over several microcontroller boards.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"79 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114872275","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Alessandro Barenghi, L. Breveglieri, Niccolò Izzo, Gerardo Pelosi
{"title":"Software-only Reverse Engineering of Physical DRAM Mappings for Rowhammer Attacks","authors":"Alessandro Barenghi, L. Breveglieri, Niccolò Izzo, Gerardo Pelosi","doi":"10.1109/IVSW.2018.8494868","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494868","url":null,"abstract":"In recent years, the ability to induce bit-flips in DRAM cells via software-only driven charge depletion has been successfully exploited to gain unauthorized privileged access to the functional resources on fixed and mobile computational platforms. The first crucial step in executing these attacks, collectively known as rowhammer attacks, concerns gaining the knowledge of how virtual memory addresses are mapped onto the geometric addresses of the physical DRAM module(s). We propose a methodology to reverse engineer such maps without direct physical probing of the DRAM bus of the target platform. We validate the correctness of the inferred maps against some publicly available data about modern Intel CPUs maps and show that they depend on the number of installed memory modules.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"395 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133938282","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Z. Kazemi, Athanasios Papadimitriou, D. Hély, M. Fazeli, V. Beroulle
{"title":"Hardware Security Evaluation Platform for MCU-Based Connected Devices: Application to Healthcare IoT","authors":"Z. Kazemi, Athanasios Papadimitriou, D. Hély, M. Fazeli, V. Beroulle","doi":"10.1109/IVSW.2018.8494843","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494843","url":null,"abstract":"Hardware security-based threats are often ignored or poorly considered by embedded system developers who focus on their system's functional specifications. Most embedded systems utilize software-based security mechanisms such as right management or cryptography, nevertheless they can be easily defeated by hardware attacks if no specific care is given during the development of the software. Consequently, it is necessary to provide software developers with efficient tools to assist in designing robust embedded systems against hardware security threats. In this work, we focus on medical embedded systems including a microcontroller unit (MCU) running the main application. We firstly show that the software running on the MCU is vulnerable against hardware attacks; then, we present an evaluation platform dedicated to MCU-based design to evaluate and secure software early in the design phase. We finally present preliminary results obtained with this platform, considering the side channel resilience of modern MCUs.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127715286","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Keynotes: Towards Self-Explaining Digital Systems: A Design Methodology for the Next Generation","authors":"R. Drechsler","doi":"10.1109/IVSW.2018.8494895","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494895","url":null,"abstract":"As digital systems get ever more complex, their behaviour may at times appear unfathomable. Users will only be prepared to accept this if they are convinced that the system does indeed work correctly. Thus, we argue the need for self-explaining systems: systems that are able to explain their behaviour, and the reasons for it. In this paper, we propose first steps towards a design methodology for such systems, and argue that beyond user acceptance, selfexplanation also has other applications such as self-verification and reconfiguration. We propose a conceptual framework for self-explaining systems, discuss how to achieve completeness, and consider implementation aspects.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130131222","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Machine Learning Attacks Resistant Two Stage Physical Unclonable Functions Design","authors":"Haibo Su, Mark Zwolinski, Basel Halak","doi":"10.1109/IVSW.2018.8494839","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494839","url":null,"abstract":"Physical Unclonable Functions (PUFs) have been designed for many security applications such as identification, authentication of devices and key generation, especially for lightweight electronics. Traditional approaches to enhancing security, such as hash functions, may be expensive and resource dependent. However, modelling attacks using machine learning (ML) show the vulnerability of most PUFs. In this paper, a combination of a 32-bit current mirror and 16-bit arbiter PUFs in 65nm CMOS technology is proposed to improve resilience against modelling attacks. Both PUFs are vulnerable to machine learning attacks and we reduce the output prediction rate from 99.2% and 98.8% individually, to 60%.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116530336","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mir Tanjidur Rahman, Qihang Shi, Shahin Tajik, Haoting Shen, D. Woodard, M. Tehranipoor, N. Asadizanjani
{"title":"Physical Inspection & Attacks: New Frontier in Hardware Security","authors":"Mir Tanjidur Rahman, Qihang Shi, Shahin Tajik, Haoting Shen, D. Woodard, M. Tehranipoor, N. Asadizanjani","doi":"10.1109/IVSW.2018.8494856","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494856","url":null,"abstract":"Due to globalization, the semiconductor industry is becoming more susceptible to trust and security issues. Hardware Trojans, i.e., malicious modification to integrated circuits (ICs), can violate the root of trust when the devices are fabricated in untrusted facilities. Literature shows as the microscopy and failure analysis tools excel in the resolution and capability, physical inspection methods like reverse engineering and photonic emission become attractive in helping verify such trust issues. On the contrary, such physical inspection methods are opening new capabilities for an adversary to extract sensitive information like secret keys, memory content or intellectual property (IP) from the chip compromising confidentiality and integrity. Different countermeasures have been proposed, however, there are still many unanswered questions. In this paper, we discuss physical inspection/attack methods using failure analysis tools and analyze the existing countermeasures and security/trust issues related to them. Next, we will introduce challenges related to the development of new countermeasures and trust verification. Finally, we present research roadmap for this emerging field.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125255518","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A. Facon, S. Guilley, Matthieu Lec'Hvien, Alexander Schaub, Youssef Souissi
{"title":"Detecting Cache-Timing Vulnerabilities in Post-Quantum Cryptography Algorithms","authors":"A. Facon, S. Guilley, Matthieu Lec'Hvien, Alexander Schaub, Youssef Souissi","doi":"10.1109/IVSW.2018.8494855","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494855","url":null,"abstract":"When implemented on real systems, cryptographic algorithms are vulnerable to attacks observing their execution behavior, such as cache-timing attacks. Designing protected implementations must be done with knowledge and validation tools as early as possible in the development cycle. In this article we propose a methodology to assess the robustness of the candidates for the NIST post-quantum standardization project to cache-timing attacks. To this end we have developed a dedicated vulnerability research tool. It performs a static analysis with tainting propagation of sensitive variables across the source code and detects leakage patterns. We use it to assess the security of the NIST post-quantum cryptography project submissions. Our results show that more than 80% of the analyzed implementations have at least one potential flaw, and three submissions total more than 1000 reported flaws each. Finally, this comprehensive study of the competitors security allows us to identify the most frequent weaknesses amongst candidates and how they might be fixed.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126097339","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards Self-Explaining Digital Systems: A Design Methodology for the Next Generation","authors":"R. Drechsler, Christoph Lüth, G. Fey, T. Güneysu","doi":"10.1109/IVSW.2018.8494900","DOIUrl":"https://doi.org/10.1109/IVSW.2018.8494900","url":null,"abstract":"As digital systems get ever more complex, their behaviour may at times appear unfathomable. Users will only be prepared to accept this if they are convinced that the system does indeed work correctly. Thus, we argue the need for self-explaining systems: systems that are able to explain their behaviour, and the reasons for it. In this paper, we propose first steps towards a design methodology for such systems, and argue that beyond user acceptance, self-explanation also has other applications such as self-verification and reconfiguration. We propose a conceptual framework for self-explaining systems, discuss how to achieve completeness, and consider implementation aspects.","PeriodicalId":125301,"journal":{"name":"2018 IEEE 3rd International Verification and Security Workshop (IVSW)","volume":"181 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124536083","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}