Real-time health monitoring systems generate massive biometric sensor data, placing substantial demands on memory, computation, and power resources. Additionally, the sensitive nature of such data raises critical privacy concerns related to attributes like gender, age, and body mass index. To address these challenges, this work proposes FAxC—a novel feature-driven approximation framework that performs multi-dimensional data reduction by leveraging the biometric features of sensor signals. Unlike prior approximation techniques that operate on isolated signals or uniformly sample data, FAxC intelligently selects and masks segments to preserve human activity recognition performance while enhancing user privacy. Our case study shows that, compared to existing privacy-aware approaches, FAxC reduces the disparity in gender-distinguishable biometric features in human activity recognition, decreasing Z-direction peak acceleration from 56% to 22% and stride root mean square from 31% to 3%. Our FAxC enhances the privacy-preserving rate by up to $5.6 \times$ over the baseline and outperforms existing methods by a factor ranging from $1.2 \times$ to $5.4 \times$. The proposed method has also been validated on the TAME Pain dataset for a voice-based pain level detection system. FAxC reduces the risk of gender leakage by 50% compared to using raw data, while maintaining pain level detection accuracy.

In-Sensor Computing (ISC) systems emerge as a promising alternative to save energy on massive data transmission, analog-to-digital conversion, and ineffective processing. While the new paradigm shift of ISC systems gains increasing attention, the highly compacted systems could incur new challenges from a hardware security perspective. This work conducts a literature review to highlight the research trend of this topic and then performs comprehensive analyses on the root of security challenges. To the best of our knowledge, this is the first work that compares the security challenges of traditional sensor-involved computing systems and emerging ISC systems. We conduct a comprehensive analysis of ISC's design phases to identify significant vulnerabilities and attack surfaces. Furthermore, new attack scenarios are predicted for board-, chip-, and device-level ISC systems. Three proof-of-concept demos are provided to reveal the consequences of the attacks for three different levels. Our findings emphasize the urgent necessity for sophisticated defense mechanisms and inspire researchers to work on new countermeasure designs against unique hardware security threats in ISC systems.

In-sensor computing (ISC) represents a paradigm shift in sensor integration technologies. ISC system combines sensing and processing elements on a single chip, enabling real-time processing and reducing computation latency by eliminating massive data transfer and analog-to-digital conversion. However, due to the high integration of sensors and computation units, ISC could suffer from new security attacks that have not been explored yet. In this work, we investigate a covert channel attack that leverages the analog nature of ISC to showcase the feasibility of security attacks and severe consequences in the context of real applications. We envision that this research paper will inspire more researchers to brainstorm new defense mechanisms for the emerging ISC.

In-Sensor Computing (ISC) systems integrate sensing and computing units within a single device, enabling low-latency, energy-efficient applications through direct analog-to-feature conversion. However, the intrinsic tight coupling between sensing and computational components introduces significant security vulnerabilities. These arise particularly in scenarios where adversaries have a good understanding of the analog computation mechanisms and could tamper with the ISC device, potentially allowing for manipulation, inference, or extraction of sensitive data. This work introduces exploitable backdoors in ISC that encode the output of the analog computation unit to create covert channels. Through theoretical modeling and empirical case studies, we investigate two ISC-specific covert channels: a logic covert channel and a frequency covert channel. These channels are established by deliberately manipulating the analog computation unit co-integrated with sensing materials on a shared substrate, thereby enabling adversaries to exfiltrate sensitive information, posing substantial threats to the security and privacy of real-world ISC applications.

Multi-tenant Field Programmable Gate Arrays (FP-GAs) have been widely integrated into cloud and edge computing environments to save hardware costs. Unfortunately, shared FPGAs among multiple users make the system vulnerable to new security threats. For instance, a voltage-drop attack exploits transient voltage fluctuations on the FPGA power distribution network to cause critical faults. Existing works either check combinatorial loops or utilize numerous on-chip sensors to detect fault attacks. Recent literature shows that some advanced power waster units can bypass combinatorial loop checks and defeat attack localization. To counteract the powerful fault attacks, this work proposes an on-chip sensor placement strategy to detect and localize the source of voltage-drop attacks. An attack mitigation framework integrates the proposed sensor placement strategy and a new assessment metric to improve the sensitivity of attack localization. Our case study shows that the proposed method achieves a 100% success rate in attack localization. Furthermore, experimental results show that the proposed method reduces the localization time by 90% and the number of deployed sensors by 89% over existing works.

Virtualization obfuscators are commonly employed to safeguard proprietary code or to impede malware analysis. Despite significant efforts to combat these obfuscators over the past decade, code virtualization continues to be an exceedingly effective obfuscation technique. At the core of modern virtualization obfuscators are the virtual machines (VMs), which employ a variety of diversification techniques to complicate their internal structures. Due to its intricate and diverse nature, reverse engineering one VM is a time-consuming task and is not useful in cracking other VMs. Yet, despite the success of these VMs, there has been no systematic study of their diversification techniques, creating a knowledge gap that needs to be addressed to enhance VM deobfuscation. This work aims to bridge the above gap. First, we categorize and unveil the techniques under the hood of VM diversification, from the perspectives of VM interpretation, byte-code organization, and handler permutation/relocation. This systematic knowledge about modern virtualization is a crucial contribution to the field. Second, we develop an automated tool to identify the VM diversification techniques adopted by state-of-the-art virtualization obfuscators. The results demystify how the VM diversification methods are deployed in practice. Third, our research also involves patching current deobfuscation tools using the newly revealed knowledge of VM diversification to overcome their weaknesses. This outcome highlights how the results of our study pave the way for next-generation VM deobfuscation.

