Countermeasures against hardware attack using power-based information leakage

The impedance characteristics of a power distribution system are analyzed in the previous chapter based on a one-dimensional circuit model. While useful for understanding the principles of the overall operation of a power distribution system, a one-dimensional model is not useful in describing the distribution of power and ground across a circuit die. The size of an integrated circuit is usually considerably greater than the wavelength of the signals in the power distribution network. Furthermore, the power consumption of on-chip circuitry (and, consequently, the current drawn from the power distribution network) varies across the die area. The voltage across the on-chip power and ground distribution networks is therefore non-uniform. It is therefore necessary to consider the two-dimensional structure of the on-chip power distribution network to ensure that target performance characteristics of a power distribution system are satisfied. The on-chip power distribution network should also be considered in the context of a die-package system as the properties of the die-package interface significantly affect the constraints imposed on the electrical characteristics of the on-chip power distribution network.

Elliptic Curve Cryptography operations rely heavily on the strong security of scalar multiplication. However, this operation is vulnerable to side channel (SCA) and fault injection (FA) attacks. The use of alternative arithmetic systems like Residue Number System (RNS) for all scalar multiplication underline operations has been proposed as an efficient countermeasure approach for the above attacks. In RNS, a number is represented as a set of smaller numbers, where each one is the result of the modular reduction with a given moduli basis. Under certain requirements, a number can be uniquely transformed from the integers to the RNS domain (and vice versa) and all arithmetic operations can be performed in RNS. This representation provides an inherent SCA and FA resistance to many attacks and can be further enhanced by additional RNS arithmetic manipulations or more traditional algorithmic countermeasures. In this paper, extending our previous work, we explore the potentials of RNS as an SCA and FA countermeasure. A description of RNS based SCA and FA resistance means is provided through appropriate scalar multiplication algorithmic variations, traces of the proposed algorithm are collected and the results are analyzed regarding the RNS countermeasure strength. More specifically, in this paper, a secure RNS based Montgomery Power Ladder based scalar multiplication algorithm is provided and is implemented on an ARM Cortex A7 processor. The implementation SCA-FA resistance is evaluated by collecting preliminary leakage trace results that validate our initial assumptions.

In this paper, we propose a model for 3-D stacked on-chip power distribution networks (PDNs) in through silicon via (TSV)-based 3-D memory ICs that includes the effects of power/ground TSVs (P/G TSVs), on-chip decoupling capacitors (on-chip decaps), and the silicon substrate. In the modeling procedure of 3-D stacked on-chip PDNs, the distributed RLGC-lumped model of an on-chip PDN, including the effects of the on-chip decaps and silicon substrate, is proposed. Additionally, the RLGC-lumped model of a P/G TSV pair is introduced. The proposed model of the 3-D stacked on-chip PDN combines the proposed models of on-chip PDNs with the models of P/G TSV pairs in a hierarchical order with a segmentation method. The proposed models of the on-chip PDN and 3-D stacked on-chip PDN are successfully validated by simulations and measurements up to 20 GHz. Additionally, with these models, the impedances of the 3-D stacked on-chip PDNs are analyzed with respect to the variations in the number of P/G TSV pairs, the capacitance of on-chip decaps, and the height of an interlayer dielectric layer between the on-chip PDN and silicon substrate. These variations critically affect the impedance of the 3-D stacked on-chip PDN by changing the capacitance and inductance of the PDN.

In this paper, we design and analyze the hierarchical power distribution network (PDN) for full wafer scale chip (FWSC) module. With its high bandwidth and low latency, FWSC has been considered a promising solution in the artificial intelligence (AI) processor market. However, the huge size of FWSC inevitably leads to long current paths and high impedance that consequently cause large IR drop and power/ground noise. In an effort to overcome these issues, the hierarchical PDN of FWSC module is designed in a 3D structure that allows direct interconnection from PCB to chip to minimize the current path. Although there are several studies related to PDN design for FWSC module, they conducted limited analysis on a specific PDN only. We design the hierarchical PDN for FWSC module composed of PCB PDN, multi-array silicone rubber socket (SRS)-based PDN, multi-array through wafer via (TWV)-based PDN, and on-chip PDN. Each PDN component was modeled into equivalent circuit models. Then, we fully analyzed the overall hierarchical PDN impedance in the frequency domain.

