Leveraging Unspecified Functionality in Obfuscated Hardware for Trojan and Fault Attacks

Hu, Wei; Ma, Yixin; Wang, Xinmu; Wang, Xingxin

doi:10.1109/asianhost47458.2019.9006725

Cited by 6 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hu et al used internal don't-care conditions as a Trojan trigger [24]. Finally, Hu et al targeted obfuscated designs by focusing on incorrect obfuscation keys as unspecified functionality to insert the Trojan [62]. Works on hardware Trojans assume a strong threat model, where the adversary has physical or logical access to the design.…”

Section: A Don't-care Hardware Trojansmentioning

confidence: 99%

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mahmoud,

Shokry,

Lenders

et al. 2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

Cloud computing environments increasingly provision field-programmable gate arrays (FPGAs) for their programmability and hardware-level parallelism. While FPGAs are typically used by one tenant at a time, multitenant schemes supporting spatial sharing of cloud FPGA resources have been proposed in the literature. However, the spatial multitenancy of FPGAs opens up new attack surfaces. Investigating potential security threats to multitenant FPGAs is thus essential for better understanding and eventually mitigating the security risks. This work makes a notable step forward by systematically analyzing the combined threat of FPGA power wasters and satisfiability don't-care hardware Trojans in shared cloud FPGAs. We demonstrate a successful remote undervolting attack that activates a hardware Trojan concealed within a victim FPGA design and exploits the payload. The attack is carried out entirely remotely, assuming two spatially colocated FPGA users isolated from one another. The victim user's circuit is infected with a Trojan, triggered by a pair of don't-care signals that never reach the combined trigger condition during regular operation. The adversary, targeting the exploitation of the Trojan, deploys power waster circuits to lower the supply voltage of the FPGA. The assumption is that, under the effect of the lowered voltage, don't-care signals may reach the particular state that triggers the Trojan. We name this exploit X-Attack and demonstrate its feasibility on an embedded FPGA and real-world cloud FPGA instances. Additionally, we study the effects of various attack tuning parameters on the exploit's success. Finally, we discuss potential countermeasures against this security threat and present a lightweight self-calibrating countermeasure. To the best of our knowledge, this is the first work on undervolting-based fault-injection attacks in multitenant FPGAs to demonstrate the attack on commercially available cloud FPGA instances.INDEX TERMS FPGA security, hardware Trojans, multitenancy, timing faults, remote attack I. INTRODUCTION

show abstract

Section: A Don't-care Hardware Trojansmentioning

confidence: 99%

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mahmoud,

Shokry,

Lenders

et al. 2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Such don't care HTs can be hard to detect since they are out of the functional specification. A more recent work hides HT in the unspecified functionality in obfuscated hardware designs [13]. Based on the fact that the design functionality under incorrect obfuscation keys cannot be explicitly specified in order to protect the correct key, the IP designer has numerous flexibility in implementing the obfuscation logic, including inserting malicious circuitry.…”

Section: Hardware Trojanmentioning

confidence: 99%

“…Besides, several HTs target emerging computing technologies. In [13], a HT is hidden in the obfuscation logic intended for IP protection. In [6], a remote HT attack targeting multitenant FPGAs deployed in the cloud was demonstrated.…”

Section: ) Trojans Insertion Throughmentioning

confidence: 99%

“…They usually target security assets like cryptographic functions, secure architectures, intellectual property (IP) and machine learning (ML) models. While classic hardware security threats such as covert and side channels, hardware Trojans and reverse engineering (RE) are constantly evolving, recent powerful attacks exploit remote [6], [11], cross-layer [2], [3], [12], specification-compatible [8], [13] attack surfaces to compromise strong cryptographic primitives, isolation mechanisms, memory protection techniques and deep neural networks (DNNs). Understanding the different hardware security threats is an important first step to developing effective security countermeasures and design tools for circumventing them.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Overview of Hardware Security and Trust: Threats, Countermeasures, and Design Tools

Chang

Sengupta

et al. 2021

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Their idea was to use internal design states that will never be satisfied (e.g., two signals cannot be logical 1 at the same time) in normal operation as Trojan trigger. Another recent work used the unspecified functionality in an obfuscated design to implement hardware Trojans [16]; it leveraged the fact that the end user usually does not care about the design behavior under incorrect obfuscation keys. Existing don't-care Trojan research usually relies on a strong threat model, assuming physical or logical access to the Trojan design in order to manipulate inputs, inject faults, and probe the Trojan payload.…”

Section: B Don't-care Hardware Trojansmentioning

confidence: 99%

X-Attack: Remote Activation of Satisfiability Don't-Care Hardware Trojans on Shared FPGAs

Mahmoud

Stojilović

2020

2020 30th International Conference on Field-Programmable Logic and Applications (FPL)

Self Cite

View full text Add to dashboard Cite

Albeit very appealing, FPGA multitenancy in the cloud computing environment is currently on hold due to a number of recently discovered vulnerabilities to side-channel attacks and covert communication. In this work, we successfully demonstrate a new attack scenario on shared FPGAs: we show that an FPGA tenant can activate a dormant hardware Trojan without any physical or logical connection to the private Trojan-infected FPGA circuit. Our victim contains a so-called satisfiability don't-care Trojan, activated by a pair of don't-care signals, which never reach the combined trigger condition under normal operation. However, once a malicious FPGA user starts to induce considerable fluctuations in the on-chip signal delaysand, consequently, the timing faults-these harmless don't-care signals take unexpected values which trigger the Trojan. Our attack model eliminates the assumption on physical access to or manipulation of the victim design. Contrary to existing fault and side-channel attacks that target unprotected cryptographic circuits, our new attack is shown effective even against provably well-protected cryptographic circuits. Besides demonstrating the attack by successfully leaking the entire cryptographic key from one unprotected and one masked AES S-box implementation, we present an efficient and lightweight countermeasure.

show abstract

Leveraging Unspecified Functionality in Obfuscated Hardware for Trojan and Fault Attacks

Cited by 6 publications

References 17 publications

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

An Overview of Hardware Security and Trust: Threats, Countermeasures, and Design Tools

X-Attack: Remote Activation of Satisfiability Don't-Care Hardware Trojans on Shared FPGAs

Contact Info

Product

Resources

About