Recent security vulnerabilities that target speculative execution (e.g., Spectre) present a significant challenge for processor design. These highly publicized vulnerabilities use speculative execution to learn victim secrets by changing the cache state. As a result, recent computer architecture research has focused on invisible speculation mechanisms that attempt to block changes in cache state due to speculative execution. Prior work has shown significant success in preventing Spectre and other attacks at modest performance costs. In this paper, we introduce speculative interference attacks, which show that prior invisible speculation mechanisms do not fully block speculation-based attacks that use cache state. We make two key observations. First, mis-speculated younger instructions can change the timing of older, bound-to-retire instructions, including memory operations. Second, changing the timing of a memory operation can change the order of that memory operation relative to other memory operations, resulting in persistent changes to the cache state. Using both of these observations, we demonstrate (among other attack variants) that secret information accessed by mis-speculated instructions can change the order of bound-to-retire loads. Load timing changes can therefore leave secret-dependent changes in the cache, even in the presence of invisible speculation mechanisms. We show that this problem is not easy to fix. Speculative interference converts timing changes to persistent cache-state changes, and timing is typically ignored by many cache-based defenses. We develop a framework to understand the attack and demonstrate concrete proof-of-concept attacks against invisible speculation mechanisms. We conclude with a discussion of security definitions that are sufficient to block the attacks, along with preliminary defense ideas based on those definitions.

Static Random Access Memory (SRAM) is a core technology for building computing hardware, including cache memory, register files and field programmable gate array devices. Hence, SRAM reliability is essential to guarantee dependable computing. While significant research has been conducted to develop automated test algorithms for detecting manufacture-induced SRAM faults, they cannot ensure detection of faults deliberately implemented in the SRAM array by untrusted parties in the integrated circuit development flow. Indeed, such hardware Trojan attacks represent an emerging security threat. While a growing body of research addresses Trojan designs in logic circuits, little research has explored hardware Trojan attacks in embedded memory arrays [20]. In this article, we propose a new class of hardware Trojans targeting embedded SRAM arrays. The Trojans are designed to evade industry standard post-manufacturing tests while enabling attacks targeting various system hardware components during deployment. Transistor-level simulation results demonstrate minimal impact on SRAM power, performance, and stability while Trojans are not activated. We also prove the feasibility of Trojan insertion in foundries by showing the proposed layouts that preserve the SRAM cell footprint and incur zero silicon area overhead. Finally, we elaborate on several system-level attacks that can leverage these Trojans to compromise security and privacy.

System-on-Chip (SoC) security architectures targeted towards diverse applications including Internet of Things (IoT) and automotive systems enforce two critical design requirements: in-field configurability and low overhead. To simultaneously address these constraints, in this paper, we present a novel, flexible, and adaptable SoC security architecture that efficiently implements diverse security policies. The architecture and associated CAD flow enable “hardware patching” i.e. hardware security policy engine that can be seamlessly and securely upgraded in field to address unanticipated attacks or new security requirements. We implement (1) a centralized Reconfigurable Security Policy Engine (RSPE), (2) smart security wrappers, and (3) Design-for-Debug (DfD) infrastructure interface as the building blocks of the architecture. The proposed framework provides a systematic approach to represent and synthesize diverse security policies. Through extensive analysis using representative SoC models, we show, for the first time to our knowledge, that the proposed framework provides high level of patchability with minimal energy and performance overhead.

Embedded memory, typically implemented with Static Random Access Memory (SRAM) technology, is an integral part of modern processors and System-on-Chips (SoCs). The reliability and integrity of embedded SRAM arrays are essential to ensure dependable and trustworthy computing. In the past, significant research has been conducted to develop automated test algorithms aimed at comprehensively detecting SRAM faults. While such tests have advanced our ability to detect manufacturing imperfection induced faults, they cannot ensure detection of deliberately implemented design modifications, also known as hardware Trojans, in an SRAM array by untrusted entities in the design and fabrication flow. Indeed, these attacks constitute an emerging concern, since they can affect the integrity of fabricated ICs and cause severe consequences in the field. While a growing body of research addresses Trojan attacks in logic circuits, little to no research has explored these attacks in embedded memory arrays. In this paper, for the first time to our knowledge, we propose a new class of hardware Trojans targeting embedded SRAM arrays. The Trojans are designed to evade industry standard post-manufacturing memory tests (e.g. March test) while enabling targeted data tampering after deployment. We demonstrate various forms of Trojan circuits in SRAM that cause diverse malicious effects and have diverse activation conditions while incurring minimal overhead in power, performance, and stability. Further, the proposed layouts preserve the SRAM cell footprint and incur negligible silicon area overhead.

