We investigate the risk posed by amplitude-modulating analog/RF hardware Trojans in wireless networks and propose a defense mechanism to mitigate the threat. First, we introduce the operating principles of amplitude-modulating analog/RF hardware Trojan circuits and we theoretically analyze their performance characteristics. Subject to channel conditions and hardware Trojan design restrictions, this analysis seeks to determine the impact of these malicious circuits on the legitimate communication and to understand the capabilities of the covert channel that they establish in practical wireless networks, by characterizing its error probability. Next, we present the implementation of two hardware Trojan examples on a Wireless Open-Access Research Platform (WARP)-based experimental setup. These examples reside in the analog and the RF circuitry of an 802.11a/g transmitter, respectively, where they manipulate the transmitted signal characteristics to leak their payload bits. Using these examples, we demonstrate (i) attack robustness, i.e., ability of the rogue receiver to successfully retrieve the leaked data, and (ii) attack inconspicuousness, i.e., ability of the hardware Trojan circuits to evade detection by existing defense methods. Lastly, we propose a defense mechanism that is capable of detecting analog/RF hardware Trojans in WiFi transceivers. The proposed defense, termed Adaptive Channel Estimation (ACE), leverages channel estimation capabilities of Orthogonal Frequency Division Multiplexing (OFDM) systems to robustly expose the Trojan activity in the presence of channel fading and device noise. Effectiveness of the ACE defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

Among the various strategies for hiding malicious capabilities in integrated circuits (ICs), analog circuit design techniques have recently drawn increased attention due their lower area, power and delay footprints, which make their detection significantly more challenging. Specifically, switched capacitors have been used for creating stealthy trigger circuits based on toggling activity on a victim wire. Various methodologies for detecting such culprits have been investigated; however, recent literature in this area contains several misconceptions or inaccuracies regarding the topologies of these trigger circuits and the effectiveness of previously proposed detection methods. Therefore, in this paper, we first revisit the design of switched capacitor-based trigger circuits and we present several design configurations which are not encompassed by previously demonstrated models, but which can also serve the same malevolent purpose. We, then, discuss the effectiveness and the shortcomings of existing defense methodologies, and we point towards additional research that is needed in this area.

Unlike the extensive research effort that has been expended over the last 15 years in understanding the threats of hardware Trojans, piracy and counterfeiting of digital Integrated Circuits (ICs), and in developing appropriate prevention and detection solutions, the topic of security and trust remains in a rather nascent state for their analog/radio-frequency (RF) counterparts. Indeed, as shown in a recent survey, which summarized and presented the available body of knowledge in trusted and secure design of analog/RF ICs, our understanding of the pertinent threats and our ability to thwart them through existing solutions are both rather limited. However, given the widespread use of analog functionality (i.e., physical interfaces, sensors, actuators, wireless communications, etc.) in most contemporary systems, comprehending their vulnerabilities and devising pertinent remedies is urgently required. In this paper, we discuss the limitations of the current state-of-the-art in this field, we highlight recent developments, and we suggest research directions and steps to be taken toward designing, fabricating and deploying trusted and secure analog/RF ICs.

We propose a machine learning-based solution for noise classification and decomposition in RF transceivers. Wireless transmitters are affected by various noise sources, each of which has a distinct impact on the signal constellation points. The proposed approach takes advantage of the characteristic dispersion of points in the constellation by extracting key statistical and geometric features that are used to train a machine learning model. The trained model is, then, capable of identifying the noise source fingerprint, comprised by single or multiple noise sources, for each affected device. Effectiveness of the model has been verified using constellation measurements from a combined set of simulated and actual silicon devices.

We discuss the threat that malicious circuitry (a.k.a. hardware Trojan) poses in wireless communications and propose a remedy for mitigating the risk. First, we present and theoretically analyze a stealthy hardware Trojan embedded in the forward error correction (FEC) block of an 802.11a/g transceiver. FEC seeks to shield the transmitted signal against noise and other imperfections. This capability, however, may be exploited by a hardware Trojan to establish a covert communication channel with a knowledgeable rogue receiver. At the same time, the unsuspecting legitimate receiver continues to correctly recover the original message, despite experiencing a slight reduction in signal-to-noise ratio (SNR) and, therefore, remains oblivious to the attack. Next, we implement this hardware Trojan on an experimental setup based on the Wireless Open Access Research Platform (WARP) and we demonstrate (i) attack robustness, i.e., the ability of the rogue receiver to correctly receive the leaked information and (ii) attack inconspicuousness, i.e., imperceptible impact on the legitimate transmission. Lastly, we theoretically analyze and experimentally evaluate a Trojan-agnostic detection mechanism, namely, channel noise profiling, which monitors the noise distribution to identify inconsistencies caused by hardware Trojans, regardless of their implementation details. The effectiveness of channel noise profiling is experimentally assessed using the proposed hardware Trojan under various channel conditions and a different covert Wi-Fi attack previously proposed in the literature.

