In today's diversified semiconductor supply-chain, protecting intellectual property (IP) and maintaining manufacturing integrity are important concerns. Circuit obfuscation techniques such as logic encryption and IC camouflaging can potentially defend against a majority of supply-chain threats such as stealthy malicious design modification, IP theft, overproduction, and cloning. Recently, a Boolean Satisfiability (SAT) based attack, namely the SAT attack has been able to deobfuscate almost all traditional circuit obfuscation schemes, and as a result, a number of defense solutions have been proposed in literature. All these defenses are based on the implicit assumption that the attacker needs a perfect deobfuscation accuracy which may not be true in many practical cases. Therefore, in this paper by relaxing the exactness constraint on deobfuscation, we propose the AppSAT attack, an approximate deobfuscation algorithm based on the SAT attack and random testing. We show how the AppSAT attack can deobfuscate 68 out of the 71 benchmark circuits that were obfuscated with state-of-the-art SAT attack defenses with an accuracy of, n being the number of inputs. AppSAT shows that with current SAT attack defenses there will be a trade-off between exact-attack resiliency and approximation resiliency.

AppSAT: Approximately deobfuscating integrated circuits

While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party -- often overseas -- to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before effecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transition between digital values. When the capacitors fully charge, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely-controllable privilege escalation by attaching the capacitor to a wire controllable and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that our attacks work, show that our attacks elude activation by a diverse set of benchmarks, and suggest that our attacks evade known defenses.

A2: Analog Malicious Hardware

Viable cryptosystem designs must address power analysis attacks, and masking is a commonly proposed technique for defending against these side-channel attacks It is possible to overcome simple masking by using higher-order techniques, but apparently only at some cost in terms of generality, number of required samples from the device being attacked, and computational complexity We make progress towards ascertaining the significance of these costs by exploring a couple of attacks that attempt to efficiently employ second-order techniques to overcome masking In particular, we consider two variants of second-order differential power analysis: Zero-Offset 2DPA and FFT 2DPA

Towards efficient second-order power analysis

Logic locking and IC camouflaging are proactive circuit obfuscation methods that if proven secure can thwart hardware attacks such as reverse engineering and IP theft. However, the security of both these schemes is called into question by recent SAT based attacks. While a number of methods have been proposed in literature that exponentially increase the running time of such attacks, they are vulnerable to "findand-remove" attacks, and only slightly hide the circuit functionality. In this paper, we present a novel approach towards creating SAT attack resiliency based on creating densely cyclic obfuscated circuit topologies by adding dummy paths to the circuit. Our methodology is applicable to both IC camouflaging and logic locking. We demonstrate that cyclic logic locking creates SAT resilient circuits with 40% less area and 20% less delay compared to an insecure XOR/XNOR-obfuscation with the same key length. Furthermore, we show that cyclic IC camouflaging can be implemented at the layout level with no substrate area overhead and little delay and power overhead with respect to the original circuit.

Cyclic Obfuscation for Creating SAT-Unresolvable Circuits

Scan-based test is commonly used to increase testability and fault coverage, however, it is also known to be a liability for chip security. Research has shown that intellectual property (IP) or secret keys can be leaked through scan-based attacks, which can be performed by entities within the supply chain. In this paper, we propose a design and test methodology against scan-based attacks throughout the supply chain, which includes a dynamically obfuscated scan (DOS) for protecting IP/integrated circuits (ICs). By perturbing test patterns/responses and protecting the Obfuscation Key, the proposed architecture is proven to be robust against existing noninvasive scan-based attacks, and can protect all scan data from attackers in foundry, assembly, and system development without compromising the testability. Further, a novel test methodology cooperating with the DOS design is also proposed, which shows full pattern application flexibility. Finally, detailed security and experimental analyses have been performed on ITC and industrial benchmarks. Demonstrated by the simulation results, the proposed architecture can be easily plugged into EDA generated scan chains without generating a noticeable impact on conventional IC design, manufacturing, and test flow. The results demonstrate that the proposed methodology can protect chips from existing brute force, differential, and other scan-based attacks that target the Obfuscation Key. Furthermore, the proposed design is of low overhead on area, power consumption, and pattern generation time, and there is no impact on test time.