Multi-tenant Field-programmable Gate Arrays (FPGAs) in cloud service are vulnerable to remotely exploitable attacks, among which power waster circuit (PWC)-based fault attacks have been demonstrated as a highly feasible one. PWC generates high switching activities and causes a sudden voltage drop in the power distribution network (PDN), resulting in a delay of signal propagation and FPGA malfunction. Existing countermeasures deploy bitstream checking methodologies or deploy numerous on-chip sensors to mitigate voltage-drop attacks. Since new PWCs without combinatorial loops and a multi-source attack are emerging, the current countermeasures lack the ability to mitigate new security challenges in multi-tenant FPGAs. To address these issues, a Signal-slowdown (SS)-based fault attack mitigation (S 2 FAM) method is proposed to detect both combinatorial (ring-oscillator (RO)-based PWC) and non-combinatorial (ring-oscillator Flip-flop (ROFF)-based PWC) loop-based attacks and precisely pinpoint the attack locations. A new calibration technique in S 2 FAM facilitates to identify and remove unstable sensor data, thus significantly reducing false positives. Moreover, the proposed method localizes both the single- and multi-source attacks in the FPGA by utilizing a tenant-level SS ranking (TSSR)-based algorithm. Experimental results show that the proposed method reduces the false alarm by 45.8%, compared to the existing works. Our proposed algorithm for attack localization achieves a 100% success rate and reduces the attack localization area for a multi-source attack by 25.2% than an existing countermeasure. The successful localization is achieved by utilizing our proposed method within 2 \(\mu\) s (200 clock cycles) of attack duration. The proposed signal slowdown metric with the calibration process reduces the number of on-chip sensors by 78% and the localization time by 90.5%, compared to the baseline.

FPGAs are being challenged by various security threats, including reverse engineering attacks, hardware tampering, and side-channel analysis attacks. Although the existing static obfuscation methods can protect FPGA systems from IP piracy and hardware tampering, limited work is available to improve the attack resilience of obfuscation modules. As hardware Trojans are one of the most significant hardware tampering attacks on FPGAs, this work aims for the specific hardware Trojan that attempts to nullify design obfuscation. To address this need, we leverage the advanced function of FPGA CAD tools to propose a Dynamic Partial Reconfiguration enabled Design Obfuscation (DPReDO) method. Our method partially modifies the FPGA bitstream at runtime to remove the sabotaged obfuscation variant, thus offering enhanced attack resilience against hardware Trojans. Experimental results based on ISCAS and ITC-99 benchmark circuits show that the DPReDO method reduces the Trojan hit rate by up to 80% over existing static obfuscation with less than 3% hardware overhead. To test the practical feasibility of the proposed countermeasure, we further apply DPReDO to an FPGA-accelerated computation engine for a financial application. Compared to static obfuscation, the proposed DPReDO only incurs 2.6% and 1.2% more FPGA LUTs and slices, respectively.

Real-time health monitoring systems generate a large volume of sensing data, requiring tremendous processing time and storage space. Orthogonal to existing approximate computing mechanisms, this work proposes a Feature-Driven Approximation (FDApx) method to address the pressing need for fast data processing and a limited storage budget in wearable health monitoring devices. The proposed FDApx method reverses the features interested in high-level applications to derive approximation thresholds to retain feature-critical information, rather than aimlessly storing and transmitting all raw data. Case studies in an insole sensing system for fall risk assessment show that FDApx can reduce the data size by up to 87% over raw data and up to 85% over 2-bit precision reduction-based approximation. The approximation from FDApx only results in up to a 2% deviation in swing time; in contrast, the approximation based on precision reduction causes a 30% deviation in the same gait feature1.

Advanced sensor networks are anticipated to deliver more innovative and cost-efficient monitoring solutions than conventional ones. Low-power technologies, such as Long-Range Wide-Area Network (LoRaWAN), are being integrated into advanced sensor networks to meet the growing need for economical automation and remote surveillance. Nonetheless, adopting LoRaWAN introduces novel security risks to hardware. This work explores a detection technique at the hardware tier to detect multiple attacks with a single detection scheme. This work proposes an Advanced Continuous Time Convolution (ACTC) approach to defend against several attack scenarios with classification. Experimental results show that the ACTC detection system can withstand jamming and replay attacks with 100% accuracy and an F1-score of 1.0, assuring a secure communication channel1.

In heterogeneous wireless sensor network environments, distinct security vulnerabilities in hardware emerge as big concerns. Wireless sensor networks, in particular, are susceptible to various cyber-physical threats, such as jamming and relay attacks. To keep up with the evolution of attack methodologies, it is imperative to develop advanced security modules to simultaneously mitigate multiple attacks. This work proposes a Continuous-Time Convolution (CTC) based attack detection method, which offers a unified framework to address jamming and replay attacks while consuming a low overhead cost in wireless transmission setups. Experimental results show that the proposed CTC achieves a 100% detection rate for both jamming and replay attacks. Furthermore, our proposed detection scheme can be seamlessly integrated with Long-Range Wide-Area Networks (LoRaWAN) inherent characteristics, ensuring robust protection against malicious security threats.