Modern system-on-chip (SoC) designs involve integration of a large number of intellectual property (IP) blocks, many of which are acquired from untrusted third-party vendors. An IP containing a security vulnerability-whether inadvertent or malicious-may compromise the trustworthiness of the entire SoC, e.g., by leaking sensitive information or causing execution failures at key points. Existing functional validation approaches, post-manufacturing tests, and IP trust verification techniques are inadequate to accomplish comprehensive system-level security assurance in the presence of untrusted IPs. In this paper, we analyze security issues at the SoC level caused by untrusted IPs. We also propose a novel, resilient SoC security architecture to ensure trusted SoC operation with untrusted IPs. Our architecture realizes fine-grained IP-trust aware security policies in an efficient security policy checker that enables run-time monitoring of security issues arising from untrusted IPs. It also exploits on-chip design-for-debug architecture to ensure trusted information flow from IP blocks to the security policy checker. Unlike existing solutions to the untrusted IP problem, which rely on verification of IP trust before they are integrated into an SoC, the proposed approach follows a fundamentally different architecture-level solution based on run-time resilience. We demonstrate the effectiveness of this framework for system protection using several illustrative practical use cases. We also provide experimental results to show that the overhead of the proposed architecture is modest on representative SoC designs.

Systematic implementation of System-on-Chip (SoC) security policies typically involves smart wrappers extracting local security critical events of interest from Intellectual Property (IP) blocks, together with a control engine that communicates with the wrappers to analyze the events for policy adherence. However, developing customized wrappers at each IP for security requirements may incur significant overhead in area and hardware resources. In this paper, we address this problem by exploiting the extensive design-for-debug (DfD) instrumentation already available on-chip. In addition to reduction in the overall hardware overhead, the approach also adds flexibility to the security architecture itself, e.g., permitting use of on-field DfD instrumentation, survivability and control hooks to patch security policy implementation in response to bugs and attacks found at post-silicon or changing security requirements on-field. We show how to design scalable interface between security and debug architectures that provides the benefits of flexibility to security policy implementation without interfering with existing debug and survivability use cases and at minimal additional cost in energy and design complexity.

We are in the regime of Internet-of-Things (IoT), - a regime characterized by billions of smart, connected computing devices coordinating to provide large-scale, highly personalized applications. Two overriding themes in this regime are energy consumption and security enforcement, which are both critical to the sustainability and proliferation of the IoT ecosystem. However, energy and security requirements are often at odds. This paper discusses several challenges in developing trustworthy IoT devices that comprehend the energy-security trade-offs. We also outline some emergent approaches to address this conflict.

The rapidly growing incidences of counterfeit integrated circuits (ICs) pose a significant threat to the semiconductor industry. These ICs may suffer from functional, performance, or reliability issues and can affect chip manufacturers, system designers as well as end users. The standard chip/package level structural and functional tests are often inadequate in detecting various forms of counterfeit ICs. Moreover, existing design for security approaches are usually not attractive due to additional design modifications, hardware overhead, test cost, and inadequate robustness. In this paper, we propose a novel, low-overhead package-level IC integrity validation approach, referred to as P-Val, for unified protection against two primary forms of counterfeiting attacks: 1) recycling and 2) cloning. Protection against recycled/remarked chips is achieved through a unique active defense that inserts antifuses (AFs) (one-time programmable) to few select pins inside the package. It effectively disables the functionality or “locks” these pins, which need to be programmed before first-time use to make a chip functional in a system. To protect against cloned ICs, intrinsic random variations in programmed resistances of AFs connected to some of the remaining IC pins are exploited to create unique chip-specific signatures for authentication. P-Val requires no die-level design modifications and remains effective for legacy designs. Moreover, we show that it is effective for small chips with just few pins including analog ICs, where common authentication approaches fail to work. We discuss optimal choice of AF structure and program parameters; their integration in IC packages; and the signature generation/verification process. Through mathematical analysis and simulation results, we demonstrate that the proposed mechanism provides high level of protection against counterfeiting attacks at ultralow overhead (<0.05% package area).

We consider the conflicts between requirements from security and post-silicon validation in SoC designs. Post-silicon validation requires hardware instrumentations to provide observability and controllability during on-field execution; this in turn makes the system prone to security vulnerabilities, resulting in potentially subtle security exploits. Mitigating such threats while ensuring that the system is amenable to post-silicon validation is challenging, involving close collaboration among security, validation, testing, and computer architecture teams. We examine the state of the practice in this area, the trade-offs and compromises made, and their limitations. We also discuss an emerging approach that we are contemplating to address this problem.

Modern SoC designs incorporate several security policies to protect sensitive assets from unauthorized access. The policies affect multiple design blocks, and may involve subtle interactions between hardware, firmware, and software. This makes it difficult for SoC designers to implement these policies, and system validators to ensure adherence. Associated problems include complexity in upgrading these policies, IP reuse for systems targeted for markets with differing security requirement, and consequent increase in design time and time-to-market. In this paper, we address this important problem by developing a generic, flexible architectural framework for implementing arbitrary security policies in SoC designs. Our architecture has several distinctive features: (1) it relies on a dedicated, centralized, firmware-upgradable plug-and-play IP block that can implement diverse security policies; (2) it interfaces with individual IP blocks through their “security wrapper”, which exploits and extends test/debug wrappers; (3) it implements a security policy as firmware code following existing security policy languages; (4) it can implement any security policy as long as relevant observable and controllable signals from the constituent IPs are accessible through the security wrappers; and (5) it realizes a low-overhead communication link between security wrappers of IP blocks and the centralized, dedicated controller. The approach builds on and extends the recent work on developing a centralized infrastructure IP for SoC security, referred to as IIPS, that interface with IP blocks using their boundary scan based wrappers. While this architecture is generic and independent of security policy types, we provide case studies with several common policies to show the flexibility and extendibility of the architecture. We also evaluate its viability in terms of overhead in area and power.

