The modern supply chain ecosystem exposes hardware intellectual property (IP) blocks to diverse confidentiality attacks aimed at reverse engineering (RE), piracy, or the extraction of design secrets. An emerging and potent design solution for IP protection against these attacks, particularly against RE, is the fine-grained redaction of security-critical logic and replacing the redacted logic with lookup tables (LUTs). The LUTs are then programmed in-field, similar to FPGAs, using protected bitstreams, thereby preventing untrusted foundries or test/assembly facilities from mounting RE attacks. The LUT-based redaction paradigm incurs a substantial hardware cost, with area overhead ranging from 70x to 100x and delay overhead from 2x to 5x, while also often necessitating significant alterations to the commercial tool flow for design, verification, and testing. In this work, we propose PROM, a robust fine-grain redaction technique inspired by structured ASIC, that aims to address the limitations of LUT-based redaction with novel overhead optimizations. The redacted security-critical logic is implemented using a library of custom-design PROM cells that are optimized to minimize overheads compared to state-of-the-art redaction techniques while providing strong protection against various RE attacks. We evaluated the proposed redaction technique across a range of open-source benchmarks, achieving robust security with average overheads of 1.42x in area and 1.09x in delay, demonstrating its efficiency and practicality.

Traditional digital implementations of neural accelerators are limited by high power consumption and area overheads, while analog and non-CMOS implementations suffer from noise, device mismatch, and reliability issues. This paper introduces a CMOS Look-Up Table (LUT)-based Architecture for Neural Accelerators (LANA) that reduces the power consumption and area overhead of traditional digital implementations through precomputed, faster LUT access while avoiding noise and mismatch challenges of analog circuits. To solve the scalability issues of conventional LUT-based computation, we split high-precision multiply and accumulate (MAC) operations into lower-precision MACs using a divide-and-conquer (D&C) based approach. LANA achieves up to 29.54× lower area with 3.34× lower energy per inference task compared to traditional LUT-based techniques and up to 1.24× lower area with 1.80× lower energy per inference task than conventional digital MAC-based techniques (Wallace Tree/Array Multipliers) without retraining and without affecting the accuracy of pre-trained unpruned models, as well as on Lottery Ticket Pruned (LTP) models that already reduce the number of required MAC operations by up to 98%. Finally, we introduce mixed precision analysis in the LANA framework for all LTP pruned and unpruned models (VGG11, VGG19, Resnet18, Resnet34, GoogleNet) that achieved up to 29.59× (GoogleNet pruned)-62.83× (VGG11 unpruned) lower area across models with 3.34× (GoogleNet pruned)-8.1× (VGG11 unpruned) lower energy per inference than traditional LUT-based techniques, and up to 1.24× (GoogleNet pruned)-2.63× (VGG11 unpruned) lower area requirement with 1.81× (GoogleNet pruned)-4.37× (VGG11 unpruned) lower energy per inference across models as compared to conventional digital MAC-based techniques with 1% accuracy loss relative to the baseline.

Physical unclonable functions (PUFs) are widely used for hardware security, yet conventional designs often suffer from considerable design overhead, limited placement flexibility, and susceptibility to environmental noise. This work presents DF-PUF, a dual-function, programmable entropy source tailored for secure and resource-efficient ASIC integration. DF-PUF leverages die-level process variations to generate device-unique responses for authentication, while its hardware resources can be dynamically repurposed as memory elements for local data storage when not operating as a PUF, thereby enhancing area efficiency. The architecture supports flexible deployment across the chip layout, facilitating integration in diverse design scenarios. Additionally, DF-PUF incorporates a noise-resilient response conditioning mechanism that mitigates environmental fluctuations, ensuring that output characteristics are predominantly determined by intrinsic process variations. These capabilities are achieved with minimal overhead, making DF-PUF a practical and scalable solution for secure embedded systems. Comprehensive evaluation through circuit-level simulations and silicon measurements on 65nm CMOS test chips demonstrates the proposed design’s superior uniqueness, randomness, and robustness.

System-on-chip security architecture is a critical, complex, and time-consuming activity, consuming months of effort. Furthermore, the architectural design can include subtle errors that compromise the security of the entire system. In this article, we develop a security engine infrastructure, SEnTry , for systematically creating security architectures for protecting SoC designs against a variety of security subversions. SEnTry provides a plug-and-play, configurable subsystem composed of custom IPs that can be integrated into the platform to derive different security primitives. We develop an instance of SEnTry for supply-chain attacks. We discuss the spectrum of challenges involved in developing a unified architecture for systematic protection against the variety of attacks involved and the SEnTry approach to addressing them. We provide several case studies to demonstrate SEnTry design and perform extensive experiments to evaluate its overhead on multiple ASIC technologies. Our experiments suggest that SEnTry incurs minimal overhead in area and power consumption.

The horizontal business model of modern semiconductors—where design, fabrication, and testing are handled by separate entities across a global supply chain—exposes integrated circuits (ICs) to various security threats throughout their lifecycle. Physical unclonable functions (PUFs) have emerged as effective hardware security primitives for device identification and attestation. However, integrating PUFs into existing designs is often manual, labor-intensive, and incurs high overhead in area, power, and design time. Moreover, traditional PUFs are typically localized to small regions of a chip, limiting entropy extraction from the full design surface. To address these limitations, we propose ASTRA, an automated framework that integrates PUF-based entropy sources into digital logic circuits in a distributed and timing-aware fashion. ASTRA enhances the conventional logic synthesis flow by inserting memory-in-logic PUFs (MeLPUFs), which are constructed using standard cell elements and offer high entropy. By distributing MeLPUF primitives across the circuit, ASTRA maximizes response randomness while minimizing area and power overhead. It can also reuse existing logic elements and supports multiple MeLPUF templates. ASTRA ensures timing constraints are respected and enables validation of both functional and logic equivalence checking (LEC) between the original and PUF-inserted designs. Experimental results show that ASTRA achieves near-ideal PUF quality metrics, demonstrating its effectiveness and scalability for secure hardware design.

Modern system-on-chip (SoC) designs are increasingly vulnerable to supply chain threats such as counterfeiting, overproduction, and reverse engineering, leading to financial losses, intellectual property (IP) theft, and compromised system integrity. Existing security engines, while effective in principle, typically rely on microcontroller-based architectures that incur significant area and power overhead, making them impractical for resource-constrained devices. In this article, we present a minimally configured security engine (MCSE), a lightweight, modular, configurable security engine designed to address the most critical supply-chain threats with minimal resource consumption. We introduce the notion ofminimum security, a baseline set of protection features necessary to secure SoCs under strict area and power constraints, and demonstrate how MCSE can be tailored to meet diverse system requirements. We validate our architecture through implementation on multiple ASIC technology nodes, showing favorable tradeoffs between security capability, area, and power. Our results establish MCSE as a compelling solution for integrating supply chain protection into low-power and area-sensitive SoC designs.

Physical Unclonable Functions (PUFs) have emerged as promising hardware security primitives to protect embedded systems from various attacks throughout their life cycle. Field Programmable Gate Arrays (FPGAs), increasingly used in embedded platforms due to their reconfigurability and performance, offer an ideal fabric for implementing PUFs. However, existing FPGA-based PUFs either incur high resource overhead or suffer from limited entropy quality. This work presents MARVEL-PUF, a novel multi-bit memory-based PUF architecture implemented using LUTs within FPGA hardware. MARVEL-PUF emulates modified SRAM cells using cross-coupled LUT-based inverters and introduces a precharge mechanism that drives the feedback loop into a high-energy metastable state before resolving to a stable response. This enables dynamic and reliable signature generation even under environmental noise. Additionally, the use of multiplexed paths expands the challenge-response space, transforming a weak memory PUF into a strong and reconfigurable security primitive. Experimental results on commercial FPGAs demonstrate that MARVEL-PUF achieves high entropy density and near-ideal values for uniqueness, robustness, uniformity, and correlation. These properties make it a strong candidate for low-overhead security in embedded applications. Future work will explore template scaling and side-channel attack resilience.

Microelectronic systems are widely used in many sensitive applications (e.g., manufacturing, energy, defense). These systems increasingly handle sensitive data (e.g., encryption key) and are vulnerable to diverse threats, such as, power sidechannel attacks, which infer sensitive data through dynamic power profile. In this paper, we present a novel framework, POLARIS for mitigating power side channel leakage using an Explainable Artificial Intelligence (XAI) guided masking approach. POLARIS uses an unsupervised process to automatically build a tailored training dataset and utilize it to train a masking model. The POLARIS framework outperforms state-of-the-art mitigation solutions (e.g., VALIANT) in terms of leakage reduction, execution time, and overhead across large designs.

Hardware fuzzing is critical for uncovering vulnerabilities in modern integrated circuits by systematically exploring input spaces. A major challenge lies in generating high-quality seeds that maximize coverage and verification efficiency. While Coverage-Guided Fuzzing (CGF) enhances overall exploration, it lacks precision when targeting specific submodules. DirectFuzz addresses this with directed test generation but suffers from key limitations, including limited HDL support, abstraction mismatches, and poor scalability for large target regions. In this work, to overcome these challenges, we propose PROFUZZ, a Directed Graybox Fuzzing (DGF) framework that integrates Automatic Test Pattern Generation (ATPG) for precise and scalable seed generation. By leveraging ATPG’s structural analysis capabilities, PROFUZZ improves coverage effectiveness and supports large-scale hardware designs. Experimental results show that PROFUZZ outperforms DirectFuzz with 30× greater scalability in terms of handling target sites, 11.66% higher coverage, and 2.76× faster execution, demonstrating its potential to advance the state-of-the-art in directed hardware fuzzing.

The growing complexity of modern system-on-chip (SoC) designs, coupled with the integration of untrusted thirdparty Intellectual Property (IP) blocks, presents significant challenges for security verification to ensure the trust and integrity of the fabricated silicon. Traditional verification methods, such as functional simulation and Formal Property Verification (FPV), suffer from limited scalability, substantial manual effort, and often incomplete coverage. To address these issues, we propose an automated formal verification framework FV-PAL that can vastly enhance security verification at both module and submodule levels. Our approach introduces judicious design partitioning to identify submodules using structural analysis and enables targeted verification of gate-level netlists, reducing computational overhead. Leveraging Large Language Models (LLMs) and retrieval-augmented generation (RAG), the framework automatically generates non-vacuous security properties translated into SystemVerilog Assertions (SVAs) using design specifications and related documentation. FV-PAL can be integrated with the commercial EDA toolflow to perform FPV and generate coverage metrics with iterative refinement via a feedback loop if coverage falls below specified threshold. FV-PAL demonstrates significant improvements in verification efficiency and coverage based on our evaluation on open-source benchmarks, offering a scalable and efficient formal verification approach for hardware designs.

Scan-Based Design-For-Testability (DFT) measures are prevalent in modern digital integrated circuits to achieve high test quality at low hardware cost. With the advent of 3D heterogeneous integration and chiplet-based systems, the role of scan is becoming ever more important due to its ability to make internal design nodes controllable and observable in a systematic and scalable manner. However, the effectiveness of scan-based DFT suffers from poor testability of internal nodes for complex circuits at deep logic levels. Existing solutions to address this problem primarily rely on Test Point Insertion (TPI) in the nodes with poor controllability or observability. However, TPI-based solutions, while an integral part of commercial practice, come at a high design and hardware cost. To address this issue, in this paper, we present LITE, a novel ATPG-aware scan instrumentation approach that utilizes the functional flip-flops in a scan chain to make multiple internal nodes observable and controllable in a low-cost, scalable manner. We provide both circuit-level design as well as an algorithmic approach for automating the insertion of LITEfor design modifications. We show that LITEsignificantly improves the testability in terms of the number of patterns and test coverage for ATPG and random pattern testability, respectively, while incurring considerably lower overhead than TPI-based solutions.

Logic Equivalence Checking (LEC) is a widely used formal verification method that ensures design accuracy by comparing implemented schematics with the respective Register Transfer Level (RTL) specifications to confirm functional equivalence. Traditional LEC approaches based on SAT-based verification often do not account for complexities introduced by resynthesis, technology transition, and port name changes, leading to verification failures or poor results. Additionally, IP protection techniques, including state space transformation and fine-grained redaction, further complicate traditional LEC analysis by altering the design and obscuring functional relationships, often leading to verification failures. This paper presents a novel framework, CLIP, Cut Point Matching-based Logic Equivalence Checking, that addresses these limitations of conventional LEC techniques and offers scalable and robust verification with higher accuracy and reliability leveraging on structural analysis. Experimental results show that CLIP can effectively handle both combinational and sequential designs, including support for transformed designs for which traditional LEC analysis fails, and significantly improves both verification efforts and accuracy for diverse open-source designs.

Hardware Trojans are malicious modifications in digital designs that can be inserted by untrusted supply chain entities. Hardware Trojans can give rise to diverse attack vectors such as information leakage (e.g. MOLES Trojan) and denial-of-service (rarely triggered bit flip). Such an attack in critical systems (e.g. healthcare and aviation) can endanger human lives and lead to catastrophic financial loss. Several techniques have been developed to detect such malicious modifications in digital designs, particularly for designs sourced from third-party intellectual property (IP) vendors. However, most techniques have scalability concerns (due to unsound assumptions during evaluation) and lead to large number of false positive detections (false alerts). Our framework (SALTY) mitigates these concerns through the use of a novel Graph Neural Network architecture (using Jumping-Knowledge mechanism) for generating initial predictions and an Explainable Artificial Intelligence (XAI) approach for fine tuning the outcomes (post-processing). Experiments show > 98% True Positive Rate (TPR) and True Negative Rate (TNR), significantly outperforming state-of-the-art techniques across a large set of standard benchmarks.

Modern computing systems rely on System-on-Chips (SoCs) to integrate multiple Intellectual Property (IP) cores developed in-house or acquired from third-party vendors with varying trust levels. Commercial Off-The-Shelf (COTS) components, such as microcontrollers and FPGAs, offer ready-made solutions but introduce security risks, especially in an untrusted supply chain. Effective verification of both IP cores and COTS components is essential for ensuring functionality, security, and reliability. Traditional IP verification techniques are often complex and error-prone due to over-reliance on manual efforts, while COTS verification poses significant challenges due to their inherent black-box nature and diverse integrity issues. The emergence of Large Language Models (LLMs) significantly enhances hardware verification by automating tasks such as code generation and bug fixing. In this paper, we present a review of LLM-based IP verification methods and discuss challenges in current verification practices. Next, we propose an LLM-driven workflow that generates test programs for COTS verification and demonstrate its effectiveness through experimental analysis on open-source COTS processors.