Approximate computing techniques that trade accuracy for better computing performance and energy efficiency have been widely used in many computation-intensive applications. As reported in the recent literature, approximate computing systems are prone to stealthy attacks that exploit approximation mechanisms to disguise malicious behaviors in normal operations. The analysis performed in this work indicates that the primary outputs of applications with approximate components are not the best location to detect the presence of attacks. This work proposes an intermediate node evaluation-based attack detection (INEAD) method to distinguish whether the cause of inaccuracy in applications is due to approximation or attacks. The attack detection rate of the proposed method was examined in two applications: 1) an approximate fast Fourier transform (FFT) and 2) an artificial neural network (ANN) using approximate arithmetic modules. The case study of an approximate FFT shows that the INEAD method improves the attack detection rate by 61.6% and reduces the false positive rate by up to 91% over the existing work that detects attacks at the primary output stage. The case study of an approximate ANN shows that the INEAD method outperforms the baseline by 93.6% in terms of attack detection rate.

Safety-critical systems such as automated embedded or industrial systems have a strong dependency on the trustworthiness of data collection. As sensors are the critical component for those systems, it is imperative to address the attack resilience of sensors. System-level defense methods typically do not differentiate the root cause and recover the system from attack with the same procedure, thus resulting in unnecessary costs. In this work, we propose a circuit-level solution to handle security challenges in a temperature sensor. The complementary current-temperature characteristics are exploited to generate a constant current reference for attack detection. Experimental results show that our sensor is capable of detecting an under-powering attack from a significant signal vibration in the constant current reference. Furthermore, our sensor can detect an active analog Trojan by analyzing substantial current deviation in a wide range of temperatures. These high sensitivities against the under-powering and analog Trojan attacks make the sensor resilient against attacks at the circuit level. The proposed sensor consumes 17% less power and achieves 11% higher power-supply-rejection-ratio than existing work.

Approximate computing (AC) techniques have been leveraged to improve computing performance and energy efficiency with minor degradation in accuracy. Recent literature indicates that some AC mechanisms could be exploited by attackers to implement new attack surfaces. To address the emerging attacks in AC systems, we propose to obfuscate the approximate-precise boundary (APB) with entry-blurring and boundary-broadening schemes. The proposed entry-blurring scheme leverages a hidden quality metric, which has a strong correlation with approximation errors, to obscure the entrance of APB and eliminate the explicit transition between approximate and precise modes, thus improving AC systems’ resilience against APB attacks. The proposed boundary-broadening scheme enlarges the transition zone between approximate and precise modes by expanding a single APB threshold to two comparison thresholds, and it further enables a random selection of AC modules in the candidate library. The protection mechanisms provided by our obfuscation method strengthens AC systems’ resilience against APB attacks. Our case studies show that the proposed entry-blurring scheme improves the application quality by up to 168% over the baseline and successfully achieves the desired accuracy. The latency overhead of our method is negligible and the increase on area and power cost can be minimized to 6% and 8%, respectively.

The advanced manufacturing industry (AMI) faces many unique challenges from the cyber-physical domain. Security threats are originated from two integral parts: software and hardware. Over the past decade, software security has been addressed extensively, but hardware security has not received enough attention. This work analyzes the security vulnerabilities of typical electronic devices deployed to AMI and proposes three attack models for sensing nodes, local storage and processing edge devices, and wired/wireless communication interfaces, respectively. Practical security attacks on hardware are demonstrated in this work to inspire the development of feasible countermeasures against hardware Trojans, fault injection attacks, and external signal interference. Moreover, this work highlights the unique security challenges posed by advanced manufacturing applications. To mitigate those security attacks in AMI, this work suggests guidelines for the defense method design that can effectively protect the hardware in AMI.

More and more digitized techniques and network connectivity are deployed to advanced manufacturing to enable remote system monitoring and automated production; however, this trend also leads to the traditional assumption of security in manufacturing not holding true any longer. For instance, the option of remote access makes advanced manufacturing infrastructures vulnerable to various security attacks from physical devices to cyberspace. Existing literature that addresses the attacks in advanced manufacturing is mainly at the network level. In this work, we study the role of hardware security in the process of advanced manufacturing. More specifically, our analysis focuses on the security vulnerability of sensors, local data processing nodes, and the interface implementation for standardized communication protocols. Unique attack examples such as hardware Trojan, interface sniffing, and fraudulent data injection attacks are provided in this work to highlight the unique challenges of attack detection and mitigation in advanced manufacturing.

No abstract available.

Logic locking has demonstrated its potential to protect the intellectual property of integrated circuits (ICs). The security strength of logic locking is typically evaluated through functional and structural analysis-based attacks. There is limited work analyzing logic locking techniques' resilience against power-based side-channel attacks. To fill this gap, we propose an attack flow for the correlation power analysis (CPA) attack on the circuits encrypted with transistor-level logic locking. Our case studies indicate that CPA attacks outperform DPA attacks in terms of key recovery rate (KRR). To improve the CPA attack resilience of an existing transistor-level logic locking technique, we propose a logic-cone conjunction (LCC) method to enlarge the key space and reduce the correlation between the locking key and the power consumption of locked circuits. The experimental results show that the LCC method successfully reduces the KRR from 100% to 0% by using cyclic logic structures. The FPGA emulation indicates that the proposed method incurs 2.6% more delay and 1.5% more power consumption than the baseline.

Satisfiability Modulo Theories (SMT) solvers have been widely applied in automated software analysis to reason about the queries that encode the essence of program semantics, relieving the heavy burden of manual analysis. Many SMT solving techniques rely on solving Boolean satisfiability problem (SAT), which is an NP-complete problem, so they use heuristic search strategies to seek possible solutions, especially when no known theorem can efficiently reduce the problem. An emerging challenge, named Mixed-Bitwise-Arithmetic (MBA) obfuscation, impedes SMT solving by constructing identity equations with both bitwise operations (and, or, negate) and arithmetic computation (add, minus, multiply). Common math theorems for bitwise or arithmetic computation are inapplicable to simplifying MBA equations, leading to performance bottlenecks in SMT solving.

