Analog Floating-Gate Transistors (AFGTs) are commonly used to fine-tune the performance of analog integrated circuits (ICs) after fabrication, thereby enabling high yield despite component mismatch and variability in semiconductor manufacturing. In this work, we propose a methodology that leverages such AFGTs to also prevent unauthorized use of analog ICs. Specifically, we introduce a locking mechanism that limits programming of AFGTs to a range which is inadequate for achieving the desired analog performance. Accordingly, our solution entails a two-step unlock-&-calibrate process. In the first step, AFGTs must be programmed through a secret sequence of voltages within that range, called waypoints. Successfully following the waypoints unlocks the ability to program the AFGTs over their entire range. Thereby, in the second step, the typical AFGT-based post-silicon calibration process can be applied to adjust the performance of the IC within its specifications. Protection against brute-force or intelligent attacks attempting to guess the unlocking sequence is ensured through the vast space of possible waypoints in the continuous (analog) domain. Feasibility and effectiveness of the proposed solution is demonstrated and evaluated on an Operational Transconductance Amplifier (OTA). To our knowledge, this is the first solution which leverages the power of analog keys and addresses both unlocking and calibration needs of analog ICs in a unified manner.

We investigate the risk posed by amplitude-modulating analog/RF hardware Trojans in wireless networks and propose a defense mechanism to mitigate the threat. First, we introduce the operating principles of amplitude-modulating analog/RF hardware Trojan circuits and we theoretically analyze their performance characteristics. Subject to channel conditions and hardware Trojan design restrictions, this analysis seeks to determine the impact of these malicious circuits on the legitimate communication and to understand the capabilities of the covert channel that they establish in practical wireless networks, by characterizing its error probability. Next, we present the implementation of two hardware Trojan examples on a Wireless Open-Access Research Platform (WARP)-based experimental setup. These examples reside in the analog and the RF circuitry of an 802.11a/g transmitter, respectively, where they manipulate the transmitted signal characteristics to leak their payload bits. Using these examples, we demonstrate (i) attack robustness, i.e., ability of the rogue receiver to successfully retrieve the leaked data, and (ii) attack inconspicuousness, i.e., ability of the hardware Trojan circuits to evade detection by existing defense methods. Lastly, we propose a defense mechanism that is capable of detecting analog/RF hardware Trojans in WiFi transceivers. The proposed defense, termed Adaptive Channel Estimation (ACE), leverages channel estimation capabilities of Orthogonal Frequency Division Multiplexing (OFDM) systems to robustly expose the Trojan activity in the presence of channel fading and device noise. Effectiveness of the ACE defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

Unlike the extensive research effort that has been expended over the last 15 years in understanding the threats of hardware Trojans, piracy and counterfeiting of digital Integrated Circuits (ICs), and in developing appropriate prevention and detection solutions, the topic of security and trust remains in a rather nascent state for their analog/radio-frequency (RF) counterparts. Indeed, as shown in a recent survey, which summarized and presented the available body of knowledge in trusted and secure design of analog/RF ICs, our understanding of the pertinent threats and our ability to thwart them through existing solutions are both rather limited. However, given the widespread use of analog functionality (i.e., physical interfaces, sensors, actuators, wireless communications, etc.) in most contemporary systems, comprehending their vulnerabilities and devising pertinent remedies is urgently required. In this paper, we discuss the limitations of the current state-of-the-art in this field, we highlight recent developments, and we suggest research directions and steps to be taken toward designing, fabricating and deploying trusted and secure analog/RF ICs.

