The globalization of the integrated circuit supply chain has introduced untrustworthy entities at various stages, arousing increasing attention to hardware security research from both academia and industry. Some tasks in hardware security research require matching two hardware designs. For example, in gate-level netlist reverse engineering, after recovering module boundaries and hierarchical structure from a netlist, one must match each candidate module against known library components to validate its functionality. Likewise, in Intellectual Property (IP) piracy detection, a suspected infringing IP can be matched against its original counterpart to determine whether infringement has occurred. We design and implement a hardware similarity evaluation framework called Twins. We develop two versions of the framework, called Twins-v1 with the basic Graph Neural Network (GNN) model and Twins-v2 with the node-independent GNN model, respectively. Twins employs a more effective training approach that substantially reduces training time and improves evaluation metrics compared to the current state-of-the-art models. Furthermore, to the best of our knowledge, Twins-v2 represents the first work to use independent graph convolutional network layers based on different node types in the context of hardware security research. The novel netlist graph extraction method has also been experimentally demonstrated to outperform the previously employed data flow graph approach in hardware similarity evaluation tasks. After conducting experimental evaluations on a dataset comprising 305 circuits, both Twins-v1 and Twins-v2 significantly surpass existing methods in terms of prediction accuracy and efficiency.

Advancements in technology have led to a continuous reduction in the size of transistors and an increase in the complexity of circuits, posing significant challenges for Electronic Design Automation (EDA) tools. Concurrently, the rapid growth of deep learning has extended its reach across various domains, yielding promising outcomes. Particularly with large-scale datasets, deep learning techniques often demonstrate superior efficiency. Circuits exhibit diverse graph structures spanning from Register-Transfer Level (RTL) to gate-level netlist representations, including Data Flow Graph (DFG), And-Inverter Graph (AIG), and mapped netlist graph, which align well with graph neural networks. Leveraging various open-source tools, GNN4HHR amalgamates disparate graphs from multiple stages into a hybrid hardware representation. The GNN model can effectively distinguish and encode circuits at various stages.

Modern processors integrate carefully designed micro-architectural components within the front-end to optimize performance. These components include instruction cache, micro-operation cache, and instruction prefetcher. Through experimentation, we observed that the rate of instruction generation in the fetch unit markedly exceeds the execution rate in the decode unit. However, existing frameworks of processors fail to explain this phenomenon. Consequently, we empirically validate the presence of an optimization feature, referred to as the Fetch Target Queue (FTQ), within the Intel processor. To the best of our knowledge, our study represents the first empirical validation of FTQ across various Intel processors and provides a comprehensive characterization of unrecorded FTQ micro-structural details on Intel processors. Our analysis uncovers overlooked insights that front-end rollbacks caused by the incorrectly ordered instructions or mismatched instruction lengths stored in FTQ introduce specific execution latencies. Based on these observations, we introduce the Oxpecker attack, consisting of two attack primitives, which leverages the FTQ to construct novel side-channel attacks. We construct two distinct exploitation scenarios for each attack primitive to demonstrate the Oxpecker attack’s capability to leak secret control flow information and break Kernel Address Space Layout Randomization.

By leveraging the power of open-source software, the EDA tool offers a cost-effective and flexible solution for designers, researchers, and hobbyists alike. Open-source EDA promotes collaboration, innovation, and knowledge sharing within the EDA community. It emphasizes the role of the toolchain in accelerating the development of electronic systems, reducing design costs, and improving design quality. This paper presents an open-source EDA project, iEDA, aiming to build a basic infrastructure for EDA technology evolution and closing the industrial-academic gap in the EDA area. As the foundation for developing EDA tools and researching EDA algorithms and technologies, iEDA is mainly composed of file system, database, manager, operator and interface. To demonstrate the effectiveness of iEDA, we implement and tape out four chips of different scales (from 700k to 500M gates) on different process nodes (110nm and 28nm) with iEDA. iEDA is publicly available on the project home page https://github.com/OSCC-Project/iEDA.

As the integrated circuit (IC) supply chain globalizes, fabrication, testing and packaging are outsourced to third-party entities, and intellectual property (IP) is widely used. As a result, new hardware security threats, including IP piracy, have emerged. Graph similarity learning is a promising technique for estimating the similarity between two input graphs and can be used to detect IP piracy after modeling input hardware designs as graphs. In this work, we propose a hardware similarity learning framework, HWSim, for gate-level IP piracy detection. We transform the gate-level netlists to directed graphs and encode graphs using the graph neural network (GNN) model which is trained based on metric learning. We optimize the training process and use a negative mining strategy to improve training efficiency. HWSim can be trained in a much shorter time compared to the baseline method and achieves an AUC score of 0.9963 on our dataset collected from open source benchmarks.

