The globalization process for integrated circuits (ICs) raises serious concerns regarding hardware Trojans (HTs). Due to the stealth and variety of HTs, detecting them at test time can be very resource intensive. This situation becomes even worse when the device under test (DUT) contains untrusted third-party intellectual property (3PIP) cores. For systems on chip (SoCs) that rely on untrusted 3PIP cores, this article solves the online HT detection and recovery problem from a graph-theoretic perspective. The proposed graph-theoretic models minimize the implementation cost of the system in terms of both the cost of purchasing different IP cores and the area overhead. To further enhance the security of the system, we also propose schemes to locate and replace an HT-infected IP core. The feasibility and efficiency of the proposed techniques are verified by experiments.

Fabrication-less integrated circuit (IC) design houses outsource fabrication to third-party foundries to reduce cost of manufacturing. The outsourcing of IC fabrication, beyond our expectation, raises concerns regarding intellectual property (IP) piracy and theft by rogue elements in the third-party foundries. Obfuscation techniques have been proposed to increase resistance to reverse engineering, IP recovery, IP theft, and piracy. However, prior work on obfuscation for IP protection has primarily applied to the gate level or the layout level. As a result, it can significantly impact the performance of the original design in addition to requiring redesign of standard cells. In this article, we propose a high-level synthesis and analysis (HLSA)-based obfuscation approach for IP protection. The proposed method is based on split manufacturing. Additional dummy units and MUXes can be added to further obfuscate the design. The proposed technique aligns with the standard-cell-based design methodologies and does not significantly impact the performance of the original design. Our experimental results confirm that the proposed approach can provide high levels of IC obfuscation with moderate area cost.

Refresh schemes have been the default approach in NAND flash memory to avoid data losses. The critical issue of the refresh schemes is that they introduce additional costs on lifetime and performance. Recent work proposed to minimize the refresh costs by using uniform refresh frequencies based on the number of program/erase (P/E) cycles. However, from our investigation, we find that the refresh costs still have a high burden on the lifetime performance. In this paper, a novel refresh minimization scheme is proposed by exploiting the process variation (PV) of flash memory. State-of-the-art flash memory always has significant PV, which introduces large variations on the retention time of flash blocks. In order to reduce the refresh costs, we first propose a new refresh frequency determination scheme by detecting the supported retention time of flash blocks. If the detected retention time is large, a low refresh frequency can be applied to minimize the refresh costs. Second, considering that the retention time requirements of data are varied with each others, we further propose a data hotness and refresh frequency matching scheme. The matching scheme is designed to allocate data to blocks with right higher supported retention time. Through simulation studies, the lifetime and performance are significantly improved compared with state-of-the-art refresh schemes.

Dynamic information flow tracking (DIFT) is a technique to track potential security vulnerabilities in software and hardware systems at run time. Untrusted data are marked with tags (tainted), which are propagated through the system and their potential for unsafe use is analyzed to prevent them. DIFT is not supported in heterogeneous systems especially hardware accelerators. Currently, DIFT is manually generated and integrated into the accelerators. This process is error-prone, potentially hurting the process of identifying security violations in heterogeneous systems. We present TaintHLS, to automatically generate a micro-architecture to support baseline operations and a shadow microarchitecture for intrinsic DIFT support in hardware accelerators while providing variable granularity of taint tags. TaintHLS offers a companion high-level synthesis (HLS) methodology to automatically generate such DIFT-enabled accelerators from a high-level specification. We extended a state-of-the-art HLS tool to generate DIFT-enhanced accelerators and demonstrated the approach on numerous benchmarks. The DIFT-enabled accelerators have negligible performance and no more than 30% hardware overhead.

The outsourcing for fabrication introduces security threats, namely hardware Trojans (HTs). Many design-for-trust (DFT) techniques have been proposed to address such threats. However, many HT detection techniques are not effective due to the dependence on golden chips, limitation of useful information available and process variations. In this paper, we data-mine on path delay information and propose a variation-tolerant path delay order encoding technique to detect HTs.

Reliability has been a challenge in the development of NAND flash memory, due to its technology size scaling and bit density improvement. To ensure the data integrity, error correction codes (ECC) with high error correction capability have been suggested. However, much higher costs will be introduced which cannot be supported for cost-limited consumer-level flash memory. Thus, low-cost ECCs are usually applied. In this work, a reliability improvement scheme is proposed for low-cost ECC enabled consumer-level flash memory. The scheme is motivated by the finding that low-cost ECC is able to protect shortened encoded data with improved reliability. This is because that the less the encoded data are, the less the errors will be occurred. With this motivation, a design is proposed to construct the shortened data case for a low-cost ECC when it cannot be able to provide the reliability requirement. Second, two relaxation approaches are proposed to relax the space reduction as it has bad effects on flash memory. A model guided evaluation is finally presented, and the results show that the lifetime can be significantly improved with little space reduction.

