Probing Attacks on Integrated Circuits: Challenges and Research Opportunities

Wang, Huan‐Yu; Forte, Domenic; Tehranipoor, Mohammad; Shi, Qihang

doi:10.1109/mdat.2017.2729398

Cited by 79 publications

(27 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Sensitive information transmitted on wires in ICs can be physically extracted using contact-based electrical probing attack [10]. In this type of attack, the chip's wires are contacted by a probe, and as a result, the signal carried by the wires can be read out when the chip is functioning.…”

Section: B Vulnerabilities Of the Interconnectsmentioning

confidence: 99%

Defense-in-depth: A recipe for logic locking to prevail

Rahman

Wang

et al. 2020

Integration

Self Cite

View full text Add to dashboard Cite

Logic locking has emerged as a promising solution for protecting the semiconductor intellectual Property (IP) from the untrusted entities in the design and fabrication process. Logic locking hides the functionality of the IP by embedding additional key-gates in the circuit. The correct output of the chip is produced, once the correct key value is available at the input of the key-gates. The confidentiality of the key is imperative for the security of the locked IP as it stands as the lone barrier against IP infringement. Therefore, the logic locking is considered as a broken scheme once the key value is exposed. The research community has shown the vulnerability of the logic locking techniques against different classes of attacks, such as Oracle-guided and physical attacks. Although several countermeasures have already been proposed against such attacks, none of them is simultaneously impeccable against Oracle-guided, Oracle-less, and physical attacks. Under such circumstances, a defense-in-depth approach can be considered as a practical approach in addressing the vulnerabilities of logic locking. Defense-in-depth is a multilayer defense approach where several independent countermeasures are implemented in the device to provide aggregated protection against different attack vectors. Introducing such a multilayer defense model in logic locking is the major contribution of this paper. With regard to this, we first identify the core components of logic locking schemes, which need to be protected. Afterwards, we categorize the vulnerabilities of core components according to potential threats for the locking key in logic locking schemes. Furthermore, we propose several defense layers and countermeasures to protect the device from those vulnerabilities. Finally, we turn our focus to open research questions and conclude with suggestions for future research directions.

show abstract

Section: B Vulnerabilities Of the Interconnectsmentioning

confidence: 99%

Defense-in-depth: A recipe for logic locking to prevail

Rahman

Wang

et al. 2020

Integration

Self Cite

View full text Add to dashboard Cite

show abstract

“…Firstly, using the nomenclature of [42], there obviously are no łpermanentž or łnon-volatilež digital secrets inside the TCB or the RBT interface. This implies that the GeniePUF design is immune to any attacks stealing such digital secrets, including side channels [44] or probing attacks [50]. Depending on the employed underlying Strong PUF, other secrets may be contained in the GeniePUF: If an iPUF is used, as in our example, the physical runtime delays in the iPUF will constitute łpermanent physical secretsž, again using the language of [42].…”

Section: Security and Practicality Of Our Design 41 Security Of Our Constructionmentioning

confidence: 99%

Erasable PUFs

Jin

Burleson

Dijk

et al. 2020

Proceedings of the 4th ACM Workshop on Attacks and Solutions in Hardware Security

View full text Add to dashboard Cite

Physical Unclonable Functions (PUFs) have not only been suggested as new key storage mechanism, but Ð in the form of socalled łStrong PUFsž Ð also as cryptographic primitives in advanced schemes, including key exchange, oblivious transfer, or secure multiparty computation. This notably extends their application spectrum, and has led to a sequence of publications at leading venues such as IEEE S&P, CRYPTO, and EUROCRYPT in the past [3,6,10,11,29,41]. However, one important unresolved problem is that adversaries can break the security of all these advanced protocols if they gain physical access to the employed Strong PUFs after protocol completion [41]. It has been formally proven [49] that this issue cannot be overcome by techniques on the protocol side alone, but requires resolution on the hardware level Ð the only fully effective known countermeasure being so-called Erasable PUFs [36]. Building on this work, this paper is the first to describe a generic method how any given silicon Strong PUF with digital CRP-interface can be turned into an Erasable PUF. We describe how the Strong PUF can be surrounded with a trusted control logic that allows the blocking (or łerasurež) of single CRPs. We implement our approach, which we call łGeniePUFž, on FPGA, reporting detailed performance data and practicality figures. Furthermore, we develop the first comprehensive definitional framework for Erasable PUFs. Our work so re-establishes the effective usability of Strong PUFs in advanced cryptographic applications, and in the realistic case adversaries get access to the Strong PUF after protocol completion. CCS CONCEPTS• Hardware → Integrated circuits; • Security and privacy → Embedded systems security.

show abstract

“…While SPA exploits the relationship between the operations that are executed and the power leakage, DPA exploits the relationship between the processed data and the power leakage. Over the years, several SCA techniques have been reported in the literature for differential EM analysis attacks [4], timing attacks [3], probing attacks [15] etc.…”

Section: Dpa and Resistive Bridges Fault Injectionmentioning

confidence: 99%