This paper presents fusion intelligence (FI), a bio-inspired paradigm that synergistically integrates the intrinsic capabilities of intelligent biological organisms with the advanced potential of artificial intelligence (AI) driven systems. FI harnesses the unique intelligence, sensing, actuation, and mobility attributes of living organisms, such as honeybees, blending these with the sophisticated data-driven problem-solving functionalities of AI. By bridging the gap between natural intelligence (NI) and AI, FI can transform how humans interact with and harness the capabilities of both natural and artificial systems. The paper presents the model of FI and its application to solve practical problems, discusses the challenges and future directions of FI research, emphasizing a generalized approach to solve complex problems, where AI can observe/control NI in a closed-loop system. We demonstrate the potential for FI to enhance the performance of an agricultural IoT system via a simulated case study, which achieves 50% improvement in the efficacy of insect pollination (entomophily).

Compute-in-memory (CiM) has emerged as a promising approach for improving energy efficiency for diverse data-intensive applications. In this paper, we present LUNA-CiM, a lookup table (LUT)-based programmable fabric for flexible and efficient mapping of artificial neural network (ANN) in memory. Its objective is to tackle scalability challenges in LUT-based computation by minimizing hardware, storage elements, and energy consumption. The proposed method utilizes the divide and conquer (D&C) strategy to enhance the scalability of LUT-based computation. For example, in a 4b × 4b lookup table-based multiplier, as one of the main components in ANN, decomposing high-precision operations into lower-precision counterparts leads to a substantial reduction in area overheads, approximately 73% less compared to conventional LUT-based approaches. Importantly, this efficiency gain is achieved without compromising accuracy. Extensive simulations were conducted to validate the performance of the proposed method. The analysis presented in this paper reveals a noteworthy advancement in energy efficiency, indicating a 58% reduction in energy consumption per computation compared to the conventional lookup table approach. Additionally, the introduced approach demonstrates a 36% improvement in speed over the traditional lookup table approach. These findings highlight notable advancements in performance, showcasing the potential of this inventive method to achieve low power, low-area overhead, and fast computations through the utilization of LUTs within an SRAM array.

This paper introduces multi-bit memory-based PUF (MBM PUF), a new PUF architecture designed to enhance the resilience of SRAM PUFs in ASIC applications. The MBM PUF utilizes an SRAM cell as its main component, capitalizing on its simplicity while mitigating weaknesses such as susceptibility to environmental noise and various attacks. As an example, a MBM PUF was implemented within an edge-triggered D flip-flop, a key component in the scan chain used by digital and mixed-signal designs, to achieve enhanced security with minimal area overhead. The concept can also be integrated into other circuits with built-in positive feedback loops, effectively leveraging their resources while minimizing die area. Simulation results in 45 nm CMOS technology show that the proposed security solution can readily fulfill the required performance criteria for a PUF.

Design and manufacturing of integrated circuits predominantly use a globally distributed semiconductor supply chain involving diverse entities. The modern semiconductor supply chain has been designed to boost production efficiency, but is filled with major security concerns such as malicious modifications (hardware Trojans), reverse engineering (RE), and cloning. While being deployed, digital systems are also subject to a plethora of threats such as power, timing, and electromagnetic (EM) side channel attacks. Many Design-for-Security (DFS) solutions have been proposed to deal with these vulnerabilities, and such solutions (DFS) relays on strategic modifications (e.g., logic locking, side channel resilient masking, and dummy logic insertion) of the digital designs for ensuring a higher level of security. However, most of these DFS strategies lack robust formalism, are often not human-understandable, and require an extensive amount of human expert effort during their development/use. All of these factors make it difficult to keep up with the ever growing number of microelectronic vulnerabilities. In this work, we propose X-DFS, an explainable Artificial Intelligence (AI) guided DFS isolution-space exploration approach that can dramatically cut down the mitigation strategy development/use time while enriching our understanding of the vulnerability by providing human-understandable decision rationale. We implement X-DFS and comprehensively evaluate it for reverse engineering threats (SAIL, SWEEP, and OMLA) and formalize a generalized mechanism for applying X-DFS to defend against other threats such as hardware Trojans, fault attacks, and side channel attacks for seamless future extensions.

Due to the globalization of the semiconductor supply chain and the adoption of the zero trust model, hardware Trojan attacks pose significant security threats introduced by untrusted entities. Hardware Trojans relate to malicious modification of a design before fabrication, resulting in unintended functional or side-channel behavior, such as causing a Denial of Service (DoS) attack or leaking sensitive information. Detecting hardware Trojans in fabricated silicon chips is extremely challenging primarily due to the vast possible attack space. Directed test generation towards activation (i.e., trigger) and/or manifestation (e.g., observation of payload) of the viable Trojans with conventional post-manufacturing Automatic Test Pattern Generation (ATPG) process is known to be practically infeasible. Hence, researchers have explored statistical test techniques for detecting arbitrary instances of Trojan attacks through post-silicon functional testing. However, existing statistical test solutions lack in effective trigger and payload coverage and suffer from scalability issues. In this paper, we propose LATENT, a scalable payload-aware statistical test pattern generation technique for high-coverage Trojan detection leveraging the power of existing functional ATPG solutions. Our experimental study on large population of randomly inserted Trojans in a suite of open-source designs shows promising results in both trigger and Trojan coverage.

Rapid adoption of AI technologies raises several major security concerns, including the risks of adversarial perturbations, which threaten the confidentiality and integrity of AI applications. Protecting AI hardware from misuse and diverse security threats is a challenging task. To address this challenge, we propose SAMURAI, a novel framework for safeguarding against malicious usage of AI hardware and its resilience to attacks. SAMURAI introduces an AI Performance Counter (APC) for tracking dynamic behavior of an AI model coupled with an on-chip Machine Learning (ML) analysis engine, known as TANTO (Trained Anomaly Inspection Through Trace Observation). APC records the runtime profile of the low-level hardware events of different AI operations. Subsequently, the summary information recorded by the APC is processed by TANTO to efficiently identify potential security breaches and ensure secure, responsible use of AI. SAMURAI enables real-time detection of security threats and misuse without relying on traditional software-based solutions that require model integration.Experimental results demonstrate that SAMURAI achieves up to 97% accuracy in detecting adversarial attacks with moderate overhead on various AI models, significantly outperforming conventional software-based approaches. It enhances security and regulatory compliance, providing a comprehensive solution for safeguarding AI against emergent threats.

The capability of artificial intelligence (AI), increasingly embedded in critical domains, faces a complex array of security threats. It has motivated researchers to explore the security vulnerability of AI solutions and propose effective countermeasures. This article offers a comprehensive exploration of diverse attacks on AI models, including backdoors (Trojans), adversarial, fault injection, data poisoning, model inversion, model extraction, membership inference attacks, etc. These security vulnerabilities are classified into two broad categories, namely, Supply Chain Attacks and Runtime Attacks. We highlight threat models, attack strategies, and defenses to secure AI systems against these attacks. The work also underscores the significance of developing secure and robust AI models and their implementation to safeguard sensitive data and embedded systems. We present some emerging research directions on secure AI systems.

Securing intellectual property (IP) in hardware has become increasingly crucial amid increasing threats from adversaries due to untrusted entities in the integrated circuit (IC) supply chain. Hardware obfuscation techniques like logic locking and state-space transformation have emerged as potent countermeasures against such threats, but doubts about their efficacy persist due to compromises in recent years. Furthermore, existing countermeasures also tend to address specific adversarial threat models. This paper introduces LISA, a multi-layered framework that uses iterative unit transformations to address security concerns in hardware obfuscation at minimal overhead costs. The proposed framework employs a security-metric-guided analysis of obfuscated IPs, subjecting them to various attacks to uncover vulnerabilities. Once identified, LISA implements unit transformations that harden the obfuscation against these vulnerabilities. Compared to prior work, the layered iterative framework employed can thwart current and emerging threats by acquiring novel adaptive design transformations to minimize overhead incurred at each iteration. The proposed methodology is implemented using commercial EDA tools and evaluated on open-source ISCAS85 and MIT-CEP benchmarks, demonstrating promising attack resilience with low overheads.

The increasing prominence of Large Language Models (LLMs) is being acknowledged for their exceptional abilities in comprehending natural language, conducting advanced reasoning, and generating contextual responses. LLMs expedite code generation, verification, and bug-fixing tasks across software and hardware domains. Development of hardware designs typically involves translating natural language specifications into Hardware Description Languages (HDLs) like Verilog or SystemVerilog, followed by circuit synthesis, physical layout, and fabrication, with the potential for human errors in the process. In the current industry practice, HDL verification tasks typically rely on manual expertise from security professionals to detect and address vulnerabilities. Modern System-on-Chip (SoC) designs integrate several Intellectual Property (IP) blocks implemented using HDL and communicate through a common bus to perform intended functions. Ensuring security throughout the SoC design process requires innovative solutions due to the complex nature of SoC designs and the distribution of assets across multiple IP blocks. Popular conversation LLMs such as Open AI’s ChatGPT and Google’s GEMINI (formerly BARD) offer the potential to automate HDL code generation and verification tasks by interpreting user prompts represented in natural language descriptions, thereby minimizing manual effort and enhancing hardware design quality. This paper explores recent research works on HDL generation, verification, and bug fix leveraging LLMs while addressing prevailing challenges and presenting potential opportunities for improvement.

Power side-channels give rise to several potent attack vectors for leaking information in digital circuits. While a plethora of (mathematically robust) solutions exist to tackle such side-channels, their deployment through existing VLSI design-flows remains an important engineering issue. Besides, most existing solutions result in significant hardware overhead hindering their practical usage for resource-constrained settings, such as Internet-of-Things (IoT) or embedded devices. In this paper, we address both of these issues through an integrated electronic design automation (EDA) tool-flow operating on gate-level designs. Based on an interesting observation that not every net in a design is equally susceptible to side-channel leakage, we devise a generic testing mechanism and lightweight albeit customizable protection strategy for a given trace count. We first analytically establish the observation based on certain physical properties of VLSI circuits and also validate it on ISCAS benchmark circuits. Next, we present a tool calledVALIANT, which can identify the leaking nets for a given number of traces from the gate-level netlist of a cipher.VALIANTworks alongside state-of-the-art design automation tools and, therefore, can be directly incorporated in existing design flows. After identifying the leaky subset of nets in a design, we propose a lightweight variant of an existing masking scheme to eliminate the leakage concerning a given trace count. The main feature of our protection scheme is that it takes into account subset of nets are not “leaky” and optimizes the usage of randomness and extra gates according to this information to minimize the overhead. Experimental evaluation over state-of-the-art lightweight S-Boxes and the GIFT block cipher establishes the efficacy of the proposed idea for generating lightweight protected solutions in an automated manner.

Counterfeiting, overproduction, and cloning of integrated circuits (ICs) and associated hardware have emerged as major security concerns in the modern globalized microelectronics supply chain. One way to combat these issues effectively is to deploy hardware authentication techniques that utilize physical unclonable functions (PUFs). PUFs utilize intrinsic variations in hardware that occur during the manufacturing and fabrication process to generate device-specific fingerprints or immutable signatures that cannot be replicated by counterfeits and clones. However, unavoidable factors like environmental noise and harmonics can significantly deteriorate the quality of the PUF signature. Besides, conventional PUF solutions are generally not amenable to in-field authentication of hardware, which has emerged as a critical need for Internet of Things (IoT) edge devices to detect physical attacks on them. In this article, we introduce frequency-domain PUF or FDPUF, a novel PUF that analyzes time-domain current waveforms in the frequency domain to create high-quality authentication signatures that are suitable for in-field authentication. FDPUF decomposes electrical signals into their spectral coefficients, filters out unnecessary low-energy components, reconstructs the waveforms, and generates high-quality digital fingerprints for device authentication purposes. Compared to the existing authentication mechanisms, the higher quality of the signatures through the frequency-domain analysis makes the proposed FDPUF more suitable for protecting the integrity of the edge computing hardware. We perform experimental measurements on FPGA and analyze FDPUF properties using the National Institute of Standards and Technology test suite to demonstrate that the FDPUF provides better uniqueness and robustness than its time-domain counterpart while being attractive for in-field authentication.

Due to the inclination towards a fab-less model of integrated circuit (IC) manufacturing, several untrusted entities get white-box access to the proprietary intellectual property (IP) blocks from diverse vendors. To this end, the untrusted entities pose security-breach threats in the form of piracy, cloning, and reverse-engineering, sometimes threatening national security. Hardware obfuscation is a prominent countermeasure against such issues. Obfuscation allows for preventing the usage of the IP blocks without authorization from the IP owners. Due to finite state machine (FSM) transformation-based hardware obfuscation, the design’s FSM gets transformed to make it difficult for an attacker to reverse-engineer the design. A secret key needs to be applied to make the FSM functional, thus preventing the usage of the IP for unintended purposes. Although several hardware obfuscation techniques have been proposed, due to the inability to analyze the techniques from the attackers’ standpoint, numerous vulnerabilities inherent to the obfuscation methods go undetected unless a true adversary discovers them. In this article, we present a collaborative approach between two entities—one acting as an attacker or red team and another as a defender or blue team , the first systematic approach to replicate the real attacker-defender scenario in the hardware security domain, which in return strengthens the FSM transformation-based obfuscation technique. The blue team transforms the underlying FSM of a gate-level netlist using state space obfuscation. The red team plays the role of an adversary or evaluator and tries to unlock the design by extracting the unlocking key or recovering the obfuscation circuitries. As the key outcome of this red team–blue team effort, a robust state space obfuscation methodology is evolved showing security promises.

Hardware obfuscation is a design transformation technique that transforms a design to protect its confidentiality against untrusted parties. In particular, it aims at protecting proprietary hardware intellectual property (IP) blocks against reverse engineering (RE), piracy, and extraction of design secrets. A wide array of existing works on hardware obfuscation have demonstrated its security promises and theoretical robustness against diverse attacks. However, these techniques lack in: 1) scalability to large commercial-scale designs; 2) ease of integration with existing electronic design automation (EDA) tool flow; 3) ability to protect against emergent attack modes, such as structural analysis-based attacks; and 4) ability to efficiently trade off security with design overhead. The latter requires an effective metric to quantify robustness against RE attacks. In this article, we introduce a practical state-space obfuscation algorithm and associated automation tool,ProtectIP, that address the above shortcomings. The algorithmic steps have polynomial complexity and are scalable for large designs. We have developed a complete EDA tool flow that integratesProtectIP. We show that exponential resistance can be achieved against all known RE attacks while incurring modest area overhead (24% on average) with negligible impact (maximum 5% overhead) on critical-path delay. We quantify the level of achieved security using metrics and show that an intelligent attacker with partial knowledge of the obfuscation process has a minimal success rate (a probability of 0.33) in RE attacks.

