Research in the field of hardware Trojans has seen significant growth in the past decade. However, standard benchmarks to evaluate hardware Trojans and their detection are lacking. To this end, we have developed a suite of Trojans and ‘trust benchmarks’ (i.e., benchmark circuits with a hardware Trojan inserted in them) that can be used by researchers in the community to compare and contrast various Trojan detection techniques. In this paper, we present a comprehensive vulnerability analysis flow at various levels of abstraction of digital-design, that has been utilized to create these trust benchmarks. Further, we present a detailed evaluation of our benchmarks in terms of metrics such as Trojan detectability, and in the context of different attack models. Finally, we discuss future work such as automatic Trojan insertion into any arbitrary circuit.

Benchmarking of Hardware Trojans and Maliciously Affected Circuits

The hardware Trojan (HT) has become a major threat for the integrated circuit (IC) industry and supply chain, and has motivated numerous developments of Trojan detection schemes. Although the side-channel method is the most promising one, nearly all of the side-channel methods require fabricated golden chips, which are very difficult to obtain in reality. In this paper, we propose a novel strategy for HT detection using electromagnetic side-channel-based spectrum modeling and analyzing. We utilize the design data at early stage of the IC lifecycle, and the generated spectrum can serve as the golden reference, and thus we do not need the fabricated golden chips anymore. Another very important feature is that our method is immune to the process variation theoretically. Experimental results on selected Advanced Encryption Standard benchmark circuits on FPGA show that our proposed method can effectively detect Trojans even with very small traces.

Hardware Trojan Detection Through Chip-Free Electromagnetic Side-Channel Statistical Analysis

There are increasing concerns about possible malicious modifications of integrated circuits (ICs) used in critical applications. Such attacks are often referred to as hardware Trojans. While many techniques focus on hardware Trojan detection during IC testing, it is still possible for attacks to go undetected. Using a combination of new design techniques and new memory technologies, we present a new approach that detects a wide variety of hardware Trojans during IC testing and also during system operation in the field. Our approach can also prevent a wide variety of attacks during synthesis, place-and-route, and fabrication of ICs. It can be applied to any digital system, and can be tuned for both traditional and split-manufacturing methods. We demonstrate its applicability for both application-specified integrated circuits and field-programmable gate arrays. Using fabricated test chips with Trojan emulation capabilities and also using simulations, we demonstrate: 1) the area and power costs of our approach can range between 7.4%–165% and 7%–60%, respectively, depending on the design and the attacks targeted; 2) the speed impact can be minimal (close to 0%); 3) our approach can detect 99.998% of Trojans (emulated using test chips) that do not require detailed knowledge of the design being attacked; 4) our approach can prevent 99.98% of specific attacks (simulated) that utilize detailed knowledge of the design being attacked (e.g., through reverse engineering); and 5) our approach never produces any false positives, i.e., it does not report attacks when the IC operates correctly.

TPAD: Hardware Trojan Prevention and Detection for Trusted Integrated Circuits

Network applications need to be fast and at the same time provide security. In order to minimize the overhead of the security algorithm on the performance of the application, the speeds of encryption and decryption of the algorithm are critical. To obtain maximum performance from the algorithm, efficient techniques for its implementation must be used and the implementation must be tuned for the specific hardware on which it is running. Bitslice is a non-conventional but efficient way to implement DES in software. It involves breaking down of DES into logical bit operations so that N parallel encryptions are possible on a single N-bit microprocessor. This results in tremendous throughput. AES is a symmetric block cipher introduced by NIST as a replacement for DES. It is rapidly becoming popular due to its good security features, efficiency. performance and simplicity. In this paper we present an implementation of AES using the bitslice technique. We analyze the impact of the architecture of the microprocessor on the performance of bitslice AES We consider three processors; the Intel Pentium 4, the AMD Athlon 64 and the Intel Core 2. We optimize the implementation to best utilize the superscalar architecture and SIMD instruction set present in the processors.

Bitslice Implementation of AES

Field-programmable gate array (FPGA) is a kind of programmable chip that is widely used in many areas, including automotive electronics, medical devices, military and consumer electronics, and is gaining more popularity. Unlike the application specific integrated circuits (ASIC) design, an FPGA-based system has its own supply-chain model and design flow, which brings interesting security and trust challenges. In this survey, we review the security and trust issues related to FPGA-based systems from the market perspective, where we model the market with the following parties: FPGA vendors, foundries, IP vendors, EDA tool vendors, FPGA-based system developers, and end-users. For each party, we show the security and trust problems they need to be aware of and the associated solutions that are available. We also discuss some challenges and opportunities in the security and trust of FPGA-based systems used in large-scale cloud and datacenters.

Recent Attacks and Defenses on FPGA-based Systems

Field programmable gate arrays (FPGAs) are being increasingly used in a wide range of critical applications, including industrial, automotive, medical, and military systems. Since FPGA vendors are typically fabless, it is more economical to outsource device production to off-shore facilities. This introduces many opportunities for the insertion of malicious alterations of FPGA devices in the foundry, referred to as hardware Trojan attacks, that can cause logical and physical malfunctions during field operation. The vulnerability of these devices to hardware attacks raises serious security concerns regarding hardware and design assurance. In this paper, we present a taxonomy of FPGA-specific hardware Trojan attacks based on activation and payload characteristics along with Trojan models that can be inserted by an attacker. We also present an efficient Trojan detection method for FPGA based on a combined approach of logic-testing and side-channel analysis. Finally, we propose a novel design approach, referred to as Adapted Triple Modular Redundancy (ATMR), to reliably protect against Trojan circuits of varying forms in FPGA devices. We compare ATMR with the conventional TMR approach. The results demonstrate the advantages of ATMR over TMR with respect to power overhead, while maintaining the same or higher level of security and performances as TMR. Further improvement in overhead associated with ATMR is achieved by exploiting reconfiguration and time-sharing of resources.

