While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party -- often overseas -- to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before effecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transition between digital values. When the capacitors fully charge, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely-controllable privilege escalation by attaching the capacitor to a wire controllable and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that our attacks work, show that our attacks elude activation by a diverse set of benchmarks, and suggest that our attacks evade known defenses.

A2: Analog Malicious Hardware

Logic locking and IC camouflaging are proactive circuit obfuscation methods that if proven secure can thwart hardware attacks such as reverse engineering and IP theft. However, the security of both these schemes is called into question by recent SAT based attacks. While a number of methods have been proposed in literature that exponentially increase the running time of such attacks, they are vulnerable to "findand-remove" attacks, and only slightly hide the circuit functionality. In this paper, we present a novel approach towards creating SAT attack resiliency based on creating densely cyclic obfuscated circuit topologies by adding dummy paths to the circuit. Our methodology is applicable to both IC camouflaging and logic locking. We demonstrate that cyclic logic locking creates SAT resilient circuits with 40% less area and 20% less delay compared to an insecure XOR/XNOR-obfuscation with the same key length. Furthermore, we show that cyclic IC camouflaging can be implemented at the layout level with no substrate area overhead and little delay and power overhead with respect to the original circuit.

Cyclic Obfuscation for Creating SAT-Unresolvable Circuits

There are increasing concerns about possible malicious modifications of integrated circuits (ICs) used in critical applications. Such attacks are often referred to as hardware Trojans. While many techniques focus on hardware Trojan detection during IC testing, it is still possible for attacks to go undetected. Using a combination of new design techniques and new memory technologies, we present a new approach that detects a wide variety of hardware Trojans during IC testing and also during system operation in the field. Our approach can also prevent a wide variety of attacks during synthesis, place-and-route, and fabrication of ICs. It can be applied to any digital system, and can be tuned for both traditional and split-manufacturing methods. We demonstrate its applicability for both application-specified integrated circuits and field-programmable gate arrays. Using fabricated test chips with Trojan emulation capabilities and also using simulations, we demonstrate: 1) the area and power costs of our approach can range between 7.4%–165% and 7%–60%, respectively, depending on the design and the attacks targeted; 2) the speed impact can be minimal (close to 0%); 3) our approach can detect 99.998% of Trojans (emulated using test chips) that do not require detailed knowledge of the design being attacked; 4) our approach can prevent 99.98% of specific attacks (simulated) that utilize detailed knowledge of the design being attacked (e.g., through reverse engineering); and 5) our approach never produces any false positives, i.e., it does not report attacks when the IC operates correctly.

TPAD: Hardware Trojan Prevention and Detection for Trusted Integrated Circuits

The threat of hardware reverse engineering is a growing concern for a large number of applications. A main defense strategy against reverse engineering is hardware obfuscation. In this paper, we investigate physical obfuscation techniques, which perform alterations of circuit elements that are difficult or impossible for an adversary to observe. The examples of such stealthy manipulations are changes in the doping concentrations or dielectric manipulations. An attacker will, thus, extract a netlist, which does not correspond to the logic function of the device-under-attack. This approach of camouflaging has garnered recent attention in the literature. In this paper, we expound on this promising direction to conduct a systematic end-to-end study of the VLSI design process to find multiple ways to obfuscate a circuit for hardware security. This paper makes three major contributions. First, we provide a categorization of the available physical obfuscation techniques as it pertains to various design stages. There is a large and multidimensional design space for introducing obfuscated elements and mechanisms, and the proposed taxonomy is helpful for a systematic treatment. Second, we provide a review of the methods that have been proposed or in use. Third, we present recent and new device and logic-level techniques for design obfuscation. For each technique considered, we discuss feasibility of the approach and assess likelihood of its detection. Then we turn our focus to open research questions, and conclude with suggestions for future research directions.

Physical Design Obfuscation of Hardware: A Comprehensive Investigation of Device and Logic-Level Techniques

The globalization of the semiconductor supply chain introduces ever-increasing security and privacy risks. Two major concerns are IP theft through reverse engineering and malicious modification of the design. The latter concern in part relies on successful reverse engineering of the design as well. IC camouflaging and logic locking are two of the techniques under research that can thwart reverse engineering by end-users or foundries. However, developing low overhead locking/camouflaging schemes that can resist the ever-evolving state-of-the-art attacks has been a challenge for several years. This article provides a comprehensive review of the state of the art with respect to locking/camouflaging techniques. We start by defining a systematic threat model for these techniques and discuss how various real-world scenarios relate to each threat model. We then discuss the evolution of generic algorithmic attacks under each threat model eventually leading to the strongest existing attacks. The article then systematizes defences and along the way discusses attacks that are more specific to certain kinds of locking/camouflaging. The article then concludes by discussing open problems and future directions.