Approximate computing (AC) represents a paradigm shift from conventional precise processing to inexact computation but still satisfying the system requirement on accuracy. The rapid progress on the development of diverse AC techniques allows us to apply approximate computing to many computation-intensive applications. However, the utilization of AC techniques could bring in new unique security threats to computing systems. This work does a survey on existing circuit-, architecture-, and compiler-level approximate mechanisms/algorithms, with special emphasis on potential security vulnerabilities. Qualitative and quantitative analyses are performed to assess the impact of the new security threats on AC systems. Moreover, this work proposes four unique visionary attack models, which systematically cover the attacks that build covert channels, compensate approximation errors, terminate normal error resilience mechanisms, and propagate additional errors. To thwart those attacks, this work further offers the guideline of countermeasure designs. Several case studies are provided to illustrate the implementation of the suggested countermeasures.

Approximate computing (AC) emerges as a promising approach for energy-accuracy trade-off in compute-intensive applications. However, recent work reveals that AC techniques could lead to new security vulnerabilities, which are presented in a format of visionary view. There is a lack of in-depth research on concrete attack models and estimation of the significance of the attacks on approximate arithmetic computing systems. This work presents several practical attack examples and then proposes two attack models with quantitative analysis. Input integrity check and exclusive logic based attack detection methods are proposed to address the attacks on AC systems. The experimental results show that the attack detection failure rate of our method is below $2.2*10^{-3}$ and the area and power overhead is less than 6.8% and 1.5%, respectively.

Approximate computing (AC) techniques have been widely used to improve the performance of computing systems by trading off accuracy. However, recent literature projects that the utilization of approximation could bring in new security threats to computing systems. This work presents two practical attacks on the AC systems for multilayer perceptron (MLP) and Sobel algorithm based image edge detection. The case studies in this work indicate that the approximation mechanism in AC systems can be exploited to conduct stealthy attacks, which suddenly cause significant degradation in accuracy and lead to unpredictable primary outputs. To address the emerging threats on AC systems, this work proposes to blur the boundary between approximate and precise computing submodules in AC systems. This new defense method obscures that boundary with three obfuscation schemes such that adversary could not easily identify the right target to precisely perform hardware tampering attacks. Simulation results show that the proposed method can effectively reduce the attack success rate.

Approximate computing (AC) techniques bring in an alternative way to improve energy efficiency for computing systems, at the cost of acceptable reduction on accuracy. Unfortunately, recent literature indicates that approximate computing systems could be vulnerable to new security threats. Approximation mechanisms maybe leveraged to introduce more errors than the level that the AC systems can tolerate. This work analyzes the existing metrics for accuracy from attack detection point of view. A differential metric is proposed to enlarge the Trojan induced difference on accuracy, delay and power, thus easing Trojan detection. Furthermore, this work proposes a unique attack detection method for AC systems to reduce false negative rate on Trojan detection. Our case study shows that the proposed method can reduce the false negative rate by 93%.

Recently literature indicates that stack based three-dimensional (3D) integration techniques may bring in new security vulnerabilities, such as new attack surfaces for hardware Trojan (HT) insertion. Compared to its two-dimensional counterpart (2DHTs), a 3D hardware Trojan (3DHT) could be stealthily distributed in multiple tiers in a single 3D chip. Although the comprehensive models for 3DHTs are available in recent work, there still lacks 3DHT detection and mitigation methods, especially run-time countermeasures against 3DHTs. This work proposes to leverage the 3D communication infrastructure, 3D network-on-chips (NoCs), to tackle the cross-tier hardware Trojans in stacked multi-tier chips. An invariance checking method is further proposed to detect the Trojans that induce malicious NoC packets or facilitate information leak. The proposed method is successfully deployed in NoC routers and achieves a Trojan detection rate of over 94%. The synthesis result of a hardened router at a 45nm technology node shows that the proposed invariance checking only increases the area by 6.49% and consumes 3.76% more dynamic power than an existing 3D router. The NoC protected with the proposed method is applied to the image authentication in a 3D system. The case study indicates that the proposed security measure reduces the correlation coefficient by up to 31% over the baseline.

Approximate computing systems improve energy efficiency and computation speed at the cost of reduced accuracy on system outputs. Existing efforts mainly explore the feasible approximation mechanisms and their implementation methods. There is limited work that investigates the security threats brought by approximate computing. To fill this gap, we first analyze the approximate mechanisms used in approximate system, software, storage, and arithmetic circuits, and then propose potential attacks that will challenge the integrity and security of approximate systems. Some illustrative examples are provided accordingly to showcase the consequences of the proposed new attacks.