In this paper, the reduction of power distribution network noise and jitter at high-speed output buffer by using on-chip linear voltage regulator module circuit is introduced and analyzed. The transient response of typical on-chip linear VRM circuit is analyzed in power gating condition. When the on-chip linear VRM circuit is inserted between on-chip PDN and operating high-speed output buffers, the on-chip PDN noise and jitter at output buffer are significantly reduced. The larger on-chip decoupling capacitor leads to the lower PDN noise generated by on-chip linear VRM circuit. The on-chip linear VRM also reduces the impact of the aggressor buffer to the victim buffer in different PDN, resulting in the improved performance of the victim buffer. Reduction of PDN noise and jitter at output buffer using on-chip linear VRM are validated based on SPICE simulation with 110 nm CMOS technology library.

The rapid adoption of heterogeneous computing has driven the integration of Field Programmable Gate Arrays (FPGAs) into cloud datacenters and flexible System-on-Chips (SoCs). This paper shows that the integrated FPGA introduces a new security vulnerability by enabling software-based power side-channel attacks without physical proximity to a target system. We first demonstrate that an on-chip power monitor can be built on a modern FPGA using ring oscillators (ROs), and characterize its ability to observe the power consumption of other modules on the FPGA or the SoC. Then, we show that the RO-based FPGA power monitor can be used for a successful power analysis attack on an RSA cryptomodule on the same FPGA. Additionally, we show that the FPGA-based power monitor can observe the power consumption of a CPU on the same SoC, and demonstrate that the FPGA-to-CPU power side-channel attack can break timing-channel protection for a RSA program running on a CPU. This work introduces and demonstrates remote power side-channel attacks using an FPGA, showing that the common assumption that power side-channel attacks require specialized equipment and physical access to the victim hardware is not true for systems with an integrated FPGA.

Trade secrets such as intellectual properties are the inherent values for firms. Although companies have exploited strict access management policies and isolated their networks from the public Internet, trade secrets are still vulnerable to side-channel attacks. Side-channels can reveal the computing processes of computers in forms of various physical signals such as light, electromagnetism, and even heat. Such side-channels can bypass the isolation mechanism and therefore bring about severe threats. However, existing side-channels can only perform well within a short-distance (e.g., less than 1 meter) due to the high attenuation of signals. In this paper, we seek to utilize the built-in power lines in a building and construct a power side-channel that enables remote, i.e., cross-outlet attack against trade secrets. To this end, we investigate the power factor correction (PFC) module inside the power supply units of commodity computers and find that the PFC signals observed from an outlet can precisely reveal the power consumption information of all the connected devices, even from the outlets in adjacent rooms. Based upon this insight, we design and implement OutletSpy, a power side-channel attack that can infer application launching from a remote outlet and therefore enjoys the stealthiness property. We validate and evaluate OutletSpy with a dataset under different background APPs, time variations and different locations. The experiment results show OutletSpy can infer the application launching with 98.25% accuracy.

A design methodology for incorporating Residue Number System (RNS) and Polynomial Residue Number System (PRNS) in Montgomery modular multiplication in GF(p) or GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ) respectively, as well as a VLSI architecture of a dual-field residue arithmetic Montgomery multiplier are presented in this paper. An analysis of input/output conversions to/from residue representation, along with the proposed residue Montgomery multiplication algorithm, reveals common multiply-accumulate data paths both between the converters and between the two residue representations. A versatile architecture is derived that supports all operations of Montgomery multiplication in GF(p) and GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ), input/output conversions, Mixed Radix Conversion (MRC) for integers and polynomials, dual-field modular exponentiation and inversion in the same hardware. Detailed comparisons with state-of-the-art implementations prove the potential of residue arithmetic exploitation in dual-field modular multiplication.