Hardware Trojan (HT) is a malicious code intentionally inserted into the original circuit design to modify the original function, leak information or decrease the performance. Circuit fabrications have increased Third-Party Intellectual Property (3PIP) usage with market pressure and the increasing global economy. Consequently, hardware may become vulnerable to a wide range of attacks at some stage of the manufacturing process, making detecting HT a necessary procedure. HT detection in the early stage is crucial because removing HT and re-designing the circuit later or after fabrication could be expensive. In this work, we propose a novel Transformer-based Method for pre-silicon HT detection and localization called HTrans. We innovatively use Graph Convolutional Network (GCN) as a preprocessing stage before the Transformer, giving our model the scalability to any design size. Experiments on the Trusthub benchmark show that our model achieves an average of 96.7% Fl score on HT detection and 91.7% accuracy on HT localization. In addition, HTrans can quickly complete the detection on the Register Transfer Level (RTL) within a second.

Recently, complex process of production forces Integrated Circuit (IC) to be designed by third-party Electronic Design Automation (EDA) tool or outsourcing, which will create an opportunity for malicious circuits to be inserted into ICs, known as Hardware Trojan (HT). Up to now, there are still challenges in existing researches, such as dependence on the golden model, unclear position of HTs, and difficulty in unknown HT detection. In this paper, a HT detection model called BGNN-HT based on bidirectional graph neural network is proposed, which can detect HT cells by assessing the structure of its surrounding cells at gate level. BGNN-HT can precisely detect HT cells in ICs, and it does not require the golden model or manual feature extraction, which greatly reduces the difficulty of detection and can adapt to unknown HTs. Experiments are conducted on Trust-hub benchmarks including TRIT-TC and TRIT-TS to evaluate our model. The results show that when detecting unknown circuits and HTs, BGNN-HT can reach 96% True Positive Rate (TPR) and 99% True Negative Rate (TNR) in various datasets, and even 99% TPR and TNR in TRIT-TC and TRIT-TS.

Most proposed studies focus on detecting the entire hardware Trojan (HT) in one step, which is very difficult. Since the results of most proposed method have false positive, it is still necessary to check the detection results manually in real-world application. Therefore, what we need is an accurate and efficient method to locate the core part of HTs, which can assist designers to the follow-up verification and modification. In this paper, we define several RTL features based on hardware Trojan trigger control flow characteristics, and then use these features to train a decision tree-based hardware Trojan trigger localization model. The experimental results on Trust-Hub show that our method can obtain 100% true positive rate on all benchmarks and average 98.20% true negative rate. And our method can complete feature extraction and HT trigger localization within 0.1s on average.

Hardware Trojan has always been a major security threat to the integrated circuit industry. In this article, we propose a novel circuit gate embedding method called SeGa, which extracts the “semantic information” of gates in the netlist. The feature vectors that representing each type of gate extracted by SeGa are used as the inputs to the neural network classification model to detect Trojans. The experimental results on TRIT-TC benchmark show that SeGa can improve the performance of the neural network classification model to detect the Trojan gate sequence.

For the purpose of stealthiness, trigger-based Hardware Trojans(HTs) tend to have at least one trigger signal with an extremely low transition probability to evade the functional verification. In this paper, we discuss the correlation between poor testability and low transition probability, and then propose a kind of systematic Trojan trigger model with extremely low transition probability but reasonable testability, which can disable the Controllability and Observability for hardware Trojan Detection (COTD) technique, an efficient HT detection method based on circuits testability. Based on experiments and tests on circuits, we propose that the more imbalanced 0/1-controllability can indicate the lower transition probability. And a trigger signal identification method using the imbalanced 0/1-controllability is proposed. Experiments on ISCAS benchmarks show that the proposed method can obtain a 100% true positive rate and average 5.67% false positive rate for the trigger signal.

Hardware Trojan (HT) has paid more and more attention to the academia and industry because of its significant potential threat. In this paper, we propose a novel approach, named GramsDet, to detect HT through capturing suspicious circuit connection structure using recurrent neural network. GramsDet considers that HT usually be inserted into the regions with low transition probability, so the circuit fragments associated with HT should have special connection structures. GramsDet models the target circuit using n-gram circuit segmentation technique, and implements the "gate embedding" by the order-sensitive co-occurrence matrix. Then, a stacked long short-term memory network is designed to build a robust HT detection model. The experimental results on different benchmarks show that GramsDet can detect effectively Trojan logic without the "Golden model" of the circuit under detection (CUD).

