Amin Rezaei, A. Hedayatipour, H. Sayadi, Mehrdad Aliasgari, H. Zhou
{"title":"Global Attack and Remedy on IC-Specific Logic Encryption","authors":"Amin Rezaei, A. Hedayatipour, H. Sayadi, Mehrdad Aliasgari, H. Zhou","doi":"10.1109/HOST54066.2022.9840128","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840128","url":null,"abstract":"In recent years, semiconductor industry has out-sourced the manufacturing to low-cost but not necessarily trusted foundries. This fabless business model encounters new security challenges, including piracy and overproduction. A well-studied solution to prevent unauthorized products from functioning is logic encryption, where a chip is encrypted using a key only known to the designer. However, the majority of the logic encryption solutions are vulnerable due to key uniformity and probing attacks. In this paper, we first present GSAT, a Global attack on existing IC-specific logic encryption schemes using the SAT model, that effectively deciphers the hidden global key pluggable to all the encrypted ICs. Next, we propose a highly secure and low-cost remedy called SPLEnD: Strong PUF -based Logic Encryption Design. Traditional I C-specific encryption schemes are vulnerable to GSAT attack, while SPLEnD not only effectively resists GSAT, but also balances security and efficiency.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133623784","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Systolic Acceleration of Polynomial Multiplication for KEM Saber and Binary Ring-LWE Post-Quantum Cryptography","authors":"Tianyou Bao, Pengzhou He, Jiafeng Xie","doi":"10.1109/HOST54066.2022.9839980","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9839980","url":null,"abstract":"Following the rapid progress in the post-quantum cryptography (PQC) field that many efforts have been gradually switched to the hardware implementation side, this paper presents a novel systolic accelerator for polynomial multiplication within two lattice-based PQC algorithms, key encapsulation mechanism (KEM) Saber and binary Ring-Learning-with-Errors (BRLWE)-based encryption scheme. Based on the observation that polynomial multiplication over ring is the key arithmetic operation for the two PQC schemes, we have proposed a novel systolic accelerator for the targeted polynomial multiplications (applicable to two PQC schemes). Mathematical formulation is given to illustrate the proposed algorithmic operation for both schemes. Then, the proposed systolic accelerator is presented. Finally, field-programmable gate array (FPGA) implementation results have been provided to confirm the efficiency of the proposed systolic accelerator under two schemes. The proposed accelerator is highly efficient, and the following work may focus on cryptoprocessor design and side-channel attacks.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"122 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134190404","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mohammad Ebrahimabadi, S. S. Mehjabin, R. Viera, S. Guilley, J. Danger, J. Dutertre, Naghmeh Karimi
{"title":"Detecting Laser Fault Injection Attacks via Time-to-Digital Converter Sensors","authors":"Mohammad Ebrahimabadi, S. S. Mehjabin, R. Viera, S. Guilley, J. Danger, J. Dutertre, Naghmeh Karimi","doi":"10.1109/HOST54066.2022.9840318","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840318","url":null,"abstract":"Fault Injection Attacks (FIA) have received a lot of attention in recent years. An adversary launches such an attack to abusively take control over the system or to leak sensitive data. Laser illumination has been considered as an effective technique to launch FIA. The laser-based FIAs are mainly used when the adversary opts to target a specific location in the target circuit. However, thanks to the miniaturization of transistors and moving towards smaller feature size, even small laser spots may illuminate more than one gate; making the attack more detectable when the circuitries are equipped with embedded fault detection mechanisms such as digital sensors. In this paper, we use time-to-digital convertors, aka digital sensors, to detect the laser shots. We show that by embedding these digital sensors in the target circuitry, the IR drop caused by the laser illumination can be sensed with a high accuracy. An alarm will be raised when the fault is detected. The simulation results show the high accuracy of the proposed scheme in detecting laser-based FIAs.