Detection Mechanisms for Unauthorized Wireless Transmissions

Abstract

With increasing diversity of supply chains from design to delivery, there is an increasing risk that unauthorized changes can be made within an IC. One of the motivations for this type of change is to learn important information (such as encryption keys, spreading codes) from the hardware, and transmit this information to a malicious party. To evade detection, such unauthorized communication can be hidden within legitimate bursts of transmit signal. In this article, we present several signal processing techniques to detect unauthorized transmissions which can be hidden within the legitimate signal. We employ a scheme where the legitimate transmission is configured to emit a single sinusoidal waveform. We use time and spectral domain analysis techniques to explore the transmit spectrum. Since every transmission, no matter how low the signal power is, must have a spectral signature, we identify unauthorized transmission by eliminating the desired signal from the spectrum after capture. Experiment results show that when spread spectrum techniques are used, the presence of an unauthorized signal can be determined without the need for decoding the malicious signal. The proposed detection techniques need to be used as enhancements to the regular testing and verification procedures if hardware security is a concern.

Digital-to-Analog Hardware Trojan Attacks

“…Two HT payload mechanisms are shown in [29], one that uses a single pole double throw switch and a pair of resistors to alter the input termination impedance of the power amplifier, and another one that reprograms the gain stages. In [28], it is proposed to use spread spectrum techniques to hide an unauthorized transmission signal within the legitimate signal below the noise level. For all the aforementioned HT attacks, the IC passes all conventional specification tests and the transmission signal still obeys the transmission specifications and is within the margins allowed because of process variations.…”

“…However, the attacker knowing the HT payload mechanism can listen to the channel and recover the key. It has been demonstrated that this type of HTs can be detected by statistical side-channel fingerprinting [27], careful analysis of the transmitted signal spectrum [28], or adaptive channel estimation [29], which leverages the slowfading characteristics of indoor communication channels to distinguish between channel impairments and HT activity.…”

Leaking Wireless ICs via Hardware Trojan-Infected Synchronization

“…Several studies have demonstrated this type of HT attack. The HT can be embedded within the Medium Access Control (MAC) protocol [22], within the digital baseband physical layer (PHY) [23], [24], [25], [26], [27], or its payload mechanism can partially act upon the Analog Front-End (AFE) [28], [29], [30], [31], [32]. In parallel, these studies propose defenses for detecting the HT attack at test time or during run-time.…”

Hardware Trojan Attacks in Analog/Mixed-Signal ICs via the Test Access Mechanism

“…cipher keys. It has been demonstrated how the key can be encoded into minute differences in amplitudes or frequencies of the transmitted signal [11], [12] or into an unauthorized transmission signal that is hidden within the legitimate signal [13]. In both cases, the IC passes all conventional specification tests and the transmission signal still obeys to the transmission specifications and is within the margins allowed because of process variations.…”

“…However, the attacker knowing the HT payload mechanism can listen to the channel and recover the key. It has been demonstrated that this type of HTs can be detected by statistical fingerprinting [11], [12], careful analysis of the transmitted signal spectrum [13], or channel estimation [14]. Another interesting direction for HT design is to exploit the fact that an analog IC may have undesired states or operation modes [15].…”