Zero-day attacks present a significant security threat to vehicular networks, exploiting vulnerabilities at both software and hardware levels within such systems that remain undiscovered. Mitigating these threats is essential to ensuring the safety and security of vehicular systems. Support Vector Machine (SVM) is a good candidate for anomaly detection of zero-day attacks within vehicular networks because it can handle highdimensional data and effectively distinguish between normal and abnormal patterns in complex and dynamic environments. A trained SVM on the normal operation data of in-vehicular network can identify flag deviations, thus making it effective in the detection of any previously unknown attack patterns, which is a common behaviour of zero-day attacks. In this paper, we introduce an anomaly detection method called “ZeroCAN” which models the behaviour of every single electronic control unit on the network with a separate SVM and a set of high-level features that capture the timing and data payload aspects of CANbus traffic. This approach achieves an anomaly detection rate of over $\mathbf{9 9 \%}$ and a false positive rate below $\mathbf{0. 0 1 \%}$ during normal operation in most cases.

Embedded systems are vulnerable to significant security threats from Fault Injection Attacks (FIAs), which allow attackers to gain access to confidential information. While various attack detectors have been proposed in the literature to detect different types of FIAs, these detectors themselves are susceptible to such attacks and can be compromised. Hence, the robustness of these detectors is critical in maintaining the security of embedded systems. The focus of this study is to evaluate the robustness of digital circuits and delay-based digital detectors against a new type of FIA called Power-Off Attack (POA). POA occurs when the power to the chip is turned off, and the detectors are not active. Following a POA attack, the circuit or its detectors may not function properly when the power is turned back on, which can allow other attacks to be applied without being detected if the detectors are less sensitive. This study implements two detectors on Xilinx Artix-7 FPGAs and examines the impact of heating cycles on detector characteristics when the FPGA is in various states, including power-off, power-on, and inactive states (such as clock-freezing mode). Our experiments reveal that heating cycles in power-off mode can alter the FPGA component delays and the accuracy of its detectors, which highlights the vulnerability of these systems to POA and potential issues for embedded system security.

The stochastic switching feature of Spin-Transfer Torque Magnetic RAM (STT-MRAM) provides an attractive knob to trade quality for energy consumption in approximate computing applications. Indeed, the quality of STT-MRAM functionalities (mainly write operation) is increased by consuming more energy to achieve a more stable write. On the other hand, in approximate computing applications, we do not need 100 percent quality for all of the data. Accordingly, in recent years, several approaches have been proposed to find a balance between output threshold quality and energy consumption in approximate computing applications employing STT-MRAM on-chip memories. While approximate computing application output qualities are highly affected by the fluctuations of the environmental-conditions or input variations, none of the previously proposed approaches have considered the effects of these fluctuations on the output quality. In this article, we propose NOSTalgy, a closed-loop cross-layer approach to dynamically trade off the quality of STT-MRAM based cache memories for energy saving in approximate computing applications. NOSTalgy utilizes a feedback managed fine-grained cache-line-level actuation knobs with different levels of quality for individual write accesses. These knobs are adjusted with the support of the operating system and programmer at run-time. Our experimental results using a set of benchmarks show that NOSTalgy satisfies the output quality thresholds while delivering up to 52 percent energy savings with negligible performance and area overheads.

STT-MRAM is regarded as an extremely promising NVM technology for replacing SRAM-based on-chip memories. While STT-MRAM memories benefit from ultra-low leakage power and high density, they suffer from some reliability challenges, namely, read disturbance, write failure, and retention failure. The write failure; storing a wrong value in an STT-MRAM cell during a write operation, is the most crucial reliability challenge. In this article, we propose ROCKY; a robust architecture equipped with efficient replacement policies for STT-MRAM-based cache memory hierarchy to improve the robustness of STT-MRAM part against the write failures. ROCKY reduces susceptible transitions in STT-MRAM cache memories leading to more reliable STT-MRAM write operations. The simulation results through comparison with traditional cache memory hierarchy demonstrate ROCKY decreases the WER of STT-MRAM cache memories by up to 35.4 percent while imposing less than 1 percent performance overhead to the system.