Reversible logic is a building block for adiabatic and quantum computing in addition to other applications. Since common functions are non-reversible, one needs to embed them into proper-size reversible functions by adding ancillary inputs and garbage outputs. We explore the Intellectual Property (IP) piracy of reversible circuits. The number of embeddings of regular functions in a reversible function and the percent of leaked ancillary inputs measure the difficulty of recovering the embedded function. To illustrate the key concepts, we study reversible logic circuits designed using reversible logic synthesis tools based on Binary Decision Diagrams and Quantum Multi-valued Decision Diagrams.

Many fabrication-less design houses are outsourcing their designs to third-party foundries for fabrication to lower cost. This IC development process, however, raises serious security concerns on Hardware Trojans (HTs). Many design-for-trust techniques have been proposed to detect HTs through observing erroneous output or abnormal side-channel characteristics. Side-channel characteristics such as path delay have been widely used for HT detection and functionality verification, as the changes of the characteristics of the host circuit incurred by the inserted HT can be identified through proper methods. In this article, for the first time, we propose a two-phase technique, which uses the order of the path delay in path pairs to detect HTs. In the design phase, a full-cover path set that covers all the nets of the design is generated; meanwhile, in the set, the relative order of paths in path pairs is determined according to their delay. The order of the paths in path pairs serves as the fingerprint of the design. In the test phase, the actual delay of the paths in the full-cover set is extracted from the fabricated circuits, and the order of paths in path pairs is compared with the fingerprint generated in the design phase. A mismatch between them indicates the existence of HTs. Both process variations and measurement noise are taken into consideration. The efficiency and accuracy of the proposed technique are confirmed by a series of experiments, including the examination of both violated path pairs incurred by HTs and their false alarm rate.

Solid state drives (SSDs) have been widely deployed in personal computers, data centers, and cloud storages. In order to improve performance, SSDs are usually constructed with a number of channels with each channel connecting to a number of nand flash chips, each flash chip consisting of multiple dies and each die containing multiple planes. Based on this parallel architecture, I/O requests are potentially able to access parallel units simultaneously. Despite the rich parallelism offered by the parallel architecture, recent studies show that the utilization of flash parallel units is seriously low. This paper shows that the low parallel unit utilization is highly caused by the access conflict among I/O requests. In this paper, we propose parallel issue queueing (PIQ), a novel I/O scheduler at the host systems. PIQ groups I/O requests without conflicts into the same batch and I/O requests with conflicts into different batches. Hence, the multiple I/O requests in one batch can be fulfilled simultaneously by exploiting the rich parallelism of SSDs. Extensive experimental results show that PIQ delivers significant performance improvement especially for the applications which have heavy access conflicts.

Due to the globalization trend of IC industry, more and more chips are designed and/or fabricated by foreign companies and foundries. Among all the consequences of this globalization trend, the possible existence of stealthy-inserted hardware Trojans (HTs) has raised a great security concern. Without the awareness of the end users or the original designers of host circuits, HTs are usually inserted stealthily at one of the outsourced design or fabrication stages, remain (almost) harmless to the host on dormant mode, and upon triggered will disturb the functions and/or leak the secrets carried by the host. It could become a serious security leak of the systems built on top of infected chips. Identifying whether a circuit carries an HT is thus of the utmost importance to mission-critical applications. Speaking from the point of HT designers, nets with extreme state probabilities could be used to create rare state combination for the purpose of HT triggering. Besides, HT designers seek nets with low switching probabilities to insert their HTs in order not to increase power leakage. We denote the nets with extreme state probability as extreme nets and the nets with low switching probability as inactive nets. It is commonly believed that in order to minimize the chance of accidental triggering or power analysis, they would be better to choose, among all the nets of the host, the nets that with extreme state probabilities (extreme nets) or the nets that barely switch (inactive nets) to construct the trigger parts of their HTs, respectively. However, a net of a circuit experiences very different state probabilities and switching probabilities on test mode and function mode, and existing works have only considered the former. The nets with low activeness on both test mode and function mode hence will be the “best candidates.” In this paper we will first build the ground on finding the nets with low activeness on function mode, and then propose a fast heuristic method approach. The method runs in minimal complexity, has high accuracy, and is tested on popular benchmarks and large-sized circuits.

