Search

The promise of strong physical unclonable functions (PUF) is to utilize the manufacturing variations of circuit elements to produce an independent and unpredictable response to any input challenge vector. Attacks on PUFs that predict the responses to input challenge vectors offer an interesting research problem. An attacking approach based on the optimization theory and side-channel information is proposed where we estimate the manufacturing variations of the circuit elements and predict the PUF’s responses to challenge vectors whose actual responses are not known. We apply this attacking approach on some popular PUF designs, including the Arbiter PUFs, the Memristor Crossbar PUFs, and the XOR Arbiter PUFs. Simulations show a substantial reduction in attack complexity compared with previously proposed machine-learning (ML)-based attacks: we achieve an average reduction of 66% in attack time compared with the ML approach. Despite some overhead, our approach is also applicable when the PUF responses are noisy.

To combat security threats to integrated circuit (IC) fabrication outsourcing, 2.5D integration can obfuscate the outsourced design by lifting a portion of the wires into an interposer layer. A security-aware physical design flow for 2.5D IC technology can then help defend against attacks by increasing the layout and functionality obfuscation.

Physical limit of transistor miniaturization has driven chip design into the third dimension. 3D integration technology emerges as a viable option to improve chip performance and increase device density in a direction orthogonal to costly device scaling. As 3D integration is becoming a promising technology for next-generation chip design, recent years have seen a huge proliferation of research literature exploiting it from a security perspective. This paper presents a survey on the current state of 3D integration technology from a security perspective and summarizes its security opportunities and challenges. We report current research work on 3D integration based security in three major applications: supply chain attack prevention, side-channel attack mitigation, and trustworthy computing system design. The security advantages and opportunities of 3D integration in these security applications are highlighted. Besides, the paper discusses new vulnerabilities risen by 3D integration that require researchers’ attention. Based on the survey result, we summarize the distinct characteristics of 3D ICs and investigate their impacts on security-aware 3D IC designs.

Due to design and fabrication outsourcing to foundries, the problem of malicious modifications to integrated circuits (ICs), also known as hardware Trojans (HTs), has attracted attention in academia as well as industry. To reduce the risks associated with Trojans, researchers have proposed different approaches to detect them. Among these approaches, test-time detection approaches have drawn the greatest attention. Many test-time approaches assume the existence of a Trojan-free (TF) chip/model also known as “golden model.” Prior works suggest using reverse engineering (RE) to identify such TF ICs for the golden model. However, they did not state how to do this efficiently. In fact, RE is a very costly process which consumes lots of time and intensive manual effort. It is also very error prone. In this paper, we propose an innovative and robust RE scheme to identify the TF ICs. We reformulate the Trojan-detection problem as clustering problem. We then adapt a widely used machine learning method, ${K}$ -means clustering, to solve our problem. Simulation results using state-of-the-art tools on several publicly available circuits show that the proposed approach can detect HTs with high accuracy rate. A comparison of this approach with our previously proposed approach [1] is also conducted. Both the limitations and application scenarios of the two methods are discussed in detail.

In recent research, it has been demonstrated that the pattern (or sequence) of memory access made to the server or external storage can leak very sensitive information even if the underlying data is encrypted. To mitigate this leakage, oblivious RAM (ORAM) has been proposed to provide provable security by hiding the access patterns. Ever since its introduction, substantial effort has been made to make ORAM more efficient. Different efficient ORAM protocols satisfy the original ORAM specification but vary in implementation details. While these ORAM protocols have been proved to be secure against an attacker who can observe the processor's output pins, the leakage from inside timing side-channels is still possible. In this paper, we identify three common leakage points in many efficient Path-ORAM implementations and design various timing side-channel attacks on them. Both FPGA-based and simulator-based experimental results show that significant amount of information can be leaked through inside timing side-channels. We also discuss several countermeasures to mitigate the proposed attacks. We hope that the analysis in this paper would motivate a new line of research to make ORAMs more secure to such attacks.

In contrast to other studies in IC supply chain security where foundries are classified as either untrusted or trusted, a more realistic threat model is that the foundries are legally and economically obliged to perform trustworthy service, and it is the individual employees that introduce security risks. We call the above as the trusted foundry and untrusted employee (TFUE) model. Based on this model, we investigate new opportunities of establishing trustworthy operations in foundries made possible by double patterning lithography (DPL). DPL is used to setup two independent mask development lines which do not need to share any information. Under this setup, we consider the attack model where the untrusted employee(s) may try to insert Trojans into the circuit. As a countermeasure, we customize DPL to decompose the layout into two sub-layouts in such a way that each sub-layout individually expose minimum information to the untrusted employee.

Device scaling has increased interconnect power and delay to an extent that it is presenting a bottleneck to further performance gain. 3D/2.5D integration technology emerges as a viable option to improve chip performance in a direction orthogonal to costly device scaling. While the technology was originally proposed to enhance performance, it has unlocked new opportunities to thwart security threats in a global IC supply chain. Various obfuscation techniques based on 3D/2.5D IC technology have been proposed to protect IC designs from being pirated or tampered during outsourced fabrication. This chapter presents the current state of 3D/2.5D IC-based obfuscation techniques and highlights potential security opportunities and challenges of this technology in hardware intellectual property (IP) protection.

Attacks on hardware can take on many forms. As modern chips are designed and fabricated in a global supply chain, circuit designs are subject to counterfeiting, piracy, and malicious modification by untrusted foundries, which are known as supply chain attacks. In this paper, we first survey existing circuit obfuscation techniques that are proposed to thwart the aforementioned attacks. Then, we investigate the application of 2.5D/3D integration technologies in circuit obfuscation. We introduce a security-aware design flow that utilizes the 2.5D IC and logic locking technique to counter the supply chain attacks. Opportunities and challenges in the 2.5D/3D IC based security applications are highlighted.

Physical unclonable functions (PUFs) utilize manufacturing variations of circuit elements to produce unpredictable response to any challenge vector. The attack on PUF aims to predict the PUF response to all challenge vectors while only a small number of challenge-response pairs (CRPs) are known. The target PUFs in this paper include the Arbiter PUF (ArbPUF) and the Memristor Crossbar PUF (MXbarPUF). The manufacturing variations of the circuit elements in the targeted PUF can be characterized by a weight vector. An optimization-theoretic attack on the target PUFs is proposed. The feasible space for a PUF's weight vector is described by a convex polytope confined by the known CRPs. The centroid of the polytope is chosen as the estimate of the actual weight vector, while new CRPs are adaptively added into the original set of known CRPs. The linear behavior of both ArbPUF and MXbarPUF is proven which ensures that the feasible space for their weight vectors is convex. Simulation shows that our approach needs 71.4% fewer known CRPs and 86.5% less time than the state-of-the-art machine learning based approach.