We propose a defense method capable of detecting hardware Trojans (HTs) in the analog/RF circuitry of wireless local area network (WLAN) transceivers. The proposed method, which is implemented on the receiver (RX) side and cannot be tampered with by the attacker, leverages the channel estimation capabilities present in Orthogonal Frequency Division Multiplexing (OFDM) systems. Specifically, it employs an adaptive approach to robustly isolate possible HT activity from channel and device noise, thereby exposing the Trojan's presence. The adaptive channel estimation (ACE) defense mechanism is put to the test using a HT which is implemented on a printed circuit board (PCB) and mounted on the Wireless Open-Access Research Platform (WARP). This HT, which is introduced through minute modifications in the power amplifier (PA), manipulates the transmission power characteristics of an 802.11a/g transmitter (TX) in order to leak sensitive data, such as the encryption key. Effectiveness of the proposed defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

As CMOS technology continues to scale down, the effect of process variations on yield and performance of analog/RF ICs is becoming more prominent. To counteract this effect, learning-based post-production tuning has been proposed, wherein regression functions are trained and used to adjust tunable knobs based on low-cost alternate tests, thereby improving the performances of a circuit and, by extension, increasing yield. Of course, tunable knobs are also subject to process variations; yet this is not an issue when the knobs are part of the procedure that generates the data with which the regression models are trained, as this data reflects the impact of process variations on both the tunable circuit and the knobs. In various cases, however, such as in heterogeneous integrated systems, 3D ICs, or multi-chip modules, the knob circuitry may not be integrated on the same die, thereby limiting our ability to obtain a comprehensive set of training data. Accordingly, in this work we investigate the impact of knob non-idealities which are not captured in the training data, on the ability of the learned regression functions to accurately predict the optimum knob position that maximizes the performance of a circuit. Using a tunable cascode low-noise amplifier (LNA) fabricated in 130nm CMOS process, alongside external knobs designed as linear low drop out regulators (LDOs) and voltage dividers operating on the bias voltages of the LNA, we first quantify this impact. Then, we demonstrate that by explicitly introducing “noise” in the knob output values used during training set generation, we can effectively alleviate external knob non-idealities and improve quality of tuning.

We discuss a methodology and the corresponding hardware architecture for performing self-calibration of analog/RF ICs through the use of on-die learning. More specifically, we introduce the design of an on-chip analog neural network which can be trained to implement a non-linear regression function. This regression function is, then, used to approximate a Figure-of-Merit (FoM) reflecting the performances of an analog/RF IC. As an input to this regression function, we use the readings of low-cost on-chip sensors in response to simple on-chip generated stimuli. The FoM is predicted for all possible settings of the knobs provided for calibrating the chip performances and the best option is retained. The proposed methodology is demonstrated on a tunable Low-Noise Amplifier (LNA) which was designed and fabricated in IBM's 130nm RF CMOS process. Experimental results show that the proposed self-calibration method achieves not only significant yield enhancement but also a compelling optimization of the LNA's overall performance across the entire chip population.

Growing demand for more powerful yet smaller devices has resulted in continuous scaling of fabrication technologies. While this approach supports aggressive design specifications, it has resulted in tighter constraints for circuit designers who face yield losses in analog/RF ICs due to process variation. Over the last few years, several statistical techniques have, therefore, been proposed to counter these losses and to recover yield through individual post-manufacturing calibration of each fabricated chip using tuning knobs. These techniques can be broadly classified as iterative or one-shot calibration methods, with the latter having the benefit of being faster and, therefore, more likely to be cost-effective in a high volume manufacturing (HVM) environment. In this paper, we first put three previously proposed one-shot statistical calibration methods to the test using a custom-designed tunable LNA, which was fabricated in IBM's 130nm RF CMOS process. We, then, introduce an improvement to the tuning knob selection criterion, which applies to all three methods, increasing their effectiveness. Finally, we demonstrate the efficacy of a previously proposed approach which uses simulation data and Bayesian model fusion in order to reduce the number of chips required for training the statistical models employed by the three one-shot calibration methods.

Repeatability, isolation and accuracy are the most desired factors while testing wireless devices. However, they cannot be guaranteed by traditional drive tests. Channel emulators play a major role in filling these gaps in testing. In this paper we present an efficient channel emulator which is better than existing commercial products in terms of cost, remote access, support for complex network topologies and scalability. We present the hardware and software architecture of our channel emulator and describe the experiments we conducted to evaluate its performance against a commercial channel emulator.