We introduce a method for protecting analog Integrated Circuits (ICs) against unauthorized use by obfuscating their operating point using an analog neural network. With the model of the trained analog neural network acting as a lock and its inputs as the key, only the correct key combination will unlock the analog IC, by providing it with the required bias conditions to operate within its specification limits. By defining the key combinations in the continuous analog space and by using floating gate transistors to realize the neural network, the proposed method defends itself against efforts to guess the correct key through model approximation attacks. Moreover, by inhibiting retraining of the analog neural network, the proposed solution enables customization of the lock and key combination to each IC. The proposed solution has been implemented in silicon through a proof-of-concept experimental setup comprising a Low-Noise Amplifier (LNA) and a programmable analog neural network. Experimental results demonstrate the effectiveness of the method in preventing unauthorized use of an analog IC.

We discuss the threat that malicious circuitry (a.k.a. hardware Trojan) poses in wireless communications and propose a remedy for mitigating the risk. First, we present and theoretically analyze a stealthy hardware Trojan embedded in the forward error correction (FEC) block of an 802.11a/g transceiver. FEC seeks to shield the transmitted signal against noise and other imperfections. This capability, however, may be exploited by a hardware Trojan to establish a covert communication channel with a knowledgeable rogue receiver. At the same time, the unsuspecting legitimate receiver continues to correctly recover the original message, despite experiencing a slight reduction in signal-to-noise ratio (SNR) and, therefore, remains oblivious to the attack. Next, we implement this hardware Trojan on an experimental setup based on the Wireless Open Access Research Platform (WARP) and we demonstrate (i) attack robustness, i.e., the ability of the rogue receiver to correctly receive the leaked information and (ii) attack inconspicuousness, i.e., imperceptible impact on the legitimate transmission. Lastly, we theoretically analyze and experimentally evaluate a Trojan-agnostic detection mechanism, namely, channel noise profiling, which monitors the noise distribution to identify inconsistencies caused by hardware Trojans, regardless of their implementation details. The effectiveness of channel noise profiling is experimentally assessed using the proposed hardware Trojan under various channel conditions and a different covert Wi-Fi attack previously proposed in the literature.

We introduce a hardware dithering methodology for neutralizing Trojans in integrated circuits (ICs). The proposed approach seeks to make the operating point of an IC an unpredictable moving target during run time. Thereby, the ability of a Trojan to exploit the process variation margins, wherein hardware Trojans typically find breathing room to operate while remaining concealed, is significantly restricted. To demonstrate this hardware dithering concept, we leverage tuning knobs operating on the power and frequency characteristics of the transmission of a wireless cryptographic IC. These knobs are driven by a random number generator, thus forcing the circuit into a random walk in the space of its parametric performances while in normal operating mode. In essence, while the circuit remains within its operating specifications during this random walk, its exact operating point varies, thus muddying the waters for the adversary. Experimental results on the wireless cryptographic IC, which was designed and fabricated in a 0.35μm CMOS technology, corroborate that hardware dithering imposes a significant and unpredictably dispersed bit error rate to the adversary, thereby impeding hardware Trojan operation.

Information flow tracking (IFT) is a widely used methodology for ensuring data confidentiality in electronic systems and numerous such methods have been developed at various software or hardware description levels. Among them, proof-carrying hardware intellectual property (PCHIP) introduced an IFT methodology for digital hardware designs described in hardware description languages (HDLs). The risk of accidental information leakage, however, is not restricted to the digital domain. Indeed, analog signals originating from sources of sensitive information, such as biometric sensors, as well as analog outputs of a circuit, could carry or leak secrets. Moreover, similar to digital designs, analog circuits can also be contaminated with malicious information leakage channels capable of evading traditional manufacturing test. Compounding the problem, in analog/mixed-signal circuits such information leakage channels can cross the analog/digital or digital/analog interface, making their detection even harder. To this end, in this paper we introduce a PCHIP-based methodology which enables systematic formal evaluation of information flow policies in analog/mixed-signal designs. As we demonstrate, by integrating IFT across the digital and analog domain, our method is able to detect sensitive data leakage from the digital domain to the analog domain and vice versa, without requiring any modification of the current analog/mixed-signal circuit design flow.