Solid state drives (SSDs) are normally constructed with a number of parallel-accessible flash chips, where host I/O requests are processed in parallel. In addition, there are many internal activities in SSDs, such as garbage collection and wear leveling induced read, write, and erase operations, to solve the issues of inability of in-place updates and limited lifetime. When internal activities are triggered on a chip, the chip will be blocked. Our preliminary studies on several workloads show that when internal activities are frequently triggered, the host I/O performance will be significantly impacted because of the access conflict between them. In this work, in order to improve the access conflict induced performance degradation, a novel access conflict minimization scheme is proposed. The basic idea of the scheme is motivated by an interesting observation in SSDs: several chips are idle when other chips are busy with internal activities and host I/O requests. Based on this observation, we propose to schedule internal activities induced operations for minimized access conflict by exploiting the idleness of the multiple chips of SSDs. This approach is realized by two steps: First, read internal activities accessed data to the controller; second, by exploiting the idle chips during internal activities, write internal activities accessed data back to these idle chips. With this scheme, the internal activities can be processed with minimized access conflict to the host requests. Simulation results show that the proposed approach significantly reduces the access conflict, and in turn leads to a significant performance improvement of SSDs.

Recent studies show that a multilevel cell flash cell in different states suffers from diverse error patterns in varying degrees. That is, the error rates of each page are highly dependent on the data content. Consequently, pages with different data will exhibit quite different error rates. However, existing technologies equipped with one uniform error correction code (ECC) scheme for all pages in a flash memory do not take the different error rates of pages into consideration. In this paper, we propose to exploit the asymmetric error rates of flash memory exhibited by the flash pages with different data for performance improvement. Before a page is programmed, its specific error rates, called content-dependent bit error rates (CDBERs), are estimated according to the content of the page. The margin between the CDBER of a page and the maximal error rates correctable by the uniform ECC code is exploited for performance improvement. On one hand, a faster and suitable write operation is selected to speed up the progress of programming while the increased speed induced CDBER does not exceed the maximal correctable error rates. On the other hand, a light-weight ECC scheme can be chosen for a faster read operation since the page decoding process of a light-weight ECC scheme incurs less time overhead. Finally, a state mapping scheme, which further reduces the CDBER through mapping high error rate states to the low error rate states of a page, is proposed. Simulation results show that the proposed approaches lead to significant write and read performance improvement.

NAND flash memory has been widely deployed in embedded systems, personal computers, and data centers. While recent technology scaling and density improvement have reduced its price, they have also significantly shortened its endurance. In this paper, with the understanding of the relationship between data retention time and flash wearing, a retention trimming approach, which trims data retention time based on the data lifetime, is proposed to reduce the wearing of flash memory, and hence improve the endurance of flash memory. Extensive experimental results show that the proposed technique achieves significant endurance improvements.

The write performance of flash memory has been degraded significantly due to the recent density-oriented advancements of flash technology. Techniques have been proposed to improve the write performance by exploiting the varying strength of a flash block in its different worn-out stages. A block is written with a faster speed when it is new and strong, and gradually will be written with slower speeds as it is aging and becomes weak. Motivated by these works, this brief proposes a new technique by exploiting the significant process variation among flash blocks introduced by the advanced technology scaling. First, a write speed detection approach is proposed to identify the strength of each block. Then, a heuristic approach is proposed to exploit the speed variation among blocks for write performance improvement. A series of trace-driven simulations shows that the proposed approach generates substantial write performance improvement over state-of-the-art approaches by 30% on average.

Tasks in hard real-time systems are required to meet deadlines in the presence of faults. We conclude that a sufficient condition of a task set experiencing its worst-case finish time (WCFT) is that its critical task (CT) incurs all faults. An algorithm is presented to identify the CT and the WCFT in O(N2) with N being the task number. A common practice that bet the WCFT using the task with the longest re-execution time could under estimate by up-to 35%!

Current Integrated Circuit (IC) development process raises security concerns about hardware Trojan which are maliciously inserted to alter functional behavior or leak sensitive information. Most of the hardware Trojan detection techniques rely on a golden (trusted) IC against which to compare a suspected one. Hence they cannot be applied to designs using third party Intellectual Property (IP) cores where golden IP is unavailable. Moreover, due to the stealthy nature of hardware Trojan, there is no technique that can guarantee Trojan-free after manufacturing test. As a result, Trojan detection and recovery at run time acting as the last line of defense is necessary especially for mission-critical applications. In this paper, we propose design rules to assist run-time Trojan detection and fast recovery by exploring diversity of untrusted third party IP cores. With these design rules, we show the optimization approach to minimize the cost of implementation in terms of the number of different IP cores used by the implementation.

NAND flash memory has been widely applied in embedded systems, personal computer systems, and data centers. However, with the development of flash memory, including its technology scaling and density improvement, the endurance of flash memory becomes a bottleneck. In this work, with the understanding of the relationship between data retention time and flash wearing, a retention trimming approach, which trims data retention time based on the time intervals between data updating, is proposed to reduce the wearing of flash memory. Reduced wearing of flash memory will improve the endurance of the flash memory. Extensive experimental results show that the proposed technique achieves significant wearing reduction for flash memory through retention trimming.