IP Protection and Supply Chain Security through Logic Obfuscation: A Systematic Overview

A successful detection of the stealthy dopant-level circuit trojan, proposed by Becker et al. at CHES 2013 [1], is reported. Contrary to an assumption made by Becker et al., dopant types in active region are visible with either scanning electron microscopy SEM or focused ion beam FIB imaging. The successful measurement is explained by an LSI failure analysis technique called the passive voltage contrast [2]. The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device [3]: an anti-reverse-engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with 1 an optical microscope, 2 SEM, and 3 FIB. As a result, the four possible dopant-well combinations, namely i p+/n-well, ii p+/p-well, iii n+/n-well and iv n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, however, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16-times expensive than that of a metal layer in terms of the number of images.

/pdf/reversing-stealthy-dopant-level-circuits-p8bi2l0q5g.pdf

Reversing Stealthy Dopant-Level Circuits

A successful detection of the stealthy dopant-level circuit (trojan), proposed by Becker et al. at CHES 2013 (LNCS 8086:197–214, 2013), is reported. Contrary to an assumption made by Becker et al. dopant types in active region are visible with either scanning electron microscopy (SEM) or focused ion beam (FIB) imaging. The successful measurement is explained by a technique called the passive voltage contrast (Rosenkranz J Mater Sci Mater Electron 22(10):1523–1535, 2011) which is used to analyze failures in large-scale integration (LSI). The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device (Shiozaki et al. Diffusion programmable device: a device to prevent reverse engineering, IACR Cryptology ePrint Archive 2014/109 2014): an anti-reverse engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with (1) an optical microscope, (2) SEM, and (3) FIB. As a result, the four possible dopant–well combinations, namely (i) p+/n-well, (ii) p+/p-well, (iii) n+/n-well and (iv) n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16 times more expensive than that of a metal layer in terms of the number of images.

/pdf/reversing-stealthy-dopant-level-circuits-13vhblsc78.pdf

Reversing stealthy dopant-level circuits

PROBLEM TO BE SOLVED: To provide a manufacturing method for a semiconductor device which suppresses chipping and cracking of a semiconductor substrate. SOLUTION: A passivation film 3 is formed on the front surface 1a of a semiconductor substrate 1 such that it extends along the outer peripheral end with a given width extending inward from the outer peripheral end. The outer peripheral end of the semiconductor substrate 1 is then ground to form an outer peripheral end face 1c perpendicular to the front surface 1a and a back surface 1b. The back surface 1b is ground to reduce the thickness of the semiconductor substrate 1 to a predetermined thickness. The ground back surface 1b is faced upward and the semiconductor substrate 1 is rotated as a mixed acid is delivered to the upward facing back surface 1b. The back surface 1b is thus etched to eliminate a crushed layer. COPYRIGHT: (C)2011,JPO&INPIT

Manufacturing method for semiconductor device

A method of manufacturing a power semiconductor device according to the present invention includes the steps of: (a) forming a silicon nitride film on a semiconductor substrate; (b) after the step (a), forming a ring-shaped trench along a peripheral portion of the semiconductor substrate 6 ; (c) forming a first silicon oxide film on an inner surface of the trench; (d) after the step (c), forming a second silicon oxide film on an entire surface of the semiconductor substrate to bury the trench; (e) planarizing the second silicon oxide film by using the silicon nitride film as a stopper; and (f) forming a third silicon oxide film in a region in which the silicon nitride film is removed.

Power semiconductor device and method of manufacturing the same

Verfahren zum Herstellen einer Leistungshalbleitervorrichtung, aufweisend die folgenden Schritte: (a) Ausbilden einer Siliziumnitridschicht (7) auf einem Halbleitersubstrat (6); (b) nach Schritt (a), Ausbilden eines ringformigen Grabens (2) entlang einem umfangsseitigen Abschnitt des Halbleitersubstrats (6) als Abschlussstruktur eines Zellenbereiches (4) und Definieren des Inneren des Rings als den Zellenbereich (4); (c) Ausbilden einer ersten Siliziumoxidschicht (10) auf einer inneren Oberflache des Grabens (2); (d) nach Schritt (c), Ausbilden einer zweiten Siliziumoxidschicht (13) auf der gesamten Oberflache des Halbleitersubstrats (6), um den Graben (2) zu fullen; (e) Planarisieren der zweiten Siliziumoxidschicht (13) unter Verwendung der Siliziumnitridschicht (7) als Stopper; und (f) Entfernen der Siliziumnitridschicht (7) und anschliesendes Ausbilden einer dritten Siliziumoxidschicht (14) in einem Bereich, in dem die Siliziumnitridschicht (7) entfernt wurde, wobei die dritte Siliziumoxidschicht (14) durch thermische Oxidation ausgebildet wird.

Ryoichi Fujii

Papers

Reversing Stealthy Dopant-Level Circuits

Reversing stealthy dopant-level circuits

Manufacturing method for semiconductor device

Power semiconductor device and method of manufacturing the same

Leistungshalbleitervorrichtung und Verfahren zur Herstellung derselben