Nowadays, it is common that both mobile applications and websites log users' visits and keep record of users browser path, even every time user click and every word user type. Each tracking information will be respectively sent to the third-party server via HTTP request. Previous studies have shown that combining multiple small HTTP requests can significantly decrease energy consumption, but not have considered a typical scenario where massive tracking records can be efficiently compressed and transferred with a delay. In this paper, we propose a comprehensive approach to reduce the energy consumption of online tracker by bundling multiple HTTP requests. Our approach first intercepts all tracking-related HTTP requests, logging and compressing the requests for bundling, and then uses a proxy-based technique to combine these requests at runtime. Through a set of real-world experiment, the evaluation demonstrates that our approach can achieve an average energy reduction of 10% for mobile devices and make apparent performance and security improvement.

As 5G high-speed mobile communications developing rapidly, services and contents that people get from the Internet have been enriched significantly, which necessitates the user equipment (UE) to have least power consumption, reduced latency, enhanced lifetime and better QoS. However, the tail energy of LTE interface on UE leads to low energy efficiency which is caused by applying fixed Radio Resource Control (RRC) inactivity timer. In this paper, we propose a novel approach to eliminate the tail whenever possible and improve the user equipment power efficiency. We design a self-adaptive tool to optimize the LTE RRC inactivity timer for individual users based on user model. Firstly, The tool collects runtime network information from cellular networks and uses machine learning method to predict the session length. Then it adjusts inactivity timer dynamically based on the predicted session length. In addition, we propose an enhanced RRC protocol to support our proposed tool. To demonstrate the effectiveness of our energy-saving tool, we applied it on commercial off-the-shelf phones. Simulation results show the proposed tool can reduce the energy consumption of smart-phone by 27-33.5%.

Hardware Trojan has attracted more and more attention from academia and industry because of its significant potential threat. Long activation time is a major concern during Trojan detection process. Traditional pre-silicon verification and post-silicon testing cannot be extended to detect hardware Trojans efficiently because Trojan is usually activated under specific rare conditions. In this paper, we propose a novel approach to expose Trojans efficiently by increasing the transition activities of ASIC logic regions hard to reach. Specifically, the proposed approach detects the "local" regions with low reachability by calculating signals statistical correlation, and detect the "local" regions with low reachability. In addition, by analyzing the global correlations between primary inputs and these rare regions, a retrospective test stimulus generation algorithm is developed to better control the internal logic alteration. Besides, we propose an output sequence model based on CRC check. The experiment results show that the Trojan activation time can be significantly decreased and the Trojans being exposed can be increased dramatically with the proposed method.

As the ubiquity and power of mobile devices continue rapid developing, smartphone vendors introduce more and more types of portable electronics into the market. Since these smart portable devices have different capabilities (performance, screen size, screen resolution, etc.), it is challenging to develop tailored user interfaces for multiple devices. In this paper, we propose an intelligent user interface transformation (IUIT) framework, using the machine-learning algorithm to transform the layout, appearance, and content of user interfaces dynamically regarding device profiles. Besides, we design the prototype system, and by evaluating the usability and feasibility of the system, we demonstrate it can deliver an ideal viewing experience (suitable for reading and navigation) across a wide range of devices.

Android applications (apps for short) frequently send users' personally identifiable data over IP networks. Previous attempts to address privacy leakage on mobiles by checking whether these sensitive data is off the device. Actually, some benign apps need to collect users' privacy information for many sensitive tasks (e.g., contacts manager, location service, or finance). Since these kinds of data transmissions provide an application's functionality, treating these as privacy leakages are false positives. In this paper, we present Android Privacy Assistant (APA), a practical privacy protection system that reveals privacy disclosure and provides fine-grained privacy information modifications to balance privacy and data usability. APA leverages machine learning to detect privacy leaks by inspecting network traffic, and uses generalization techniques to decrease privacy sensitivity. The evaluation result shows that APA can detect privacy leakage with up to 95% accuracy in our dataset and have almost no overhead on network and battery consumption.

The trigger circuitry is critical for trace-based post-silicon debug, which detects specified events or event sequences to initiate or stop the tracing. In this paper, we propose a resource efficient trigger design for the post-silicon debug which integrates several different detection schemes to improve the detect ability. The design reuses the trace buffer to store the trigger set for event detection or store the transitions of the generated finite state machine for event sequence detection, which converts the trigger detection into simple read operations to the trace buffer and equality matching operations. Simulation and emulation are both used to validate the usability of the design. In comparison with the prior trigger circuits with the same trigger width, the proposed method provides much more powerful detect ability and configurability for complicated trigger conditions, and needs lower area overhead.