Internet of Things (IoT) is experiencing significant growth in the safety-critical applications which have caused new security challenges. These devices are becoming targets for different types of physical attacks, which are exacerbated by their diversity and accessibility. Therefore, there is a strict necessity to support embedded software developers to identify and remediate the vulnerabilities and create resilient applications against such attacks. In this paper, we propose a hardware security vulnerability assessment based on fault injection of an embedded application. In our security assessment, we apply a fault injection attack by using our clock glitch generator on a critical medical IoT device. Furthermore, we analyze the potential risks of ignoring these attacks in this embedded application. The results will inform the embedded software developers of various security risks and the required steps to improve the security of similar MCU-based applications. Our hardware security assessment approach is easy to apply and can lead to secure embedded IoT applications against fault attacks.

There is a growing attention to the theory of fuzzy-logic and its applications. Efficient hardware design of the fuzzy-inference engine has become necessary for high-performance applications. Considering the facts that fuzzy-logic variables have truth values in the [0, 1] interval and fuzzy controllers include minimum and maximum operations, this work proposes to apply the concept of unary processing to the platform of fuzzy-logic. In unary processing, data in the [0, 1] interval is encoded as bitstream with the value defined by the frequency of 1s. Operations such as minimum and maximum functions can be implemented using simple logic gates. Latency, however, has been an important issue in the unary designs. To mitigate the latency, the proposed design processes right-aligned bit-streams. A one-hot decoder is used for fast detection of the bit-stream with maximum value. Implementing a fuzzy-inference engine with 81 fuzzy-inference rules, the proposed architecture provides 82%, 46%, and 67% saving in the hardware area, power and energy consumption, respectively, and 94% reduction in the number of used LUTs compared to conventional binary implementation.

Scan chain is an architectural solution to facilitate in‐field tests and debugging of digital chips, however, it is also known as a source of security problems, e.g. scan‐based attacks in the chips. The authors conduct a comprehensive gate‐level security analysis on crypto‐chips, which are equipped with a scan chain, and then propose a set of protection mechanisms to immune vulnerable nets of the chips against scan‐based attacks. After extracting the set of most vulnerable nets, they perform net pruning algorithms on them, and gate‐level protection mechanisms to block the information leaking from the nets during test mode. The protection mechanisms employ net masking, net flipping, and net shuffling based on the specifications of every net, i.e. gate‐type driving the net, fan‐out of the net, and net's logical depth. Their evaluations on the hardware‐implemented advanced encryption standard (AES) and data encryption standard (DES) encryption algorithms show 100% for all types of scan‐based attack tolerance, while the area overhead is at most 1.5%, 6.1% for AES and DES crypto‐chip, respectively. As they find the smallest set of nets that have a high contribution to the scan attack, the test coverage loss of their protection mechanism is evaluated to be <0.8%.

This article explores the design space of secure communication in ultra-low-energy IoT devices based on Micro-Controller Units (MCUs). It tries to identify, benchmark, and compare security-related design choices in a Commercial-Off-The-Shelf (COTS) embedded IoT system which contributes to the energy consumption. We conduct a study over a large group of software crypto algorithms: symmetric, stream, hash, AEAD, MAC, digital signature, and key exchange. A comprehensive report of the targeted optimization attributes (memory, performance, and specifically energy) will be presented from over 450 experiments and 170 different crypto source codes. The article also briefly explores a few system-related choices which can affect the energy consumption of secure communication, namely, architecture choice, communication bandwidth, signal strength, and processor frequency. In the end, the article gives an overview of the obtained results and the contribution of all. Finally, it shows, in a case study, how the results could be utilized to have a secure communication in an exemplary IoT device. This article gives IoT designers insight into ultra-low-energy security, helps them to choose appropriate cryptographic algorithms, reduce trial-and-error of alternatives, save effort, and hence cut the design costs.