Wen-Sheng Zhao from Hangzhou University, China, talks to Electronics Letters about the paper ‘Novel electromagnetic bandgap structure for wideband suppression of simultaneous switching noise’, page 1243 Wen-Sheng Zhao My research fields include interconnect modelling, multiphysics simulations and microwave sensor design. My major research topic is signal and power analysis of silicon via (TSV)-based 3D integrated systems. In recent years, the fourth industry revolution has shown an urgent need to develop next generation memory modules. As a key technology of industry 4.0, TSV-based high-bandwidth memory (HBM) has attracted a lot of interest from both the research and industrial worlds. To guarantee the system performance, it is necessary to perform signal/power/thermal integrity analysis for an HBM module. We are currently working on the issues related to the physical design of HBM modules (such as TSV modeling, equaliser design, and power noise suppression). Modern circuits are developing towards miniaturisation, high frequency and low power consumption, which puts strict constraints on the signal and power integrity design. For example, the operating voltages are continuously lowered, thereby limiting noise margin in power distribution network (PDN). Under such circumstances, power/ground noise is becoming a serious problem. To resolve this issue, various techniques including decoupling capacitor and electromagnetic bandgap (EBG) have been proposed and are under study. In comparison with decoupling capacitor, EBG structure can provide wideband noise suppression, and has been widely explored in the chip, package, and board. To improve the system performance, it is always desirable to increase the stopband bandwidth and rejection level of EBG structure. In this Letter, a power plane with coplanar EBG etched in the S-bridge EBG was proposed. With the proposed EBG structure, an ultrawide bandgap from 0.28 to 25 GHz with a high suppression level of -45 dB was achieved. Moreover, the signal integrity performance of the proposed EBG power plane was examined. The signal integrity can be ensured by utilising differential traces as the transmission structure. The proposed design can be used to reduce power/ground noise efficiently for mixed signal systems. We expect the proposed design to provide performance improvements in various mixed-signal systems in the immediate future. Currently, we are also working on developing EBG structures for silicon interposer and on-chip PDN. In the longer term, we expect that the EBG structures can be further explored and used in the physical design optimisation of HBM systems. As the clock frequency of the circuit system is continuously increased, the frequency of the simultaneous switching noise (SSN) also increases. However, the low-frequency components of the noise are not reduced accordingly. Therefore, the major issue we faced was developing a wide stopband EBG structure with a low cutoff frequency. Moreover, as grooves etched on the power/ground plane have an adverse impact on the signal transmission, we had to pay special attention to ensure signal integrity in the EBG design procedure. When we began studying TSV technologies, there was very little real-world deployment. Although several semiconductor giants such as Samsung presented some TSV based memory modules, these systems remained in the laboratory stage. Nowadays, TSV technology has matured, and the TSV-based HBM modules have been used in many graphics processing units since 2015. We are currently working on the physical design and optimisation (including signal and power integrity analysis) for TSV-based integrated systems. We have seen the introduction of many kinds of techniques (e.g., EBG, equaliser, differential signaling, and active decoupling) which will be helpful for future designs. There is no doubt that further improvements are always desirable to promote wide applications of TSV based integrated systems.

GPUs have been increasingly adopted as hardware accelerators for neural networks (NN). Prior studies show that the unique execution model and many DC-DC units on GPUs make it uneasy to reverse engineer detailed information of encryption algorithms through power side-channel attacks. However, we observe that a few core parameters of NN can be acquired through power profiling when victim and attacker share a GPU. We discuss potential solutions for the power side-channel attacks on GPUs.

In this paper, we show the advantages of 3-D stacked through silicon via (TSV) in high chip density package in aspect of wideband and low power distribution network (PDN) impedance. We selected large size (80 μm) and large pitch (200 μm) TSV with thick silicon substrate (Si, 80 μm, aspect ratio =1) for on-chip PDN, and compared two total PDN impedances of a PDN with TSVs and a PDN with wire-bondings depending on number of stacked chips from 2 to 10 on a single package. PDN impedance with TSVs includes total capacitance and inductance of TSV and 20 mm × 20 mm package substrate. PDN impedance with wire-bondings shows total capacitance and inductance of wire-bondings and same size package substrate. PDN impedance with TSVs has lower levels with wide bandwidth from 10 MHz to 5 GHz except serial resonance frequency range of the package substrate around 350 MHz. In low frequency range from 10 MHz to 350 MHz, total capacitance of a PDN with TSVs is larger than that of a PDN with wire-bonding because of 0.1 μm thickness silicon oxide (Si02) for blocking DC leakage from TSV to Si substrate. Over 350 MHz, total inductance of a PDN with TSVs is smaller than that of a PDN with wire-bonding because TSV is the smallest electrical path from top surface of stacked chips to the package PDN. The effectiveness of lowering total PDN impedance is better when the number of stacked chips is growing because total length of TSVs is linearly increased with factor 1 while total length of wire-bonding is done with factor √2.

