Jamming attacks can severely disrupt the communications in wireless sensor networks (WSNs). Accurate jammer localization is crucial for the implementation of active anti-jamming strategies. Existing localization methods primarily target the proactive jammer equipped with an omnidirectional antenna within the WSN area, which limits their effectiveness in more complex scenarios. To bridge this capability gap, an accurate localization method based on signal strength map (ALSSM) is proposed to locate the jammer, regardless of whether it is proactive or reactive, and irrespective of its antenna type or location. The ALSSM method constructs a jamming signal strength (JSS) map using JSSs collected by sensor nodes via a deception strategy. This map is then utilized to formulate an evaluation metric to quantify localization estimation errors. Therefore, the localization task is transformed into an optimization problem. This method is convenient to implement, as it requires no additional dedicated hardware, and the collected JSS data can be integrated into the WSN’s normal data transmission process. Simulation and experimental results demonstrate that the ALSSM method can accurately locate the jammer, regardless of whether it is directional or omnidirectional, and irrespective of its deployment inside or outside the WSN area.

With the popularization of horizontal business model in the semiconductor design and manufacturing industry, IC piracy frequently occurs in the supply chain by overpro-ducing and transporting unqualified/defective devices, reverse engineering, etc. This paper proposes a dual logic locking (DLL) method to prevent counterfeit IP/IC. Based on this method, the foundry/assembly can perform tests in the state of IP/IC output obfuscated and obtain test results. Then, the designer decides whether to permanently activate the IP/IC based on the encrypted test results. The proposed method only needs one data exchange between the designer and foundry/assembly compared with the secure split test method. The proposed DLL was implemented on several benchmarks, and the experimental result shows that it has a low overhead. In addition, the security analysis shows that it is robust against IP/IC piracies.

Scan-based test is commonly used to increase testability and fault coverage, however, it is also known to be a liability for chip security. Research has shown that intellectual property (IP) or secret keys can be leaked through scan-based attacks, which can be performed by entities within the supply chain. In this paper, we propose a design and test methodology against scan-based attacks throughout the supply chain, which includes a dynamically obfuscated scan (DOS) for protecting IP/integrated circuits (ICs). By perturbing test patterns/responses and protecting the Obfuscation Key, the proposed architecture is proven to be robust against existing noninvasive scan-based attacks, and can protect all scan data from attackers in foundry, assembly, and system development without compromising the testability. Further, a novel test methodology cooperating with the DOS design is also proposed, which shows full pattern application flexibility. Finally, detailed security and experimental analyses have been performed on ITC and industrial benchmarks. Demonstrated by the simulation results, the proposed architecture can be easily plugged into EDA generated scan chains without generating a noticeable impact on conventional IC design, manufacturing, and test flow. The results demonstrate that the proposed methodology can protect chips from existing brute force, differential, and other scan-based attacks that target the Obfuscation Key. Furthermore, the proposed design is of low overhead on area, power consumption, and pattern generation time, and there is no impact on test time.

With silicon technology further scaling, the switching activity is getting more intense in modern designs. The large switching activities together with GHz operation frequency can greatly affect the power integrity by generating IR-drop noises. Excessive IR-drop can cause functional failures such as timing failure, abnormal reset and SRAM flipping. Hence, IR-drop needs to be monitored in-field. However, directly measuring transient IR-drop waveform usually involves high design or equipment cost. This paper presents a low-cost on-chip GHz ring oscillator-based transient IR-drop monitor (TRO). TRO is composed of all-digital elements, and can be easily integrated into existing IC design flow with negligible overhead. Different from traditional transient IR-drop monitors, TRO measures IR-drop waveform width and average in-field, while recovers IR-drop peak, and reconstructs the transient noise waveform during data analysis or customer return, which eliminates the need for custom circuits or high frequency sampling clock. Simulation results show that TRO is sensitive to IR-drop with peak and width larger than 100 mV and 1.0 ns, which is suitable for GHz IC monitoring. The IR-drop noise width detection resolution can reach 0.125 ns and higher under the help of the proposed edge detector, with noise peak and width measurement error rate less than 6.8% and 9.0%, for 97% of the Monte Carlo samples considering process variations. According to the results and analyses, TRO is also able to trigger quick adaptation within one clock cycle.