Reverse engineering (RE) of hardware designs poses a significant threat to the modern distributed electronics supply chain. RE can be performed at both chip and printed circuit board (PCB) levels by using structural, functional, or combined analysis techniques. Recent studies on artificial intelligence (AI)-inspired RE techniques have seen a drastic increase in the effectiveness of such attacks. While various countermeasures, e.g., logic locking (LL) at the chip level and camouflaging at the board level, have been studies to combat RE, the advent of Boolean satisfiability (SAT)-based functional query at chip level and 3-D imaging attacks at board level has shown that these protections can be easily bypassed. We observe that a common factor that contributes to the success of these attacks at both chip and board levels is the ability of an attacker to observe the input/output (I/O) patterns of a working system. Based on this observation, we present a novel locking scheme calledIOLockthat can effectively prevent access to golden I/O behavior of a working system.IOLockrestricts access to the actual I/Os of the chips in a PCB by introducing a low-overhead key management unit (KMU) that works in conjunction with internal encryption/decryption modules near the I/O ports. The encryption/decryption modules are designed to work with the existing joint test action group (JTAG) infrastructure.IOLockcan be used in standalone mode or in conjunction with another LL scheme to enhance the overall security of the design. We evaluate the security guarantees offered byIOLocktheoretically, through simulation, and hardware measurements. We show thatIOLockprovides robust protection against both chip-level and PCB-level RE attacks while incurring minimal design overhead.

The fourth industrial revolution (a.k.a. Industry 4.0) relies on intelligent machines that are fully autonomous and can diagnose and resolve operational issues without human intervention. Therefore, embedded computing platforms enabling the necessary computations for intelligent machines are critical for the ongoing industrial revolution. Especially field programmable gate arrays (FPGAs) are highly suited for such embedded computing due to their high performance and easy reconfigurability. Many Industry 4.0 applications, such as predictive maintenance, critically depend on real-time and reliable processing of time-series data using recurrent neural network models, especially long short-term memory (LSTM). Therefore, the FPGA-based acceleration of LSTM is imperative for many Industry 4.0 applications. Existing LSTM models for FPGAs incur significant resources and power and are not energy efficient. Moreover, prior works focusing on reducing latency and power mainly adhere to model pruning, which compromises the accuracy. Comparatively, we propose a memory-based energy-efficient inference of LSTM by exploiting overlay in FPGA. In our methodology, we pre-compute predominant operations and store them in the available embedded memory blocks (EMBs) of an FPGA. On-demand, these pre-computed results are accessed to minimize the necessary workload. Via this methodology, we obtained lower latency, lower power, and better energy efficiency than state-of-the-art LSTM models without any loss of accuracy. Specifically, when implemented on the ZynQ XCU104 evaluation board, a 3 x reduction in latency and 5 x reduction in power is obtained then the reference 16-bit LSTM model.

Automated test-pattern generation (ATPG) is an important step of testing flows that is responsible for generating test values that expose faults in post-fabrication hardware. Previous work has introduced numerous ATPG methods that analyze application functionality to minimize the number of required tests. However, this existing work is misaligned with the emerging trend to use reconfigurable hardware, such as eFPGAs, to redact security-critical IP. When using reconfigurable hardware, application functionality is only known after serially loading a bitstream into a set of configuration flip-flops, which requires ATPG to do more general tests of the reconfigurable hardware as opposed to the targeted application. This more general testing results in prohibitively slow testing times that are on average 14.6× longer than the original design. In this paper, we explore novel ATPG and test methods for reconfigurable hardware to maximize stuck-at fault coverage, while minimizing testing time. We show significantly improved testing times that are on average 1.9× slower than the unredacted designs, without requiring any knowledge of the original application.

System-on-chip (SoC) developers increasingly rely on pre-verified hardware intellectual property (IP) blocks often acquired from untrusted third-party vendors. These IPs might contain hidden malicious functionalities or hardware Trojans that may compromise the security of the fabricated SoCs. Lack of golden or reference models and vast possible Trojan attack space form some of the major barriers in detecting hardware Trojans in these third-party IP (3PIP) blocks. Recently, supervised machine learning (ML) techniques have shown promising capability in identifying nets of potential Trojans in 3PIPs without the need for golden models. However, they bring several major challenges. First, they do not guide us to an optimal choice of features that reliably covers diverse classes of Trojans. Second, they require multiple Trojan-free/trusted designs to insert known Trojans and generate a trained model. Even if a set of trusted designs are available for training, the suspect IP can have an inherently very different structure from the set of trusted designs, which may negatively impact the verification outcome. Third, these techniques only identify a set of suspect Trojan nets that require manual intervention to understand the potential threat. In this article, we present VIPR, a systematic machine learning (ML)-based trust verification solution for 3PIPs that eliminates the need for trusted designs for training. We present a comprehensive framework, associated algorithms, and a tool flow for obtaining an optimal set of features, training a targeted machine learning model, detecting suspect nets, and identifying Trojan circuitry from the suspect nets. We evaluate the framework on several Trust-Hub Trojan benchmarks and provide a comparative analysis of detection performance across different trained models, selection of features, and post-processing techniques. We demonstrate promising Trojan detection accuracy for VIPR with up to 92.85% reduction in false positives by the proposed post-processing algorithm.

Field Programmable Gate Arrays (FPGAs) provide a flexible compute platform for quick prototyping or hardware acceleration in diverse application domains. However, similar to the global semiconductor life-cycle in the modern supply chain, FPGA-based product development includes processes and interactions with potentially untrusted parties outside the traditional scrutiny of a completely in-house development cycle. An untrusted party/software can maliciously alter hardware intellectual property (IP) blocks mapped to an FPGA device during various stages of the FPGA life-cycle. Such malicious alterations, also known as hardware Trojans, have garnered significant research into their detection and prevention in the context of application-specific integrated circuit (ASIC) design flow. However, Trojan attacks in FPGAs have not enjoyed this same attention. Designers often rely on mapping ASIC-specific solutions and benchmarks to the FPGA domain, leaving much of the FPGA-specific Trojan space uncovered. The distinctive business model and architectural configurations of FPGAs also present unique Trojan attack opportunities for adversaries. To this end, we introduce a framework to automatically explore the hardware Trojan attack space in FPGA netlists, which can insert different FPGA-specific Trojans in a netlist enabling rapid exploration of potential Trojan attacks in an FPGA design: soft-template, monolithic and distributed dark silicon. The dark silicon Trojans use the under-utilized input space in FPGA primitives and other optimizations to realize Trojans with effectively zero area, delay, and power footprint. We generate over 1300 Trojan-inserted benchmarks using the introduced FPGA Trojan classes, and compare their impact on utilization, delay, and power and evaluate their stealthiness against Trojan detection.

Physical unclonable functions (PUFs) have emerged as one of the most notable hardware primitives to mitigate the ever-growing global issue of counterfeiting and cloning of integrated circuits (ICs) in recent times. PUFs exploit the intrinsic manufacturing process-induced parametric variations for generating unique chip identifiers. However, most of the existing PUF implementations require complex structures or the inclusion of additional components, which incur performance and area overheads. In this work, we introduceCurIAs, a supply current-based novel PUF implementation to authenticate ICs and to protect them from counterfeiting attacks. It exploits the dynamic current stemming from temporal switching activities in existing on-chip structures as an entropy source to generate high-quality IC-specific digital signatures. First, we investigate the source of the entropy of this PUF,i.e., the dynamic current variations in different circuit structures, with transistor-level Monte-Carlo simulations in HSPICE. Next, to evaluate its effectiveness in Silicon, we apply this approach to map LFSR (Linear Feedback Shift Register) designs into 20 FPGA chips (fabricated in TSMC 55nm process node), perform practical measurements, and generate digital signatures. These signatures show high uniqueness, robustness, uniformity, and randomness features, and the overall implementation requires modest hardware overhead ($<$1%). We assess and substantiate the robustness of this approach at eight different operating points by varying supply voltage and temperature. Furthermore, we upscale the design to more extended LFSR sizes, and it exhibits a constant trend of performance improvement over the operating points. Through a judicious selection of challenge vectors,CurIAsdemonstrates a high resilience against model learning attacks, with an average prediction accuracy of 50%. These intrinsic variations in supply current across ICs for varying workloads entail unique chip-specific signatures, which are extremely difficult to clone, and can be deployed effectively against IC counterfeiting issues.

The emergence of distributed manufacturing ecosystems for electronic hardware involving untrusted parties has led to diverse trust issues. In particular, Intellectual Property (IP) piracy, reverse engineering, and overproduction pose significant threats to integrated circuits (IC) manufacturers. Watermarking has been one of the solutions employed by the semiconductor industry to overcome many of the trust issues. However, existing watermarking techniques often suffer from one or more of the following deficiencies: (1) low structural coverage, (2) applicability to specific design abstraction level (e.g., gate or layout), (3) high design overhead, and (4) vulnerabilities to removal or tampering attacks. We address these deficiencies by introducing a new watermarking scheme, calledSIGNED:SignatureInsertion through challenGe respoNse inElectronicDesign.SIGNEDrelies on a challenge-response protocol-based interrogation scheme for generating the watermark. It identifies strategic locations of an input design and samples them in response to select input patterns to form a set of compact signatures representing the functional and structural characteristics of a design. We show that this signature set can be used as high-quality watermark of an IP to verify its provenance. We evaluateSIGNEDon the ISCAS85, ITC, and MIT CEP benchmark circuits with respect to all major quality parameters of hardware watermark. We show thatSIGNEDachieves excellent structural coverage and robustness against identification and removal attacks, while introducing modest design overheads.

The push to meet growing user requirements and manufacturing challenges at lower technology nodes have motivated chip designers to adopt non-traditional design techniques. 2.5D/3DIC stacking has gained popularity in recent years since it enables chip manufacturers to integrate complex IPs to meet user demands without incurring design penalties. However, the non-traditional nature of the supply chain also means that additional challenges exist for verification and testing of the manufactured design, making the trust assurance of these designs an extremely challenging proposition. While there have been works focussing on securing 3DIC designs, very few address a completely untrusted supply chain. A robust security countermeasure must address the diverse trust requirements of the IPs in the design and the distributed supply chain requirements while ensuring that the functionality and performance overheads of the IC are not violated. We presentTREEHOUSE, a trust assurance solution to counter piracy, reverse-engineering, and counterfeiting attacks.TREEHOUSEuses scan authentication to detect piracy and counterfeiting, scan-and functional-locking to prevent reverse-engineering. We evaluate the efficiency of our proposed scheme on an example 3DIC design. We show thatTREEHOUSEincurs less than 1% area and power overheads while incurring less than 1% increase in overall gate count for each layer.

Economic and operational advantages have led the supply chain of printed circuit boards (PCBs) to incorporate various untrusted entities. Any of the untrusted entities are capable of introducing malicious alterations to facilitate a functional failure or leakage of secret information during field operation. While researchers have been investigating the threat of malicious modification within the scale of individual microelectronic components, the possibility of a board-level malicious manipulation has essentially been unexplored. In the absence of standard benchmarking solutions, prospective countermeasures for PCB trust assurance are likely to utilize homegrown representation of the attacks that undermine their evaluation and do not provide scope for comparison with other techniques. In this article, we have developed a benchmarking solution to facilitate an unbiased and comparable evaluation of countermeasures applicable to PCB trust assurance. Based on a taxonomy tailored for PCB-level alterations, we have developed a toolflow for the automatic generation of Trojan benchmarks to facilitate a comprehensive evaluation against a large number of diverse Trojan implementations and application of data mining for trust verification. Using the toolflow, we have developed a suite of custom “Trojan benchmarks” (i.e., PCB designs with Trojans) containing representative examples of Trojans in the taxonomy inserted in different PCB designs of varying complexity and functionality. Finally, with experimental measurements from a fabricated PCB and structural analysis of netlist, we analyze the stealthiness of the Trojan designs and present the runtime of the tool for a large number of PCB designs.

The need for metrics for quantifying trustworthiness of electronic hardware against diverse threats on its integrity and confidentiality has greatly increased due to the increasing reliance on the untrusted global supply chain. Hardware Trojans, or malicious design alterations, has emerged as a major threat to hardware integrity and garnered significant interest in recent times due to its catastrophic potential. Effective protection against hardware Trojan attacks, however, requires well-defined metrics, which fall into two broad classes: 1) measure of a design’s vulnerability to Trojan insertion and 2) measure of effectiveness of a defense solution—a design or verification/test approach—against Trojan attacks, which is often represented as Trojan coverage. The former is important to assess the level of difficulty an adversary would encounter to insert a hard-to-detect Trojan. Previous efforts have assigned vulnerability as a function of the number of suspect nets identified in a design or are required to enumerate a subspace of Trojans. However, these values simplify the problem of hardware Trojan insertion and leave much of the subsequent analysis regarding the viable Trojan space unmeasured. In this article, we address this critical gap by presenting Trojan vulnerability factor (TVF), a metric for quantifying a design’s vulnerability to Trojan insertion via maximal clique analysis. With such analysis, we can frame the threat to more accurately represent the Trojan behavior and quantify the level of effort required for a designer to cover these Trojan triggers without needing to directly consider Trojan trigger sizes. We also introduce soft thresholding to account for suspect nets, which lie at the boundary of a design. Experimental results highlight the benefits of the proposed approach over existing Trojan vulnerability metrics. Finally, we demonstrate scalability to large designs through partitioning and clique sampling-based estimations.

Power side-channel attacks are potent security threats that exploit the power consumption patterns of an electronic device to glean sensitive information ranging from secret keys and passwords to web-browsing activity. While pre-Silicon tools promise early detection of side-channel leakage at the design stage, they require several hours of simulation time. In this paper, we present an analytical framework called FORTIFY that estimates the power side-channel vulnerability of digital circuit designs at signal-level granularity, given the RTL or gate-level netlist of the design, at least 100 times faster than contemporary works. We demonstrate the correctness of FORTIFY by comparing it with a recent simulation-based side-channel leakage analysis framework. We also test its scalability by evaluating FORTIFY on an open-source System-on-Chip.

Printed circuit boards (PCBs) form an integral part of the electronics life cycle by providing mechanical support and electrical connections to microchips and discrete electronic components. PCBs follow a similar life cycle as microchips and are vulnerable to similar assurance issues. Malicious design alterations, i.e., hardware Trojan attacks, have emerged as a major threat to PCB assurance. Board-level Trojans are extremely challenging to detect due to (1) the lack of golden or reference models in most use cases, (2) potentially unbounded attack space, and (3) the growing complexity of commercial PCB designs. Existing PCB inspection techniques (e.g., optical and electrical) do not scale to large volume and are expensive, time-consuming, and often not reliable in covering diverse Trojan space. To address these issues, in this paper, we present VIPR-PCB, a board-level Trojan detection framework that employs a machine learning (ML) model to learn Trojan signatures in functional and structural space and uses a trained model to discover Trojans in suspect PCB designs with high fidelity. Using extensive evaluation with 10 open-source PCB designs and a wide variety of Trojan instances, we demonstrate that VIPR-PCB can achieve over 98% accuracy and is even capable of detecting Trojans in partially-recovered PCB designs.