The increasing usage and popularity of the field-programmable gate array (FPGA) systems bring in security concerns. Existing countermeasures are mostly based on the assumption that the computer-aided design (CAD) tools for FPGA configuration are trusted. Unfortunately, this assumption does not always hold. In this paper, we investigate the potential security threats originated from the untrusted CAD tools. Furthermore, we exploit the principle of moving target defense (MTD) to propose an FPGA-oriented MTD (FOMTD) method. The three defense lines in the FOMTD generate uncertainties, from the attacker's point of view, to thwart hardware Trojan insertion attacks. The theoretical upper bound of the hardware Trojan hit rate for each defense line is provided in this paper. Experimental results show that the proposed defense line 2 and defense line 3 reduce the Trojan hit rate by up to 40% and 91%, respectively, for the scenario where the malicious CAD tool can insert Trojans in the occupied FPGA slices. The proposed gate replacement technique in the defense line 3 further improves the attack resilience and obtains 88% reduction on the Trojan hit rate. Compared to the static redundancy-based Trojan detection method, the proposed method achieves better resilience against Trojan insertions and consumes 50% less dynamic power.

Emerging physical unclonable function (PUF) circuit designs in the IC supply chain pose not only a challenge to security threats but also a serious concern about hardware efficiency. The existing conventional PUF methods extract intrinsic random physical variation to generate two-valued secret key bits, which lack logical complexity and have poor efficiency in interconnect lines. This paper proposes a multiple-valued logic PUF circuit (MPUF), which focuses on adding logical complexity and minimizing hardware cost by processing on multilevel-cell and interconnect lines. The twins' cell is selected as the MPUF cell to source the multiple-valued physical variation, and the bit-line sharing strategy was integrated to implement the four-valued PUF data. After full-custom designing, the MPUF with 512 cells only needs 16 transmit bit lines. The proposed MPUF chip is fabricated under 65-nm CMOS technology and the core area occupies approximately 0.016 mm2with a 4.9-μm2bitcell size. The measured results show that the MPUF data passed National Institute of Standards and Technology randomness tests, and that it operates 0.1-pJ/b energy efficiency at 1.2 V, ensures randomness and uniqueness with 50.42% hamming distance, and less than 0.04 autocorrelation at 95% confidence level. Compared with other state of the arts, logical complexity improves 50% for resisting power attacks.

The emerging security threats in the integrated circuit supply chain do not only challenge the chip integrity, but also raise serious concerns on hardware intellectual property (IP) piracy. Hardware design obfuscation is a promising countermeasure to resist reverse engineering attacks and IP piracy. The majority of existing hardware obfuscation methods modify the original finite state machine (FSM) by adding additional state transitions and utilizing a key sequence to lock the transition from the nonfunctional states to the functional reset state. Those methods are effective to prevent attackers from entering the normal functional mode but they lack resilience if the FSM is already in the normal mode. This paper proposes to protect all the states with a low-cost state-deflection-based obfuscation method, which dynamically deflects state transitions from the original transition path to a black hole cluster if a wrong key is applied. Unlike other works that use static transitions between legal states to black hole states at the design time, this method utilizes a state rotation function (Rotatefunc) and selective register flipping function (Mapfunc) to dynamically control the state deflection paths. Hence, the difficulty of reverse engineering and thwarting register overwrite attacks is increased. Simulations performed on ISCAS'89 benchmark circuits show that the proposed method significantly reduces the difference of the net toggle activities between the correct and wrong key scenarios, and achieves up to 56% higher code coverage than the most efficient obfuscation method. Thanks to the dynamic deflection feature, on average, this method generates about 100 more unique state register patterns than other methods with moderate power increase. Moreover, the proposed method achieves the Hamming distance of primary outputs and state registers close to 50%.

Existing works on Three-dimensional (3D) hardware security focus on leveraging the unique 3D characteristics to address the supply chain attacks that exist in 2D design. However, 3D ICs introduce specific and unexplored challenges as well as new opportunities for managing hardware security. In this paper, we analyze new security threats unique to 3D ICs. The corresponding attack models are summarized for future research. Furthermore, existing representative countermeasures, including split manufacturing, camouflaging, transistor locking, techniques against thermal signal based side-channel attacks, and network-on-chip based shielding plane (NoCSIP) for different hardware threats are reviewed and categorized. Moreover, preliminary countermeasures are proposed to thwart TSV-based hardware Trojan insertion attacks.

Correlation power analysis (CPA) attacks on the hardware implementation of cryptographic algorithms can retrieve the cipher key by analyzing the correlation between hypothesized keys and the power measurement of that crypto hardware. The existing CPA attacks and the countermeasures are mainly for two-dimensional (2D) integrated circuits (ICs). There is a lack of study on CPA in the context of three dimensional(3D) ICs. To fill in this gap, this work investigates the impact of a 3D power distribution network (PDN) on the efficiency of CPA mounted on a cryptographic module, which is in one of the 3D planes. The Pearson correlation coefficient is used as a metric to assess the impact of different PDN types, circuit loads, and switching activities of the neighboring planes on the CPA efficiency.

Embedded systems are prone to security attacks from their limited resources available for self-protection and unsafe language typically used for application programming. Attacks targeting control flow is one of the most common exploitations for embedded systems. We propose a hardware-level, effective, and low overhead countermeasure to mitigate these types of attacks. In the proposed method, a Built-in Secure Register Bank (BSRB) is introduced to the processor micro-architecture to store the return addresses of subroutines. The inconsistency on the return addresses will direct the processor to select a clean copy to resume the normal control flow and mitigate the security threat. This proposed countermeasure is inaccessible for the programmer and does not require any compiler support, thus achieving better flexibility than software-based countermeasures. Experimental results show that the proposed method only increases the area and power by 3.8% and 4.4%, respectively, over the baseline OpenRISC processor.