With the rapid development and globalization of semiconductor design and fabrication, integrated circuit (IC) is becoming more vulnerable to malicious modification called hardware Trojan. As Advanced Encryption Standard (AES) core has been widely used in security critical applications, it can easily become a target of Hardware Trojan. In this paper, 9 potential AES hardware Trojans, which cover Trojan types leaking key or plain text are demonstrated. Then three protections of varying strengths against the proposed Trojans, including combination, reorder, and reconfiguration logic insertion, are presented. The proposed protections are shown to effectively disfunction the 9 types of potential Trojans. Therefore, the information security of AES is significantly improved.

For 40nm and below technologies, billions of transistors can be integrated into a single chip. Meanwhile, the operation frequency has reached over Giga Hertz. In this case, highly synchronized switching activities can induce significant current, which leads to IR-drop. Excessive IR-drop can cause timing failure, abnormal reset, or disruption of data processing. As a result, dynamic voltage and frequency scaling (DVFS) system implemented effective adaptation strategies are widely used by SoCs to mitigate IR-Drop noise and stabilize performance. As the basis of DVFS action, economic and accurate IR-drop monitors are in great need. This paper presents a novel and efficient IR-Drop Alarmer, which can cooperate with the DVFS system for fast IR-drop adaptation. The IR-drop alarming threshold of the proposed sensor is configurable between 45mV to 120mV. Considering a 1.1ns width IR-drop noise, the IR noise sampling window can be as small as 0.125ns, with alarming duration error rate less than 6.8% for 97% of the Monte Carlo samples considering process variations. Furthermore, the proposed alarmer is composed by all-digital standard gates without an y high frequency sampling clock, which is of low area overhead and power consumption.

For 45-nm technologies and below, the maximum operation frequency of integrated circuits (ICs) has reached multiple gigahertz. At the same time, the size of modern ICs has increased significantly with several billions of transistors integrated on each die. When a large number of transistors switch at the same time, high current consumption is generated. The high current consumption combining with the parasitic resistance and inductance of the power supply network generates a significant power supply noise peak, which causes abnormal reset and generates excessive radiation emission, and hence needs to be accurately monitored, adapted, and mitigated. This paper presents a novel power supply noise measurement and adaptation system that can monitor the peak power supply noise and make dynamic adaptation within one clock cycle. The proposed system has been implemented in Nangate 45-nm technology. It has been proved that the proposed measurement and the adaptation system can successfully avoid the performance degradation or functional failure due to excessive power supply noise. The peak power supply noise monitoring accuracy is 5 mV. The adaptation reaction time is 75%-100% of single system clock cycle. The proposed system is robust against temperature and process variation, and of negligible area overhead and power consumption.

As process technology further scales, aging, noise and variations in integrated circuits (ICs) and systems become a major challenge to both the semiconductor and electronic design automation (EDA) industries, which may cause significantly increased mismatch between modeled and actual silicon behavior, and even IC failure in field. Therefore, the addition of accurate and low-cost on-chip sensors is of great value to reduce the mismatch and perform in-field measurements. This paper presents a novel standard-cell-based sensor for reliability analysis of digital ICs (called Radic), in order to better understand the characteristics of gate, functional path aging and process variations' impact on timing performance, and perform in-field aging measurements. The Radic sensor has been fabricated on two floating gate Freescale SoCs in very advanced technology. The measurement results demonstrate that the resolution can be better than 0.1 ps, and the accuracy is kept throughout aging/process variation. Additionally, a built-in aging adaption system based on Radic sensor is proposed to perform in-field aging adaption. Simulation results verify that, comparing with designs with fixed aging guardband, the proposed aging adaption system releases 80% of aging timing margin, saves silicon area by 1.02%-3.16% at most targeting frequencies, and prevents aging induced failure.