With growing use of hardware intellectual property (IP) based integrated circuits (IC) design and increasing reliance on a globalized supply chain, the threats to confidentiality of hardware IPs have emerged as major security concerns to the IP producers and owners. These threats are diverse, including reverse engineering (RE), piracy, cloning, and extraction of design secrets, and span different phases of electronics life cycle. The academic research community and the semiconductor industry have made significant efforts over the past decade on developing effective methodologies and CAD tools targeted to protect hardware IPs against these threats. These solutions include watermarking, logic locking, obfuscation, camouflaging, split manufacturing, and hardware redaction. This paper focuses on key topics on confidentiality of hardware IPs encompassing the major threats, protection approaches, security analysis, and metrics. It discusses the strengths and limitations of the major solutions in protecting hardware IPs against the confidentiality attacks, and future directions to address the limitations in the modern supply chain ecosystem.

The modern horizontal semiconductor supply chain has introduced a plethora of security threats targeting the integrity and confidentiality of hardware intellectual properties (IPs) and integrated circuits (ICs). Threats, such as reverse engineering, cloning, tampering, extraction of design intent have given rise to serious concerns for both the user and the producer of microelectronic devices. Logic locking, a recently proposed methodology, aims to defend against some of these threats through strategic logic gate insertions (key gates) and structural modifications. However, we observed that most existing logic locking techniques are vulnerable to structural analysis attacks. Furthermore, there is no technique available to quantify the robustness against structural analysis attacks of logic locking techniques. Based on these observations, we have developed a set of artificial intelligence guided evaluation frameworks and metrics to identify structural (SAIL, SIVA) and joint structural-functional (SURF) vulnerabilities in locked designs and quantify them. We have also developed a learning-guided logic locking framework, LeGO, that iteratively hardens a design against a set of known attacks with the possibility of expanding this attack database over time as new attacks are discovered. SAIL, SURF, and SIVA have opened up a new research area on structural attack vulnerability analysis of logic locking, while LeGO serves as a building block for developing the next generation of AI-guided logic locking techniques.

The heterogeneous array of edge devices in an Internet of Things (IoT) infrastructure is increasingly vulnerable to physical in-field tampering attacks. These devices can significantly benefit from a difficult-to-clone and tamper-immune intrinsic identifier that can verify the authenticity or integrity of the physical components. In this article, we develop an intrinsic device identifier,RIHANN, that captures the state of the electronic hardware in an IoT device. This state can adequately reflect any physical tampering of the hardware components by transforming the intrinsic delay variations in the electronic components of an edge device into unique and robust signatures. Our proposed authentication approach utilizes the boundary scan architecture (BSA) in printed circuit boards (PCBs). BSA is a prevalent design for test (DFT) structure used in most PCBs in IoT edge devices. This technique supports an extensive array of heterogeneous devices and can seamlessly operate during the device’s runtime. We measure the boundary scan path delays using the parallel scan delay-measurement (PSDM) technique for commercially available ICs. We perform practical experiments on 20 devices, generate signatures, and evaluate their uniqueness, robustness, randomness, and resistance to aging. We also introduce a security protocol for the cloud server, owner/verifier, or other IoT devices connected to a network to verify their identity remotely. The policy prevents attacks from extracting the device’s secret keys using an efficient moving target defense mechanism that periodically updates and evolves the challenge–response database.

Abstract Storage and retrieval of data in a computer memory play a major role in system performance. Traditionally, computer memory organization is ‘static’—i.e. it does not change based on the application-specific characteristics in memory access behaviour during system operation. Specifically, in the case of a content-operated memory (COM), the association of a data block with a search pattern (or cues) and the granularity (details) of a stored data do not evolve. Such a static nature of computer memory, we observe, not only limits the amount of data we can store in a given physical storage, but it also misses the opportunity for performance improvement in various applications. On the contrary, human memory is characterized by seemingly infinite plasticity in storing and retrieving data—as well as dynamically creating/updating the associations between data and corresponding cues. In this paper, we introduce BINGO, a brain-inspired learning memory paradigm that organizes the memory as a flexible neural memory network. In BINGO, the network structure, strength of associations, and granularity of the data adjust continuously during system operation, providing unprecedented plasticity and performance benefits. We present the associated storage/retrieval/retention algorithms in BINGO, which integrate a formalized learning process. Using an operational model, we demonstrate that BINGO achieves an order of magnitude improvement in memory access times and effective storage capacity using the CIFAR-10 dataset and the wildlife surveillance dataset when compared to traditional content-operated memory.

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this article, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power, and delay overhead of 39%, 45%, and 15%, respectively.

The commercial off-the-shelf (COTS) component-based ecosystem provides an attractive system design paradigm due to the drastic reduction in development time and cost compared to custom solutions. However, it brings in a growing concern of trustworthiness arising from the possibility of malicious embedded logic or hardware Trojans in COTS components. Existing hardware Trojan countermeasures are typically not applicable to COTS hardware due to the need for zero trust consideration for all supply chain entities, absence of golden models, and lack of observability of internal signals within the component. In this work, we propose a novel approach for runtime Trojan detection and resilience in untrusted COTS processors through judicious modifications in the software. The proposed approach does not rely on any hardware redundancy or architectural modification and hence seamlessly integrates with the COTS-based system design process. Trojan resilience is achieved through the execution of multiple functionally equivalent software variants. We have developed and implemented a solution for compiler-based automatic generation of program variants, metric-guided selection of variants, and their integration in a single executable. To evaluate the proposed approach, we first analyzed the effectiveness of program variants in avoiding the activation of a random pool of Trojans. Then, by implementing several Trojans in an OpenRISC 1000 processor, we analyzed the detectability and resilience under Trojan activation in both single and multiple variants. We also present delay and code size overhead for the automatically generated variants for several programs and discuss future research directions.

We present CAD framework and EDA tool,$\mathrm{S{\scriptstyle O}CC{\scriptstyle OM}}$, for automated synthesis of optimized SoC architectures. We delineate a disciplined and streamlined methodology to enable automated IP integration and design optimization.$\mathrm{S{\scriptstyle O}CC{\scriptstyle OM}}$supports generation of a wide variety of optimized SoCs by: 1) automating the entire process of intellectual property (IP) standardization and integration; 2) allowing configurable assembly of complex, scalable systems with application-specific subsystems; and 3) enabling optimization and evaluation of generated designs based on area and power constraints. Applications of$\mathrm{S{\scriptstyle O}CC{\scriptstyle OM}}$include development of heterogeneous, domain-specific SoCs, rapid register-transfer level (RTL) prototyping of wide-varieties of SoC benchmarks, and many others.

The globalization of the semiconductor supply chain has developed a new set of challenges for security researchers. Among them, malicious alterations of hardware designs at an untrusted facility, or Trojan insertion, are considered one of the most difficult challenges. While side-channel analysis-based hardware Trojan detection techniques have shown great potential, most solutions, proposed over the past decade, require the availability of golden (i.e., Trojan-free) chips and are susceptible to process variations. Few techniques that do not require a golden chip depend on simulation-based modeling of the side-channel signature, which may not be reliable for differentiating between process and Trojan induced variations. Furthermore, most of these techniques are evaluated either using very few Trojan inserted chips or simulation-based test setup. Spatial and temporal self-referencing-based detection mechanisms proposed earlier effectively eliminate the need for a golden chip and the impact of process variations. However, these techniques have not been adequately studied to achieve high detection sensitivity. In this article, we propose a golden-free multidimensional self-referencing technique that analyzes the side-channel signatures in both the time and frequency domains to significantly broaden the Trojan coverage and strengthen the detection confidence. We introduce a fully automated detection framework containing systematic methodologies for test generation, signature extraction, signal processing, threshold calculation, and metric-based decision-making that effectively enables the synergistic self-referencing approach. Finally, we evaluate the proposed technique through a comprehensive hardware measurement setup consisting of 96 Trojan-inserted test chips. Along with achieving a high detection coverage, we demonstrate that the analysis of spatial and temporal discrepancies in both frequency and time domains helps to reliably detect small hard-to-detect Trojans under process and measurement induced variations.

Modern System-on-Chip (SoC) designs include a large number of embedded microcontrollers that execute custom firmware. Firmware provides the flexibility of updating security features, i.e., it enables patching or in-field update, in response to an emerging security threat, bug, or changing requirements. Unfortunately, current firmware update mechanisms are complex, manual, and error-prone. In this paper we present CASTLE, an architectural framework to enable systematic and assured updates to SoC firmware. The main workhorse of CASTLE is a centralized, dedicated IP in the SoC that is responsible for receiving, authenticating, and installing a patch. The architecture works with off-chip firmware validation flows, e.g., cloud-based service for validating a proposed patch, and identifying compatibility constraints on other resident firmware in the SoC. The result is a comprehensive infrastructure that works seamlessly across architectures, vendors, and service providers, while meeting deployment and usability requirements. We demonstrate the application of proposed framework in addressing functional and security flaws of existing firmware patching mechanisms including firmware incompatibility, inadequate authentication, and time-of-check vs. time-of-use (TOCTOU) constraints.

Asset provisioning is a crucial step in present-day IC manufacturing process. The nature of on-chip assets can range from crypto keys, IC configurations, and manufacturer firmware to target specific security specifications, policies, and chip debugging information. Given the criticality of the assets, a major part of IC security research is targeted towards the development of their protection mechanisms, especially in post-fabrication deployment phase. However, in this work our curious observation is that a series of novel attack surfaces can stem from asset provisioning at untrusted testing sites and colluding foundries which are not covered by existing threat models and defense schemes. To that end, we study the state-of-the-art protection mechanisms adopted for secure IC provisioning at untrusted testing facilities and highlight their security vulnerabilities. In particular, we show the inadequacy of existing authentication and design obfuscation-based defense mechanisms during asset provisioning through a secure root of trust.

The emergent ecosystems of intelligent edge devices in diverse Internet-of-Things (IoT) applications, from automatic surveillance to precision agriculture, increasingly rely on recording and processing a variety of image data. Due to resource constraints, e.g., energy and communication bandwidth requirements, these applications require compressing the recorded images before transmission. For these applications, image compression commonly requires: 1) maintaining features for coarse-grain pattern recognition instead of the high-level details for human perception due to machine-to-machine communications; 2) high compression ratio that leads to improved energy and transmission efficiency; and 3) large dynamic range of compression and an easy tradeoff between compression factor and quality of reconstruction to accommodate a wide diversity of IoT applications as well as their time-varying energy/performance needs. To address these requirements, we propose, MAGIC, a novel machine learning (ML)-guided image compression framework that judiciously sacrifices the visual quality to achieve much higher compression when compared to traditional techniques, while maintaining accuracy for coarse-grained vision tasks. The central idea is to capture application-specific domain knowledge and efficiently utilize it in achieving high compression. We demonstrate that the MAGIC framework is configurable across a wide range of compression/quality and is capable of compressing beyond the standard quality factor limits of both JPEG 2000 and WebP. We perform experiments on representative IoT applications using two vision data sets and show 42.65× compression at similar accuracy with respect to the source. We highlight low variance in compression rate across images using our technique as compared to JPEG 2000 and WebP.

A printed circuit board (PCB) provides necessary mechanical support to an electronic system and acts as a platform for connecting electronic components. Counterfeiting and in-field tampering of PCBs have become significant security concerns in the semiconductor industry as a result of increasing untrusted entities in the supply chain. These counterfeit components may result in performance degradation, profit reduction, and reputation risk for the manufacturers. While Integrated Circuit (IC) level authentication using physical unclonable functions (PUFs) has been widely investigated, countermeasures at the PCB level are scarce. These approaches either suffer from significant overhead issues, or opportunistic counterfeiters can breach them like clockwork. Besides, they cannot be extended to system-level (both chip and PCB together), and their applications are also limited to a specific purpose (i.e., either counterfeiting or tampering). In this article, we introduce SILVerIn , a novel systematic approach to verify the authenticity of all chips used in a PCB as well as the board for combating attacks such as counterfeiting, cloning, and in-field malicious modifications. We develop this approach by utilizing the existing boundary scan architecture (BSA) of modern ICs and PCBs. As a result, its implementation comes at a negligible (∼0.5%) hardware overhead. SILVerIn is integrated into a PCB design during the manufacturing phase. We implement our technique on a custom hardware platform consisting of an FPGA and a microcontroller. We incorporate the industry-standard JTAG (Joint Test Action Group) interface to transmit test data into the BSA and perform hands-on measurement of supply current at both chip and PCB levels on 20 boards. We reconstruct these current values to digital signatures that exhibit high uniqueness, robustness, and randomness features. Our approach manifests strong reproducibility of signatures at different supply voltage levels, even with a low-resolution measurement setup. SILVerIn also demonstrates a high resilience against machine learning-based modeling attacks, with an average prediction accuracy of ∼51%. Finally, we conduct intentional alteration experiments by replacing the on-board FPGA to replicate the scenario of PCB tampering, and the results indicate successful detection of in-field modifications in a PCB.

Hardware security and trust have become a pressing issue during the last two decades due to the globalization of the semiconductor supply chain and ubiquitous network connection of computing devices. Computing hardware is now an attractive attack surface for launching powerful cross-layer security attacks, allowing attackers to infer secret information, hijack control flow, compromise system root-of-trust, steal intellectual property (IP), and fool machine learners. On the other hand, security practitioners have been making tremendous efforts in developing protection techniques and design tools to detect hardware vulnerabilities and fortify hardware design against various known hardware attacks. This article presents an overview of hardware security and trust from the perspectives of threats, countermeasures, and design tools. By introducing the most recent advances in hardware security research and developments, we aim to motivate hardware designers and electronic design automation tool developers to consider the new challenges and opportunities of incorporating an additional dimension of security into robust hardware design, testing, and verification.

Intellectual property (IP) protection against piracy and reverse engineering (RE) has emerged as a critical area of research in the field of hardware security. Logic locking has been studied as a promising technique to provide robust protection against these attacks. However, a vast body of recent works has presented successful attacks to break existing locking methods in terms of retrieving the secret key and restoring the original functionality. In this paper, we propose SARO, a scalable attack-resistant logic locking that provides a robust functional and structural design transformation process. SARO treats the target circuit as a hypergraph (G), and performs partitioning of G to produce a set of sub-graphs, then applies an efficient Truth Table Transformation (T3) process to each partition. Further, to mitigate specific attacks (such as SAT-based analysis), SARO implements distributed attack resistance, which integrates random SAT-hard functions (obtained from an automatic function generator, RanSAT) into select partitions. RanSAT produces non-biased and non-deterministic design transformations, where added locking mechanisms are not distinguishable from the original circuit. Finally, it implements a concept of a derived key generation that simultaneously helps to minimize the required key size through judicious reuse of key bits, as well as enhancing the structural alterations. Unlike state-of-the-art logic locking solutions, which focus on primarily enhancing robustness against functional query-based attacks, the proposed transformation steps provide the following unique benefits: (1) high scalability to large designs obtained through partitioning; (2) high structural obfuscation leading to resistance to structural attacks; and (3) low key size, while maintaining strong resistance against functional attacks. To quantitatively represent the level of structural and functional transformation, we also propose the T3metric. We evaluate SARO on ISCAS85 and EPFL benchmarks, and provide comprehensive security and performance analysis of our proposed framework.