The reliability of flash memory is getting worse with the introduction of Multiple Level Cell (MLC) and Triple Level Cell (TLC) technologies. To account for possible errors, each page in a flash memory is equipped with an Error Correction Code (ECC) module. An ECC scheme is chosen according to the worst-case error occurrences across all pages in the flash memory. Recent studies show that an MLC flash cell in different states exhibits diverse error rates and the difference is dramatic. Consequently, pages with different data will exhibit quite different error rates. Existing technologies that use one uniform ECC scheme for all pages in a flash memory is far from optimal. This paper exploits the asymmetric error rates exhibited by the pages with different data for write performance improvement. Before a page is programmed, its specific error rate, called Content-Dependent Bit Error Rate (CDBER), is estimated according to the content of the page. The margin between the CDBER of a page and the maximal error rate correctable by the uniform ECC code is exploited for write performance improvement. Simulation results show that the proposed approach leads to significant write performance improvement.

Solid state drives (SSDs) have been widely deployed in personal computers, data centers, and cloud storages. In order to improve performance, SSDs are usually constructed with a number of channels with each channel connecting to a number of NAND flash chips. Despite the rich parallelism offered by multiple channels and multiple chips per channel, recent studies show that the utilization of flash chips (i.e. the number of flash chips being accessed simultaneously) is seriously low. Our study shows that the low chip utilization is caused by the access conflict among I/O requests. In this work, we propose Parallel Issue Queuing (PIQ), a novel I/O scheduler at the host system, to minimize the access conflicts between I/O requests. The proposed PIQ schedules I/O requests without conflicts into the same batch and I/O requests with conflicts into different batches. Hence the multiple I/O requests in one batch can be fulfilled simultaneously by exploiting the rich parallelism of SSD. And because PIQ is implemented at the host side, it can take advantage of rich resource at host system such as main memory and CPU, which makes the overhead negligible. Extensive experimental results show that PIQ delivers significant performance improvement to the applications that have heavy access conflicts.

In recent years, an emerging low-power system “wireless sensor networks (WSNs)” attracts significant research interests. The energy of the distributed sensors is an essential constraint in such a complex distributed embedded system. Routing techniques in WSNs always follow a high-performance and energy-efficient way. However, conventional routing schemes of WSNs generally do not take the timing and reliability requirements into account when making routing decisions to prolong the lifetime of WSNs. Moreover, due to environmental factors such as temperature, humidity and signal interference, the bandwidths of links in a WSN various from time to time like random variables, which demands special considerations when timing and reliability requirements are presented for routing. In this paper, we introduce a graph model called Multi-level Uncertain Graph (MUG) to deal with the situation. Based on the MUG model, we define the new problem as the Energy-Balanced Transmission (EBT) Problem, and propose a EBT-Solver to maximize the lifetime of the WSN subject to timing and reliability constraints. Experimental results show that EBT-Solver solves EBT problem to the best advantage of energy balance and network's lifetime.

Welcome to Chongqing, China, and the 20th IEEE International Conference on Embedded and Real- Time Computing Systems and Applications (RTCSA 2014). RTCSA has been a long-running technical conference sponsored by IEEE. The objective of the conference is to bring together academic researchers and industry developers for intensive discussion of recent advancing in the field of embedded systems, real-time systems, system design practice and emerging applications.

Side channel attacks allow an attacker to retrieve secret keys with far less effort than other attacks. Countermeasures against these attacks should be considered during cryptosystem design. This paper presents a novel low-cost error detection and recovery scheme (LOEDAR) to counter fault attacks. The proposed architecture retains the efficiency of the Montgomery ladder algorithm and shows strong resistance to both environmental-induced faults as well as attacker-introduced faults. Moreover, the proposed LOEDAR scheme is compatible with most existing countermeasures against various power analysis attacks including differential power analysis and its variants, which makes it extendable to a comprehensive countermeasure against both fault attacks and power analysis attacks.

In response to the rising fault susceptibility of integrated circuits due to aggressive device scaling, a number of concurrent error detection (CED) techniques have been proposed. However, many of these CED techniques do not concern power. Even worse, these techniques are inefficient or even incapable of addressing the new challenges brought about by nanometer devices. In this paper, we propose a new register-transfer-level CED technique that comprehensively considers power efficiency and fault security. Its CED capability can be adjusted at runtime according to the actual need. The proposed high-level synthesis technique ensures that the generated datapath consumes minimal power for any fault scenario it has been turned to.