We summarize and present the available body of knowledge in trusted and secure design of analog/mixed-signal/ radio frequency (RF) integrated circuits (ICs) and intellectual properties (IPs), covering both known vulnerabilities and available remedies. Furthermore, we discuss the limitations of the current state-of-the-art in this topic, highlight the concomitant risks, and suggest research directions and steps to be taken towards designing, fabricating and deploying trusted and secure analog/mixed-signal/RF circuits. More specifically, a comprehensive survey of the relevant literature is provided, organized around three themes: (i) hardware Trojans and Trojan states in analog/mixed-signal/RF ICs along with existing detection/prevention methods, (ii) analog/mixed-signal/RF IC/IP reverse engineering and counterfeiting, as well as techniques for proving authenticity and ownership, and (iii) limitations of existing methods in the analog/mixed-signal (AMS) and RF domain, focusing on the gaps that exist in our current understanding of this problem and potential directions towards filling them and mitigating the threats in AMS/RF ICs/IPs.

We propose a defense method capable of detecting hardware Trojans (HTs) in the analog/RF circuitry of wireless local area network (WLAN) transceivers. The proposed method, which is implemented on the receiver (RX) side and cannot be tampered with by the attacker, leverages the channel estimation capabilities present in Orthogonal Frequency Division Multiplexing (OFDM) systems. Specifically, it employs an adaptive approach to robustly isolate possible HT activity from channel and device noise, thereby exposing the Trojan's presence. The adaptive channel estimation (ACE) defense mechanism is put to the test using a HT which is implemented on a printed circuit board (PCB) and mounted on the Wireless Open-Access Research Platform (WARP). This HT, which is introduced through minute modifications in the power amplifier (PA), manipulates the transmission power characteristics of an 802.11a/g transmitter (TX) in order to leak sensitive data, such as the encryption key. Effectiveness of the proposed defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

As CMOS technology continues to scale down, the effect of process variations on yield and performance of analog/RF ICs is becoming more prominent. To counteract this effect, learning-based post-production tuning has been proposed, wherein regression functions are trained and used to adjust tunable knobs based on low-cost alternate tests, thereby improving the performances of a circuit and, by extension, increasing yield. Of course, tunable knobs are also subject to process variations; yet this is not an issue when the knobs are part of the procedure that generates the data with which the regression models are trained, as this data reflects the impact of process variations on both the tunable circuit and the knobs. In various cases, however, such as in heterogeneous integrated systems, 3D ICs, or multi-chip modules, the knob circuitry may not be integrated on the same die, thereby limiting our ability to obtain a comprehensive set of training data. Accordingly, in this work we investigate the impact of knob non-idealities which are not captured in the training data, on the ability of the learned regression functions to accurately predict the optimum knob position that maximizes the performance of a circuit. Using a tunable cascode low-noise amplifier (LNA) fabricated in 130nm CMOS process, alongside external knobs designed as linear low drop out regulators (LDOs) and voltage dividers operating on the bias voltages of the LNA, we first quantify this impact. Then, we demonstrate that by explicitly introducing “noise” in the knob output values used during training set generation, we can effectively alleviate external knob non-idealities and improve quality of tuning.

We discuss a methodology and the corresponding hardware architecture for performing self-calibration of analog/RF ICs through the use of on-die learning. More specifically, we introduce the design of an on-chip analog neural network which can be trained to implement a non-linear regression function. This regression function is, then, used to approximate a Figure-of-Merit (FoM) reflecting the performances of an analog/RF IC. As an input to this regression function, we use the readings of low-cost on-chip sensors in response to simple on-chip generated stimuli. The FoM is predicted for all possible settings of the knobs provided for calibrating the chip performances and the best option is retained. The proposed methodology is demonstrated on a tunable Low-Noise Amplifier (LNA) which was designed and fabricated in IBM's 130nm RF CMOS process. Experimental results show that the proposed self-calibration method achieves not only significant yield enhancement but also a compelling optimization of the LNA's overall performance across the entire chip population.