Hardware Trojans (HTs) are emerging threats for integrated circuits. In this paper, we propose a novel scheme, named LMDet, to detect HTs through distinguishing the “unnaturalness” of HTs from the “naturalness” of normal circuits using the natural language processing technology. The key insight of LMDet is that we find clean circuits tend to be “natural” (i.e., to be highly repetitive in structure) and HTs appear to be “unnatural” (i.e., to be rare in structure) in some sense. LMDet models circuit gates sequentially, using the n-gram language model. Gate sequences from the circuit under detection (CUD) are assessed according to their probability in the model, and lowprobability sequences are marked as suspected Trojan-related gates. Evaluation with benchmarks and industrial circuits shows that LMDet is capable of detecting Trojan logic without the HT-free reference of CUD. LMDet has short execution time on large commercial circuits with acceptable space overhead. It is a promising method in real industry since plenty of HT-free designs are available as training corpus to ensure good statistical effects.

Hardware Trojan detection, which is very important to the chip security, has drawn more and more attention in both academia and industry. In this paper, we propose a novel hardware Trojan detection scheme named HTChecker, which detects hardware Trojans with subgraph isomorphism based on static characteristics of Trojans. Unlike other schemes, HTChecker pay more attention to preventing the replication and dissemination of hardware Trojans. We evaluate the HTChecker with random mixtures of Trojans and circuits from ITC'99 benchmarks and OpenCores. Experiments show that HTChecker can detect Trojans quickly and accurately without “Golden Chip” and it can cope with actual VLSI designs with large scale efficiently.

Massive multiple-input multiple-output (MIMO) has been considered as one of the key technologies in 5G communication, owing to its promising potential to increase the spectrum efficiency significantly. The capacity grows rapidly with the increasing number of antennas. However, in real-time environment, the more antennas are employed, the more computing resources are required, and this increase is even in a nonlinear progression. In this work, radio computing architecture (RCA) with multiple parallel general purpose processors (GPPs) and automatic distribution system (ADS) are utilized to overcome the strict real-time constraints and establish a highly flexible prototype platform for massive MIMO research. The feasibility and performance of the GPP-based prototype has been investigated through field trial. A collocated 64-RF-channel base station (BS) with each RF channel driving 3 antennas can simultaneously serve twelve 8-antenna user equipments (UEs). The maximum overall bandwidth is 200 MHz, and the maximum flow number is pre-defined as 24. In this field trial, a peak total user throughput of 11.29 Gbps and a cell spectrum efficiency of 79.82 bps/Hz are achieved. As far as we know, this is the world's highest throughput ever achieved in the sub 6 GHz band. Furthermore, apart from multi-user MIMO, single-user MIMO is also tested in this field trial.

Radio frequency (RF) channel reciprocity calibration is one of the most important technologies in massive multiple-input multiple-output (MIMO) system. With the increasing of the antenna size, the calibration procedure becomes much more challenging. In this paper, wired- and wireless-calibration schemes have been proposed and investigated through field-trial test based on a real-time massive MIMO prototype with 64 independent RF channels. The prototype is capable of supporting 12 200-MHz user equipments (UEs) simultaneously. The field trial test results validate both schemes can significantly improve the overall system throughput. For single-user (SU) MIMO scenario, the throughput can be enhanced from 0.71 Gbps to 1.46 Gbps and 1.54 Gbps with wireless- and wired-calibration schemes, respectively. For multi-user (MU) MIMO scenario, the corresponding enhancement can be from 0.26 Gbps to 9.18 Gbps and 11.29 Gbps, respectively. In terms of calibration accuracy, the wired-calibration scheme has better performance, but the wireless one has lower system complexity and cost. To the best of our knowledge, this is the first field trial investigation of wireless-calibration scheme and comparison with wired calibration in a real-time high-throughput massive MIMO prototype.

A wide-range tracking technique for clock and data recovery (CDR) circuit is presented. Compared to the traditional technique, a digital CDR controller with calibration is adopted to extend the tracking range. Because of the use of digital circuits in the design, CDR is not sensitive to process and power supply variations. To verify the technique, the whole CDR circuit is implemented using 65-nm CMOS technology. Measurements show that the tracking range of CDR is greater than ±6×10 −3 at 5 Gb/s. The receiver has good jitter tolerance performance and achieves a bit error rate of <10 –12 . The re-timed and re-multiplexed serial data has a root-mean-square jitter of 6.7 ps.