/pdf/design-and-validation-for-fpga-trust-under-hardware-trojan-4plboqt9of.pdf

Design and Validation for FPGA Trust under Hardware Trojan Attacks

Reconfigurable hardware including Field programmable gate arrays (FPGAs) are being used in a wide range of embedded applications including signal processing, multimedia, and security. FPGA device production is often outsourced to off-shore facilities for economic reasons. This opens up the opportunities for insertion of malicious design alterations in the foundry, referred to as hardware Trojan attacks, to cause logical and physical malfunction. The vulnerability of these devices to hardware attacks raises security concerns regarding hardware and design assurance. In this paper, we analyze hardware Trojan attacks in FPGA considering diverse activation and payload characteristics and derive a taxonomy of Trojan attacks in FPGA. To our knowledge, this is the first effort to analyze Trojan threats in FPGA hardware. Next, we propose a novel redundancy-based protection approach based on Trojan tolerance that modifies the application mapping process to provide high-level of protection against Trojans of varying forms and sizes. We show that the proposed approach incurs significantly higher security at lower overhead than conventional fault-tolerance schemes by exploiting the nature of Trojans and reconfiguration of FPGA resources.

Hardware trojan attacks in FPGA devices: threat analysis and effective counter measures

Field-programmable gate arrays (FPGAs) are being increasingly used as a preferred prototyping and accelerator platform for diverse application domains, such as digital signal processing (DSP), security, and real-time multimedia processing. However, mapping of these applications to FPGA typically suffers from poor energy efficiency because of high energy overhead of programmable interconnects (PI) in FPGA devices. This paper presents an energy-efficient heterogenous application mapping framework in FPGA, where the conventional application mappings to logic and DSP blocks (for DSP-enhanced FPGA devices) are combined with judicious mapping of specific computations to embedded memory blocks. A complete mapping methodology including functional decomposition, fusion, and optimal packing of operations is proposed and efficiently used to reduce the large energy overhead of PIs. Effectiveness of the proposed methodology is verified for a set of common applications using a commercial FPGA system. Experimental results show that the proposed heterogenous mapping approach achieves significant energy improvement for different input bit-widths (e.g., more than 35% of energy savings with 8 bit or smaller bit inputs compared to the corresponding mapping in configurable logic blocks). For further reduction of energy, we propose an energy/accuracy tradeoff approach, where the input operand bit-width is dynamically truncated to reduce memory area and energy at the expense of modest degradation in output-accuracy. We show that using a preferential truncation method, up to 88.6% energy savings can be achieved in a 32-tap finite impulse response filter with modest impact on the filter performance.

Improving Energy Efficiency in FPGA Through Judicious Mapping of Computation to Embedded Memory Blocks

Nanoscale devices provide the capability of gigascale integration in modern electronic systems. However, such systems suffer from high defect rates and large parametric variations that can adversely affect system reliability. Hardware duplication is an obvious direction but it incurs significant area overhead that is unacceptable in many scenarios. Memory-based computing (MBC) is a promising alternative to improve overall system reliability when few functional units are defective or unreliable under process-induced or thermal variations. Existing works demonstrated the utility of MBC in single-core based designs. In this paper, we explore the effectiveness of MBC in multicore architectures where each core uses a small private cache while a set of cores share a large second-level cache. The private as well as shared caches are used to perform computation on demand using a lookup table. When a functional unit fails, temporarily due to temperature induced variations or permanently, the associated computation is transfered to caches. Experimental results demonstrate that on-demand memory based computing can significantly improve reliability with minor loss in performance.

Reliability improvement in multicore architectures through computing in embedded memory

FPGAs have emerged as the preferred prototyping and accelerator platform for diverse application domains such as digital signal processing (DSP), security and multimedia, which often impose real-time performance requirements. Most applications in these domains require efficient implementation of complex data paths or functions, e.g. transcendental functions which are spatially mapped in the configurable logic or embedded DSP blocks of a FPGA device. Requirement of elaborate computational resources to realize these operations impose a major barrier to energy efficiency. In this paper, we propose to use embedded memory blocks in FPGA for computing to significantly improve energy efficiency of the applications which are dominated by complex data paths and/or functions. Complex operations are decomposed into large multi-input/output lookup tables (LUTs); mapped to embedded memory blocks and evaluated through memory access over single or multiple cycles. Different parts of an application are selectively mapped into memory or logic/DSP blocks in a heterogeneous mapping framework to maximize energy efficiency. We explore optimal energy configuration of embedded memory for mapping applications of varying input size and develop a complete mapping flow including decomposition, fusion and packing. Effectiveness of the proposed flow is evaluated using a commercial state-of-the-art FPGA system (Alter a Stratix IV device). Finally the proposed framework is used to drastically trade-off energy vs accuracy at run-time for common signal processing applications.

Anandaroop Ghosh

Papers

Design and Validation for FPGA Trust under Hardware Trojan Attacks

Hardware trojan attacks in FPGA devices: threat analysis and effective counter measures

Improving Energy Efficiency in FPGA Through Judicious Mapping of Computation to Embedded Memory Blocks

Reliability improvement in multicore architectures through computing in embedded memory

Energy-Efficient Application Mapping in FPGA through Computation in Embedded Memory Blocks