Fault-based attacks, which recover secret keys by deliberately introducing fault(s) in cipher implementations and analyzing the faulty outputs, have been proved to be extremely powerful. In this paper, we propose a novel Concurrent Error Detection (CED) scheme to counter fault-based attack against RSA by exploiting its multiplicative homomorphic property. Specifically, the proposed CED scheme verifies if Πi=1kE(mi) ≡ EΠi=1kmi(mod n) (mod n) where E could be either RSA encryption, or decryption, or signature, or verification process. Upon a mismatch, all the ciphertexts will be suppressed. The time overhead is 1/k and k can be used to trade-off the time overhead with memory overhead and output latency. Recognizing that an RSA device could be subject to a combination of several side-channel attacks, the proposed scheme enables an easy divide-and-concur solution-any fine-tuned architecture, for example, a power-attack-resistant architecture, can be equipped with fault-attack resistance easily without disturbing its original resistance. This advantage distinguishes the proposed scheme over the existing countermeasures.

This paper presents LOEDAR, a novel low-cost error detection and recovery scheme, for Montgomery Ladder Algorithm based Elliptic Curve Scalar Multiplication (ECSM). The LOEDAR scheme exploits the invariance among the intermediate results produced by the algorithm to detect errors. The error detection process can be carried periodically during ECSM to verify data correctness, and will recover the cryptosystem back to the latest checkpoint upon detecting errors. The frequency of running the error detection process can be adjusted to trade off the power and time overhead with error detection latency and recovery overhead. The hardware and power overhead of LOEDAR are about 37.6% and 69% respectively. Each additional error detection process contributes less than 1% additional time overhead and power overhead.

In response to the rising fault susceptibility of ICs due to aggressive device scaling, a number of concurrent error detection (CED) techniques have been proposed. The existing circuit- or logic- level CED techniques aim at the worst case of fault susceptibility. Recognizing that the energy consumption of the circuitry with different CED capability varies significantly, these techniques could result in significant overhead for today's deep sub-micron devices that suffer from strong variation of fault susceptibility. In this paper, we propose a novel RT-level CED technique for linear digital systems. The proposed technique offers run-time adaptable CED so that devices will never overpay the energy bills for their CED needs.

Stream cipher is an important class of encryption algorithm that encrypts plaintext messages one bit at a time. Various stream ciphers are deployed in wireless telecommunication applications because they have simple hardware circuitry, are generally fast and consume very low power. On the other hand, scan-based Design-for-Test (DFT) is one of the most popular methods to test IC devices. All flip-flops in the Design Under Test are connected to one or more scan chains and the states of the flip-flops can be scanned out through these chains. In this paper, we present an attack on stream cipher implementations by determining the scan chain structure of the Linear Feedback Shift Registers in their implementations. Although scan-based DFT is a powerful testing scheme, we show that it can be used to retrieve the information stored in a crypto chip thus compromising its theoretically proven security.

This paper studies the dilemma between fault tolerance and energy efficiency in frame-based real-time systems. Given a set of K tasks to be executed on a system that supports L voltage levels, the proposed heuristic-based scheduling technique minimizes the energy consumption of tasks execution when faults are absent, and preserves feasibility under the worst case of fault occurrences. The proposed technique first finds out the optimal solution in a comparable system that supports continuous voltage scaling, then converts the solution to the original system. The runtime complexity is only (LK2). Experimental results show that the proposed approach produces near-optimal results in polynomial time.

In response to the rising fault susceptibility of ICs due to aggressive device scaling, a number of concurrent error detection (CED) techniques have been proposed. Most existing techniques address the problem at device or logic level. To account for the significant process variations and device aging of today's nano-meter devices, these techniques must always aim at the worst case of fault susceptibility. Recognizing that the power consumption of the CED circuitry for different fault susceptibility varies significantly, these techniques could result in significant overhead. In this paper, we propose register transfer level CED techniques that can be adjusted at runtime according to the actual need. The proposed high-level synthesis technique ensures that the generated datapath consumes minimal power for any CED capability it has been turned to. The proposed approach is tested using known benchmarks.

Energy-efficient task allocation and scheduling schemes with deterministic fault-tolerance capabilities are proposed for symmetric multiprocessor systems executing tasks with hard real-time constraints. The proposed heuristic is proven to achieve energy savings by optimally balancing application workload among processors in a system. Based on the observation that fault-free operation is expected to remain dominant in the near future and the probability of the worst case faults is low, an optimistic fault-tolerant heuristic is then proposed to achieve maximum energy savings in the absence of faults while degrading gradually to meet application timing requirements in the worst case of faults. Simulation results show that compared to state-of-art allocation and scheduling schemes proposed heuristic achieves average energy savings of up to 70%. It is also shown that optimistic approach is more resilient to variations in application utilizations and fault occurrences beyond system specifications.

In this paper we present an register transfer level (RTL) concurrent error detection (CED) technique targeting hardware implementations of elliptic curve cryptography (ECC). The proposed mixed hardware- and time-redundancy based CED techniques use the mathematical properties of the underlying Galois field as well as the ECC primitives to detect both soft errors and permanent faults with low area overhead. Results for sequential implementations of GF multiplication and inverse operations yielded an area overhead of 30% and a time overhead of 120%.