Controller Area Network (CAN) is the main bus that connects Electronic Control Units(ECUs) in automobiles. The CAN protocol has been revised over the years to improve vehicle safety but the security of communication over a CAN bus is still a concern. Despite different kinds of attacks challenge the CAN security, the attack that injects masqueraded CAN frames is extremely difficult to defeat given the limited resources available in CAN system. We propose a low-cost detection mechanism to address the masquerade and replay attacks on the CAN bus. Existing work either requires to store a long list of legal CAN IDs or uses hardware-consuming cryptographic algorithms to detect attacks. In contrast, our method only adds one more CAN ID to the acceptance filter of the CAN node under protection, eliminating the need for cryptographic modules and significantly reducing the hardware cost. We implemented our method in a CAN system prototype. Our experimental results show that the latency overhead of the proposed method is approximately three orders of magnitude less than that of other methods. Our method is capable of detecting the masqueraded and replayed CAN frames with a detection speed of 40μs, which satisfies the real-time requirement of automobiles.

Countermeasures for Advanced Encryption Standard (AES) to thwart side-channel attack and fault attack are typically investigated in a separate fashion. There is lack of thorough investigation on how one countermeasure specifically for one attack affects the efficiency of another attack. In this work, we consider three different fault detection (FD) methods - double modular redundancy (DMR), inverse function (inverse), and even parity check code (parity). We perform FPGA-based systematic analysis to investigate the impact of FD schemes on the correlation power analysis (CPA) resistance of a complete AES implementation. Moreover, the power model used in the existing work is Hamming weight rather than the powerful Hamming distance one. Our experimental results show that, in some scenarios, the use of fault detection mechanisms in AES improves the resistance against CPA. For instance, applying a parity FD to the AES's S-Box makes it harder to retrieve the key than the case without any FD protection.

New hardware security threats are identified in emerging three-dimensional (3D) integrated circuits (ICs) and potential countermeasures are introduced. Trigger and payload mechanisms for future 3D hardware Trojans are predicted. Furthermore, a novel, network-on-chip based 3D obfuscation method is proposed to block the direct communication between two commercial dies in a 3D structure, thus thwarting reverse engineering attacks on the vertical dimension. Simulation results demonstrate that the proposed method effectively obfuscates the cross-plane communication by increasing the reverse engineering time by approximately 5x as compared to using direct through silicon via (TSV) connections. The proposed method consumes approximately one fifth the area and power of a typical network-on-chip designed in a 65 nm technology, exhibiting limited overhead.

The Internet of Things (IoT) offers a more advanced service than a single device or an isolated system, as IoT connects diverse components, such as sensors, actuators, and embedded devices through the internet. As predicted by Cisco, there will be 50 billion IoT connected devices by 2020. Integration of such a tremendous number of devices into IoT potentially brings in a new concern, system security. In this work, we review two typical hardware attacks that can harm the emerging IoT applications. As IoT devices typically have limited computation power and need to be energy efficient, sophisticated cryptographic algorithms and authentication protocols are not suitable for every IoT device. To simultaneously thwart hardware Trojan and side-channel analysis attacks, we propose a low-cost dynamic permutation method for IoT devices. Experimental results show that the proposed method achieves 5.8X higher accumulated partial guessing entropy than the baseline, thus strengthening the IoT processing unit against hardware attacks.

We investigate the impact of single-event upsets in dynamic flip-flop circuits, which are more appealing for the design of high-performance microprocessors because of short latency, small area and high clock frequency. Previous work either uses the approaches for static flip-flops to evaluate SEU effects in dynamic flip-flops or overlook the SEU injected during the precharge phase. We re-examine the possible SEU sensitive nodes in dynamic flip-flops and extend the window of vulnerability of dynamic flip-flops. Our simulation results show that the drain nodes of clocked transistors in dynamic flip-flops are also sensitive to SEUs. For a non-hardened dynamic D-flipflop, the last 55.3 % of the precharge phase and the entire evaluation phase are affected by SEUs. However, the upset sensitivity trend is reversed in a hardened dynamic flip-flop.

This paper proposes a novel four phase-shifted sinusoid symbol (PSS-4) signaling technique to relief high-speed wireline backplane transceiver to reduce large intersymbol interference. The four-level pulse amplitude modulation (PAM-4) and other existing amplitude modulation techniques have been widely used to simplify transceiver equalization design for highly dispersive channels. Unfortunately, PAM-4 and other methods reduce the symbol rate at the expense of signal-to-noise ratio (SNR) and thus limit the bit-error-rate (BER). The proposed PSS-4 signaling avoids large SNR degradation by using four phase-shifted symbols to transmit two-bit data. The experimental results show that with sufficient equalization, our PSS-4 signaling can achieve over 2 dB larger SNR than the conventional non-return-to-zero (NRZ), Duobinary, and PAM-4 signaling techniques. In addition, for a target BER of 1E-12, the proposed PSS-4 signaling has the largest sampling range comparing against existing backplane signaling techniques. Furthermore, compared with NRZ-based backplane transceiver, PSS-4 signaling reduces the equalizer power consumption by 24%.

We propose a new dual-level fault injection method for evaluating combination effect of single event upsets (SEUs) and single event transients (SETs). The proposed interaction method allows collaborative simulation on register-transfer level (RTL) and gate level. Conventional fault injection methods or fault model techniques typically aim at SEUs or SETs, rather than the combination of SETs and SEUs. As a logic depth and clock period decrease, SEUs and SET are likely to co-exist, which further challenges circuit reliability. To facilitate the investigation of advanced SEU and SET management methods, our fault injection method considers both SETs and SEUs. We apply the proposed method to two ITC'99 benchmark circuits to analyze the mutual masking effect between SETs and SEUs. Simulations performed on the two circuits show that SET duration time is the dominant factor affecting the mutual masking effect. If SEU duration time changes (but not beyond one cycle), the maximum masked error ratio is up to five times the minimum masked error ratio. We also observed that doubling clock frequency results in the average masked error ratio varying from 3% to 10%.

