Genetic programming (GP), for the synthesis of brand new programs, continues to demonstrate increasingly capable results towards increasingly complex problems. A key challenge in GP is how to learn from the past so that the successful synthesis of simple programs can feed into more challenging unsolved problems. Transfer Learning (TL) in the literature has yet to demonstrate an automated mechanism to identify existing donor programs with high-utility genetic material for new problems, instead relying on human guidance. In this article we present a transfer learning mechanism for GP which fills this gap: we use a Turing-complete language for synthesis, and demonstrate how a neural network (NN) can be used to guide automated code fragment extraction from previously solved problems for injection into future problems. Using a framework which synthesises code from just 10 input-output examples, we first study NN ability to recognise the presence of code fragments in a larger program, then present an end-to-end system which takes only input-output examples and generates code fragments as it solves easier problems, then deploys selected high-utility fragments to solve harder ones. The use of NN-guided genetic material selection shows significant performance increases, on average doubling the percentage of programs that can be successfully synthesised when tested on two different problem corpora, compared with a non-transfer-learning GP baseline.

In side-channel analysis attacks, on-die localized EM monitoring enable high bandwidth measurements of only a relevant part of the Integrated Circuit (IC). This can lead to improved attacks compared to cases where only power consumption is measured. Combined with profiled attacks which utilize a training phase to create precise models of the information leakage, the attacks can become even more powerful. In contrast, localized EM measurements can cause difficulties in applying the learned models as the probe should be identically positioned for both the training and the attack even when the setup was used otherwise in between. Even small differences in the probe position can lead to significant differences in the recorded signals. In this paper we present an automated system to precisely and efficiently reposition the probe when performing repeated measurements. Based on the training IC, we train a machine learning system to return the position of the probe for a given measurement. By taking a small number of measurements on the IC under attack, we can then obtain the coordinates of the measurements and map it to correct the coordinate system. As the target for our practical analyses, we use an STM32L0 ARM-M0+ microcontroller with integrated hardware AES.

Designers of secure hardware are required to harden their implementations against physical threats, such as power analysis attacks. In particular, cryptographic hardware circuits need to decorrelate their current consumption from the information inferred by processing (secret) data. A common technique to achieve this goal is the use of special logic styles that aim at equalizing the current consumption at each single processing step. However, since all hiding techniques like Dual-Rail Precharge (DRP) were originally developed for ASICs, the deployment of such countermeasures on FPGA devices with fixed and predefined logic structure poses a particular challenge. In this work, we propose and practically evaluate a new DRP scheme (GliFreD) that has been exclusively designed for FPGA platforms. GliFreD overcomes the well-known early propagation issue, prevents glitches, uses an isolated dual-rail concept, and mitigates imbalanced routings. With all these features, GliFreD significantly exceeds the level of physical security achieved by any previously reported, related countermeasures for FPGAs.

Physical Unclonable Functions (PUFs) have gained a lot of research attention in recent years resulting in many different PUF proposals. Several of these proposals were aimed specifically at FPGA implementations. However, often these PUFs are evaluated and implemented for different (and often old) FPGA families with different metrics. Missing implementation details in many papers further hamper a fair analysis, as small details such as the exact routing can have significant impact on the PUF performance. In this paper we aim to overcome these problems by providing a fair comparison of some of the most promising Weak PUFs for FPGAs, the classic Ring Oscillator PUF (RO PUF), the Loop PUF and the TERO PUF. Each PUF is implemented with the same area optimizations and careful manual routing for modern Xilinx Artix-7 FPGAs and several implementation options are discussed. We measure the reliability and uniqueness of the PUF constructs on 100 BASYS-3 boards for a temperature range of -22°C to 44°C and use a glitch-generating core to analyze the vulnerability of the PUF constructs to surrounding logic. Our results show that the RO PUF has the best reliability in the presence of temperature variations while TERO has the best uniqueness of the three considered PUFs. Interestingly, the TERO PUF also shows the highest resistance to surrounding logic. To encourage further research in FPGA PUFs and to enable a fair comparison to future work the implementations as well as the measurement data will be made publicly available.

Physically Unclonable Functions (PUFs) based on the evaluation of uninitialized SRAM are one of the most promising PUF candidates to date. However, transferring their concept to Xilinx FPGAs is not straightforward since all SRAM-based block memories in these FPGAs are automatically cleared on power-up, destroying the desired initial bits of information. In this work we therefore propose a novel strategy to convert block memories of 28nm Xilinx FPGAs into SRAM-PUFs by exploiting their recently introduced feature of power-gating and partial reconfiguration.