Errors introduced by radiation-induced single event upset and single event latchup in very deep submicron (VDSM) ICs necessitate concurrent error detection (CED) and correction. Power consumed by circuits used for detecting and correcting errors becomes an extra burden on the tight power budget of VDSM ICs. The triple-modular redundancy-based fault tolerance technique, which is traditionally used for error detection and correction, incurs over 200 percent power overhead. In this paper, we propose register-transfer level low-power on-demand error correction techniques. Proposed techniques implement an original computation and a recomputation in datapath and compare the results from two computations to monitor the health of circuit. A mismatch in results indicates faulty computation and a second recomputation is triggered to rectify the error. The proposed techniques can detect and correct SEU induced transient errors and detect SEL induced permanent errors with as little as 12 percent power overhead

Quantum-dot cellular automata (QCA) is attracting a lot of attention due to its extremely small feature size and ultralow power consumption. Up to now, several adder designs using QCA technology have been proposed. However, it was found that not all of the designs function properly. This paper analyzes the reasons of the failures and proposes adders that exploit proper clocking schemes

In this paper we investigate fault tolerance and Dynamic Voltage Scaling (DVS) in hard real time systems. We present two low-complexity fault-aware scheduling algorithms that combine feasibility analysis of Rate Monotonic Algorithm (RMA) schedules and DVS-based frequency scaling using exact characterization of RMA algorithm. These algorithms lay the foundation for highly efficient online schemes that minimize energy consumption by adapting DVS policies to runtime behavior of tasks and fault occurrences without violating the offline feasibility analysis. Simulation results demonstrate energy savings of up to 60% over low-energy offline scheduling algorithms [22].

Secure operation of cryptographic algorithms is critical to the success of secure transactions. Fault-based attacks that recover secret keys by deliberately introducing fault(s) in cipher implementations and analyzing the faulty outputs have been proven to be extremely powerful. Substitution Permutation Networks (SPN) and Feistel Networks (FN) are the two important classes of Symmetric Block Ciphers. Some SPN ciphers and all FN Ciphers satisfy the involution property. A function F is an involution if F(F(x)) = x. In this paper, we investigate tamper proofing techniques that use low cost involution-based time redundancy concurrent error detection (CED) schemes for involutional SPN and FN symmetric block ciphers. We incorporated this tamper proofing by design technique in a hardware implementation of the 128-bit ANUBIS SPN cipher (an involution variant of the Advanced Encryption Standard (AES)) and the 128-bit TwoFish FN cipher (an AES finalist). We performed fault simulation at both the algorithm and the gate level to show that the low-cost involution-based CED schemes, in addition to detecting all transient faults, can detect all single-bit permanent faults and > 99 percent of all multiple-bit permanent faults. Consequently, this low cost CED technique can protect the crypto device against Differential Fault Analysis (DFA) attacks.

In this paper, a time redundancy based Concurrent Error Detection (CED) technique targeting involutional functions is presented. A function F is an involution if F(F(x))=x. The proposed CED technique exploits the involution property and checks if x=F(F(x)). Unlike traditional time redundancy based CED methods, this technique can detect both permanent and transient faults.

This paper presents Algorithm-level REcomputing with Shifted Operands (ARESO), which is a new register transfer (RT) level time redundancy-based concurrent error detection (CED) technique. In REcomputing with Shifted Operands (RESO), operations (additions, subtractions, etc.) are carried out twice-once on the basic input and once on the shifted input. Results from these two operations are compared to detect an error. Although using RESO operators in RT-level designs is straightforward, it entails time and area overhead. In contrast, ARESO does not use specialized RESO operators. In ARESO, an algorithm is carried out twice-once on the basic input and once on the shifted input. Results from these two algorithm-level instantiations are compared to detect an error. By operating at the algorithm level, ARESO exploits RT-level scheduling, pipelining, operator chaining, and multicycling to incorporate user-specified error detection latencies. ARESO supports hardware versus performance versus error detection latency tradeoffs. The authors validated ARESO on practical design examples using the Synopsys Behavior Compiler (BC). An industry standard behavioral synthesis system.

Scan-based design for test (DFT) is a powerful testing scheme, but it can be used to retrieve the secrets stored in a crypto chip, thus compromising its security. On one hand, sacrificing the security for testability by using a traditional scan-based DFT restricts its use in privacy sensitive applications. On the other hand, sacrificing the testability for security by abandoning the scan-based DFT hurts the product quality. The security of a crypto chip comes from the small secret key stored in a few registers, and the testability of a crypto chip comes from the data path and control path implementing the crypto algorithm. Based on this key observation, the authors propose a novel scan DFT architecture called secure scan that maintains the high test quality of traditional scan DFT without compromising the security. They used a hardware implementation of the advanced encryption standard to show that the traditional scan DFT scheme can compromise the secret key. They then showed that by using secure-scan DFT, neither the secret key nor the testability of the AES implementation is compromised