The rapidly rising incidences of counterfeit Integrated Circuits (ICs) including cloning attacks pose a significant threat to the semiconductor industry. Conventional functional/structural testing are mostly ineffective to identify different forms of cloned ICs. On the other hand, existing design for security (DfS) measures are often not attractive due to additional design effort, hardware overhead and test cost. In this paper, we propose a novel robust IC authentication approach, referred to as PiRA, to validate the integrity of ICs in presence of cloning attacks. It exploits intrinsic random variations in pin resistances across ICs to create unique chip-specific signatures for authentication. Pin resistance is defined as the resistance looking into or out the pin according to set parameters and biasing conditions, measured by standard tests for IC defect/performance analysis such as input leakage, protection diode and output load current tests. A major advantage of PiRA over existing methodologies is that it incurs virtually zero design effort and overhead. Furthermore, unlike most authentication approaches, it works for all chip types including analog/mixed-signal ICs and can be applied to legacy designs. Theoretical analysis as well as experimental measurements with common digital and analog ICs verify the effectiveness of PiRA.

Security is becoming an increasingly important parameter in current system-on-chip (SoC) design due to diverse hardware security attacks that can affect manufacturers, system designers or end users. To effectively address the security issues, design-time considerations, e.g. incorporation of design-for-security (DfS) features, are becoming essential. However, DfS measures for diverse security threats require specific design modifications to achieve target security level, which significantly increases design effort thus time-to-market, and usually incurs considerable design overhead. In addition, the general heterogeneous architecture of current SoCs makes many core-level DfS mechanisms unusable at SoC level. In this paper, we propose a centralized on-chip infrastructure IP for SoC security (IIPS), which alleviates the SoC designers from separately addressing different security issues through design modifications in multiple cores. It also provides ease of integration and functional scalability. We consider a specific implementation of IIPS that provides protection against: (1) scan-based attack for information leakage through low-overhead authentication; (2) counterfeiting attacks through integration of a Physical Unclonable Function (PUF); and (3) hardware Trojan attacks through a test infrastructure fortrust validation. To make the IP amenable for plug-and-play during SoC design, working protocols of the security functions are designed to comply with IEEE 1500 Standard for Embedded Core Test (SECT). Since IIPS resides outside the functional modules, it does not incur functional performance or power overhead. Simulations and experiments on example SoC designs validate the effectiveness of IIPS in providing protections against diverse attacks at a low hardware overhead.

Rising incidences of counterfeit chips in the supply chain have posed a serious threat to the semiconductor industry. Recycling of used chips constitutes a major form of counterfeiting attacks. If undetected, they can lead to serious consequences including system performance/reliability issues during field operation and potential revenue/reputation loss for a trusted manufacturer. Existing validation approaches based on path delay analysis suffer from reduced robustness and sensitivity under large process variations. On the other hand, existing design solutions based on aging sensors require additional design/verification efforts and cannot be applied to legacy chips. In this paper, we present a novel recycled chip identification approach, CACI, that exploits differential aging in self-similar modules (e.g., different parts of an adder) to isolate aged chips under large inter- and intra-die process variations. It compares dynamic current (IDDT) signatures between two adjacent similar circuit structures in a chip. We derive an isolation metric based on multiple current comparisons to provide high level of confidence. CACI does not rely on any embedded structures for authentication, thus it comes at virtually zero design overhead and can be applied to chips already in the market. Through extensive simulations, we show that for 15% inter- and 10% intra-die variations in threshold voltage for a 45nm CMOS process, over 97% of recycled chips can be reliably identified.

The rapidly rising incidences of counterfeit Integrated Circuits (ICs) in the semiconductor supply chain pose a significant threat to the electronic industry. These ICs may suffer from functional, performance or reliability issues and can affect design houses, chip manufacturers, system designers as well as end users. The standard chip/package/system level tests are often inadequate in detecting various forms of counterfeit ICs. On the other hand, design approaches that enable IC authentication are often not attractive due to significant design effort, hardware overhead and test cost. In this paper, we propose a novel defense against counterfeiting attacks through a “chip locking approach”, where an IC is made non-operational by locking select pins through insertion of Antifuse (AF) devices in input/output circuitry. It can be unlocked through application of a hard-to-clone key. The key is internally stored in a onetime programmable non-volatile memory. The key storage and comparison circuit is protected against reverse engineering and side-channel analysis attacks. Through mathematical analysis and simulation results, we demonstrate that the proposed mechanism provides high level of protection against all major forms of counterfeiting attacks (reselling, remarking and cloning) at ultralow overhead (<; 0.01% area).