Obfuscation or Logic locking (LL) is a technique for protecting hardware intellectual property (IP) blocks against diverse threats, including IP theft, reverse engineering, and malicious modifications. State-of-the-art locking techniques primarily focus on securing a design from unauthorized usage by disabling correct functionality – they often do not directly address hiding design intent through structural transformations. They rely on the synthesis tool to introduce structural changes. We observe that this process is insufficient as the resulting changes in circuit topology are: (1) local and (2) predictable. In this paper, we analyze the structural transformations introduced by LL and introduce a potential attack, called SAIL, that can exploit structural artifacts introduced by LL. SAIL uses machine learning (ML) guided structural recovery that exposes a critical vulnerability in these techniques. Through this attack, we demonstrate that the gate-level structure of a locked design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to most forms of logic locking, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g., an unlocked IC). Evaluation on benchmark circuits shows that we can recover an average of about 92%, up to 97%, transformations (Top-10 R-Metric) introduced by logic locking. We show that this attack is scalable, flexible, and versatile. Additionally, to evaluate the SAIL attack resilience of a locked design, we present the SIVA-Metric that is fast in terms of computation speed and does not require any training. We also propose possible mitigation steps for incorporating SAIL resilience into a locked design.

Fault attacks belong to a potent class of implementation-based attacks that can compromise a crypto-device within a few milliseconds. Out of the large numbers of faults that can occur in the device, only a very few are exploitable in terms of leaking the secret key. Ignorance of this fact has resulted in countermeasures that have either significant overhead or inadequate protection. This article presents a framework, referred to as FaultDroid, for automated vulnerability analysis of fault attacks. It explores the entire fault attack space, identifies the single/multiple fault scenarios that can be exploited by a differential fault attack, rank-orders them in terms of criticality, and provides design guidance to mitigate the vulnerabilities at low cost. The framework enables a designer to automatically evaluate the fault attack vulnerabilities of a block cipher implementation and then incorporate efficient countermeasures. FaultDroid uses a formal model of fault attacks on a high-level specification of a block cipher and hence is equally applicable to both software and hardware implementation of the cipher. As case studies, we employ FaultDroid to comprehensively evaluate the fault scenarios in several common ciphers—AES, CLEFIA, CAMELLIA, SMS4, SIMON, PRESENT, and GIFT—and assess their vulnerability.

Hardware intellectual property (IP) piracy and misuse have introduced new challenges in the semiconductor industry as untrusted parties in the IP's life cycle may clone, reverse-engineer, or extract important design secrets from an IP. A promising solution to protect a hardware IP against such attacks is to perform logic locking, where additional logic controlled by a secret key is inserted in strategic locations of an IP to lock the functionality when the correct key is not available. As a multitude of logic locking techniques has emerged in the past decade, the research community has also developed strong attacks against them to expose various vulnerabilities that can be exploited by an adversary to break the protection. While state-of-the-art logic locking solutions have demonstrated provable robustness against known attacks, there is a critical need to explore new attack vectors and mitigate them to achieve a higher level of protection. In this article, we present SCOPE, a novel synthesis-based constant propagation attack for security evaluation of logic locking techniques. SCOPE is oracle-less and requires no knowledge about the locking algorithm or the locked design by an attacker. The introduced attack performs a synthesis-based analysis on each individual key-input port and looks for meaningful design features that may help derive the correct key value. SCOPE offers two attack modes with varying complexity and effectiveness, a linear regression test, and an unsupervised machine-learning analysis. We perform SCOPE to a number of existing locking techniques and demonstrate that the average attack accuracy is 84.13% with high scalability in terms of design size. Based on the vulnerabilities identified by SCOPE, we provide a low-overhead countermeasure that can help mitigate such constant propagation attacks.

Counterfeit integrated circuits (ICs) have become a significant security concern in the semiconductor industry as a result of the increasingly complex and distributed nature of the supply chain. These counterfeit chips may result in performance degradation, profit reduction, and reputation risk for the manufacturer. Therefore, developing effective countermeasures against such malpractices is becoming severely crucial. Physical unclonable function (PUF)-based authentication methods have the potential to mitigate these challenges. However, PUF-based solutions are restrained by several factors, such as additional design efforts and significant area/power overhead, struggle to maintain and update challenge-response pairs (CRPs) database, and the vulnerability to machine learning (ML) attacks. In this article, we address these challenges by developing a novel database-free and enrolment-free hardware authentication approaches, i.e., a digital watermark metric for ICs. To enable efficient database-free hardware integrity verification without enrolment, first, we transform the intrinsic variations in circuit parameters, e.g., boundary scan chain (BSC) path delays in the joint test action group (JTAG) chain into robust digital signatures. Then, we perform statistical analysis on a small pilot unit of authentic chips to create a robust watermark for a complete batch of chips, which jointly captures the characteristics of the physical layout, the manufacturing process, and the foundry. The increasing complexity in the current state-of-the-art designs makes it extremely hard for an adversary to perfectly clone such statistical characterization of circuit parameters using counterfeit or compromised hardware. Besides, the proposed approach requires no additional design or hardware overhead in IC design since it utilizes an embedded structure, which inherently exists within the chips. It also obviates the design house from characterizing each manufactured chip instance, reducing overall testing cost. A path-delay measurement method at a high resolution based on clock phase sweep is introduced to measure the delay values effectively. The proposed intrinsic identifier-based authentication approach is validated by performing emulation on FPGAs and also by conducting physical measurements on custom-made printed circuit boards (PCBs). The reliability of the generated watermarks is evaluated with environmental temperature fluctuations and the aging effect.

Fault attacks are potent physical attacks on crypto-devices. A single fault injected during encryption can reveal the cipher's secret key. In a hardware realization of an encryption algorithm, only a tiny fraction of the gates is exploitable by such an attack. Finding these vulnerable gates has been a manual and tedious task requiring considerable expertise. In this paper, we propose SOLOMON, the first automatic fault attack vulnerability detection framework for hardware designs. Given a cipher implementation, either at RTL or gate-level, SOLOMON uses formal methods to map vulnerable regions in the cipher algorithm to specific locations in the hardware thus enabling targeted countermeasures to be deployed with much lesser overheads. We demonstrate the efficacy of the SOLOMON framework using three ciphers: AES, CLEFIA, and Simon.

Commercial off-the-shelf (COTS) components, such as microcontrollers, processors, and field programmable gate arrays (FPGA) increasingly constitute the hardware backbone for modern electronic systems, including internet of things (IoT) devices. However, distributed untrusted supply chain of these components make counterfeiting and malicious alterations of these components easy and wide-spread phenomenon. In this paper, we address the various trust issues in COTS and present a list of promising design and verification solutions to address them.

With rising concerns over fossil fuel depletion and the impact of Internal Combustion Engine (ICE) vehicles on our climate, the transportation industry is observing a rapid proliferation of Electric Vehicles (EVs). Yet, people continue to use ICE vehicles over EVs due to consumer worries over issues such as limited range, limited battery life, long charging times, and the lack of EV charging stations. Existing solutions to these problems, such as building more charging stations, increasing battery capacity, and road-charging have not been proven efficient so far. In this paper, we propose Peer-to-PeerCar Charging (P2C2), ahighly scalable novel technique for charging EVs on-the-go with minimal cost overhead. We allow EVs to share charge among each other based on the instructions from a cloud-based control system. The control system assigns and guides EVs for charge sharing. We also introduce Mobile Charging Stations (MoCS), which are high battery capacity vehicles that are used to replenish the overall charge in the vehicle networks. We have implemented P2C2 and integrated it with the traffic simulator, SUMO. We observe promising results with up to 65% reduction in the number of EV halts and with up to 24.4% reduction in required battery capacity without any extra halts.

introduction Share on Introduction to the Special Issue on New Trends in Nanoelectronic Device, Circuit, and Architecture Design, Part 1 Editors: Helen Li Duke University, Durham, NC Duke University, Durham, NCView Profile , Wei Zhang Hong Kong University of Science and Technology, Clear Water Bay, NT, Hong Kong SAR Hong Kong University of Science and Technology, Clear Water Bay, NT, Hong Kong SARView Profile , Swarup Bhunia University of Florida, Gainesville, FL University of Florida, Gainesville, FLView Profile , Wujie Wen Lehigh University, Bethlehem, PA Lehigh University, Bethlehem, PAView Profile Authors Info & Claims ACM Journal on Emerging Technologies in Computing SystemsVolume 16Issue 3July 2020 Article No.: 24pp 1–3https://doi.org/10.1145/3392080Published:27 June 2020Publication History 0citation105DownloadsMetricsTotal Citations0Total Downloads105Last 12 Months9Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Static Random Access Memory (SRAM) is a core technology for building computing hardware, including cache memory, register files and field programmable gate array devices. Hence, SRAM reliability is essential to guarantee dependable computing. While significant research has been conducted to develop automated test algorithms for detecting manufacture-induced SRAM faults, they cannot ensure detection of faults deliberately implemented in the SRAM array by untrusted parties in the integrated circuit development flow. Indeed, such hardware Trojan attacks represent an emerging security threat. While a growing body of research addresses Trojan designs in logic circuits, little research has explored hardware Trojan attacks in embedded memory arrays [20]. In this article, we propose a new class of hardware Trojans targeting embedded SRAM arrays. The Trojans are designed to evade industry standard post-manufacturing tests while enabling attacks targeting various system hardware components during deployment. Transistor-level simulation results demonstrate minimal impact on SRAM power, performance, and stability while Trojans are not activated. We also prove the feasibility of Trojan insertion in foundries by showing the proposed layouts that preserve the SRAM cell footprint and incur zero silicon area overhead. Finally, we elaborate on several system-level attacks that can leverage these Trojans to compromise security and privacy.

introduction Free Access Share on Guest Editorial: ACM JETC Special Issue on New Trends in Nanolectronic Device, Circuit, and Architecture Design: Part 2 Editors: Wei Zhang The Hong Kong University of Science and Technology, Clear Water Bay, NT, Hong Kong SAR The Hong Kong University of Science and Technology, Clear Water Bay, NT, Hong Kong SARView Profile , Helen Li Duke University Durham, NC 27708 USA Duke University Durham, NC 27708 USAView Profile , Wujie Wen Lehigh University Bethlehem, PA 18015 USA Lehigh University Bethlehem, PA 18015 USAView Profile , Swarup Bhunia University of Florida Gainesville, FL 32611 University of Florida Gainesville, FL 32611View Profile Authors Info & Claims ACM Journal on Emerging Technologies in Computing SystemsVolume 16Issue 4October 2020 Article No.: 35pp 1–3https://doi.org/10.1145/3412343Published:23 September 2020Publication History 0citation232DownloadsMetricsTotal Citations0Total Downloads232Last 12 Months40Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteView all FormatsPDF

Most cipher implementations are vulnerable to a class of cryptanalytic attacks known as fault injection attacks. To reveal the secret key, these attacks make use of faults induced at specific locations during the execution of the cipher. Countermeasures for fault injection attacks require these vulnerable locations in the implementation to be first identified and then protected. However, both these steps are difficult and error-prone and, hence, it requires considerable expertise to design efficient countermeasures. Incorrect or insufficient application of the countermeasures would cause the implementation to remain vulnerable, while inefficient application of the countermeasures could lead to significant performance penalties to achieve the desired fault-attack resistance. In this paper, we present a novel framework called SAFARI for automatically synthesizing fault-attack resistant implementations of block ciphers. The framework takes as input the security requirements and a high-level specification of the block cipher. It automatically detects the vulnerable locations from the specification, applies an appropriate countermeasure based on the user-specified security requirements, and then synthesizes an efficient, fault-attack protected, RTL, or C code for the cipher. We take AES, CAMELLIA, and CLEFIA as case studies and demonstrate how the framework would explore different countermeasures, based on the vulnerability of the locations, the output format, and the required security margins. We then evaluate the efficacy of SAFARI in hardware and software to the design overhead incurred and the fault coverage.

Modern System-on-Chip (SoC) designs integrate a number of third party IPs (3PIPs) that coordinate and communicate through a Network-on-Chip (NoC) fabric to realize system functionality. An important class of SoC security attack involves a rogue IP tampering with the inter-IP communication. These attacks include message snoop, message mutation, message misdirection, IP masquerade, and message flooding. Static IP-level trust verification cannot protect against these SoC-level attacks. In this paper, we analyze the vulnerabilities of system level communication among IPs and develop a novel SoC security architecture that provides system resilience against exploitation by untrusted 3PIPs integrated over an NoC fabric. We show how to address the problem through a collection of fine-grained SoC security policies that enable on-the-fly monitoring and control of appropriate security-relevant events. Our approach, for the first time to our knowledge, provides an architecture-level solution for trusted SoC communication through run-time resilience in the presence of untrusted IPs. We demonstrate viability of our approach on a realistic SoC design through a series of attack models and show that our architecture incurs minimal to modest overhead in area, power, and system latency.

Field Programmable Gate Arrays (FPGAs) have become an attractive choice for diverse applications due to their reconfigurability and unique security features. However, designs mapped to FPGAs are prone to malicious modifications or tampering of critical functions. Besides, targeted modifications have demonstrably compromised FPGA implementations of various cryptographic primitives. Existing security measures based on encryption and authentication can be bypassed using their side-channel vulnerabilities to execute bitstream tampering attacks. Furthermore, numerous resource-constrained applications are now equipped with low-end FPGAs, which may not support power-hungry cryptographic solutions. In this article, we propose a novel obfuscation-based approach to achieve strong resistance against both random and targeted pre-configuration tampering of critical functions in an FPGA design. Our solution first identifies the unique structural and functional features that separate the critical function from the rest of the design using a machine learning guided framework. The selected features are eliminated by applying appropriate obfuscation techniques, many of which take advantage of “FPGA dark silicon”—unused lookup table resources—to mask the critical functions. Furthermore, following the same obfuscation principle, a redundancy-based technique is proposed to thwart targeted, rule-based, and random tampering. We have developed a complete methodology and custom software toolflow that integrates with commercial tools. By applying the masking technique on a design containing AES, we show the effectiveness of the proposed framework in hiding the critical S-Box function. We implement the redundancy integrated solution in various cryptographic designs to analyze the overhead. To protect 16.2% critical component of a design, the proposed approach incurs an average area overhead of only 2.4% over similar redundancy-based approaches, while achieving strong security.