Due to their extremely small feature sizes and ultra low power consumption, Quantum-dot Cellular Automata (QCA) technology is projected to be a promising nanotechnology. However, in nanotechnologies, manufacture time defect levels and operational time fault rates are expected to be quite high. Straightforward Triple Modular Redundancy (TMR) based fault tolerance is inappropriate for QCA nanotechnology since wire delays dominate the logic delays and faults in wires dominate the faults in a QCA based design. Furthermore, long wires are necessary in TMR based designs. In this paper we show that fault-tolerance can be obtained by using TMR with Shifted Operands (TMRSO). TMRSO uses shorter wires of QCA cells and exploits the self-latching property of clocked QCA arrays to provide the same level of fault tolerance capability as straightforward TMR while being significantly faster and smaller. This technique can be applied to a variety of operations; we have validated TMRSO on adders. Implementation results obtained using QCADesigner [6] show that an 8-bit adder using TMRSO has more than 50% area reduction and more than 100% throughput improvement when compared to a TMR implementation.

Scan-based Design-for-Test (DFT) is a powerful testing scheme, but it can be used to retrieve the secrets stored in a crypto chip thus compromising its security. On one hand, sacrificing security for testability by using traditional scan-based DFT restricts its use in privacy sensitive applications. On the other hand, sacrificing testability for security by abandoning scan-based DFT hurts product quality. The security of a crypto chip comes from the small secret key stored in a few registers and the testability of a crypto chip comes from the data path and control path implementing the crypto algorithm. Based on this key observation, we propose a novel scan DFT architecture called secure scan that maintains the high test quality of traditional scan DFT without compromising the security. We used a hardware implementation of the Advanced Encryption Standard (AES) to show that the traditional Scan DFT scheme can compromise the secret key. We then showed that by using secure scan DFT, neither the secret key nor the testability of the AES implementation is compromised.

Quantum-dot cellular automata (QCA) are attracting a lot of attention due to their extremely small feature sizes and ultra low power consumption. Several designs using QCA technology have been proposed. However, we have found that not all of the designs function properly. Further, no general design guidelines have been proposed so far. A straightforward extension of a simple functional design pattern may fail. This makes designing large scale circuits using QCA technology an extremely time-consuming process. We show several critical vulnerabilities in the structures of primitive QCA gates and QCA interconnects, and propose a disciplinary guideline to prevent any additional plausible, but malfunctioning, QCA designs.

We present a new low-cost concurrent checking method for the advanced encryption standard (AES) encryption algorithm. In this method, the parity of the 128-bit input is determined and modified step-by-step into the parity of the 128-bit output according to the processing steps of the AES encryption. For the parity-preserving AES steps shift-rows and mix-column no parity modifications are necessary. The modified parity is compared in any round with the actual parity of the outputs of the round. To obtain the hardware costs we implemented this method on a Xilinx Virtex 1000 FPGA. For this implementation, the hardware overhead is about 8% and the additional time delay is about 5%. The method detects technical faults and deliberately injected faults during normal operation.

Scan based test is a double edged sword. On one hand, it is a powerful test technique. On the other hand, it is an equally powerful attack tool. We show that scan chains can be used as a side channel to recover secret keys from a hardware implementation of the Data Encryption Standard (DES). By loading pairs of known plaintexts with one-bit difference in the normal mode and then scanning out the internal state in the test mode, we first determine the position of all scan elements in the scan chain. Then, based on a systematic analysis of the structure of the nonlinear substitution boxes, and using three additional plaintexts we discover the DES secret key. Finally, some assumptions in the attack are discussed.

A fault-secure datapath either generates a correct result or signals an error. This paper presents a register transfer level concurrent error detection (CED) technique that uses hybrid time and hardware redundancy to optimize the time and area overhead associated with fault security. The proposed technique combines the idle computation cycles in a datapath with selective breaking of data dependences of the normal computation. Designers can tradeoff time and hardware overhead by varying these design parameters. We present an algorithm to synthesize fault secure designs and validate it using Synopsys' behavioral compiler.

A fault-secure datapath either generates a correct result or signals an error. This paper presents a register transfer level Concurrent Error Detection (CEO) technique that uses hybrid time and hardware redundancy to optimize the time and area overhead associated with fault security. The proposed technique combines the idle computation cycles in a datapath with selective breaking of data dependences of the normal computation. Designers can trade-off time and hardware overhead by varying these design parameters. We present an algorithm to synthesize fault secure designs and validate it using Synopsys Behavioral Compiler.

