Today’s smartphone operating systems frequently fail to provide users with visibility into how third-party applications collect and share their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid enables realtime analysis by leveraging Android’s virtualized execution environment. TaintDroid incurs only 32p performance overhead on a CPU-bound microbenchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, in our 2010 study we found 20 applications potentially misused users’ private information; so did a similar fraction of the tested applications in our 2012 study. Monitoring the flow of privacy-sensitive data with TaintDroid provides valuable input for smartphone users and security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-5d8smsr0iy.pdf

TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones

Today's smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid provides realtime analysis by leveraging Android's virtualized execution environment. TaintDroid incurs only 14% performance overhead on a CPU-bound micro-benchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, we found 68 instances of potential misuse of users' private information across 20 applications. Monitoring sensitive data with TaintDroid provides informed use of third-party applications for phone users and valuable input for smartphone security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-3fnz9lwdso.pdf

TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

Ordered Binary-Decision Diagrams (OBDDs) represent Boolean functions as directed acyclic graphs. They form a canonical representation, making testing of functional properties such as satisfiability and equivalence straightforward. A number of operations on Boolean functions can be implemented as graph algorithms on OBDD data structures. Using OBDDs, a wide variety of problems can be solved through symbolic analysis. First, the possible variations in system parameters and operating conditions are encoded with Boolean variables. Then the system is evaluated for all variations by a sequence of OBDD operations. Researchers have thus solved a number of problems in digital-system design, finite-state system analysis, artificial intelligence, and mathematical logic. This paper describes the OBDD data structure and surveys a number of applications that have been solved by OBDD-based symbolic analysis.

/pdf/symbolic-boolean-manipulation-with-ordered-binary-decision-cpwxp0mluy.pdf

Symbolic Boolean manipulation with ordered binary-decision diagrams

Physical Unclonable Functions (PUFs) are innovative circuit primitives that extract secrets from physical characteristics of integrated circuits (ICs). We present PUF designs that exploit inherent delay characteristics of wires and transistors that differ from chip to chip, and describe how PUFs can enable low-cost authentication of individual ICs and generate volatile secret keys for cryptographic operations.

/pdf/physical-unclonable-functions-for-device-authentication-and-4tsc0jtbn3.pdf

Physical unclonable functions for device authentication and secret key generation

Physical Unclonable Functions for Device Authentication and Secret Key Generation

The power estimation methods described in the previous chapters apply to combinational logic blocks. In this chapter we describe techniques that target issues particular to sequential circuits.

Power Estimation for Sequential Circuits

Secure Processors Part I: Background, Taxonomy for Secure Enclaves and Intel SGX Architecture

/pdf/secure-processors-part-i-background-taxonomy-for-secure-3lnwh17wi6.pdf

Recently developed methods for power estimation have primarily focused on combinational logic. In this paper, we present a framework for the e cient and accurate estimation of average power dissipation in sequential circuits. Switching activity is the primary cause of power dissipation in CMOS circuits. Accurate, average switching activity estimation for sequential circuits is considerably more di cult than for combinational circuits, because the probability of the circuit being in each of its possible states has to be calculated. The Chapman-Kolmogorov equations can be used to accurately estimate the power dissipation of sequential circuits by computing the exact state probabilities in steady state. However, the Chapman-Kolmogorov method requires the solution of a linear system of equations of size 2 N , where N is the number of ipops in the machine. We describe a comprehensive framework for exact and approximate switching activity estimation in this paper. The basic computation step is the solution of a non-linear system of equations. Increasing the number of variables or the number of equations in the system results in increased accuracy. For a wide variety of examples, we show that the approximation scheme is within 1 3% of the exact method, but is orders of magnitude faster for large circuits. Previous sequential switching activity estimation methods can have signi cantly greater inaccuracies. J. Monteiro and S. Devadas were supported in part by the Defense Advanced Research Projects Agency under contract N00014-91-J-1698 and in part by a NSF Young Investigator Award with matching funds from Mitsubishi and IBM Corporation. C-Y. Tsui, M. Pedram and A. Despain are with the Department of Electrical Engineering at the University of Southern California. J. Monteiro and S. Devadas are with the Department of Electrical Engineering and Computer Science at the Massachusetts Institute of Technology, Cambridge. B. Lin is with IMEC, Belgium. Latches Combinational Logic P r i m a r y I n p u t s P r i m a r y O u t p u t s Present States Next States Clock Figure 1: A Synchronous Sequential Circuit

Exact and Approximate Methods of Switching Activity Estimation in Sequential Logic Circuits

The techniques described have been implemented in a multilayer channel router called Chameleon. Chameleon consists of two stages: a partitioner and a detailed router. The partitioner divides the problems into two-layer and three-layer subproblems such that global channel area is minimized. The detailed router then implements the connections using generalizations of the algorithms used in YACR2 (see ibid., vol.CAD-4, no.3, p.208-19, 1985). In particular, a three-dimensional maze router is used for the vertical connections; this methodology is effective even when cycle constraints are present. Chameleon has produced optimal results on a wide range of industrial and academic examples for a variety of layer and pitch combinations, and can handle a variety of technology constraints. >

Techniques for multilayer channel routing

Timing simulation is a widely used method to verify the timing behavior of a design. In a synchronous digital system the timing property that needs to be verified is that there is no event at the outputs of the combinational parts of the circuit at or after time /spl tau/, the clock period. In this paper we first show that conventional timing simulation applied to this problem has exponential complexity. Next we demonstrate that for this problem a complete history of circuit activity before time /spl tau/ is not needed. We exploit this observation and present an event suppression method that potentially leads to an exponential reduction in the number of events that need to be processed during simulation. This is backed by encouraging experimental results. >

Srinivas Devadas

Papers

Power Estimation for Sequential Circuits

Secure Processors Part I: Background, Taxonomy for Secure Enclaves and Intel SGX Architecture

Exact and Approximate Methods of Switching Activity Estimation in Sequential Logic Circuits

Techniques for multilayer channel routing

Event suppression: improving the efficiency of timing simulation for synchronous digital circuits