基于温度特征分析的硬件木马检测方法

硬件木马是一种在特定条件下使集成电路失效或泄露机密信息等的恶意电路,给现代信息系统带来了严重的安全隐患。该文基于硬件木马在芯片工作之初造成的温度响应特征,提出一种利用芯片温度变化特性并进行比对的硬件木马检测方法。该方法采用环形振荡器作为片内温度特征测量传感器,提取温度变化特征信息,并采用曲线拟合评价指标来评估硬件木马对温度变化特征的影响,通过比对无木马芯片温度响应特征从而完成木马检测。通过对10个不同芯片的检测,结果表明该方法能够对面积消耗32个逻辑单元硬件木马的检测率达到100%,对16个逻辑单元检测概率也能达到90%;同时检测结果表明该方法完成硬件木马检测后,能够对硬件木马的植入位置进行粗定位。     

Golden-Free Hardware Trojan Detection with High Sensitivity Under Process Noise

Malicious modification of integrated circuits in untrusted design house or foundry has emerged as a major security threat. Such modifications, popularly referred to as Hardware Trojans, are difficult to detect during manufacturing test. Sequential hardware Trojans, usually triggered by a sequence of rare events, represent a common and deadly form of Trojans that can be extremely hard to detect using logic testing approaches. Side-channel analysis has emerged as an effective approach for detection of hardware Trojans. However, existing side-channel approaches suffer from increasing process variations, which largely reduce the detection sensitivity and sets a lower limit of the sizes of Trojans detectable. In this paper, we present TeSR, a Temporal Self-Referencing approach that compares the current signature of a chip at two different time windows to isolate the Trojan effect. Since it uses a chip as a reference to itself, the method completely eliminates the effect of process noise and other design marginalities (e.g. capacitive coupling), thus providing high detection sensitivity for Trojans of varying size. Furthermore, unlike most of the existing approaches, TeSR does not require a golden reference chip instance, which may impose a major limitation. Associated test generation, test application, and signature comparison approaches aimed at maximizing Trojan detection sensitivity are also presented. Simulation results for three complex sequential designs and three representative sequential Trojan circuits demonstrate the effectiveness of the approach under large inter- and intra-die process variations. The approach is also validated with current measurement results from several Xilinx Virtex-II FPGA chips.     

基于多维结构特征的硬件木马检测技术

硬件木马是第三方知识产权(IP)核的主要安全威胁,现有的安全性分析方法提取的特征过于单一,导致特征分布不够均衡,极易出现较高的误识别率。该文提出了基于有向图的门级网表抽象化建模算法,建立了门级网表的有向图模型,简化了电路分析流程;分析了硬件木马共性特征,基于有向图建立了涵盖扇入单元数、扇入触发器数、扇出触发器数、输入拓扑深度、输出拓扑深度、多路选择器和反相器数量等多维度硬件木马结构特征;提出了基于最近邻不平衡数据分类(SMOTEENN)算法的硬件木马特征扩展算法,有效解决了样本特征集较少的问题,利用支持向量机建立硬件木马检测模型并识别出硬件木马的特征。该文基于Trust_Hub硬件木马库开展方法验证实验,准确率高达97.02%,与现有文献相比真正类率(TPR)提高了13.80%,真负类率(TNR)和分类准确率(ACC)分别提高了0.92%和2.48%,在保证低假阳性率的基础上有效识别硬件木马。     

一种面向粗粒度可重构阵列的硬件木马检测算法的设计与实现

硬件木马检测已成为当前芯片安全领域的研究热点,现有检测算法大多面向ASIC电路和FPGA电路,且依赖于未感染硬件木马的黄金芯片,难以适应于由大规模可重构单元组成的粗粒度可重构阵列电路。因此,该文针对粗粒度可重构密码阵列的结构特点,提出基于分区和多变体逻辑指纹的硬件木马检测算法。该算法将电路划分为多个区域,采用逻辑指纹特征作为区域的标识符,通过在时空两个维度上比较分区的多变体逻辑指纹,实现了无黄金芯片的硬件木马检测和诊断。实验结果表明,所提检测算法对硬件木马检测有较高的检测成功率和较低的误判率。     

Reliability based hardware Trojan design using physics-based electromigration models