This paper proposes a novel hardware-based multidimensional sorting algorithm and its respective architecture, called real-time hardware sorter (RTHS), for emerging data intensive processing applications where performance and resource conservation are serious concerns. The basic idea behind RTHS is to reduce the hardware complexity of parallel hardware sorting architectures (PHSAs) through a high-performance scalable matrix-based sorting method. The proposed method can also be used for implementing Min/Max queues or finding the largest/smallest records exclusively in the big data application. Implementing the RTHS design on a Virtex-7 field-programmable gate array (FPGA) reveals that the number of lookup tables (LUTs) of the proposed method has decreased by 66.3% and 87.3% compared to the conventional Bitonic sorting network (CBSN) and the state-of-the-art PHSA, respectively. In addition, the number of required registers for the proposed method has decreased by 94.8% compared to the state-of-the-art PHSA.

In this study, a gate‐level vulnerability model is proposed to detect the potential security holes of crypto‐chips against scan‐based attacks. The proposed model offers a relative measure so‐called vulnerability factor (VF) for each net of a given crypto‐chip. Nets with the highest VFs are considered as the most vulnerable nets of the crypto‐chip. The VF of each gate output is calculated considering (i) VFs of the gate inputs, and (ii) the probability of having a signal transition at the gate output. In order to validate the proposed model, the authors implemented the iterative and pipelined AES, as well as the iterative DES encryption algorithms to find their most vulnerable nets. Then the most vulnerable nets of each design, have been masked by a simple mechanism to explore the accuracy of the proposed model. Results of scan‐based attacks which are done by ModelSim simulations show that by masking only 32, 64 and 32 nets in iterative Advanced Encryption Standard (AES), pipelined AES and iterative Data Encryption Standard(DES) designs, respectively, all of the done attacks are failed. Achieved results of the proposed model in comparison with the signal activity and random approaches demonstrate the superiority of the proposed model.

IC design and manufacturing chains show steadily growing complexity which provides different third party roles in between. Reprobate parties can take the opportunity to steal a client's IP or insert their malicious circuits-Hardware Trojans-in the original client's design and trigger them in case of need. Trojans are usually inserted in the most hidden internal signals with the lowest activity which increase their chance for not being activated and revealed by clients or end-users. In this paper we propose a method to reduce the number of signals with low activity and hence the chance of inserting hidden trojans. This method is based on an enhanced Logic Encryption approach and uses a 128-bit key. Encryption can also secure the design against IP piracy. Simulation results show that the proposed method can eliminate 83.17% of low activity signals in the circuit.

Scratchpad memory (SPM) is widely used in modern embedded processors to overcome the limitations of cache memory. The high vulnerability of SPM to soft errors, however, limits its usage in safety-critical applications. This paper proposes an efficient fault-tolerant scheme, called cache-assisted duplicated SPM (CADS), to protect SPM against soft errors. The main aim of CADS is to utilize cache memory to provide a replica for SPM lines. Using cache memory, CADS is able to guarantee a full duplication of all SPM lines. We also further enhance the proposed scheme by presenting buffered CADS (BCADS) that significantly improves the CADS energy efficiency. BCADS is compared with two well-known duplication schemes as well as single-error correction scheme. The comparison results reveal that: 1) BCADS imposes a 13.6% less energy-delay product (EDP) overhead than the duplication schemes and it does not require to modify the SPM manager and target application and 2) in comparison with the conventional single-error correction double-error detection (SEC-DED) scheme, BCADS provides a significantly higher error correction capability by correcting up to 4-b burst errors using a low-cost 4-b interleaved parity code. Moreover, the area overhead for error correction and the performance overhead of BCADS are negligible (less than 1%), whereas the area and performance overheads are 21.9% and 6.1% for SEC-DED, respectively. Furthermore, BCADS imposes about a 10.7% lower EDP overhead compared with the SEC-DED scheme.

ScratchPad Memory (SPM) is an important part of most modern embedded processors. The use of embedded processors in safety-critical applications implies including fault tolerance in the design of SPM. This paper proposes a method, called FTSPM, which integrates a multi-priority mapping algorithm with a hybrid SPM structure. The proposed structure divides SPM into three parts: 1) a part is equipped with Non-Volatile Memory (NVM) which is immune against soft errors, 2) a part is equipped with Error-Correcting Code, and 3) a part is equipped with parity. The proposed mapping algorithm is responsible to distribute the program blocks among the above three parts with regards to their vulnerability level. The simulation results demonstrate that the FTSPM reduces the SPM vulnerability by about 7x in comparison to a pure SRAM-based SPM. In addition, the dynamic energy consumption of the proposed method is 77% and 47% less than that of a pure NVM-based SPM and a pure SRAM-based SPM, respectively.