In this paper, a new countermeasure against power and electromagnetic (EM) Side Channel Attacks (SCA) on FPGA implemented cryptographic algorithms is proposed. This structure mainly focuses on a critical vulnerability, Early Evaluation, also known as Early Propagation Effect (EPE), which exists in most conventional SCA-hardened DPL (Dual-rail with Precharge Logic) solutions. The main merit of this proposal is that the EPE can be effectively prevented by using a synchronized non regular precharge network, which maintains identical routing between the original and mirror parts, where costs and design complexity compared with previous EPE-resistant countermeasures are reduced, while security level is not sacrificed. Another advantage for our Precharge Absorbed(PA) - DPL method is that its Dual-Core style (independent architecture for true and false parts) could be generated using partial reconfiguration. This helps to get a dynamic security protection with better energy planning. That means system only keeps the true part which fulfills the normal en/decryption task in low security level, and reconfigures the false parts once high security level is required. A relatively limited clock speed is a compromise, since signal propagation is restricted to a portion of the clock period. In this paper, we explain the principles of PA-DPL and provide the guidelines to design this structure. We experimentally validate our methods in a minimized AES co-processor on Xilinx Virtex-5 board using electromagnetic (EM) attacks.

Dynamic restructuring of cryptographic implementations has been proposed as a viable countermeasure against power and electromagnetic-based Side Channel Attacks (SCA).These kind of countermeasures involve shuffling between functionally identical but structurally different realizations (known as variants) of a cryptographic circuit using Partial Reconfiguration.Previous studies show that the overall resistance of this countermeasure relies on the strength of individual variants.In this work we explore the possibility to use AMD Xilinx Vivado's implementation strategies to easily generate variants and evaluate their influence on the resistance of AES against SCA using various metrics.For different implementation strategies, we present leakage behavior for individual bits of the resulting AES realizations and also their impact on overall resistance against SCA. CCS Concepts Security and privacy Side-channel analysis and countermeasures.

This paper focuses on the modeling and analysis of different power distribution network (PDN) structures in 3D TSV ICs, including 3D full wave model and equivalent circuit model. In addition, a simplified equivalent circuit model of stacked PDN is proposed to analysis aspects influencing stacked PDN impedance, such as number of ground TSVs, number of TSV pairs and number of stacked layers. Analyses about how these aspects influencing total capacitance, inductance of stacked PDN and causing resonance in PDN self-impedance (Z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">11</sub> ) are made in detail. What's more, power noise in different stacked PDN structures is calculated and analyzed in time domain to evaluate their power integrity features. Analysis in this paper can offer instructions for the design and analysis of on-chip PDN.

In this paper, the authors presented a new parallel architecture to avoid side-channel analysis such as: timing attack, simple/differential power analysis, fault induction attack and simple/differential electromagnetic analysis. Montgomery multiplication based on residue number systems was used. Thanks to RNS, a design which is able to perform an RSA signature in parallel on was developed a set of identical and independent coprocessors. Of independent interest, the authors proposed a new DPA countermeasure when RNS are used that is only (slightly) memory consuming. Finally, the new architecture was synthesized on FPGA and it presents promising performance results. Even if the aim is to sketch a secure architecture, the RSA signature is performed in less than 150 ms, with competitive hardware resources. To the authors' knowledge, this is the first proposal of an architecture counteracting electromagnetic analysis apart from hardware countermeasures reducing electromagnetic radiations