In recent years the concern over Hardware Trojans has come to the forefront of hardware security research as these types of attacks pose a real and dangerous threat to both commercial and mission-critical systems. One interesting threat model utilizes semiconductor physics, specifically aging effects such as Electromigration (EM). However, existing methods for EM-based Trojans rely on empirical Black's models can easily lead to performance degradation and less accuracy in Trojan activation time prediction. In this article, we study the EM-based Trojan attacks based on recently developed physics-based EM models. We propose novel EM attack techniques in which the EM-induced hydrostatic stress increase in a wire is caused by wire structure or layer changes without changing the current density of the wires. The proposed techniques consist of sink/reservoir insertion or sizing and layer switching techniques based on the early and late failure modes of EM wear-out effects. As a result, the proposed techniques can have minimal impact on circuit performance, which is in contrast with existing current-density-based EM attacks. The proposed techniques can serve as a trigger for the EM attack on power/ground networks and signal and clock networks. Furthermore, we also present two potential EM attack mitigation techniques, namely, the split fabrication and burn-in testing.     

Security Against Hardware Trojan Attacks Using Key-Based Design Obfuscation

Malicious modification of hardware in untrusted fabrication facilities, referred to as hardware Trojan, has emerged as a major security concern. Comprehensive detection of these Trojans during post-manufacturing test has been shown to be extremely difficult. Hence, it is important to develop design techniques that provide effective countermeasures against hardware Trojans by either preventing Trojan attacks or facilitating detection during test. Obfuscation is a technique that is conventionally employed to prevent piracy of software and hardware intellectual property (IP). In this work, we propose a novel application of key-based circuit structure and functionality obfuscation to achieve protection against hardware Trojans triggered by rare internal circuit conditions. The proposed obfuscation scheme is based on judicious modification of the state transition function, which creates two distinct functional modes: normal and obfuscated. A circuit transitions from the obfuscated to the normal mode only upon application of a specific input sequence, which defines the key. We show that it provides security against Trojan attacks in two ways: (1) it makes some inserted Trojans benign, i.e. they become effective only in the obfuscated mode; and (2) it prevents an adversary from exploiting the true rare events in a circuit to insert hard-to-detect Trojans. The proposed design methodology can thus achieve simultaneous protection from hardware Trojans and hardware IP piracy. Besides protecting ICs against Trojan attacks in foundry, we show that it can also protect against malicious modifications by untrusted computer-aided design (CAD) tools in both SoC and FPGA design flows. Simulation results for a set of benchmark circuits show that the scheme is capable of achieving high levels of security against Trojan attacks at modest area, power and delay overhead.     

基于探索式分区和测试向量生成的硬件木马检测方法

本文提出基于分区和最优测试向量生成的硬件木马检测方法.首先,采用基于扫描细胞分布的分区算法将电路划分为多个区域.然后,提出测试向量重组算法,对各区域依据其自身结构生成近似最优的测试向量.最后,进行分区激活和功耗分析以检测木马,并采用信号校正技术消减制造变异和噪声的影响.优点是成倍提高了检测精度,克服了制造变异的影响,解决了面对大电路的扩展性问题,并可以定位木马.在基准电路上的验证实验表明检测性能有较大的提升.     

基于XGBoost的混合模式门级硬件木马检测方法

针对恶意的第三方厂商在电路设计阶段中植入硬件木马的问题,该文提出一种基于XGBoost的混合模式门级硬件木马检测方法。该检测方法将电路的每个线网类型作为节点,采用混合模式3层级的检测方式。首先,基于提取的电路静态特征,利用XGBoost算法实现第1层级的检测。继而,通过分析扫描链的结构特征,对第1层级分离得到的正常电路继续进行第2层级的面向扫描链中存在木马电路的静态检测。最后,在第3层级采用动态检测方法进一步提升检测的准确性。Trust-Hub基准测试集的实测结果表明,该方法与现有的其他检测方法相比具有较优的木马检测率,可达到94.0%的平均真阳率(TPR)和99.3%的平均真阴率(TNR)。     

