Globalization of the System-on-Chip (SoC) supply chain has resulted in increased intellectual property (IP) piracy, illegal reuse, and tampering by malicious actors. In response to these challenges, IP watermarking presents itself as a promising solution to protect against these risks; however, traditional methods rely heavily on labor-intensive manual tests by verification engineers and fail to account for the potential threat posed by malicious SoC design houses. To overcome these challenges and improve the efficiency of the watermark verification process while safeguarding against possible attacks, we developedActiWateas an innovative watermarking approach that not only provides proof of authorship but also prevents unauthorized usage of an IP. Using an automatic self-verification technique, the watermark establishes communication with various peripherals within the SoC. The versatility and effectiveness ofActiWatehave been proven through extensive experiments on multiple SoCs with diverse components and peripherals, including the testing of watermarking and the verification of various IPs. Moreover, we discuss the inclusion of this multiple serialized verification in more case studies and results, as well as analyzing prominent security threats, including reverse engineering attacks.

To meet the demands of diverse and rapidly evolving markets, system-on-chips (SoCs) are becoming more complex in size and functionality. More IPs and hardware accelerators are required to support a varied set of applications with faster response. In recent years, there has been a growing trend of using reconfigurable and adaptable hardware for compute-intensive kernels, e.g., neural networks, crypto-engines, and blockchains. Hence, embedded FPGA (eFPGA) technology has emerged as a standard solution incorporated into the SoC to enhance computational performance and provide reconfigurability. However, with the increasing complexity and size of modern SoCs, coupled with the integration of third-party IPs (3PIPs) and accelerators, ensuring the information security, i.e., integrity, confidentiality, and availability, of critical and sensitive data has become more challenging than ever before. Thus, a sustainable and upgradable security auditing infrastructure has become a necessity. This paper extends EnSAFe, a framework specially crafted to streamline security policy auditing while enabling upgradability within designs that leverage eFPGA-based accelerators. The EnSAFe framework enables signal monitoring in a plug-and-play fashion, and the monitoring core logic is mapped onto the eFPGA accelerator component with minimal overhead. We extend EnSAFe through novel methodologies and algorithms for security policy generation, optimization of security policy implementations, and enhancement of the reconfigurability of the Security Status Monitor (SSM). We also establish a security policy database and assess the effectiveness of the extended framework for policy checking across various use case scenarios. Our experiments show that EnSAFe can detect runtime threats/vulnerabilities at low area overhead.

As modern SoC architectures incorporate many complex/heterogeneous intellectual properties (IPs), the protection of security assets has become imperative, and the number of vulnerabilities revealed is rising due to the increased number of attacks. Over the last few years, penetration testing (PT) has become an increasingly effective means of detecting software (SW) vulnerabilities. As of yet, no such technique has been applied to the detection of hardware vulnerabilities. This paper proposes a PT framework, SHarPen, for detecting hardware vulnerabilities, which facilitates the development of a SoC-level security verification framework. SHarPen proposes a formalism for performing gray-box hardware (HW) penetration testing instead of relying on coverage-based testing and provides an automation for mapping hardware vulnerabilities to logical/mathematical cost functions. SHarPen supports both simulation and FPGA-based prototyping, allowing us to automate security testing at different stages of the design process with high capabilities for identifying vulnerabilities in the targeted SoC.

Watermarking offers a viable solution to combat IP piracy and illegal re-use. However, watermarking verification techniques rely heavily on manual testing by verification engineers and ignore the possibility of having a rogue SoC design house. To automate the watermarking-based verification process and to be against wider attacks (e.g., rogue design house), this paper presents ActiWate, which conducts automatic self-verification by communicating with various peripherals within the SoC. Showing its resilience against removal and spoofing attacks, ActiWate is architectured to be an IP/SoC-agnostic watermarking and our experiments demonstrate its versatility by implementing it on multiple RISC-V SoCs with different components/peripherals.

The ever-increasing propensity for intellectual property (IP) reuse has reduced the design productivity gap in the supply chain. As a consequence, protecting IPs has become more difficult since IP vendors now make their IPs more flexible so that they can be reused in other designs for greater profits. This has made IP piracy and infringement easier than ever. IP watermarking can detect IP piracy and infringement and it has been an active research topic for the past decade. Various watermarking techniques have been discussed in the literature that embed circuitry into IP to provide proof of ownership. But, in most RT-level watermarking methods, the watermarking circuit is separate from IP functionality and can be easily identified and tampered with. In this paper, we propose CAPEC, a Cellular Automata (CA) guided watermarking technique that embeds watermarking circuits into the don’t care states of the FSM. The watermarking function is a set of configurable CA rules tightly coupled with the functional states of the FSM. CAPEC generates a signature in a challenge-response-based protocol, is resistant to identification, tampering, and removal attacks, and has minimal overhead. We also analyze and evaluate the efficiency of the technique and its resilience to different attacks for varying challenge size and CA rules. After watermarking different benchmarks, the watermark overhead was found to be negligible and formal verification proved no changes to the functional circuit.