A Physical Design Flow Against Front-Side Probing Attacks by Internal Shielding

Wang, Huanyu; Shi, Qihang; Nahiyan, Adib; Forte, Domenic; Tehranipoor, Mark

doi:10.1109/tcad.2019.2952133

Cited by 30 publications

(10 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A variety of countermeasures and evaluation techniques have emerged to counter FIB-based probing attacks. For example, in [31], an anti-probing physical design approach is introduced, which utilizes internal shield nets within the design layout. This method can establish single-layer and two-layer parallel shield structures to protect against probing from the top metal layer of the chip.…”

Section: Countermeasuresmentioning

confidence: 99%

“…• Improved simplicity and accuracy: We extend our linear programming-based approach in [31] to a hybrid model covering both linear and nonlinear scenarios such that the vulnerabilities of reroute attacks within the target layout can be analyzed in a more comprehensive and accurate manner. Although the linear programming we utilized previously can be effective in reroute attack vulnerability assessment, the linear constraints increase exponentially with respect to targets and associated shield nets.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Detour-RS: Reroute Attack Vulnerability Assessment with Awareness of the Layout and Resource

Gao,

Biswas,

Asadi

et al. 2024

Cryptography

Self Cite

View full text Add to dashboard Cite

Recent decades have witnessed a remarkable pace of innovation and performance improvements in integrated circuits (ICs), which have become indispensable in an array of critical applications ranging from military infrastructure to personal healthcare. Meanwhile, recent developments have brought physical security to the forefront of concern, particularly considering the valuable assets handled and stored within ICs. Among the various invasive attack vectors, micro-probing attacks have risen as a particularly menacing threat. These attacks leverage advanced focused ion beam (FIB) systems to enable post-silicon secret eavesdropping and circuit modifications with minimal traceability. As an evolved variant of micro-probing attacks, reroute attacks possess the ability to actively disable built-in shielding measures, granting access to the security-sensitive signals concealed beneath. To address and counter these emerging challenges, we introduce a layout-level framework known as Detour-RS. This framework is designed to automatically assess potential vulnerabilities, offering a systematic approach to identifying and mitigating exploitable weaknesses. Specifically, we employed a combination of linear and nonlinear programming-based approaches to identify the layout-aware attack costs in reroute attempts given specific target assets. The experimental results indicate that shielded designs outperform non-shielded structures against reroute attacks. Furthermore, among the two-layer shield configurations, the orthogonal layout exhibits better performance compared to the parallel arrangement. Furthermore, we explore both independent and dependent scenarios, where the latter accounts for potential interference among circuit edit locations. Notably, our results demonstrate a substantial near 50% increase in attack cost when employing the more realistic dependent estimation approach. In addition, we also propose time and gas consumption metrics to evaluate the resource consumption of the attackers, which provides a perspective for evaluating reroute attack efforts. We have collected the results for different categories of target assets and also the average resource consumption for each via, required during FIB reroute attack.

show abstract

Section: Countermeasuresmentioning

confidence: 99%

mentioning

confidence: 99%

Detour-RS: Reroute Attack Vulnerability Assessment with Awareness of the Layout and Resource

Gao,

Biswas,

Asadi

et al. 2024

Cryptography

Self Cite

View full text Add to dashboard Cite

show abstract

“…This type of attack is usually prevented by adding protecting shields (active or passive). Anyhow, these shields are expensive and consume, at least, a full metallization layer [45]. A second vulnerability exists during the reading of the cells.…”

Section: Rram Cell and Security Aspectsmentioning

confidence: 99%

“…In this context, we propose a multilayer array architecture, as illustrated in Figure 18. Multilayer RRAMs is a technology that has been already proposed as a way for building denser memories [44][45][46], therefore it can also be leveraged for this serial RRAM cell configuration, avoiding the need of a specific array design or technology, which could discourage its implementation. Two word-lines are necessary to bias nodes V ap1 (WL1) and V ap3 (WL2) while nodes V ap2 are connected through transmission gates to the bit lines.…”

Section: Array Architecturementioning

confidence: 99%

Serial RRAM Cell for Secure Bit Concealing

et al. 2021

View full text Add to dashboard Cite

Non-volatile memory cells are exposed to adversary attacks since any active countermeasure is useless when the device is powered off. In this context, this work proposes the association of two serial RRAM devices as a basic cell to store sensitive data, which could solve this bothersome problem. This cell has three states: ‘1’, ‘0’, and masked. When the system is powered off or the data is not used, the cell is set to the masked state, where the cell still stores a ‘1’ or a ‘0’ but a malicious adversary is not capable of extracting the stored value using reverse engineering techniques. Before reading, the cell needs to be unmasked and it is masked afterwards until the next reading request. The operation of the cell also provides robustness against side-channel attacks. The presented experimental results confirm the validity of the proposal.

show abstract

“…Since probing models and tools can identify nets of interest for an attacker to probe, they can be used to distribute these physical countermeasures in a more efficient way. [161] investigates a CAD flow to automatically place-and-route shields over the most critical nets, but its approach for selecting the nets is ad hoc and inapplicable to masked circuits. 6.1.5 Quantification of Side Channel-based Disassembly.…”

Section: Evaluation Of Probing Sensors and Physical Countermeasuresmentioning

confidence: 99%

Circuit Masking: From Theory to Standardization, A Comprehensive Survey for Hardware Security Researchers and Practitioners

Covic,

Ganji,

Forte

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Side-channel attacks extracting sensitive data from implementations have been considered a major threat to the security of cryptographic schemes. This has elevated the need for improved designs by embodying countermeasures, with masking being the most prominent example. To formally verify the security of a masking scheme, numerous attack models have been developed to capture the physical properties of the information leakage as well as the capabilities of the adversary. With regard to these models, extensive research has been performed to realize masking schemes. These research efforts have led to significant progress in the development of security assessment methodologies and further initiated standardization activities. However, since the majority of this work is theoretical, it is challenging for the more practice-oriented hardware security community to fully grasp and contribute to. To bridge the gap, these advancements are reviewed and discussed in this survey, mainly from the perspective of hardware security. In doing so, a clear taxonomy is provided that is helpful for a systematic treatment of the masking-related topics. By giving an extensive overview of the existing methods, this survey (1) provides a research landscape of circuit masking for newcomers to the field, (2) offers guidelines on which attack model and verification tool to choose when designing masking schemes, and (3) identifies interesting new research directions where masking models and assessment tools can be applied. Thus, this survey serves as an essential reference for hardware security practitioners interested in the theory behind masking techniques, the tools useful to verify the security of masked circuits, and their potential applications.

show abstract

A Physical Design Flow Against Front-Side Probing Attacks by Internal Shielding

Cited by 30 publications

References 14 publications

Detour-RS: Reroute Attack Vulnerability Assessment with Awareness of the Layout and Resource

Detour-RS: Reroute Attack Vulnerability Assessment with Awareness of the Layout and Resource

Serial RRAM Cell for Secure Bit Concealing

Circuit Masking: From Theory to Standardization, A Comprehensive Survey for Hardware Security Researchers and Practitioners

Contact Info

Product

Resources

About