Although algorithm level re-computing techniques can trade-off the fault detection capability vs. time overhead of a Concurrent Error Detection (CED) scheme, they result in 100% time overhead when the strongest CED capability is achieved. Using the idle cycles in the data path to do the re-computation can reduce this time overhead. However, dependences between operations prevent the re-computation from fully utilizing the idle cycles. Deliberately breaking some of these data dependences can further reduce the time overhead associated with algorithm level re-computing. According to the experimental results the proposed technique, it brings time overhead down to 0-60% while the associated hardware overhead is from 12% to 50% depending on the design size.

Deep sub-micron VLSI circuits are susceptible to permanent and transient faults. Several techniques for concurrent error detection (CED) recovery and correction have been proposed to target permanent and transient faults. We propose a new register transfer (RT) level time redundancy based CED technique that exploits the idle cycles in the data path. Although algorithm level re-computing techniques can trade-off the detection capability of CED vs. time overhead, it results in 100 % time overhead when the strongest CED capability is achieved.. Using the idle cycles in the data path to do the re-computation can reduce this time overhead. However dependencies between operations prevent the recomputation from fully utilizing the idle cycles. Deliberately breaking some of these data dependencies can further reduce the time overhead associated with algorithm level re-computing.

Fault-based side-channel cryptanalysis is very effective against symmetric and asymmetric encryption algorithms. Although straightforward hardware and time redundancy-based concurrent error detection (CED) architectures can be used to thwart such attacks, they entail significant overheads (either area or performance). The authors investigate systematic approaches to low-cost low-latency CED techniques for symmetric encryption algorithms based on inverse relationships that exist between encryption and decryption at algorithm level, round level, and operation level and develop CED architectures that explore tradeoffs among area overhead, performance penalty, and fault detection latency. The proposed techniques have been validated on FPGA implementations of Advanced Encryption Standard (AES) finalist 128-bit symmetric encryption algorithms.

In this paper, the authors propose an algorithm-level time redundancy-based concurrent error detection (CED) scheme against permanent and transient faults by exploiting the hardware allocation diversity at the register transfer level. Although the normal computation and the recomputation are carried out on the same data path, the operation-to-operator allocation for the normal computation is different from the operation-to-operator allocation for the recomputation. The authors show that the proposed scheme provides very good CED capability with very low area overhead.

Concurrent error detection (CED) based on time redundancy entails performing the normal computation and the re-computation at different times and then comparing their results. Time redundancy implemented can only detect transient faults. We present two algorithm-level time-redundancy-based CED schemes that exploit register transfer level (RTL) implementation diversity to detect transient and permanent faults. At the RTL, implementation diversity can be achieved either by changing the operation-to-operator allocation or by shifting the operands before re-computation. By exploiting allocation diversity and data diversity, a stuck-at fault will affect the two results in two different ways. The proposed schemes yield good fault detection probability with very low area overhead. We used the Synopsys behavior complier (BC), to validate the schemes.

Fault-based side channel cryptanalysis is very effective against symmetric and asymmetric encryption algorithms. Although straightforward hardware and time redundancy based concurrent error detection (CED) architectures can be used to thwart such attacks, they entail significant overhead (either area or performance). In this paper we investigate systematic approaches to low-cost, low-latency CED for symmetric encryption algorithms based on the inverse relationship that exists between encryption and decryption at algorithm level, round level and operation level and develop CED architectures that explore the trade-off between area overhead, performance penalty and error detection latency. The proposed techniques have been validated on FPGA implementations of AES finalist 128-bit symmetric encryption algorithms.

In this paper we propose two algorithm-level time redundancy based Concurrent Error Detection (CED) schemes that exploit diversity in a Register Transfer (RT) level implementation. RT level diversity can be achieved either by changing the operation-to-operator allocation (allocation diversity) or by shifting the operands before re-computation (data diversity). By enabling a fault to affect the normal result and the re-computed result in two different ways, RT level diversity yields good CED capability with low area overhead. We used Synopsys Behavior Compiler (BC) to implement the technique.

Proposes an algorithm-level time redundancy based CED scheme that exploits the hardware allocation diversity at the register transfer (RT) level. Although the normal computation and the re-computation are carried out on the same data path, the operation-to-operator allocation for the normal computation is different from the operation-to-operator allocation for the recomputation. We show that proposed scheme provides very good CED capability with very low area overhead.

Re-computing with shifted operands (RESO) is a logic level time redundancy based concurrent error detection (CED) technique. In RESO, logic level operations (and, nand, etc) are carried out twice-once on the basic input and once on the shifted input. Results from these two operations are compared to detect an error. Although using RESO operators in register transfer level (RTL) designs is straightforward, it entails time and area overhead. We developed an RTL CED technique called algorithm level re-computing with shifted operands (ARESO). ARESO does not use specialized RESO operators. Rather, it exploits RTL scheduling, pipelining, operator chaining, and multi-cycling to incorporate user specified error detection latencies. ARESO supports hardware vs. performance vs. error detection latency trade-offs. ARESO has been validated on practical design examples using Synopsys Behavior Compiler.