Fault-injection attacks (FIAs) represent a wide-spread and potent method of compromising the integrity and confidentiality of integrated circuits (ICs) and electronic systems. These attacks include voltage/clock glitching, electromagnetic (EM) interference, laser, and optical injection. One promising defense strategy is intrusion detection, which uses sensors to monitor and capture the effects of such attacks. However, the diversity of these attacks has led to the development of specialized sensors for each attack type, posing challenges in terms of feasibility and overhead. This article introduces a universal solution for efficiently detecting prominent FIAs using a lightweight on-chip delay-based fault-to-time converter (FTC) sensor. The proposed sensor functions by translating the consequences of fault attacks into measurable “time” differentials. This design is readily implementable on both field-programmable gate array (FPGA) and application-specific integrated circuit (ASIC) platforms. The sensor placement considers the most vulnerable elements in the design to fault attacks to position them closely to those locations for extracting the best sensitivity to delay changes. We illustrate the sensor’s responses to major FIAs, demonstrating its ability to differentiate between nominal and fault conditions. The overhead analysis also highlights the sensor’s minimal resource utilization in FPGA implementations. We also explore the sensor’s response to environmental variations for proper characterization.

Conventional logic locking techniques mainly focus on gate-level netlists to combat IP piracy and IC overproduction. However, this is generally not sufficient for protecting semantics and behaviors of the design. Further, these techniques are even more objectionable when the IC supply chain is at risk of insider threats. This paper proposes RTLock, a robust logic locking framework at the RTL abstraction. RTLock provides a detailed formal analysis of the design specs at the RTL that determines the locking candidate points w.r.t. attacks resiliency (SAT/BMC), locking key size, and overhead. RTLock incorporates (partial) DFT infrastructure (scan chain) at the RTL, enabled with a scan locking mechanism. It allows us to push all the necessary security-driven actions to the highest abstraction level, thus making the flow EDA tool agnostic. Additionally, RTLock demonstrates why RTL-based locking must be coupled with encryption and management protocols (e.g., IEEE P1735), to be effective against insider threats. Our experimental results show that, vs. other techniques, RTLock protects the design against broader threats at low overhead and without compromising testability.

With the emergence of the horizontal business model in the semiconductor industry, numerous hardware security concerns have been emerged, including intellectual property (IP) theft, malicious functionality insertion, and IC overproduction. To combat these threats, logic locking has been introduced as one of the most prominent countermeasures, and advances in logic locking have led the most recent techniques toward higher levels of abstractions, i.e., register transfer language (RTL) or high-level languages (C/C++). In this article, we propose HLock+, a robust logic locking framework at the high-level design language. HLock+ consists of two main parts to achieve multiple goals: 1) Locking in HLock+ is based on a formal analysis over design specifications, assets, and critical operations to determine locking points in the design to provide the best solution in terms of desired attack resiliency (e.g., SAT attacks), and locking key size and 2) we integrate the formal analysis with a point function locking technique, in which the locking candidates have been chosen by an optimization algorithm helping us to boost the efficiency of the approach with the given area, power, and performance constraints. Furthermore, the proposed framework ensures a dynamic/automatic locking solution based on a set of specifications, and it is well suited for large-scale designs. Apart from having lesser development/verification efforts, HLock+ at high-level language will be followed by high-level synthesis (HLS) and RTL synthesis, which provides superior uniform distribution and optimum output corruptibility. We show that HLock+ provides potent robustness against de-obfuscation attacks, e.g., SAT and machine-learning-based attacks, while the overhead is kept low.

Working towards a higher level of abstraction (C/C++) facilitates designers to execute and validate complex designs faster in response to highly demanding time-to-market requirements. High-Level Synthesis (HLS) is an automatic process that translates the high-level description of the design behaviors into the corresponding hardware description language (HDL) modules. However, HLS translation steps/optimizations can cause security vulnerabilities since they have not been designed with security in mind. It is very important that HLS generates functionally correct RTL in a secure manner in the first place since it is not easy to read the automatically generated codes and trace them back to the source of vulnerabilities. Even if one manages to identify and fix the security vulnerabilities in one design, the core of the HLS engine remains vulnerable. Therefore, the same vulnerabilities will appear in all other HLS generated RTL codes. This paper shows a systematic approach for identifying the source of security vulnerabilities introduced during HLS and mitigating them.

With the increased complexity of integrated circuits (ICs) and the fabrication processes at lower technology nodes, the semiconductor industry has largely shifted to a horizontal business model to minimize time-to-market and manufacturing costs. Due to outsourcing, the design house and third-party intellectual property (IP) owners lack control over the fabrication process, which can result in IP piracy, overuse, and counterfeiting. Watermarking is an approach to trace pirated parts back to the source by uniquely identifying IPs. In this paper, we introduce a novel watermarking technique, called ADWIL, using specific features and characteristics of the analog and mixed-signal (AMS) IP cores without modifying the target IP circuitry or its internal structure. Since the IP core remains unaltered, the watermark is very hard to detect and impossible to remove. Our experimental results on different op-amps demonstrate that watermark can be extracted reliably from target IP cores by using ADWIL.

The introduction of the horizontal business model for the semiconductor industry has introduced trust issues for the integrated circuit supply chain. The most common vulnerabilities related to intellectual properties can be caused by untrusted third-party vendors and malicious foundries. Various techniques have been proposed to lock the design at the gate-level or RTL before sending it to the untrusted foundry for fabrication. However, such techniques have been proven to be easily broken using SAT attacks and machine learning-based attacks. In this paper, we propose HLock, a framework for ensuring hardware protection in the form of locking at the high-level description of the design. Our approach includes a formal analysis of design specifications, assets, and critical operations to determine points in which locking keys are inserted. The locked design is then synthesized using high-level synthesis, which has become an integral part of modern IP design due to its advantages on lesser development and verification efforts. The locking at the higher abstraction with the combination of multiple syntheses shows that HLock delivers superior performance considering attack resiliency (i.e., SAT attack, removal attacks, machine learning-based attacks) and overheads compared to conventional locking techniques. Additionally, HLock provides a dynamic/automatic locking solution for any high-level abstraction design based on performance constraints, attack resiliency, power, and area overheads as well as locking key size, and it is well suited for large-scale designs.