International audience

Integrated Circuit (IC) supply chain attacks—such as piracy and intellectual property (IP) theft—pose a critical challenge for IC and System-on-Chip (SoC) designers. This paper introduces a novel anti-piracy design technique for Bluetooth Low Energy (BLE) transceivers by adapting SyncLock, an RF transceiver-specific logic locking method originally developed for Wi-Fi, to the BLE hardware architecture. The core idea of SyncLock is to key-control the transmitted frame’s preamble, ensuring that an incorrect key prevents synchronization between transmitter and receiver. We demonstrate this approach using a Continuous Phase Modulation (CPM) transmitter configured for BLE. Experimental results confirm that the proposed technique successfully achieves key-based functionality: with the correct key, normal operation is preserved and the locking mechanism remains transparent, whereas an incorrect key prevents communication link establishment. Additionally, the results show that embedding SyncLock incurs minimal and justifiable overhead, highlighting its practicality and making it a strong candidate for protecting Bluetooth transceiver hardware IPs.

The globalization of the Integrated Circuit (IC) supply chain has given rise to several hardware security and trust threats. Especially, IC piracy and counterfeiting are significant preoccupations for designers. This demonstration shows how to secure a wireless IC against such threats. The case study is an open-source IEEE 802.11 WiFi modem implemented on hardware using a Software Defined Radio (SDR) bladeRF board. The modem is secured with synchronization-based locking (SyncLock), a state-of-the-art locking scheme for RF transceivers. SyncLock disables the wireless communication between the modem and a WiFi-compliant receiver unless the correct secret key is loaded onto the modem.

We present a locking-based design-for-security methodology to prevent piracy of RF transceiver integrated circuits. The solution is called SyncLock as it locks the synchronization of the transmitter with the receiver. If a key other than the secret key is applied, synchronization and, thereby, communication fail. SyncLock is implemented using a novel locking concept consisting of two spatially separated mechanisms. A hard-coded error is hidden into the design to break synchronization while error correction, i.e., unlocking, takes place in another part of the design by applying the secret key. SyncLock offers several advantages: the secret key is unique, i.e., any incorrect key causes a denial-of-service, there is no performance penalty, it can be seemingly integrated into the digital design flow, area and power overheads are negligible, and it achieves maximum provable security thwarting all known counter-attacks. SyncLock is demonstrated with hardware measurements.

We propose a Hardware Trojan (HT) attack in wireless Integrated Circuits (ICs) that aims at leaking sensitive information within a legitimate transmission. The HT is hidden inside the transmitter modulating the sensitive information into the preamble of each transmitted frame which is used for the synchronization of the transmitter with the receiver. The data leakage does not affect synchronization and is imperceptible by the inconspicuous nominal receiver as it does not incur any performance penalty in the communication. A knowledgeable rogue receiver, however, can recover the data using signal processing that is too expensive and impractical to be used during run-time in nominal receivers. The HT mechanism is designed at circuit-level and is embedded entirely into the digital section of the RF transceiver having a tiny footprint. The proposed HT attack is demonstrated with measurements on a hardware platform. We demonstrate the stealthiness of the attack, i.e., its ability to evade defenses based on testing and run-time monitoring, and the robustness of the attack, i.e., the ability of the rogue receiver to recover the leaked information even under unfavorable channel conditions.

We present an anti-piracy locking-based design methodology for RF transceivers, called SyncLock. SyncLock acts on the synchronization of the transmitter with the receiver. If a key other than the secret one is applied the synchronization and, thereby, the communication fails. SyncLock is implemented using a novel locking concept. A hard-coded error is hidden into the design while the unlocking, i.e., the error correction, takes place at another part of the design upon application of the secret key. SyncLock presents several advantages. It is generally applicable, incorrect keys result in denial-of-service, it incurs no performance penalty and minimum overheads, and it offers maximum security thwarting all known counter-attacks. We demonstrate SyncLock with hardware measurements.

The design and manufacturing steps of a chip typically involve several parties. For example, a chip may comprise several third-party intellectual property (IP) cores and the integrated circuit (IC) fabrication may be outsourced to a third-party foundry. IP cores and ICs are shared with potentially untrusted third parties and, as a result, are subject to piracy attacks. Even more, any legally purchased chip may be reverse engineered to retrieve the design down to transistor level and, thereby, it is also subject to piracy attacks. In this article, we proposeMixLock, an anti-piracy countermeasure for mixed-signal IP cores and ICs.MixLockprotection is based on inserting a lock mechanism into the design such that correct functionality is established only after applying a key which is the designer’s secret. The lock mechanism acts on the mixed-signal performances by leveraging logic locking of the digital part.MixLockpresents several key attributes. It is generally applicable, it is nonintrusive to the sensitive analog section, it incurs no performance penalty and has very low area and power overheads, it is fully automated, and it is capable of co-optimizing security in both the analog and digital domains. We demonstrateMixLockon a$\Sigma \Delta $analog-to-digital converter (ADC) using hardware measurements and an audio demonstrator.