Serial communication facilitates the high-speed communication in gigascale systems. Serializer designs typically use the current-mode logic to achieve high speed at the cost of large power consumption. For the latches in the serializer, the power-hungry current-mode logic is replaced with differential cascaded pass-gate to reduce the power and delay. For the selectors in the serializer, the conventional differential cascode voltage switch is modified with pass-gate logic by replacing a PMOS load with a resistor load and adding an inductive peaking structure. Simulation results show that the proposed method reduces the power-delay-product by up to 70%, compared to the conventional current-mode-logic-based serializer.

A collaborative method is proposed to detect soft errors in combinational logic and memory elements of sequential logic circuits. The proposed match functions examine the current flip-flop values and the incoming flip-flop inputs produced by combinational logic to recognize the presence of soft errors. Conventional error control methods for sequential circuits focus on protecting the memory elements, rather than combinational logic. Unfortunately, the error rate of combinational logic is approaching that of memory elements as technology scales down. Modular redundancy approaches, such as triple modular redundancy (TMR), can simply protect both combinational logic and memory elements at the cost of large area and power. We apply the proposed collaborative method to a binary counter and one ITC'99 benchmark circuit to assess the system failure rate and error protection overhead. Gate-level simulation results show that our approach improves the system failure rate more than one order of magnitude over TMR. Synthesized netlists show that our method consumes 40% less area and 50% less power than TMR. Experimental results also show that our method achieves a comparable error detection rate to an error control coding method with 34% dynamic power reduction.

We propose a 1.5V 10-bit 400MHz fully integrated digital-to-analog converter (DAC). The proposed DAC uses a current-steering architecture with Red/Green/Blue channels to support video display. To improve the integration density, we use an on-die current and voltage reference circuit to replace the off-chip resistor in traditional reference generation approaches. Our reference circuit is temperature insensitive because of using the temperature coefficient of poly resistors. To compensate the gain error mainly caused by process variation in current reference, we further propose an auto-calibration scheme to detect and calibrate the DAC gain error. Simulation results show that the gain error in our fully integrated DAC is minimized to 2.8% through different Process-Temperature (PT) variation conditions.

We exploit the inherent information redundancy in the control path of Network-on-Chip (NoC) routers to manage transient errors, preventing packet loss and misrouting. Outputs of the routing arbitration units in NoC routers can be used to determine arbitration failures, because the valid arbitration outputs are a subset of all possible values. This feature is exploited to detect and correct logic and register errors in the router arbitration control path. The proposed method is complementary to other error management methods for NoC routers. An analytical reliability model of our method is provided, including parameters such as logic unit size, different error rates for logic gates and registers, and the location of faulty elements. Compared to triple-modular redundancy (TMR), the proposed method improves the arbiter reliability by two orders of magnitude while reducing the total area and power by 43% and 64%, respectively. In the presented case studies, two traffic traces from the PARSEC benchmark suite are used to evaluate the average latency and energy consumption. Simulations performed on a 4× 4 NoC show that our method reduces the average latency by up to 50% and reduces average energy by up to 70% compared to other methods.

We propose a concatenate error detection method that exploits inherent information redundancy in network-on-chip (NoC) router, to address transient route computation errors. In our previous works, inherent information redundancy has been successfully employed to management transient errors in routers using XY deterministic routing algorithm. To prevent misrouting caused by transient errors injected in the partially adaptive router, we improve our previous method by using concatenate error detection logic. The proposed method is applied to a recent partially adaptive router based on logic-based distributed routing (LBDR). Analysis and simulation results show that the proposed method reduces the residual error rate by up to 1.98× and 3.47× over our previous approach and triple modular redundancy (TMR), respectively. More importantly, the proposed method consumes 2.6× less area and 2.1× less power consumption compared to TMR.

We propose a series of fine-grained splitting transmission methods to address permanent errors in Network-on-Chip (NoC) links, maintaining high throughput and ensuring reliability. While prior permanent error management approaches discard the entire or half link, our proposed methods greatly improve wire utilization in the presence of permanent errors. A case study shows that our methods achieve throughput improvement of 234% and 56%, respectively, compared to fault-tolerant routing and half-splitting methods in the presence of high number of permanent errors.

High-end MPSoC systems with built-in high-radix topologies achieve good performance because of the improved connectivity and the reduced network diameter. In high-end MPSoC systems, fault tolerance support is becoming a compulsory feature. In this work, we propose a combined method to address permanent and transient link and router failures in those systems. The LBDRhr mechanism is proposed to tolerate permanent link failures in some popular high-radix topologies. The increased router complexity may lead to more transient router errors than routers using simple XY routing algorithm. We exploit the inherent information redundancy (IIR) in LBDRhr logic to manage transient errors in the network routers. Thorough analyses are provided to discover the appropriate internal nodes and the forbidden signal patterns for transient error detection. Simulation results show that LBDRhr logic can tolerate all of the permanent failure combinations of long-range links and 80% of links failures at short-range links. Case studies show that the error detection method based on the new IIR extraction method reduces the power consumption and the residual error rate by 33% and up to two orders of magnitude, respectively, compared to triple modular redundancy. The impact of network topologies on the efficiency of the detection mechanism has been examined in this work, as well.