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134219572","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Evaluating the Impact of Hardware Faults on Program Execution in a Microkernel Environment","authors":"Y. B. Bekele, D. Limbrick","doi":"10.1109/HOST54066.2022.9840063","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840063","url":null,"abstract":"Safety-critical systems require resiliency against both cyberattacks and environmental faults. Researches have shown that microkernels can isolate components and limit the capabilities of would-be attackers by confining the attack in the component that it is initiated in. This limits the propagation of faults to sensitive components in the system. Nonetheless, the isolation mechanism in microkernels is not fully investigated for its resiliency against hardware faults. This paper investigates whether microkernels provide protection against hardware faults and, if so, to what extent quantitatively. This work is part of an effort in establishing an overlap between security and reliability with the goal of maximizing both while minimizing their impact on performance. In this work, transient faults are emulated on the seL4 microkernel and Linux kernel using debugger-induced bit flips across random timestamps in benchmark applications. Results show differences in the frequency and final outcome of fault to error manifestation in the seL4 environment compared to the Linux environment, including a reduction in silent data corruptions.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133326542","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Insertion of random delay with context-aware dummy instructions generator in a RISC-V processor","authors":"Gaëtan Leplus, O. Savry, L. Bossuet","doi":"10.1109/HOST54066.2022.9840060","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840060","url":null,"abstract":"Embedded systems are vulnerable to side channel and fault injection attacks. These two types of attacks can be slightly complicated by using temporal desynchronization methods. In this article we propose a new hardware solution to efficiently insert dummy instructions in run time for a general-purpose processor. The main contribution of this solution is to contextualize these dummy instructions, making them less distinguishable and more variable with a minimal spatial overhead of 2.96% and a 4.27% additional consumption and no code size impact on a eV32E40P RISC V processor. As a result, they bring a significant resistance to resynchronization methods.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133934711","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Md Rafid Muttaki, Tao Zhang, M. Tehranipoor, Farimah Farahmandi
{"title":"FTC: A Universal Sensor for Fault Injection Attack Detection","authors":"Md Rafid Muttaki, Tao Zhang, M. Tehranipoor, Farimah Farahmandi","doi":"10.1109/HOST54066.2022.9840177","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840177","url":null,"abstract":"Over the past two decades, fault-injection methods have evolved into very effective attacks to cause integrity or con-fidentiality violations in integrated circuits or electronic systems. Fault-injection attacks (FIAs) can be carried out using clock-glitch, voltage glitch, laser, optical instruments, electromagnetic (EM) emanation, and more. One promising solution to detect FIAs is to use on-chip sensors to capture the attacks' effect. However, having different types and techniques of FIAs enforces using the custom-designed sensors for each type of attack, which is challenging and introduces a large overhead. To address this, in this paper, we propose to develop a universal Fault-to- Time Converter (FTC) sensor that can effectively detect all the above-mentioned FIAs while requiring minimal overhead. The FTC sensor converts the effect of faults injected by an FIA method into “time” that is measurable. Then, the “time” difference can be analyzed further to identify whether an attack has been carried out successfully. Our FTC sensor implementation in FPGA platforms demonstrates that the design can effectively differentiate various FIA attack scenarios with its encoded output. The FTC sensor can also be extended to cover other fault attacks that have a similar impact on the victim device (i.e., affecting circuit timing).","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123341616","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tsion Yimer, Edmund Smith, Paige Harvey, Marcial Tienteu, Kevin T. Kornegay
{"title":"Error Correction Attacks on BACnet MS/TP","authors":"Tsion Yimer, Edmund Smith, Paige Harvey, Marcial Tienteu, Kevin T. Kornegay","doi":"10.1109/HOST54066.2022.9840120","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840120","url":null,"abstract":"Industrial Control Systems (ICS) collect information from various sensors through routine processes, using the data collected to control the physical environments. However, from the industrial control perspective, the reliability in the communication between sensors and edge node devices is in question. This paper looks at the specific threats of physical layer attacks on BACnet systems and how an adversary can physically manipulate an MS/TP network to cause an error.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129158162","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Nafis Irtija, Eirini-Eleni Tsiropoulou, C. Minwalla, J. Plusquellic