Secure Scan and Test Using Obfuscation Throughout Supply Chain

A successful detection of the stealthy dopant-level circuit trojan, proposed by Becker et al. at CHES 2013 [1], is reported. Contrary to an assumption made by Becker et al., dopant types in active region are visible with either scanning electron microscopy SEM or focused ion beam FIB imaging. The successful measurement is explained by an LSI failure analysis technique called the passive voltage contrast [2]. The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device [3]: an anti-reverse-engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with 1 an optical microscope, 2 SEM, and 3 FIB. As a result, the four possible dopant-well combinations, namely i p+/n-well, ii p+/p-well, iii n+/n-well and iv n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, however, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16-times expensive than that of a metal layer in terms of the number of images.

/pdf/reversing-stealthy-dopant-level-circuits-p8bi2l0q5g.pdf

Reversing Stealthy Dopant-Level Circuits

Leaks inside semi-custom ASIC (Application Specific Integrated Circuit) design primitives are rigorously investigated. The study is conducted by measuring a dedicated TEG (Test Element Group) chip with a small magnetic-field probe on the chip surface. Measurement targets are standard cells and a memory macro cell. Leaks inside the primitives are focused as many of conventional countermeasures place measurability boundaries on these primitives. Firstly, it is shown that current-path leak: a leak based on input-dependent active current path within a standard cell [1] is measurable. Major gate-level countermeasures (RSL, MDPL, and WDDL) become vulnerable if the current-path leak is considered. Secondly, it is shown that internal-gate leak: a leak based on non-linear sub-circuit within a XOR cell is measurable. It can be exploited to bias the distribution of the random mask. Thirdly, it is shown that geometric leak: a leak based on geometric layout of the memory matrix structure is measurable. It is a leak correlated to integer representation of the memory address. We also show that a ROM-based countermeasure (Dual-rail RSL memory [10]) becomes vulnerable with the geometric leak. A general transistor-level design method to counteract the current-path and internal-gate leaks is also shown.

/pdf/on-measurable-side-channel-leaks-inside-asic-design-320jt8jq0x.pdf

On measurable side-channel leaks inside ASIC design primitives

Physical Unclonable Functions (PUFs) have been proposed to produce tamper-resistant device or create unique identifications of the secure systems. The conventional basic arbiter-PUF was fabricated with 0.18µm CMOS technology, and the uniqueness of generated multi-bit responses was evaluated. The uniqueness is inadequate than expected because some of multi-bit responses are never generated. In this study, we propose a novel arbiter-PUF utilizing a RG-DTM (Response Generation according to Delay Time Measurement) scheme. The uniqueness is evaluated by the standard deviation of the Hamming Distance distribution between generated 256-bit responses. The standard deviation on the proposed PUFs is greatly improved to 8.45 from 31 on the conventional PUFs.

The arbiter-PUF with high uniqueness utilizing novel arbiter circuit with Delay-Time Measurement

PROBLEM TO BE SOLVED: To provide a semiconductor device that prevents a pair of electromagnetically coupled inductors from leaching each other by at least the thickness of a substrate SOLUTION: The semiconductor device 1 includes a pair of electromagnetically coupled inductors 5 and 6 The inductors 5 and 6 each includes a plurality of through electrodes penetrating a semiconductor device substrate 3a and interconnects connecting the plurality of through electrodes in series COPYRIGHT: (C)2011,JPO&INPIT

Semiconductor device and method of manufacturing semiconductor device

In the field of image recognition, machine learning technologies, especially deep learning, have been rapidly advancing alongside with the advances of hardware such as GPUs. In image recognition, in general, large numbers of labeled sets containing image and correct value pairs to be identified are input to a neural network, and repeatedly learning the set enables the neural network to identify objects with high accuracy. A new side-channel attack method, deep learning side-channel attack (DLSCA), utilizes the high identifying ability of the neural network to try and unveil a secret key of the cryptographic module by being trained with power waveforms and learning the leak model. However, at this stage, attacks on software implementations have been mainly investigated. In contrast, there are few studies about hardware implementations especially such as ASIC circuits. In this paper, we investigate the use of DL-SCA against hardware implementations of AES and demonstrate that it is able to unveil the secret key by applying a new technique named "mixed model dataset based on round-round XORed value." We also compare the attack performance and characteristics of DL-SCA with conventional analysis methods such as correlation power analysis and conventional template attack.

Mitsuru Shiozaki

Papers

Reversing Stealthy Dopant-Level Circuits

On measurable side-channel leaks inside ASIC design primitives

The arbiter-PUF with high uniqueness utilizing novel arbiter circuit with Delay-Time Measurement

Semiconductor device and method of manufacturing semiconductor device

Deep Learning Side-Channel Attack Against Hardware Implementations of AES