{"title":"Hardware trojan detection by symmetry breaking in path delays","authors":"N. Yoshimizu","doi":"10.1109/HST.2014.6855579","DOIUrl":"https://doi.org/10.1109/HST.2014.6855579","url":null,"abstract":"This paper discusses the detection of hardware Trojans (HTs) by their breaking of symmetries within integrated circuits (ICs), as measured by path delays. Typically, path delay or side channel methods rely on comparisons to a golden, or trusted, sample. However, golden standards are affected by inter-and intra-die variations which limit the confidence in such comparisons. Symmetry is a way to detect modifications to an IC with increased confidence by confirming subcircuit consistencies within as it was originally designed. The difference in delays from a given path to a set of symmetric paths will be the same unless an inserted HT breaks symmetry. Symmetry can naturally exist in ICs or be artificially added. We describe methods to find and measure path delays against symmetric paths, as well as the advantages and disadvantages of this method. We discuss results of examples from benchmark circuits demonstrating the detection of hardware Trojans.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"113 4","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132089827","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"DWM-PUF: A low-overhead, memory-based security primitive","authors":"Anirudh Iyengar, Kenneth Ramclam, Swaroop Ghosh","doi":"10.1109/HST.2014.6855587","DOIUrl":"https://doi.org/10.1109/HST.2014.6855587","url":null,"abstract":"Physically Unclonable Function (PUF) is a security primitive to address hardware security issues such as chip authentication, Intellectual Property (IP) protection etc. Conventional CMOS PUFs are built on delay (inverter chains, scan chains etc.) or memory structures (like SRAM). In this paper, we propose a novel PUF which works on the principles of spintronic Domain Wall Memory (DWM). Conventional DWM is limited by pinning due to process variations induced surface roughness of the nanowire. We exploit this limitation towards chip-authentication. We propose two flavors of PUFs namely relay-PUF and memory-PUF. The proposed PUFs show excellent entropy (measured by Hamming Distance). We also analyze metrics such as robustness, area and power of the DWM-PUFs. The memory-PUF indicated up to an order of magnitude reduction in power compared to SRAM PUF.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127936185","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Chaotic Ring oscillator based Random Number Generator","authors":"S. Dhanuskodi, Arunkumar Vijayakumar, S. Kundu","doi":"10.1109/HST.2014.6855588","DOIUrl":"https://doi.org/10.1109/HST.2014.6855588","url":null,"abstract":"True Random Number Generator (TRNG) circuits play an important role in hardware security. Traditional Ring Oscillator (RO) based TRNGs aim to amplify thermal noise and supply noise jitters. To increase randomness, traditional RO based TRNGs harvest random noise from large number of stages resulting in large area and power. We propose a Chaotic Ring oscillator based random number Generator (CRNG) for CMOS implementation. This circuit uses nonlinear elements which are straightforward to implement in CMOS to bring about chaotic behavior. We demonstrate that the proposed CRNG passes tests for randomness and are immune to modeling attacks. Albeit small in magnitude, the proposed CRNG also harvests physical noise which acts as a compounder over chaos. The proposed CRNG circuit is small in area, scales well with technology, operates at low voltages and does not require any special manufacturing process. The output bit stream of the proposed CRNG implemented in a 45 nm process was tested using the NIST test suite and it passes 11 tests. Results show that the proposed CRNG occupies an area of 93.1 μm2 and has a throughput of 127 Mbps at a power of 1.1 mW. This compares very well against state of the art TRNGs.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134379923","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Oliver Soll, Thomas Korak, M. Muehlberghuber, M. Hutter
{"title":"EM-based detection of hardware trojans on FPGAs","authors":"Oliver Soll, Thomas Korak, M. Muehlberghuber, M. Hutter","doi":"10.1109/HST.2014.6855574","DOIUrl":"https://doi.org/10.1109/HST.2014.6855574","url":null,"abstract":"The detectability of malicious circuitry on FPGAs with varying placement properties yet has to be investigated. The authors utilize a Xilinx Virtex-II Pro target platform in order to insert a sequential denial-of-service Trojan into an existing AES design by manipulating a Xilinx-specific, intermediate file format prior to the bitstream generation. Thereby, there is no need for an attacker to acquire access to the hardware description language representation of a potential target architecture. Using a side-channel analysis setup for electromagnetic emanation (EM) measurements, they evaluate the detectability of different Trojan designs with varying location and logic distribution properties. The authors successfully distinguish the malicious from the genuine designs and provide information on how the location and distribution properties of the Trojan logic affect its detectability. To the best of their knowledge, this has been the first practically conducted Trojan detection using localized EM measurements.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124616117","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kaushik Vaidyanathan, B. P. Das, Ekin Sumbul, Renzhi Liu, Larry Pileggi
{"title":"Building trusted ICs using split fabrication","authors":"Kaushik Vaidyanathan, B. P. Das, Ekin Sumbul, Renzhi Liu, Larry Pileggi","doi":"10.1109/HST.2014.6855559","DOIUrl":"https://doi.org/10.1109/HST.2014.6855559","url":null,"abstract":"Due to escalating manufacturing costs the latest and most advanced semiconductor technologies are often available at off-shore foundries. Utilizing these facilities significantly limits the trustworthiness of the corresponding integrated circuits for mission critical applications. We address this challenge of cost-effective and trustworthy CMOS manufacturing for advanced technologies using split fabrication. Split fabrication, the process of splitting an IC into an untrusted and trusted component, enables the designer to exploit the most advanced semiconductor manufacturing capabilities available offshore without disclosing critical IP or system design intent. We show that split fabrication after the Metal1 layer is secure and has negligible performance and area overhead compared to complete IC manufacturing in the off-shore foundry. Measurements from split fabricated 130nm testchips demonstrate the feasibility and efficacy of the proposed approach.