Patanjali SLPSK

Reverse engineering (RE) of hardware designs poses a significant threat to the modern distributed electronics supply chain. RE can be performed at both chip and printed circuit board (PCB) levels by using structural, functional, or combined analysis techniques. Recent studies on artificial intelligence (AI)-inspired RE techniques have seen a drastic increase in the effectiveness of such attacks. While various countermeasures, e.g., logic locking (LL) at the chip level and camouflaging at the board level, have been studies to combat RE, the advent of Boolean satisfiability (SAT)-based functional query at chip level and 3-D imaging attacks at board level has shown that these protections can be easily bypassed. We observe that a common factor that contributes to the success of these attacks at both chip and board levels is the ability of an attacker to observe the input/output (I/O) patterns of a working system. Based on this observation, we present a novel locking scheme called IOLock that can effectively prevent access to golden I/O behavior of a working system. IOLock restricts access to the actual I/Os of the chips in a PCB by introducing a low-overhead key management unit (KMU) that works in conjunction with internal encryption/decryption modules near the I/O ports. The encryption/decryption modules are designed to work with the existing joint test action group (JTAG) infrastructure. IOLock can be used in standalone mode or in conjunction with another LL scheme to enhance the overall security of the design. We evaluate the security guarantees offered by IOLock theoretically, through simulation, and hardware measurements. We show that IOLock provides robust protection against both chip-level and PCB-level RE attacks while incurring minimal design overhead.

Physically Unclonable Functions (PUFs) are used for securing electronic devices across the implementation spectrum ranging from Field Programmable Gate Array (FPGA) to system on chips (SoCs). However, existing PUF implementations often suffer from one or more significant deficiencies: (1) Significant design overhead; (2) Difficulty to configure and integrate based on application-specific requirements; (3) Vulnerability to model-building attacks; and (4) Spatial locality to a specific region of a chip. These factors limit their application in the authentication of designs used in various applications. In this work, we propose MeLPUF: Memory-in-Logic PUF; a low-overhead distributed PUF that leverages the existing logic gates in a design to create cross-coupled inverters (i.e., memory cells), in a logic circuit as an entropy source. It exploits these memory cells’ power-up states as the source of entropy to generate device-specific unique fingerprints. A dedicated control signal governs these on-demand memory cells. They can be dispersed across the combinational logic of a design to achieve distributed authentication. They can also be synthesized with a standard logic synthesis tool to meet the target area, power, and performance constraints. We demonstrate the scalability of MeLPUF by aggregating power-up states from multiple memory cells, thus creating PUF signatures or digital identifiers of varying lengths. Our analysis shows the high quality of the PUF in terms of uniqueness, randomness, and robustness while incurring modest overhead.

System-on-Chips contain variety of Hardware Security Assets (HSAs) to protect the components of the system against untrusted entities. Binding the HSAs to each SoC silicon instance during the testing stage, known as provisioning, is a critical step in SoC life cycle since improper provisioning could compromise the secure, trustworthy field operation of SoC and/or lead to crucial supply chain threats (e.g., piracy, cloning and reverse engineering). However, existing SoC provisioning methods do not scale to more advanced threat vectors under the emergent zero trust model that considers the foundry and testing/assembly process untrustworthy. We address this problem through a comprehensive framework, PROTECTS that enables secure provisioning of HSAs under zero trust. We demonstrate PROTECTS using a representative RISC-V based SoC with diverse set of HSAs. Our analysis shows that PROTECTS incurs minimal design overheads (0.36%, 0.54% and 0.0%) in area, power, and gate-count, respectively, for the entire SoC), while providing strong security guarantees.

Sean-based Design-for- Test (DIT) infrastructure renders an ASIC design testable by making internal circuit nodes more controllable and observable. It, however, vastly conflicts with the security requirements of a design by making on-chip assets vulnerable to scan-based attacks. To address this critical security issue, over the past two decades, numerous scan protection solutions have been investigated. However, none of the existing solutions addresses the growing need to protect a scan chain under the emergent zero trust model. This model considers a fully untrusted fabrication and testing facility consistent with the modern globally distributed supply chain ecosystem. Under this model, existing protection against scan-based DIT can be easily bypassed, leading to unauthorized scan access. This work, for the first time, analyzes the vulnerabilities of state-of-the-art scan countermeasures and presents InvisibleScan, an innovative state space obfuscation-based scan protection method to prevent scan attacks under zero trust. We evaluate InvisbleScan on a suite of ITC’99 benchmarks and show that it incurs minimal overhead while providing strong security guarantees.

The need for metrics for quantifying trustworthiness of electronic hardware against diverse threats on its integrity and confidentiality has greatly increased due to the increasing reliance on the untrusted global supply chain. Hardware Trojans, or malicious design alterations, has emerged as a major threat to hardware integrity and garnered significant interest in recent times due to its catastrophic potential. Effective protection against hardware Trojan attacks, however, requires well-defined metrics, which fall into two broad classes: 1) measure of a design’s vulnerability to Trojan insertion and 2) measure of effectiveness of a defense solution—a design or verification/test approach—against Trojan attacks, which is often represented as Trojan coverage. The former is important to assess the level of difficulty an adversary would encounter to insert a hard-to-detect Trojan. Previous efforts have assigned vulnerability as a function of the number of suspect nets identified in a design or are required to enumerate a subspace of Trojans. However, these values simplify the problem of hardware Trojan insertion and leave much of the subsequent analysis regarding the viable Trojan space unmeasured. In this article, we address this critical gap by presenting Trojan vulnerability factor (TVF), a metric for quantifying a design’s vulnerability to Trojan insertion via maximal clique analysis. With such analysis, we can frame the threat to more accurately represent the Trojan behavior and quantify the level of effort required for a designer to cover these Trojan triggers without needing to directly consider Trojan trigger sizes. We also introduce soft thresholding to account for suspect nets, which lie at the boundary of a design. Experimental results highlight the benefits of the proposed approach over existing Trojan vulnerability metrics. Finally, we demonstrate scalability to large designs through partitioning and clique sampling-based estimations.