基于电路模块自相似性的硬件木马检测方法

由于硬件木马种类的多样性和SoC电路制造过程中不可预测的工艺变化,硬件木马检测变得极具挑战性。现有的旁路信号分析法存在两个缺点,一是需要黄金模型作为参考,二是工艺波动会掩盖部分硬件木马的活动效果。针对上述不足,提出一种利用电路模块结构自相似性的无黄金模型检测方法。通过对32位超前进位加法器的软件仿真实验和对128位AES加密电路的硬件仿真实验,验证了该方法的有效性。实验结果表明,在45 nm工艺尺寸下,对于面积占比较小的硬件木马,该方法的检测成功率可以达到90.0%以上。     

Hardware Trojan Detection Using an Advised Genetic Algorithm Based Logic Testing

Today, outsourced manufacturing of integrated circuit designs are prone to a range of malicious modifications of the circuitry called Hardware Trojans. HTs can alter the functionality of a circuit, leak secret information and initiate other possible malicious actions. HTs are activated in a very rare condition known by an intruder. Therefore, a group of HT detection methods tries to activate the HT circuitry by crafting test vectors. In this paper, we propose a logic testing based HT detection method using an advised genetic algorithm which creates effective test vectors, the so-called TRIAGE (hardware TR ojan detectI on using an A dvised G enetic algorithm based logic tE sting). The key contribution of this paper is to present a proper fitness function for the genetic algorithm providing better evaluation of the test vectors. The controllability, observability and transition probability factors of rare nodes have been considered in the fitness function. Simulation results indicate 80% reduction in generation time for test sets (on average) as compared to the previous work. On the other hand, reduced generation time for test vectors has been associated with an increase in trigger coverage. The coverage of the TRIAGE method for very hard to trigger Trojans increases by about 23% due to high efficiency of the proposed fitness function for the genetic algorithm.     

硬件木马检测与防护

第三方技术服务的普及使得在集成电路（IC）设计制造过程中,芯片可能被恶意植入“硬件木马”,给芯片的安全性带来了极大挑战,由此,如何检测“安全芯片”中是否存在硬件木马,确保芯片的安全性开始受到人们的广泛关注.在简要介绍硬件木马概念及其危害的基础上,分析硬件木马的特点和结构,介绍了当前现有的几种硬件木马检测技术,给出了硬件木马检测技术的科学分类,重点分析了这些检测方法所面临的问题和挑战并提出了相应的改进措施,总结了未来硬件木马防测技术的发展趋势.     

硬件木马技术研究进展

通常存在于应用软件、操作系统中的信息安全问题正在向硬件蔓延。硬件木马是集成电路芯片从研发设计、生产制造到封装测试的整个生命周期内被植入的恶意电路,一经诱发,将带来各种非预期的行为,造成重大危害。当前,SoC芯片大量复用IP核,意味着将有更多环节招致攻击;日益增长的芯片规模又使得硬件木马的检测变得更难、成本更高。因此,硬件木马的相关技术研究成为硬件安全领域的热点。介绍了硬件木马的概念、结构、植入途径和分类,对硬件木马的设计、检测和防御技术进行了分析、总结和发展趋势预测,着重分析了检测技术。     

Golden-Free Processor Hardware Trojan Detection Using Bit Power Consistency Analysis

Processor is the core chip of modern information system, which is severely threatened by hardware Trojan. Side-channel analysis is the most promising method for hardware Trojan detection. However, most existing detection methods require golden chips as reference, which significantly increases the test cost and complexity. In this paper, we propose a golden-free detection method that exploits the bit power consistency of processor. For the data activated processor hardware Trojan, the power model of processor is modified. Two decomposition methods of power signal are proposed: the differential bit power consistency analysis and the contradictory equations solution. With the proposed method, each bit power can be calculated. The bit consistency based detection algorithms are proposed, the deviation boundaries are obtained by statistical analysis. Experimental measurements were done on field programmable gate array chip with open source 8051 core and hardware Trojans. The results showed that the differences between the two methods were very small. The data activated processor hardware Trojans were detected successfully.     

基于投影寻踪分析的芯片硬件木马检测

提出一种利用芯片旁路泄漏信息的硬件木马无损检测方法,通过基于绝对信息散度指标的投影寻踪技术,将芯片运行过程中产生的高维旁路信号投影变换到低维子空间,在信息损失尽量小的前提下发现原始数据中的分布特征,从而实现芯片旁路信号特征提取与识别。针对示例性高级加密标准(AES-128)木马电路的检测实验表明,该技术可以有效分辨基准芯片与硬件木马测试芯片之间的旁路信号特征差异,实现硬件木马检测。     

新情况下的特殊武器——硬件木马

现今的集成电路,在设计中就有可能植入恶意电路,这种恶意电路被称为硬件木马,硬件木马会影响系统的功能或将关键信息传输给对手.过去几年里这个问题已经获得了巨大关注.依据危害结果对硬件木马进行了分类,分为功能破坏型、性能劣化型、数据窃取型、后门预留型.作者介绍硬件木马的植入途径及其防范方法,硬件木马的危害;还介绍并分析了硬件...     