This article presents anomaly detection by examining sensor stream statistics (AEGIS), a novel mixed-signal framework for real-time AEGIS. AEGIS utilizes kernel density estimation (KDE)-based nonparametric density estimation to generate a real-time statistical model of the sensor data stream. The likelihood estimate of the sensor data point can be obtained based on the generated statistical model to detect outliers. We present CMOS Gilbert Gaussian cell-based design to realize Gaussian kernels for KDE. For outlier detection, the decision boundary is defined in terms of kernel standard deviation (σKernel) and likelihood threshold (PThres). We adopt a sliding window to update the detection model in real time. We use time-series data set provided from Yahoo to benchmark the performance of AEGIS. A f1-score higher than 0.87 is achieved by optimizing parameters such as length of the sliding window and decision thresholds which are programmable in AEGIS. Discussed architecture is designed using 45-nm technology node and our approach on average consumes ~75-μW power at a sampling rate of 2 MHz while using ten recent inlier samples for density estimation.

Electronic hardware trust is an emerging concern for all stakeholders in the semiconductor industry. Trust issues in electronic hardware span all stages of its life cycle - from creation of intellectual property (IP) blocks to manufacturing, test and deployment of hardware components and all abstraction levels - from chips to printed circuit boards (PCBs) to systems. The trust issues originate from a horizontal business model that promotes reliance of third-party untrusted facilities, tools, and IPs in the hardware life cycle. Today, designers are tasked with verifying the integrity of third-party IPs before incorporating them into system-on-chip (SoC) designs. Existing trust metric frameworks have limited applicability since they are not comprehensive. They capture only a subset of vulnerabilities such as potential vulnerabilities introduced through design mistakes and CAD tools, or quantify features in a design that target a particular Trojan model. Therefore, current practice uses ad-hoc security analysis of IP cores. In this paper, we propose a vector-based comprehensive coverage metric that quantifies the overall trust of an IP considering both vulnerabilities and direct malicious modifications. We use a variable weighted sum of a design's functional coverage, structural coverage, and asset coverage to assess an IP's integrity. Designers can also effectively use our trust metric to compare the relative trustworthiness of functionally equivalent third-party IPs. To demonstrate the applicability and usefulness of the proposed metric, we utilize our trust metric on Trojan-free and Trojan-inserted variants of an IP. Our results demonstrate that we are able to successfully distinguish between trusted and untrusted IPs.

Internet of things (IoT) promises to usher in the fourth industrial revolution through an exponential growth of smart connected devices deployed in myriad application domains. It gives rise to new relationships between man and smart connected machines that might transform our everyday experiences. Such a transformation, however, builds on innovations at all levels in the IoT architecture - from edge devices to the cloud. In this talk, we will cover the IoT design practices and core technological challenges that need to be addressed to enable wide-spread deployment of IoT. We will focus on innovations in the areas of energy-efficiency, security, interoperability and intelligent decision making. Next, we will discuss several compelling applications of IoT that gives unprecedented capability to us. In particular, we will cover applications of IoT in addressing some of the critical safety, security, and sustainability issues in our society.

Random number generators play a pivotal role in generating security primitives, e.g., encryption keys, nonces, initial vectors, and random masking for side-channel countermeasures. A quantum entropy source based on radioactive isotope decay can be exploited to generate random numbers with sufficient entropy. If a deterministic random bit generator (DRBG) is combined for post-processing, throughput of the quantum random number generator (QRNG) can be improved. However, general DRBGs are susceptible to side-channel attacks. In this paper, we propose a framework called SCR-QRNG framework, which offers Side-Channel Resistant primitives using QRNG. The QRNG provides sources of randomness for modulating the clock frequency of a DRBG to obfuscate side-channel leakages, and to generate unbiased random numbers for security primitives. The QRNG has robustness against power side-channel attacks and is in compliance with NIST SP 800-22/90B and BSI AIS 31. We fabricate a quantum entropy chip, and implement a PCB module for a random frequency clock generator and a side-channel resistant QRNG on an FPGA.

Hardware plays an integral role in system security with many emerging vulnerabilities and defense mechanisms targeting hardware. The IEEE International Symposium on Hardware Oriented Security and Trust (HOST) aims to facilitate the rapid growth of hardware-based security research and development. Since 2008, HOST has provided an environment to present cutting-edge developments in hardware security and trust. With the recent expansion of its scope to include all areas of overlap between hardware and security, HOST has become a premier event in the field of cybersecurity, and is one of the few to bridge the gap between computer security, mircoelectronics, and electronic design automation (EDA) communities.

Ahstract-Various attacks on hardware intellectual properties (IPs) have been successful in obtaining design information that can be used to reverse engineer a system, create counterfeits, or insert hardware Trojans. Key-based hardware obfuscation is an attractive solution that helps prevent such attacks. In this paper, for the first time, we propose a key error tolerant obfuscation approach that achieves graceful degradation in output Quality of Service (QoS) as the bit error rate (BER) in obfuscation key increases. The approach, which we refer to it as, “Quality Obfuscation”, is applicable to a large variety of IPs, including digital signal processing (DSP) and approximating computing IPs, which are resilient to output QoS degradation. We present a complete obfuscation framework that can be adapted to any error tolerance rate. To demonstrate its robustness, we obfuscate several common DSP IP blocks and observe the performance under various percentages of bit-flips in the key. We show that our approach provides controllability of system quality, as well as the strong protection at low overhead, e.g., average 15% area and 5.9% power overhead to tolerate 10% BER.

The continuing decrease in feature size of integrated circuits, and the increase of the complexity and cost of design and fabrication has led to outsourcing the design and fabrication of integrated circuits to third parties across the globe, and in turn has introduced several security vulnerabilities. The adversaries in the supply chain can pirate integrated circuits, overproduce these circuits, perform reverse engineering, and/or insert hardware Trojans in these circuits. Developing countermeasures against such security threats is highly crucial. Accordingly, this paper first develops a learning-based trust verification framework to detect hardware Trojans. To tackle Trojan insertion, IP piracy and overproduction, logic locking schemes and in particular stripped functionality logic locking is discussed and its resiliency against the state-of-the-art attacks is investigated.

We interact with a wide variety of computing systems in our daily life. These computing systems are often connected through a network to provide a wide array of services. Depending on our specific circumstances, our interactions can be with embedded and cyber-physical systems (CPSs) or Internet-of-Things (IoT) devices. While these devices vary in terms of form factors, hardware–software integration, and energy constraints, they have one commonality—security and privacy are the primary design considerations. These systems collect and analyze sensitive data, which may include our personal, financial, as well as health information on a regular basis. As a result, the existing academic and industrial efforts have focused on designing systems with security and privacy in mind. Given the complexity of these systems and the diversity of the potential attacks, machine learning (ML) has become an attractive solution for security and privacy analytics.

Detection of counterfeit chips has emerged as a crucial concern. Physically unclonable function (PUF)-based techniques are widely used for authentication; however, these require dedicated hardware and large signature database. In this paper, we show intrinsic and database-free authentication using back-end capacitors. The discussed technique simplifies authentication setup and reduces the test cost. We show that an analog-to-digital converter (ADC) can be modified for back-end capacitor-based authentication in addition to its regular functionality; hence, a dedicated authentication module is not necessary. Moreover, since back-end capacitors are quite insensitive to temperature and aging-induced variations than transistors, the discussed technique results in a more reliable authentication than transistor PUF-based authentication. Discussed authentication scheme manifests significant resilience against power supply instability. The modifications to conventional ADC incur 3.2% power overhead and 75% active-area overhead; however, arguably, the advantages of the discussed intrinsic and database-free authentication outweigh the overheads.

System-on-Chip (SoC) security architectures targeted towards diverse applications including Internet of Things (IoT) and automotive systems enforce two critical design requirements: in-field configurability and low overhead. To simultaneously address these constraints, in this paper, we present a novel, flexible, and adaptable SoC security architecture that efficiently implements diverse security policies. The architecture and associated CAD flow enable “hardware patching” i.e. hardware security policy engine that can be seamlessly and securely upgraded in field to address unanticipated attacks or new security requirements. We implement (1) a centralized Reconfigurable Security Policy Engine (RSPE), (2) smart security wrappers, and (3) Design-for-Debug (DfD) infrastructure interface as the building blocks of the architecture. The proposed framework provides a systematic approach to represent and synthesize diverse security policies. Through extensive analysis using representative SoC models, we show, for the first time to our knowledge, that the proposed framework provides high level of patchability with minimal energy and performance overhead.

Malicious hardware modification, also known as hardware Trojan attack, has emerged as a serious security concern for electronic systems. Such attacks compromise the basic premise of hardware root of trust. Over the past decade, significant research efforts have been directed to carefully analyze the trust issues arising from hardware Trojans and to protect against them. This vast body of work often needs to rely on well-defined set of trust benchmarks that can reliably evaluate the effectiveness of the protection methods. In recent past, efforts have been made to develop a benchmark suite to analyze the effectiveness of pre-silicon Trojan detection and prevention methodologies. However, there are only a limited number of Trojan inserted benchmarks available. Moreover, there is an inherent bias as the researcher is aware of Trojan properties such as location and trigger condition since the current benchmarks are static. In order to create an unbiased and robust benchmark suite to evaluate the effectiveness of any protection technique, we have developed a comprehensive framework of automatic hardware Trojan insertion. Given a netlist, the framework will automatically generate a design with single or multiple Trojan instances based user-specified Trojan properties. It allows a wide variety of configurations, such as the type of Trojan, Trojan activation probability, number of triggers, and choice of payload. The tool ensures that the inserted Trojan is a valid one and allow for provisions to optimize the Trojan footprint (area and switching). Experiments demonstrate that a state-of-the-art Trojan detection technique provides poor efficacy when using benchmarks generated by our tool. This tool is available for download from http://www.trust-hub.org/.

Panel Overview Known security vulnerabilities across the computing stack have caused significant concern, even requiring extensive countermeasures and system patches to address. As an example, the Meltdown and Spectre attacks, which were disclosed in January 2018, exploit architectural and circuit vulnerabilities to allow a malicious process access to secrets stored in the memory of another running program. Although software-based patches were distributed, true hardware solutions are only available through replacement.

Authentication of integrated circuits (IC) to verify their integrity has emerged as a critical need to address increasing concerns associated with counterfeit ICs in the supply chain. In this paper, novel SAR-ADC based intrinsic and database-free authentication scheme has been proposed. Proposed technique utilizes mismatch in back end of line (BEOL) capacitors used in charge-redistribution SAR ADC to generate authentication signature. BEOL metal-oxide-metal (MOM) capacitors form a reliable source of process variation information and are less sensitive to aging & temperature induced variations. Line edge roughness is the primary source of mismatch in BEOL capacitors and thus, capacitor mismatch variation has been analyzed in terms of LER and geometric parameters. Resource overhead incurred by the proposed modifications to the ADC architecture to incorporate authentication ability is minimal and existing on-chip calibration circuitry is used to extract signature. Proposed technique does not require sophisticated test setup, thereby, simplifying the authentication procedure.

Increasing reliance on hardware Intellectual Property (IP) cores in modern system-on-chip (SoC) design flow, often obtained from untrusted vendors distributed across the globe, can significantly compromise the security of SoCs. While the design could be verified for a specified functionality using existing tools, it is extremely hard to verify its trustworthiness to guarantee that no hidden, and possibly malicious function exists in the form of a hardware Trojan. Conventional verification process and tools fail to verify the trust of a third-party IP, primarily due to the lack of trusted reference design or golden models. In this paper, for the first time to our knowledge, we introduce a systematic framework to apply machine learning based classification for hardware IP trust verification. A supervised classifier could be trained for identifying Trojan nets within a suspect IP, but the detection coverage and accuracy are extremely sensitive to the quality of training set available. Furthermore, reliance on a static training database limits the classifier's ability in detecting new Trojans and facilitates adversarial learning. The proposed framework includes a Trojan insertion tool that dynamically generates a large number of diverse implementations of Trojan classes for creating a robust training set. It is significantly more difficult for an adversary to evade our classifier using known Trojan classes since the tool dynamically samples the entire Trojan population. To further improve the efficiency of the system, we combined three machine learning models into an average probability Voting Ensemble. Our results for two broad classes of Trojan show excellent classification accuracy of 99.69% and 99.88% with F-score of 86.69% and 88.37% for sequential and combinational Trojans, respectively.

Embedded memory, typically implemented with Static Random Access Memory (SRAM) technology, is an integral part of modern processors and System-on-Chips (SoCs). The reliability and integrity of embedded SRAM arrays are essential to ensure dependable and trustworthy computing. In the past, significant research has been conducted to develop automated test algorithms aimed at comprehensively detecting SRAM faults. While such tests have advanced our ability to detect manufacturing imperfection induced faults, they cannot ensure detection of deliberately implemented design modifications, also known as hardware Trojans, in an SRAM array by untrusted entities in the design and fabrication flow. Indeed, these attacks constitute an emerging concern, since they can affect the integrity of fabricated ICs and cause severe consequences in the field. While a growing body of research addresses Trojan attacks in logic circuits, little to no research has explored these attacks in embedded memory arrays. In this paper, for the first time to our knowledge, we propose a new class of hardware Trojans targeting embedded SRAM arrays. The Trojans are designed to evade industry standard post-manufacturing memory tests (e.g. March test) while enabling targeted data tampering after deployment. We demonstrate various forms of Trojan circuits in SRAM that cause diverse malicious effects and have diverse activation conditions while incurring minimal overhead in power, performance, and stability. Further, the proposed layouts preserve the SRAM cell footprint and incur negligible silicon area overhead.

Modern system-on-chip (SoC) designs include a wide variety of highly sensitive assets which must be protected from unauthorized access. A significant aspect of SoC design involves exploration, analysis, and evaluation of resiliency mechanisms against attacks to such assets. These attacks may arise from a number of sources, including malicious intellectualproperty blocks (IPs) in the hardware, malicious or vulnerable firmware and software, insecure communication of the system with other devices, and side-channel vulnerabilities through power and performance profiles. Countermeasures for these attacks are equally diverse, which include architecture, design, implementation, and validation-based protection. In this paper, we provide a comprehensive overview of the security infrastructure in modern SoC designs, including both resiliency techniques and their validation paradigms at presilicon and postsilicon stages. We identify gaps in current resiliency and analysis architectures and propose design and validation solutions to address them. Finally, we provide industry perspectives on the role and impact of current practices on SoC security, and discuss some emerging trends in this important area.