In this paper, we present a scan-chain-based multiple error recovery technique for triple modular redundancy (TMR) systems (SMERTMR). The proposed technique reuses scan-chain flip-flops fabricated for testability purposes to detect and correct faulty modules in the presence of single or multiple transient faults. In the proposed technique, the manifested errors are detected at the modules' outputs, while the latent faults are detected by comparing the internal states of the TMR modules. Upon detection of any mismatch, the faulty modules are located and the state of a fault-free module is copied into the faulty modules. In case of detecting a permanent fault, the system is degraded to a master/checker configuration by disregarding the faulty module. FPGA-based fault injection experiments reveal that SMERTMR has the error detection and recovery coverage of 100% and 99.7% in the presence of single and two faulty modules, respectively, while imposing negligible area and performance overheads on the traditional TMR systems.

In this paper, we present a very fast and accurate technique to estimate the soft error rate of digital circuits in the presence of Multiple Event Transients (METs). In the proposed technique, called Multiple Event Probability Propagation (MEPP), a four-value logic and probability set are used to accurately propagate the effects of multiple erroneous values (transients) due to METs to the outputs and obtain soft error rate. MEPP considers a unified treatment of all three masking mechanisms i.e., logical, electrical, and timing, while propagating the transient glitches. Experimental results through comparisons with statistical fault injection confirm accuracy (only 2.5% difference) and speed-up (10,000X faster) of MEPP.

This paper proposes an efficient concurrent error detection method using control flow checking for embedded processors. The proposed method is based on the co-operation of two hardware modules: 1) an on-chip hardware component to detect branch instructions and generate signatures for the running program, and 2) an external watchdog processor to compare runtime signatures and branch addresses with the information extracted offline. The proposed method is implemented on an embedded processor core and is evaluated by a simulation based statistical fault injection approach where faults are injected into cache and main memory. Experimental results show that the proposed method detects more than 96.7% of all errors with only 2.6% overhead in area and less than 1% increase in power consumption. Furthermore, this technique imposes almost no performance degradation.

Ever Increasing use of commercial off-the-shelf (COTS) processors to reduce cost and time to market in embedded systems has brought significant challenges in error detection and recovery methods employing in such systems. This paper presents a software based control flow error detection and correction technique, so called branch TMR (BTMR), suitable for use in COTS-based embedded systems. In BTMR method, each branch instruction is triplicated and a software interrupt routine is invoked to check the correctness of the branch instruction. During the execution of a program, when a branch instruction is executed, it is compared with the second redundant branch in the interrupt routine. If a mismatch is detected, the third redundant branch instruction is considered as the error-free branch instruction; otherwise, no error has occurred. The main advantage of BTMR over previously proposed control flow checking (CFC) methods is its ability to correct CFEs as well as protection of indirect branch instructions. The BTMR method is evaluated on LEON2 embedded processor. The results show that, error correction coverage is about 96%, while memory overhead and performance overhead of BTMR is about 28% and 10%, respectively.

In this paper, we propose a very fast analytical approach to measure the overall circuit Soft Error Rate (SER) and to identify the most vulnerable gates and flip-flops. In the proposed approach, we first compute the error propagation probability from an error site to primary outputs as well as system bistables. Then, we perform a multi-cycle error propagation analysis in the sequential circuit. The results show that the proposed approach is four to five orders of magnitude faster than the Monte Carlo (MC) simulation-based fault injection approach with 92% accuracy. This makes the proposed approach applicable to industrial-scale circuits.