An advanced SEU tolerant latch based on error detection

This paper proposes a latch that can mitigate SEUs via an error detection circuit.The error detection circuit is hardened by a C-element and a stacked PMOS.In the hold state,a particle strikes the latch or the error detection circuit may cause a fault logic state of the circuit.The error detection circuit can detect the upset node in the latch and the fault output will be corrected.The upset node in the error detection circuit can be corrected by the Celement.The power dissipation and propagation delay of the proposed latch are analyzed by HSPICE simulations.The proposed latch consumes about 77.5％ less energy and 33.1％ less propagation delay than the triple modular redundancy (TMR) latch.Simulation results demonstrate that the proposed latch can mitigate SEU effectively.     

用于检测硬件木马延时的线性判别分析算法

针对芯片生产链长、安全性差、可靠性低,导致硬件木马防不胜防的问题,该文提出一种针对旁路信号分析的木马检测方法。首先采集不同电压下电路的延时信号,通过线性判别分析(LDA)分类算法找出延时差异,若延时与干净电路相同,则判定为干净电路,否则判定有木马。然后联合多项式回归算法对木马延时特征进行拟合,基于回归函数建立木马特征库,最终实现硬件木马的准确识别。实验结果表明,提出的LDA联合线性回归(LR)算法可以根据延时特征识别木马电路,其木马检测率优于其他木马检测方法。更有利的是,随着电路规模的增大意味着数据量的增加,这更便于进行数据分析与特征提取,降低了木马检测难度。通过该方法的研究,对未来工艺极限下识别木马电路、提高芯片安全性与可靠性具有重要的指导作用。     

Fault-tolerant analysis of TMR design with noise-aware logic

Due to the effect of thermal noise, ground bounce and process variations in nanometer process, the behavior of any logical circuit becomes increasingly probabilistic. In this paper, based on the noise model [5] on the input and output nodes of a probabilistic CMOS (PCMOS) gate, the correctness probabilities of four PCMOS primitive gates, NOT, NAND, NOR and XOR, can be firstly computed. Based on the concept of the probabilistic transfer matrices (PTMs) and the corresponding operations on PTMs for the serial and parallel compositions of the components in a well-formed circuit, the correctness probability of the output in a 3-input PCMOS majority circuit in a triple modular redundancy (TMR) design can be further computed. For a given circuit with smaller error, it is well known that a TMR design has good fault-tolerant characterization and the correctness probability of the original output is converged to 1. Under the use of noise-aware logic in a TMR design, it is obvious that the fault-tolerant characterization of a TMR design is degraded and the correctness probability of the original output is not converged to 1. The experimental results show that the improvement region of the correctness probability of the original output will be narrowed due to the noise effect on the gates in a 3-input PCMOS majority circuit.     

Single Event crosstalk shielding for CMOS logic

With advances in technology scaling, CMOS circuits are increasingly more sensitive to transient pulses caused by Single Event particles. Hardening techniques for CMOS combinational logic have been developed to address the problems associated with Single Event transients, but in these designs, Single Event crosstalk effects have been ignored. In order to complement the Single Event upset (SEU) hardening process, coupling effects among interconnects need to be considered in the Single Event hardening and analysis of CMOS logic gates due to technology scaling effects that increase both SE vulnerability and crosstalk effects. As technologies advance, the coupling effects increasingly cause SE transients to contaminate electronically unrelated circuit paths which can in turn increase the “Single Event susceptibility” of CMOS circuits. Serious effects may occur if the affected line is a clock line or an input line of voters in triple-modular redundancy (TMR) circuit. Hence, this work first analyzes Single Event crosstalk on recent technologies and then proposes hardening techniques to reduce Single Event crosstalk. Hardening results are demonstrated using HSpice Simulations with interconnect and device parameters derived in 90 nm technology.