ICBPI: Accurate and Validated Fine-Grained Power Estimation with Application to Thermal Hardware Trojan Detection and Localization in SOCs

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in‐house design team attacks, third‐party intellectual property vendor attacks, computer‐aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field‐programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti‐detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

Here, the side-channel attack (SCA)-resistant cryptographic chip: a cryptographic circuit employs a voltage scaling technique is studied with hardware Trojan attacks. Two different types of hardware Trojans, sequential hardware Trojan and combinational hardware Trojan, are proposed to be embedded into the SCA-resistant cryptographic chip for leaking the secret key. Moreover, the sequential Trojan can only disclose a single bit of the secret key at a time, while the combinational Trojan is able to leak the whole bit of the secret key at once. As demonstrated in the results, only analysing ∼270 (150) power traces are sufficient to disclose the 8-bit secret key of the sequential (combinational) Trojan-infected chip to the adversary. Furthermore, both the sequential and combinational Trojan-infected chips can evade the testing of the power attack and be detected with the proposed statistical models successfully.

Security is becoming an increasingly important parameter in current system-on-chip (SoC) design due to diverse hardware security attacks that can affect manufacturers, system designers or end users. To effectively address the security issues, design-time considerations, e.g. incorporation of design-for-security (DfS) features, are becoming essential. However, DfS measures for diverse security threats require specific design modifications to achieve target security level, which significantly increases design effort thus time-to-market, and usually incurs considerable design overhead. In addition, the general heterogeneous architecture of current SoCs makes many core-level DfS mechanisms unusable at SoC level. In this paper, we propose a centralized on-chip infrastructure IP for SoC security (IIPS), which alleviates the SoC designers from separately addressing different security issues through design modifications in multiple cores. It also provides ease of integration and functional scalability. We consider a specific implementation of IIPS that provides protection against: (1) scan-based attack for information leakage through low-overhead authentication; (2) counterfeiting attacks through integration of a Physical Unclonable Function (PUF); and (3) hardware Trojan attacks through a test infrastructure fortrust validation. To make the IP amenable for plug-and-play during SoC design, working protocols of the security functions are designed to comply with IEEE 1500 Standard for Embedded Core Test (SECT). Since IIPS resides outside the functional modules, it does not incur functional performance or power overhead. Simulations and experiments on example SoC designs validate the effectiveness of IIPS in providing protections against diverse attacks at a low hardware overhead.

Traditionally, Hardware is considered as root of trust. Software generally builds on top of the hardware. By emerging Hardware Trojan attacks, this trust seems to be violated. Hardware Trojan is any addition or modification to a circuit or a system with malicious intention. Trojan can cause change or control over functionality in circuit or it may leak sensitive information from inside the chip and hence reduce circuit reliability. In this paper, we analyze threats caused by hardware Trojan attacks and type of hardware Trojans. We have discussed state-of-art hardware Trojan protection schemes. The limitations and challenges related to those trojan detection schemes are described. We also propose simple but effective probabilistic method to detect and find the location of hardware trojan in combinational circuits. The experimental results for a series of ISCAS85 benchmark circuits show that better trojan detection rate or coverage can be achieved with proposed technique.

We propose a new power simulation technique that effectively considers dynamic program execution behaviors such as cache hit/miss or branch predicted/mis-predicted and achieves fast and accurate power estimation results. Traditionally, accurate software power estimation relies on slower fine-grained simulations while faster coarse-grained simulations often lead to inaccurate estimation results. We pre-characterize detailed circuit power consumption, pipeline and branch effects of each basic block for accuracy and then apply efficient instruction-set simulators to compute total software power consumption. The experimental result shows that our approach achieves over 200 MIPS performance with a less than 3% error rate.

Accurate and efficient power estimation at higher-levels of abstraction is becoming increasingly important. However, tools and methodologies are lacking for such a task. In this paper, we present a methodology for accurate power estimation at high-level by reusing pre-existing verification or validation resources in the design flow. This novel methodology enables architectural exploration and design optimization through a framework that exploits the abstraction aspect of high-level designs and the availability aspect of well-established tool flows for RTL designs. Thereby, utilizing the best from both worlds (high-level and low-level) to bring forth a fast and accurate enough solution to a well-known problem in the design of low power embedded systems and SoCs. In this paper, the focus is on how to apply our approach on a deign of reasonable complexity. We present the case study of a power state machine controller that is a critical component of most power-aware embedded systems. The approach uses verification collaterals such as test content, assertions, etc., which are normally built during the verification process of a high-level design to enable power profiling and estimation. The presented methodology is specific to a high-level synthesis and power estimation framework.

Hardware Trojans (HTs) can be implanted in security-weak parts of a chip with various means to steal the internal sensitive data or modify original functionality, which may lead to huge economic losses and great harm to society. Therefore, it is very important to perform hardware Trojan detection and diagnosis, find potential safety hazards and apply protection techniques in the whole IC design cycle, in order to enhance the security of chips. In this paper, we elaborate an IC market model, and describe the potential HT threats faced by the parties involved in the model. Then we survey the recent research advances in the countermeasures against HT attacks, which are classified into HT detection, diagnosis and prevention. Finally, the challenges and prospects for HT defense are illuminated.