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117351286","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"IP-level implementation of a resistance-based physical unclonable function","authors":"Dylan Ismari, J. Plusquellic","doi":"10.1109/HST.2014.6855570","DOIUrl":"https://doi.org/10.1109/HST.2014.6855570","url":null,"abstract":"A complete on-chip implementation of a bit generation engine using a physical unclonable function is presented in this paper. The bit generation engine, called the JellyFishPUF (JFP), provides keying material for encryption, authentication bitstrings for anti-counterfeiting and true random number generation. JFP utilizes a Physical Unclonable Function that is based on resistance variations in metals and transistors. JFP is fully implemented as a layout in an area of 0.125 mm2 using a 65 nm technology, which includes a 2KB SRAM for public data storage. The bitstrings produced from Monte Carlo SPICE-level simulations of the entropy source in combination with logic simulations of the digital engine are evaluated with respect to randomness, uniqueness and stability metrics across a wide range of temperature and voltage corners.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"191 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123009265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
K. Xiao, Md. Tauhidur Rahman, Domenic Forte, Yu Huang, Mei Su, M. Tehranipoor
{"title":"Bit selection algorithm suitable for high-volume production of SRAM-PUF","authors":"K. Xiao, Md. Tauhidur Rahman, Domenic Forte, Yu Huang, Mei Su, M. Tehranipoor","doi":"10.1109/HST.2014.6855578","DOIUrl":"https://doi.org/10.1109/HST.2014.6855578","url":null,"abstract":"Physically Unclonable Functions (PUFs) are impacted by environmental variations and aging which can reduce their acceptance in identification and authentication applications. Prior approaches to improve PUF reliability include bit analysis across environmental conditions, better design, and post-processing error correction, but these are of high cost in terms of test time and design overheads, making them unsuitable for high volume production. In this paper, we aim to address this issue for SRAM PUFs with novel bit analysis and bit selection algorithms. Our analysis of real SRAM PUFs reveals (i) critical conditions on which to select stable SRAM cells for PUF at low-cost (ii) unexplored spatial correlation between stable bits, i.e., cells that are the most stable tend to be surrounded by stable cells determined during enrollment. We develop a bit selection procedure around these observations that produces very stable bits for the PUF generated ID/key. Experimental data from real SRAM PUFs show that our approaches can effectively reduce number of errors in PUF IDs/keys with fewer enrollment steps.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128760399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A look into SIMON from a side-channel perspective","authors":"S. Bhasin, T. Graba, J. Danger, Zakaria Najm","doi":"10.1109/HST.2014.6855568","DOIUrl":"https://doi.org/10.1109/HST.2014.6855568","url":null,"abstract":"SIMON is a lightweight block cipher, specially designed for resource constrained devices that was recently presented by the National Security Agency (NSA). This paper deals with a hardware implementation of this algorithm from a side-channel point of view as it is a prime concern for embedded systems. We present the implementation of SIMON on a Xilinx Virtex-5 FPGA and propose a low-overhead countermeasure using first-order Boolean masking exploiting the simplistic construction of SIMON. Finally we evaluate the side-channel resistance of both implementations.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123904360","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Nicolas Moro, K. Heydemann, Amine Dehbaoui, B. Robisson, Emmanuelle Encrenaz-Tiphène
{"title":"Experimental evaluation of two software countermeasures against fault attacks","authors":"Nicolas Moro, K. Heydemann, Amine Dehbaoui, B. Robisson, Emmanuelle Encrenaz-Tiphène","doi":"10.1109/HST.2014.6855580","DOIUrl":"https://doi.org/10.1109/HST.2014.6855580","url":null,"abstract":"Injection of transient faults can be used as a way to attack embedded systems. On embedded processors such as microcontrollers, several studies showed that such a transient fault injection with glitches or electromagnetic pulses could corrupt either the data loads from the memory or the assembly instructions executed by the circuit. Some countermeasure schemes which rely on temporal redundancy have been proposed to handle this issue. Among them, several schemes add this redundancy at assembly instruction level. In this paper, we perform a practical evaluation for two of those countermeasure schemes by using a pulsed electromagnetic fault injection process on a 32-bit microcontroller. We provide some necessary conditions for an efficient implementation of those countermeasure schemes in practice. We also evaluate their efficiency and highlight their limitations. To the best of our knowledge, no experimental evaluation of the security of such instruction-level countermeasure schemes has been published yet.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121832491","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
S. Krstic, Jin Yang, David W. Palmer, R. Osborne, Eran Talmor
{"title":"Security of SoC firmware load protocols","authors":"S. Krstic, Jin Yang, David W. Palmer, R. Osborne, Eran Talmor","doi":"10.1109/HST.2014.6855571","DOIUrl":"https://doi.org/10.1109/HST.2014.6855571","url":null,"abstract":"The security architecture of modern systems-on-a-chip (SoC) is complex and critical to be done right and quickly. SoC security architects feel an acute need for new tool-supported specification and validation technologies. Aiming to stimulate research into creation of these technologies, in this paper we provide some industrial insights and initial solutions. Focusing on a concrete non-trivial example of security sensitive firmware load protocols, we show how to: (1) concisely specify the communication between IP blocks; (2) model the adversary; (3) debug and verify the protocol.","PeriodicalId":222932,"journal":{"name":"2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132954615","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}