Hardware Trojan detection has emerged as a critical challenge to ensure security and trustworthiness of integrated circuits. A vast majority of research efforts in this area has utilized side-channel analysis for Trojan detection. Functional test generation for logic testing is a promising alternative but it may not be helpful if a Trojan cannot be fully activated or the Trojan effect cannot be propagated to the observable outputs. Side-channel analysis, on the other hand, can achieve significantly higher detection coverage for Trojans of all types/sizes, since it does not require activation/propagation of an unknown Trojan. However, they have often limited effectiveness due to poor detection sensitivity under large process variations and small Trojan footprint in side-channel signature. In this paper, we address this critical problem through a novel side-channel-aware test generation approach, based on a concept of multiple excitation of rare switching (MERS), that can significantly increase Trojan detection sensitivity. This paper makes several important contributions: 1) it presents in detail a scalable statistical test generation method, which can generate high-quality test set for creating high relative activity in arbitrary Trojan instances; 2) it analyzes the effectiveness of generated test set in terms of Trojan coverage; and 3) it describes two judicious reordering methods that can further tune the test set and greatly improve the side channel sensitivity. Simulation results demonstrate that the tests generated by MERS can significantly increase the Trojans sensitivity, thereby making Trojan detection effective using side-channel analysis.

The pharmaceutical supply chain is the pathway through which prescription and over-the-counter (OTC) drugs are delivered from manufacturing sites to patients. Technological innovations, price fluctuations of raw materials, as well as tax, regulatory, and market demands are driving change and making the pharmaceutical supply chain more complex. Traditional supply chain management methods struggle to protect the pharmaceutical supply chain, maintain its integrity, enhance customer confidence, and aid regulators in tracking medicines. To develop effective measures that secure the pharmaceutical supply chain, it is important that the community is aware of the state-of-the-art capabilities available to the supply chain owners and participants. In this article, we will be presenting a survey of existing hardware-enabled pharmaceutical supply chain security schemes and their limitations. We also highlight the current challenges and point out future research directions. This survey should be of interest to government agencies, pharmaceutical companies, hospitals and pharmacies, and all others involved in the provenance and authenticity of medicines and the integrity of the pharmaceutical supply chain.

SoCs implementing security modules should be both testable and secure. Oversights in a design's test structure could expose internal modules creating security vulnerabilities during test. In this paper, for the first time, we propose a novel automated security vulnerability analysis framework to identify violations of confidentiality, integrity, and availability policies caused by test structures and designer oversights during SoC integration. Results demonstrate existing information leakage vulnerabilities in implementations of various encryption algorithms and secure microprocessors. These can be exploited to obtain secret keys, control finite state machines, or gain unauthorized access to memory read/write functions.

Field Programmable Gate Arrays (FPGAs) are being increasingly deployed in diverse applications including the emerging Internet of Things (IoT), biomedical, and automotive systems. However, security of the FPGA configuration file (i.e. bitstream), especially during in-field reconfiguration, as well as effective safeguards against unauthorized tampering and piracy during operation, are notably lacking. The current practice of bitstreram encryption is only available in high-end FPGAs, incurs unacceptably high overhead for area/energy-constrained devices, and is susceptible to side channel attacks. In this paper, we present a fundamentally different and novel approach to FPGA security that can protect against all major attacks on FPGA, namely, unauthorized in-field reprogramming, piracy of FPGA intellectual property (IP) blocks, and targeted malicious modification of the bitstream. Our approach employs the security through diversity principle to FPGA, which is often used in the software domain. We make each device architecturally different from the others using both physical (static) and logical (time-varying) configuration keys, ensuring that attackers cannot use a priori knowledge about one device to mount an attack on another. It therefore mitigates the economic motivation for attackers to reverse engineering the bitstream and IP. The approach is compatible with modern remote upgrade techniques, and requires only small modifications to existing FPGA tool flows, making it an attractive addition to the FPGA security suite. Our experimental results show that the proposed approach achieves provably high security against tampering and piracy with worst-case 14% latency overhead and 13% area overhead.

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

Big Data refers to the growing challenge of turning massive, often unstructured datasets into meaningful, organized, and actionable data. As datasets grow from petabytes to exabytes and beyond, it becomes increasingly difficult to run advanced analytics, especially Machine Learning (ML) applications, in a reasonable time and on a practical power budget using traditional architectures. Previous work has focused on accelerating analytics readily implemented as SQL queries on data-parallel platforms, generally using off-the-shelf CPUs and General Purpose Graphics Processing Units (GPGPUs) for computation or acceleration. However, these systems are general-purpose and still require a vast amount of data transfer between the storage devices and computing elements, thus limiting the system efficiency. As an alternative, this article presents a reconfigurable memory-centric advanced analytics accelerator that operates at the last level of memory and dramatically reduces energy required for data transfer. We functionally validate the framework using an FPGA-based hardware emulation platform and three representative applications: Naïve Bayesian Classification, Convolutional Neural Networks, and k-Means Clustering. Results are compared with implementations on a modern CPU and workstation GPGPU. Finally, the use of in-memory dataset decompression to further reduce data transfer volume is investigated. With these techniques, the system achieves an average energy efficiency improvement of 74× and 212× over GPU and single-threaded CPU, respectively, while dataset compression is shown to improve overall efficiency by an additional 1.8× on average.

Due to the enhanced capability of adversaries, electronic systems are now increasingly vulnerable to counterfeiting and piracy. The majority of counterfeit systems today are of cloned type, which have been on the rise in the recent years. Ensuring the security of such systems is of great concern as an adversary can create a backdoor or insert a malware to bypass security modules. The reliability of such systems could also be questionable as the components used in these systems may be counterfeit and/or of inferior quality. It is of prime importance to develop solutions that can prevent an adversary from creating these non-authentic systems. In this paper, we present a novel system-level mutual authentication approach for both the hardware and firmware. The hardware authenticates the firmware by verifying the checksum during the power-up. On the other hand, firmware verifies the identity of the hardware and cannot produce correct results unless it receives a unique hardware fingerprint, which we call as system ID. We propose two secure protocols, TIDP and TIDS, to construct the system ID and authenticate the system by using this unique ID. We show that our approach is resistant to various known attacks.

Modern system-on-chip (SoC) designs involve integration of a large number of intellectual property (IP) blocks, many of which are acquired from untrusted third-party vendors. An IP containing a security vulnerability-whether inadvertent or malicious-may compromise the trustworthiness of the entire SoC, e.g., by leaking sensitive information or causing execution failures at key points. Existing functional validation approaches, post-manufacturing tests, and IP trust verification techniques are inadequate to accomplish comprehensive system-level security assurance in the presence of untrusted IPs. In this paper, we analyze security issues at the SoC level caused by untrusted IPs. We also propose a novel, resilient SoC security architecture to ensure trusted SoC operation with untrusted IPs. Our architecture realizes fine-grained IP-trust aware security policies in an efficient security policy checker that enables run-time monitoring of security issues arising from untrusted IPs. It also exploits on-chip design-for-debug architecture to ensure trusted information flow from IP blocks to the security policy checker. Unlike existing solutions to the untrusted IP problem, which rely on verification of IP trust before they are integrated into an SoC, the proposed approach follows a fundamentally different architecture-level solution based on run-time resilience. We demonstrate the effectiveness of this framework for system protection using several illustrative practical use cases. We also provide experimental results to show that the overhead of the proposed architecture is modest on representative SoC designs.

Field programmable gate arrays (FPGAs) are well-established as fine-grained reconfigurable computing platforms. However, FPGAs demonstrate poor scalability in advanced technology nodes due to the large negative impact of the elaborate programmable interconnects (PIs). The need for such vast PIs arises from two key factors: 1) fine-grained bit-level data manipulation in the configurable logic blocks and 2) the purely spatial computing model followed in the FPGAs. In this paper, we propose ENFIRE, a novel memory-based spatio-temporal framework designed to provide the flexibility of reconfigurable bit-level information processing while improving scalability and energy efficiency. Dense 2-D memory arrays serve as the main computing elements storing not only the data to be processed but also the functional behavior of the application mapped into lookup tables. Computing elements are spatially distributed, communicating as needed over a hierarchical bus interconnect, while the functions are evaluated temporally inside each computing element. A custom software framework facilitates application mapping to the framework. By leveraging both spatial and temporal computing, ENFIRE significantly reduces the interconnect overhead when compared with FPGA. Simulation results show an improvement of 7.6× in energy, 1.6× in energy efficiency, 1.1× in leakage, and 5.3× in unified energy efficiency, a metric that considers energy and area together, compared with comparable FPGA implementations.

A Printed Circuit Board (PCB) provides the backbone for the interconnection of diverse electronic components into an electronic system. Unfortunately, the increased use of untrusted third-party PCB design/fabrication facilities and the long, distributed, supply chain of a PCB makes it extremely vulnerable to variety of integrity violation attacks, primarily different forms of counterfeiting, including cloning and recycling. In this paper, we propose a novel low-overhead and robust method to authenticate PCBs that utilizes an existing industry standard - IEEE 1149.1 or JTAG test infrastructure to extract high-quality signatures with high entropy. Since the signature encapsulates the intrinsic properties of the PCB components, it can be effectively used to identify malicious modifications of PCB components (e.g. replacing a chip) in a supply chain or during field operation. Measurement results with 30 custom fabricated test boards are promising in terms of uniqueness (48.34% inter-PCB hamming distance) and robustness (1.22% intra-PCB Hamming Distance) of 128-bit authentication signature.

Hardware Trojan detection has emerged as a critical challenge to ensure security and trustworthiness of integrated circuits. A vast majority of research efforts in this area has utilized side-channel analysis for Trojan detection. Functional test generation for logic testing is a promising alternative but it may not be helpful if a Trojan cannot be fully activated or the Trojan effect cannot be propagated to the observable outputs. Side-channel analysis, on the other hand, can achieve significantly higher detection coverage for Trojans of all types/sizes, since it does not require activation/propagation of an unknown Trojan. However, they have often limited effectiveness due to poor detection sensitivity under large process variations and small Trojan footprint in side-channel signature. In this paper, we address this critical problem through a novel side-channel-aware test generation approach, based on a concept of Multiple Excitation of Rare Switching (MERS), that can significantly increase Trojan detection sensitivity. The paper makes several important contributions: i) it presents in detail the statistical test generation method, which can generate high-quality testset for creating high relative activity in arbitrary Trojan instances; ii) it analyzes the effectiveness of generated testset in terms of Trojan coverage; and iii) it describes two judicious reordering methods can further tune the testset and greatly improve the side channel sensitivity. Simulation results demonstrate that the tests generated by MERS can significantly increase the Trojans sensitivity, thereby making Trojan detection effective using side-channel analysis.

Systematic implementation of System-on-Chip (SoC) security policies typically involves smart wrappers extracting local security critical events of interest from Intellectual Property (IP) blocks, together with a control engine that communicates with the wrappers to analyze the events for policy adherence. However, developing customized wrappers at each IP for security requirements may incur significant overhead in area and hardware resources. In this paper, we address this problem by exploiting the extensive design-for-debug (DfD) instrumentation already available on-chip. In addition to reduction in the overall hardware overhead, the approach also adds flexibility to the security architecture itself, e.g., permitting use of on-field DfD instrumentation, survivability and control hooks to patch security policy implementation in response to bugs and attacks found at post-silicon or changing security requirements on-field. We show how to design scalable interface between security and debug architectures that provides the benefits of flexibility to security policy implementation without interfering with existing debug and survivability use cases and at minimal additional cost in energy and design complexity.

Field Programmable Gate Arrays (FPGAs) are well-established as fine-grained hardware reconfigurable computing platforms. However, FPGA energy usage is dominated by programmable interconnects, which have poor scalability across different technology generations. In this work, we propose ENFIRE, a novel, energy-efficient, fine-grained, spatio-temporal, memory-based reconfigurable computing framework that provides the flexibility of bit-level information processing, which is not available in conventional coarse-grain reconfigurable architectures (CGRAs). A dense two-dimensional memory array is the main computing element in the proposed framework, which stores not only the data to be processed, but also the functional behavior of a mapped application in the form of lookup tables (LUTs) of various input/output sizes. Spatially distributed configurable computing elements (CEs) communicate with each other based on data dependencies using a mesh network, while execution inside each CE occurs in a temporal manner. A custom software framework has also been co-developed which enables application mapping to a set of CEs. By finding the right balance between spatial and temporal computing, it can achieve a highly energy-efficient mapping, significantly reducing the programmable interconnect overhead when compared with FPGA. Simulation results show an improvement of 7.6X in overall energy, 1.6X in energy efficiency, 1.1X in leakage energy, and 5.3X in Unified Energy-Efficiency, a metric that considers energy and area together, compared with comparable FPGA implementations for a set of random logic benchmarks.

Inherent stochastic physical mechanisms in emerging nonvolatile memories (NVMs), such as resistive random-access-memory (RRAM), have recently been explored for hardware security applications. Unlike the conventional silicon Physical Unclonable Functions (PUFs) that are solely based on manufacturing process variation, RRAM has some intrinsic randomness in its physical mechanisms that can be utilized as entropy sources; for instance, resistance variation, random telegraph noise, and probabilistic switching behaviors. This paper reviews the challenges and opportunities in building security primitives with emerging devices. In particular, it presents research progress of RRAM-based hardware security primitives, including PUF and True Random Number Generator (TRNG).

A hardware Trojan (HT) detection method is presented that is based on measuring and detecting small systematic changes in path delays introduced by capacitive loading effects or series inserted gates of HTs. The path delays are measured using a high resolution on-chip embedded test structure called a time-to-digital converter (TDC) that provides approx. 25 ps of timing resolution. A calibration method for the TDC as well as a chip-averaging technique are demonstrated to nearly eliminate chip-to-chip and within-die process variation effects on the measured path delays across chips. This approach significantly improves the correlation between Trojan-free chips and a simulation-based golden model. Path delay tests are applied to multiple copies of a 90nm custom ASIC chip having two copies of an AES macro. The AES macros are exact replicas except for the insertion of several additional gates in the second hardware copy, which are designed to model HTs. Simple statistical detection methods are used to isolate and detect systematic changes introduced by these additional gates. We present hardware results which demonstrate that our proposed chip-averaging and calibration techniques in combination with a single nominal simulation model can be used to detect small delay anomalies introduced by the inserted gates of hardware Trojans.

We are in the regime of Internet-of-Things (IoT), - a regime characterized by billions of smart, connected computing devices coordinating to provide large-scale, highly personalized applications. Two overriding themes in this regime are energy consumption and security enforcement, which are both critical to the sustainability and proliferation of the IoT ecosystem. However, energy and security requirements are often at odds. This paper discusses several challenges in developing trustworthy IoT devices that comprehend the energy-security trade-offs. We also outline some emergent approaches to address this conflict.