Recently, NTT DOCOMO and Huawei conducted a large-scale experimental trial of key technologies for the 5th generation (5G) mobile systems. Downlink multi-user (MU) transmission with massive MIMO in the time-division duplex (TDD) mode is one of the technologies evaluated in this trial. With linear and non-linear downlink precoding schemes, we investigated the practical performance of MU massive MIMO systems under different numbers of users, user distributions, and different radio frequency channel calibration settings with up to 24 users deployed. When linear precoding is used, the cell spectrum efficiency reaches 39 bit/s/Hz, and it reaches 43 bit/s/Hz when non-linear precoding is used. In term of the cell throughput, up to 1.35 Gbps cell throughput was observed with a linear precoder and 100 MHz bandwidth; and 343 Mbps cell throughput was observed with a non-linear precoder and 20 MHz bandwidth. Based on these investigations, we verified the feasibility and performance of a TDD massive MIMO system for 5G mobile systems, and studied the impact of key factors on the system performance.

Coverage model is the main technique to evaluate the thoroughness of dynamic verification of a Design-under-Verification (DUV). However, rather than achieving a high coverage, the essential purpose of verification is to expose as many bugs as possible. In this paper, we propose a novel verification methodology that leverages the early bug prediction of a DUV to guide and assess related verification process. To be specific, this methodology utilizes predictive models built upon artificial neural networks (ANNs), which is capable of modeling the relationship between the high-level attributes of a design and its associated bug information. To evaluate the performance of constructed predictive model, we conduct experiments on some open source projects. Moreover, we demonstrate the usability and effectiveness of our proposed methodology via elaborating experiences from our industrial practices. Finally, discussions on the application of our methodology are presented.

This paper presents a new approach to reduce finite state machines with respect to a CTL formula to alleviate state explosion problem. Reduction is achieved by removing parts useless to the formula of original machines. The main contribution of this paper is to exploit relations among sub formulas of the CTL formula so as to gain more reduction, as well as to extend traditional pruning method, which handles only existential formulas, to handle universal formulas. Based on this kind of reduction, verification of a large system, which usually consists of several components, can be done by evaluating properties on a reduced version of the system, which is built by composing components of the system one by one while doing reduction after each composition. Experimental results show the effectiveness of the approach. Especially when a property is written in a more detailed way, that is to describe the system part by part, the approach has a great potential.

As a primary method for functional verification of microprocessors, simulation-based verification has received extensive studies over the last decade. Most investigations have been dedicated to the generation of stimuli (test cases), while relatively few has focused on explicitly reducing the redundant stimuli among the generated ones. In this paper, we propose an on-the-fly approach for reducing the stimuli redundancy based on machine learning techniques, which can learn from new knowledge in every cycle of simulation-based verification. Our approach can be easily embedded in traditional framework of simulation-based functional verification, and the experiments on an industrial microprocessor have validated that the approach is effective and efficient.

The verification of an execution against memory consistency is known to be NP-hard. This paper proposes a novel fast memory consistency verification method by identifying a new natural partial order: time order. In multiprocessor systems with store atomicity, a time order restriction exists between two operations whose pending periods are disjoint: the former operation in time order must be observed by the latter operation. Based on the time order restriction, memory consistency verification is localized: for any operation, both inferring related orders and checking related cycles need to take into account only a bounded number of operations. Our method has been implemented in a memory consistency verification tool for CMP (chip multi processor), named LCHECK. The time complexity of the algorithm in LCHECK is O(Cpp2n2) (where C is a constant, p is the number of processors and n is the number of operations) for soundly and completely checking, and O(p3n) for soundly but incompletely checking. LCHECK has been integrated into both pre and post silicon verification platforms of the Godson-3 microprocessor, and many bugs of memory consistency and cache coherence were found with the help of LCHECK.

Biased random test generation is one of the most important methods for the verification of modern complex processors. As the complexity of processors grows, the bottleneck remains in generating suitable test programs that meet coverage metrics automatically. Many technologies have been proposed to implement the automatic feedback loop. In this paper, we introduce our coverage directed test generation scheme which combines traditional biased random test generation and genetic algorithms to feed back process. It is the first time we use our scheme in our real industrial processor verification independently and successfully without human intervention. The efficiency of our approach has been demonstrated by the practical results.

Comparing with the passion for verification technical innovations, the practical verification experiences especially the bug reports and analyses rarely appear in public research. It is very important to analyze the practical bug reports for feedback on the future verification. Thanks to the sufficient design scale of our microprocessor and efficient verification environment we developed, we are able to present in this paper an extensive analysis of the effects of bugs on different design stages and different microarchitectures. The analysis approaches and results are valuable for estimating the distribution of bugs in a microprocessor design and preventing the project from verification bottlenecks.