In this work, we present a new error control method to improve the energy efficiency and reliability of network-on-chip (NoC) links. The proposed method combines the error control coding (ECC) capabilities of the NoC's datalink and network layers to dynamically adjust the error control strength in variable noise conditions. Network-layer ECC is used in low noise conditions and error control strength is enhanced by adding datalink-layer ECC in high noise regions. To switch between the two ECC modes at runtime without interrupting normal operation, we propose a dual-layer cooperative error control protocol and its hardware-efficient implementation using the concept of product codes. Theoretical analyses of residual error rate and performance show the proposed method outperforms previous single-layer fixed and adaptive error control schemes. Compared to previous solutions, the proposed method reduces residual packet error rate by up to four orders of magnitude, achieves up to 72% energy reduction and improves average latency by up to 64%. The energy and latency reduction benefits are maintained as the routing path length and packet size increase, at the cost of a moderate increase in area overhead.

We exploit the inherent information redundancy in the control path of Networks-on-Chip (NoCs) routers to manage transient errors, preventing packet loss and misrouting. Unlike fault-tolerant routing, our method does not drop packets when faults occur in routers and thus does not increase the burden on neighboring routers. Unlike the NoC interconnect links, the routing operation is nonlinear and standard error control coding methods cannot be used. Instead, our method exploits existing information redundancy in the router, significantly reducing the area overhead and power consumption compared to triple-modular redundancy (TMR). An analytical reliability model of our method is provided, including parameters such as circuit size, different error rates for logic gates and registers, and the location of a faulty element. Compared to TMR, the proposed method improves the arbiter reliability by two orders of magnitude while reducing the total power and area by 43% and 64%, respectively. Simulations performed on a 4x4 NoC show that our method reduces the average latency by up to 90% and 12% over no-protection and TMR methods, respectively.

Error control is imperative for reliable Networks-on-Chip (NoCs) design. In this demo session, we will present a CAD tool---a flexible and parallel NoC simulator. Our simulator evaluates the impact of different error control mechanisms on NoC performance and energy consumption in various noise and traffic injection scenarios. Our message passing interface language-based simulator can be executed on multiprocessors or server clusters. Multiple built-in blocks provide flexibility to evaluate different error control methods.

To improve noise tolerance of link transmission and router buffers, we propose an error control scheme that integrates a powerful link error recovery method, an efficient buffer error correction coding, and an algorithm to further manage the loss of header and tail flits in a packet. With this method, header and tail flits can be effectively protected, reducing network saturation. Simulation results show the proposed scheme achieves up to a 9x improvement in operation time before saturation and 26% higher throughput than other error control methods. Simulations performed on a parallel FFT application mapped on a 4×4 mesh NoC demonstrate that the proposed error control scheme reduces the total computation time over a previous method in the high noise region.

We propose a transient and permanent error co-management method for NoC links to achieve low latency, high throughput and high reliability, while maintaining energy efficiency. To reduce the energy overhead, a configurable error control coding adapts the number of redundant wires to the varying noise conditions, achieving different error detection capability. Infrequently used redundant wires are used as spare wires to replace broken links. Furthermore, a packet rebuilding/restoring algorithm that cooperates with a shortened error control coding method is proposed to support a low-latency splitting transmission. With this co-management method, we manage transient errors and a small number of permanent errors, without using extra spare wires, to reduce the need for adaptive routing. Simulation results show that the proposed method achieves up to 71% packet latency reduction and 20% throughput improvement, compared to previous methods. Case studies show that our method reduces the energy per packet by up to 68% and 48% for low and high permanent error conditions, respectively.

This paper presents a flexible parallel simulator to evaluate the impact of different error control methods on the performance and energy consumption of networks-on-chip (NoCs). Various error control schemes can be inserted into the simulator in a plug-and-play manner for evaluation. Moreover, a highly tunable fault injection feature is developed for modeling various fault injection scenarios, including different fault injection rates, fault types, fault injection locations, and faulty flit types. Case studies performed in the proposed flexible simulation environment are presented to demonstrate the impact of a set of error control schemes on NoC performance and energy in different noise scenarios. This paper also uses the simulator to provide design guidelines for NoCs with error control capabilities.

A multipurpose simulator for ballistic nanostructures, based on classical mechanics of electrons at the Fermi level, has been successfully implemented. Despite the simplicity of the model, the simulator successfully reproduces a number of experimental results, and is shown to consistently match observed current-voltage characteristics and magnetoresistance phenomena. The simulator results provide design guidelines for devices which operate on ballistic transport principles. Using the simulator, preliminary logic structures have been designed based on the ballistic deflection transistor.

We present an adaptive error control scheme that employs a link quality grading technique and a burst error prediction mechanism, in order to handle multi-wire and multi-cycle errors, respectively. Our approach enables the transmitter to select the most effective error-control scheme for the particular link quality. Using this method, we can improve switch-to-switch throughput by 4X and reduce power consumption by 70%, compared to retransmission-only and retransmission-plus-fixed-coding approaches.

Energy-delay product (EDP) minimization in nanoscale domino logic circuits by supply voltage selection and device sizing is presented. It is shown that the dependence of leakage current on transistor width introduces an additional factor in sizing for leakage dominant circuit blocks. A model is presented for EDP-optimal sizing of the evaluation tree of domino AND-type gates, and the effects of sizing the static output inverter and keeper on EDP are discussed. The model is applied to an 8x8 carry-save multiplier, which achieves 10% reduction in EDP at low frequencies compared to minimum width sizing.