In this paper, we propose a very fast and accurate analytical approach to estimate the overall SER and to identify the most vulnerable gates, flip-flops, and paths of a circuit. Using such information, designers can selectively protect the vulnerable parts resulting in lower power and area overheads that are the most important factors in embedded systems. Unlike previous approaches, the proposed approach firstly does not rely on fault injection or fault simulation; secondly it measures the SER for multi cycles of circuit operation; thirdly, the proposed approach accurately computes all three masking factors, namely, logical, electrical, and timing masking; fourthly, the effects of error propagation in re-convergent fanouts are considered in the proposed approach. SERs estimated by the proposed approach for some ISCAS89 circuit benchmarks are compared with that estimated by the Monte Carlo (MC) simulation based fault injection approach. The results show that the proposed approach is about four orders of magnitude faster than the MC fault injection approach while having an accuracy of about 97%. This level of fastness and accuracy makes the proposed approach a viable solution to measure the SER of very large size circuits used in industry.

This paper presents a circuit level soft error-tolerant-technique, called RRC (robust register caching), for the register file of embedded processors. The basic idea behind the RRC is to effectively cache the most vulnerable registers in a small highly robust register cache built by circuit level SEU and SET protected memory cells. To decide which cache entry should be replaced, the average number of read operations during a register ACE time is used as a criterion to judge. In fact, the victim cache entry is one which has the maximum read count. To minimize the power overhead of the RRC, the clock gating technique is efficiently exploited for the main register file resulting in significantly low power consumption. The RRC is able to protect the register file not only against single bit upsets (SBUs) but also against multiple bit upsets (MBUs) and single event transients (SETs). The RRC is experimentally evaluated using the LEON processor. The experimental results show that, if the cache size is selected properly, the architectural vulnerability factor (AVF) of the register file becomes about 1% while it imposes low power, area and performance overheads to the processor.

This paper proposes a new technique called CFEDC to detect and correct control flow errors (CFEs) without program interruption. The proposed technique is based on the modification of application software and minor changes in the underlying hardware. To demonstrate the effectiveness of CFEDC, it has been implemented on an OpenRISC 1200 as a case study. Analytical results for three workload programs show that this technique detects all CFEs and corrects on average about 81.6% of CFEs. These figures are achieved with zero error detection /correction latency. According to the experimental results, the overheads are generally low as compared to other techniques; the performance overhead and the memory overhead are on average 8.5% and 9.1%, respectively. The area overhead is about 4% and the power dissipation increases by the amount of 1.5% on average.

The continuous decrease in CMOS technology feature size increases the susceptibility of such circuits to single event upsets (SEU) caused by the impact of particle strikes on system flip flops. This paper presents a novel SEU-tolerant latch where redundant feedback lines are used to mask the effects of SEUs. The power dissipation, area, reliability, and propagation delay of the presented SEU-tolerant latch are analyzed by SPICE simulations. The results show that this latch consumes about 50% less power and occupies 42% less area than a TMR-latch. However, the reliability and the propagation delay of the proposed latch are still the same as the TMR-latch. the reliability of the proposed latch is also compared with other SEU-tolerant latches.

High reliability, high performance, low power consumption are the main objectives in the design of NoCs. These three design objectives are mostly conflicting and should be considered simultaneously in order to have an optimal design. This paper proposes a method based on duplicating the virtual channels of each NoC node as well as parity codes to prevent SEUs from producing erroneous data. The method is compared with two widely used SEU-tolerant methods i.e., the switch to switch and the end to end flow control methods, in terms of reliability, power consumption and performance. A flit level VHDL-based simulator and Synopsys power compiler tool have been used to extract experimental results. The simulation results show the same reliability for all three methods, while the proposed method shows the lowest power consumption and the highest performance almost in all traffic generation rates and all packet error rates.

This paper suggests a method, called distributed voting, to overcome the problem of the single point of failure in a TMR system used in robotics and industrial control applications. It uses time redundancy and is based on TMR with disagreement detector feature. This method masks faults occurring in the voter where the TMR system can continue its function properly. The method has been evaluated by injecting faults into Vertex2Pro and Vertex4 Xilinx FPGAs An analytical evolution is also performed. The results of both evaluation approaches show that the proposed method can improve the reliability and the mean time to failure (MTTF) of a TMR system by at least a factor of (2-RV(t)) where RV(t) is the reliability of the voter