Hardware Trojan detection via rewriting logic

Over the years, system on chip (SoC) designs have evolved extensively sophisticated in order to fulfil the need of increasing complexity of running applications driven by the advancement of VLSI technology. The next generation multiprocessor system on chip (MPSoC) integrates hundreds of processing elements on a single chip, expected to achieve high performance, low latency, and low-power consumption. Tiled chip multicore processors (TCMP) with network on chip (NoC) have become a foundation for the computation critical embedded and real-time systems. Faster time-to-market restraint and business competition compelled manufacturers to look for the prospects of manufacturing SoCs integrated with various third party intellectual property (3PIP). Usage of 3PIP gave rise to exploit the underlying interconnect while adding some unwanted malicious circuit known as hardware trojan (HT), making NoC vulnerable to get attacked. A tiniest manipulation of any communication attribute by HT can degrade the overall behaviour of the system significantly while impacting NoC performance metrics. In this paper, we present one of such study considering HT malign behaviour of manipulating the output port of each incoming flit from specific ports once genuine route computation takes place and re-directs all to one port causing disruption in tile communication.The proposed HT is intermittent in nature and activates for few cycles. We study the behaviour of proposed confluence attack and analyze its impact over network level. The empirical evaluation exhibits the misbehaviour of the packet communication in terms of wrong usage of VCs and extra hop distance overhead. To validate the proposed work, various performance metrics like buffer utilization, virtual channel utilization, number of flits processed, link utilization, and the like are analyzed. We also show that such HTs are difficult to detect due to marginal increase at malicious port traffic leaving no trace of malicious conduct.

We present efficient power estimation techniques for HW/SW System-On-Chip (SOC) designs. Our techniques are based on concurrent and synchronized execution of multiple power estimators that analyze different parts of the SOC (we refer to this as co-estimation), driven by a system-level simulation master. We motivate the need for power co-estimation, and demonstrate that performing independent power estimation for the various system components can lead to significant errors in the power estimates, especially for control-intensive and reactive embedded systems. We observe that the computation time for performing power co-estimation is dominated by: (i) the requirement to analyze/simulate some parts of the system at lower levels of abstraction in order to obtain accurate estimates of timing and switching activity information and (ii) the need to communicate between and synchronize the various simulators. Thus, a naive implementation of power co-estimation may be too inefficient to be used in an iterative design exploration framework. To address this issue, we present several acceleration (speedup) techniques for power co-estimation. The acceleration techniques are energy caching, software power macromodeling, and statistical sampling. Our speedup techniques reduce the workload of the power estimators for the individual SOC components, as well as their communication/synchronization overhead. Experimental results indicate that the use of the proposed acceleration techniques results in significant (8/spl times/ to 87/spl times/) speedups in SOC power estimation time, with minimal impact on accuracy. We also show the utility of our co-estimation tool to explore system-level power tradeoffs for a TCP/IP network interface card sub-system and an automotive controller.

Malicious Hardware Trojans can corrupt data which if undetected may cause serious harm. We propose a technique where characteristics of the data itself are used to detect Hardware Trojan (HT) attacks. In particular, we use a two-chip approach where we generate a data in analog and test for the signature in a partially reconfigurable digital microchip where the HT may attack. This paper presents an overall signature-based HT detection architecture and case study for cardiovascular signals used in medical device technology. Our results show that with minimal performance and area overhead, the proposed architecture is able to detect HT attacks on primary data inputs as well as on multiple modules of the design.

Malicious hardware modification, also known as hardware Trojan attack, has emerged as a serious security concern for electronic systems. Such attacks compromise the basic premise of hardware root of trust. Over the past decade, significant research efforts have been directed to carefully analyze the trust issues arising from hardware Trojans and to protect against them. This vast body of work often needs to rely on well-defined set of trust benchmarks that can reliably evaluate the effectiveness of the protection methods. In recent past, efforts have been made to develop a benchmark suite to analyze the effectiveness of pre-silicon Trojan detection and prevention methodologies. However, there are only a limited number of Trojan inserted benchmarks available. Moreover, there is an inherent bias as the researcher is aware of Trojan properties such as location and trigger condition since the current benchmarks are static. In order to create an unbiased and robust benchmark suite to evaluate the effectiveness of any protection technique, we have developed a comprehensive framework of automatic hardware Trojan insertion. Given a netlist, the framework will automatically generate a design with single or multiple Trojan instances based user-specified Trojan properties. It allows a wide variety of configurations, such as the type of Trojan, Trojan activation probability, number of triggers, and choice of payload. The tool ensures that the inserted Trojan is a valid one and allow for provisions to optimize the Trojan footprint (area and switching). Experiments demonstrate that a state-of-the-art Trojan detection technique provides poor efficacy when using benchmarks generated by our tool. This tool is available for download from http://www.trust-hub.org/.

Fast and accurate power estimation has become an important topic with the increasing need for low power electronics. In this paper we address the problem of using event-driven simulation tools for power estimation. We identify and compare two approaches: input-driven and output-driven, and propose several ways of improvement. The estimation accuracy is degraded in event-driven power estimators due to superfluous and partial glitches. We described glitch filtering and estimation techniques pertaining to input-driven and output-driven power estimators. An output-driven power estimator, Peony, was developed which used the proposed path power idea to improve the estimation accuracy. It achieved significant power estimation accuracy improvement at a speed of two orders of magnitude faster than Spice.

This paper presents a methodology to generate a hierarchy of power models for power estimation of custom hardware IP blocks, enabling a trade-off between power estimation accuracy, modeling effort and estimation speed. Our power estimation approach enables several novel system-level explorations - such as observing the effect of clock gating, and the effects of tweaking application-level parameters on system power - with an estimation accuracy that is close to the gate-level. We implemented our methodology on an H.264 video decoder prediction IP case study, created power models, and evaluated the effects of varying design parameters (e.g., clock gating, IIP frame ratios, quantization), allowing rapid system-level power exploration of these design parameters.