{"title":"True Random Number Generation with the Shift-register Reconvergent-Fanout (SiRF) PUF","authors":"Nafis Irtija, Eirini-Eleni Tsiropoulou, C. Minwalla, J. Plusquellic","doi":"10.1109/HOST54066.2022.9839935","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9839935","url":null,"abstract":"True Random Number Generator (TRNG) is an important hardware security primitive for system security. TRNGs are capable of providing random bits for initialization vectors in encryption engines, for padding and nonces in authentication protocols and for seeds to pseudo random number generators (PRNG). A TRNG needs to meet the same statistical quality standards as a physical unclonable function (PUF) with regard to randomness and uniqueness, and therefore one can envision a unified architecture for both functions. In this paper, we investigate a FPGA implementation of a TRNG using the Shift-register Reconvergent-Fanout (SiRF) PUF. The SiRF PUF measures path delays as a source of entropy within a engineered logic gate netlist. The delays are measured at high precision using a time-to-digital converter, and then processed into a random bitstring using a series of linear-time mathematical operations. The SiRF PUF algorithm that is used for key generation is reused for the TRNG, with simplifications that improve the bit generation rate of the algorithm. This enables the TRNG to leverage both fixed PUF-based entropy and random noise sources, and makes the TRNG resilient to temperature-voltage attacks. TRNG bitstrings generated from a programmable logic implementation of the SiRF PUF-TRNG on a set of FPGAs are evaluated using statistical testing tools.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116341888","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Noeloikeau F. Charlot, D. Gauthier, D. Canaday, A. Pomerance
{"title":"Mathematical Model of Strong Physically Unclonable Functions Based on Hybrid Boolean Networks","authors":"Noeloikeau F. Charlot, D. Gauthier, D. Canaday, A. Pomerance","doi":"10.48550/arXiv.2207.10816","DOIUrl":"https://doi.org/10.48550/arXiv.2207.10816","url":null,"abstract":"We introduce a mathematical framework for sim-ulating Hybrid Boolean Network (HBN) Physically Unclonable Functions (PUFs, HBN-PUFs). We verify that the model is able to reproduce the experimentally observed PUF statistics for uniqueness µinter and reliability µintra obtained from ex-periments of HBN-PUFs on Cyclone V FPGAs. Our results suggest that the HBN-PUF is a true ‘strong’ PUF in the sense that its security properties depend exponentially on both the manufacturing variation and the challenge-response space. Our Python simulation methods are open-source and available at https://github.com/Noeloikeau/networkm.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126011837","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Shajib Ghosh, Mohammad Tahsin Mostafiz, S. Gurudu, S. Taheri, N. Asadizanjani
{"title":"PCB Component Detection for Hardware Assurance: A Feature Selection-based Approach","authors":"Shajib Ghosh, Mohammad Tahsin Mostafiz, S. Gurudu, S. Taheri, N. Asadizanjani","doi":"10.1109/HOST54066.2022.9840298","DOIUrl":"https://doi.org/10.1109/HOST54066.2022.9840298","url":null,"abstract":"Physical inspection in the optical domain is becoming increasingly important to hardware assurance professionals. Several efforts have been undertaken to create a reliable system for Printed Circuit Board (PCB) assurance that combines image processing, computer vision, and machine learning. However, this field remains challenging owing to the need for a significant amount of data as well as emerging problems with the rapid growth of technology. As a result, as demonstrated in our work, feature extraction and feature selection can play a vital role in addressing these problems and developing an interpretable PCB assurance system. Our findings indicate that the color feature, as opposed to the shape and texture features, is the most important for PCB component recognition using semantic data. Furthermore, feature selection can assist alleviate the curse of dimensionality issues and offer a better understanding of how to create an effective PCB component recognition algorithm, which is the goal of our research.","PeriodicalId":222250,"journal":{"name":"2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123658546","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}