Internet of Things (IoT) is becoming prevalent in almost all aspects of our daily lives as well as in critical, infrastructures. The widely usage of IoT also breeds security and privacy concerns. In this session, we will discuss IoT security challenges related to unique validation challenges, low-cost IoT authentication solutions, and design for security in IoT space.

Security has emerged as a critical need in today's computer applications. Unfortunately, most security algorithms are computationally expensive and often do not map efficiently to general purpose processors. Fixed-function accelerators offer significant improvement in energy-efficiency, but they do not allow more than one application to reuse hardware resources. Mapping applications to generic reconfigurable fabrics can achieve the desired flexibility, but at the cost of area and energy efficiency. This paper presents a novel reconfigurable framework, referred to as hardware accelerator for security kernel (HASK), for accelerating a wide array of security applications. This framework incorporates a coarse-grained datapath, supports for lookup functions, and flexible interconnect optimizations, which enable on-demand pipelining and parallel computations in multiple ultralight-weight processing elements. These features are highly effective for energy-efficient operation in a diverse set of security applications. Through simulations, we have compared the performance of HASK to software and field programmable gate array (FPGA) platforms. Simulation results for a set of six common security applications show comparable latency between HASK and FPGA with 2.5X improvement in energy-delay product and 4X improvement in iso-area throughput. HASK also shows 5X improvement in iso-area throughput and 45X improvement in energy-delay product compared to optimized software implementations.

The rapidly growing incidences of counterfeit integrated circuits (ICs) pose a significant threat to the semiconductor industry. These ICs may suffer from functional, performance, or reliability issues and can affect chip manufacturers, system designers as well as end users. The standard chip/package level structural and functional tests are often inadequate in detecting various forms of counterfeit ICs. Moreover, existing design for security approaches are usually not attractive due to additional design modifications, hardware overhead, test cost, and inadequate robustness. In this paper, we propose a novel, low-overhead package-level IC integrity validation approach, referred to as P-Val, for unified protection against two primary forms of counterfeiting attacks: 1) recycling and 2) cloning. Protection against recycled/remarked chips is achieved through a unique active defense that inserts antifuses (AFs) (one-time programmable) to few select pins inside the package. It effectively disables the functionality or “locks” these pins, which need to be programmed before first-time use to make a chip functional in a system. To protect against cloned ICs, intrinsic random variations in programmed resistances of AFs connected to some of the remaining IC pins are exploited to create unique chip-specific signatures for authentication. P-Val requires no die-level design modifications and remains effective for legacy designs. Moreover, we show that it is effective for small chips with just few pins including analog ICs, where common authentication approaches fail to work. We discuss optimal choice of AF structure and program parameters; their integration in IC packages; and the signature generation/verification process. Through mathematical analysis and simulation results, we demonstrate that the proposed mechanism provides high level of protection against counterfeiting attacks at ultralow overhead (<0.05% package area).

Counterfeit chips in the supply chain as well as hardware Trojan (HT) attacks pose serious threats to the semiconductor industry. If undetected before deployment, they can lead to serious consequences including system performance/reliability issues during field operation and potential revenue/reputation loss for a trusted manufacturer. Currently, no unified detection method is available that can simultaneously address these integrity violations in integrated circuits (ICs). In addition, most existing detection approaches require a set of golden chips as a reference, which significantly increases the test cost and complexity. Furthermore, in some scenarios, it may be extremely difficult to obtain golden chips. In this paper, we present a novel unified IC integrity analysis approach that can effectively detect both recycled counterfeit ICs (the most dominant form of counterfeiting) as well as Trojan attacks in ICs without the need of golden chips. The proposed approach, referred to as self-similarity-based microchip integrity analysis (SeMIA), exploits intrinsic structural self-similarity in a design (e.g., multiple cores, multiple functional units of the same type, different parts of an adder) to isolate recycled chips and HT attacks under large inter- and intra-die process variations. It compares dynamic current (${I} _{\text {DDT}}$) signatures between two adjacent similar circuit structures using an appropriate isolation metric to detect such attacks with high degree of confidence. SeMIA does not rely on any embedded structure for authentication, thus it comes at virtually zero hardware overhead and can be applied to chips already produced. Through extensive simulations, we show that for 15% inter- and 10% intra-die variations in threshold voltage for a 45 nm CMOS process, over 98% of recycled chips can be reliably identified. Finally, experimental measurements on field programmable gate array chips demonstrate effectiveness of SeMIA for protection against both attacks.

The production and sale of counterfeit and substandard pharmaceutical products, such as essential medicines, is an important global public health problem. We describe a chemometric passport-based approach to improve the security of the pharmaceutical supply chain. Our method is based on applying nuclear quadrupole resonance (NQR) spectroscopy to authenticate the contents of medicine packets. NQR is a non-invasive, non-destructive, and quantitative radio frequency (RF) spectroscopic technique. It is sensitive to subtle features of the solid-state chemical environment and thus generates unique chemical fingerprints that are intrinsically difficult to replicate. We describe several advanced NQR techniques, including two-dimensional measurements, polarization enhancement, and spin density imaging, that further improve the security of our authentication approach. We also present experimental results that confirm the specificity and sensitivity of NQR and its ability to detect counterfeit medicines.

Given the increasing complexity of modern electronics and the cost of fabrication, entities from around the globe have become more heavily involved in all phases of the electronics supply chain. In this environment, hardware Trojans (i.e., malicious modifications or inclusions made by untrusted third parties) pose major security concerns, especially for those integrated circuits (ICs) and systems used in critical applications and cyber infrastructure. While hardware Trojans have been explored significantly in academia over the last decade, there remains room for improvement. In this article, we examine the research on hardware Trojans from the last decade and attempt to capture the lessons learned. A comprehensive adversarial model taxonomy is introduced and used to examine the current state of the art. Then the past countermeasures and publication trends are categorized based on the adversarial model and topic. Through this analysis, we identify what has been covered and the important problems that are underinvestigated. We also identify the most critical lessons for those new to the field and suggest a roadmap for future hardware Trojan research.

Text mining is a growing field of applications, which enables the analysis of large text data sets using statistical methods. In recent years, exponential increase in the size of these data sets has strained existing systems, requiring more computing power, server hardware, networking interconnects, and power consumption. For practical reasons, this trend cannot continue in the future. Instead, we propose a reconfigurable hardware accelerator designed for text analytics systems, which can simultaneously improve performance and reduce power consumption. Situated near the last level of memory, it mitigates the need for high-bandwidth processor-to-memory connections, instead capitalizing on close data proximity, massively parallel operation, and analytic-inspired functional units to maximize energy efficiency, while remaining flexible to easily map common text analytic kernels. A field-programmable gate array-based emulation framework demonstrates the functional correctness of the system, and a full eight-core accelerator is synthesized for power, area, and delay estimates. The accelerator can achieve two to three orders of magnitude improvement in energy efficiency versus CPU and general-purpose graphics processing unit (GPU) for various text mining kernels. As a case study, we demonstrate how indexing performance of Lucene, a popular text search and analytics platform, can be improved by an average of 70% over CPU and GPU while significantly reducing data transfer energy and latency.

Physical unclonable function (PUF) has emerged as an attractive primitive to address diverse hardware security issues in integrated circuits, such as authentication and cryptographic key generation. Most of the existing PUFs rely on dedicated circuit structure for generating random signatures. It often causes concerns due to extra design efforts and hardware overhead. Moreover, the hardware complexity increases with higher entropy requirement, which may be unacceptable in area-constrained applications. In this paper, we propose DScanPUF, a novel PUF structure that leverages on the scan chain, a prevalent design-for-test structure in a chip. It is based on a low-overhead delay measurement structure consisting of a phase-locked loop and multiple clock delay lines to measure scan path delays at high resolution. A method is proposed to transform the responses into robust binary signatures. We note that the area of DScanPUF is only 18% of the ring-oscillator (RO) PUF with 1024 ROs. Moreover, it can be easily integrated into a design without any influence on testability. DScanPUF is evaluated with test results from 31 field-programmable gate array chips, which show good randomness, uniqueness and reproducibility under temperature, and supply voltage fluctuations. We also show that the signature is robust under aging effects on scan paths through a simulation at 45-nm CMOS process. Finally, we propose a simple structural modification to further improve the signature robustness.

Spin-Transfer Torque Random Access Memory (STTRAM) is a possible candidate for universal memory due to its high-speed, low-power, non-volatility, and low cost. Although attractive, STTRAM is susceptible to contactless tampering through malicious exposure to magnetic field with the intention to steal or modify the bitcell content. In this paper, for the first time to our knowledge, we analyze the impact of magnetic attacks on STTRAM using micro-magnetic simulations. Next, we propose a novel array-based sensor to detect the polarity and magnitude of such attacks and then propose two design techniques to mitigate the attack, namely, array sleep with encoding and variable strength Error Correction Code (ECC). Simulation results indicate that the proposed sensor can reliably detect an attack and provide sufficient compensation window (few ns to ~100us) to enable proactive protection measures. Finally, we shows that variable-strength ECC can adapt correction capability to tolerate failures with various strength of an attack.

We consider the conflicts between requirements from security and post-silicon validation in SoC designs. Post-silicon validation requires hardware instrumentations to provide observability and controllability during on-field execution; this in turn makes the system prone to security vulnerabilities, resulting in potentially subtle security exploits. Mitigating such threats while ensuring that the system is amenable to post-silicon validation is challenging, involving close collaboration among security, validation, testing, and computer architecture teams. We examine the state of the practice in this area, the trade-offs and compromises made, and their limitations. We also discuss an emerging approach that we are contemplating to address this problem.

Modern SoC designs incorporate several security policies to protect sensitive assets from unauthorized access. The policies affect multiple design blocks, and may involve subtle interactions between hardware, firmware, and software. This makes it difficult for SoC designers to implement these policies, and system validators to ensure adherence. Associated problems include complexity in upgrading these policies, IP reuse for systems targeted for markets with differing security requirement, and consequent increase in design time and time-to-market. In this paper, we address this important problem by developing a generic, flexible architectural framework for implementing arbitrary security policies in SoC designs. Our architecture has several distinctive features: (1) it relies on a dedicated, centralized, firmware-upgradable plug-and-play IP block that can implement diverse security policies; (2) it interfaces with individual IP blocks through their “security wrapper”, which exploits and extends test/debug wrappers; (3) it implements a security policy as firmware code following existing security policy languages; (4) it can implement any security policy as long as relevant observable and controllable signals from the constituent IPs are accessible through the security wrappers; and (5) it realizes a low-overhead communication link between security wrappers of IP blocks and the centralized, dedicated controller. The approach builds on and extends the recent work on developing a centralized infrastructure IP for SoC security, referred to as IIPS, that interface with IP blocks using their boundary scan based wrappers. While this architecture is generic and independent of security policy types, we provide case studies with several common policies to show the flexibility and extendibility of the architecture. We also evaluate its viability in terms of overhead in area and power.

The rapidly rising incidences of counterfeit Integrated Circuits (ICs) including cloning attacks pose a significant threat to the semiconductor industry. Conventional functional/structural testing are mostly ineffective to identify different forms of cloned ICs. On the other hand, existing design for security (DfS) measures are often not attractive due to additional design effort, hardware overhead and test cost. In this paper, we propose a novel robust IC authentication approach, referred to as PiRA, to validate the integrity of ICs in presence of cloning attacks. It exploits intrinsic random variations in pin resistances across ICs to create unique chip-specific signatures for authentication. Pin resistance is defined as the resistance looking into or out the pin according to set parameters and biasing conditions, measured by standard tests for IC defect/performance analysis such as input leakage, protection diode and output load current tests. A major advantage of PiRA over existing methodologies is that it incurs virtually zero design effort and overhead. Furthermore, unlike most authentication approaches, it works for all chip types including analog/mixed-signal ICs and can be applied to legacy designs. Theoretical analysis as well as experimental measurements with common digital and analog ICs verify the effectiveness of PiRA.

The long and distributed supply chain of printed circuit boards (PCBs) makes them vulnerable to different forms of counterfeiting attacks. Existing chip-level integrity validation approaches cannot be readily extended to PCB. In this paper, we address this issue with a novel PCB authentication approach that creates robust, unique signatures from a PCB based on process-induced variations in its trace impedances. The approach comes at virtually zero design and hardware overhead and can be applied to legacy PCBs. Experiments with two sets of commercial PCBs as well as a set of custom designed PCBs show that the proposed approach can obtain unique authentication signature with inter-PCB hamming distance of 47.94% or higher.

Content-addressable memory (CAM) and associative memory (AM) are types of storage structures that allow searching by content as opposed to searching by address. Such memory structures are used in diverse applications ranging from branch prediction in a processor to complex pattern recognition. In this paper, we review the emerging challenges and opportunities in implementing different varieties of CAM/AM structures. Beyond-CMOS silicon and nonsilicon memory technologies hold significant promise in implementing dense, fast, and energy-efficient CAM/AM structures. We describe circuit/architecture level implementations of CAM/AM using these technologies, as well as novel applications in different domains, including informatics, text analytics, data mining, and reconfigurable computing platforms.

Security is becoming an increasingly important parameter in current system-on-chip (SoC) design due to diverse hardware security attacks that can affect manufacturers, system designers or end users. To effectively address the security issues, design-time considerations, e.g. incorporation of design-for-security (DfS) features, are becoming essential. However, DfS measures for diverse security threats require specific design modifications to achieve target security level, which significantly increases design effort thus time-to-market, and usually incurs considerable design overhead. In addition, the general heterogeneous architecture of current SoCs makes many core-level DfS mechanisms unusable at SoC level. In this paper, we propose a centralized on-chip infrastructure IP for SoC security (IIPS), which alleviates the SoC designers from separately addressing different security issues through design modifications in multiple cores. It also provides ease of integration and functional scalability. We consider a specific implementation of IIPS that provides protection against: (1) scan-based attack for information leakage through low-overhead authentication; (2) counterfeiting attacks through integration of a Physical Unclonable Function (PUF); and (3) hardware Trojan attacks through a test infrastructure fortrust validation. To make the IP amenable for plug-and-play during SoC design, working protocols of the security functions are designed to comply with IEEE 1500 Standard for Embedded Core Test (SECT). Since IIPS resides outside the functional modules, it does not incur functional performance or power overhead. Simulations and experiments on example SoC designs validate the effectiveness of IIPS in providing protections against diverse attacks at a low hardware overhead.

Creating backdoors in integrated circuits (ICs), stealing hardware intellectual property, counterfeiting electronic components, reverse engineering ICs, and injecting malware in ICs are no longer nation state acts requiring specialized, expensive, and unlimited resources. Democratization of IC design has created numerous opportunities for rogues throughout the IC supply chain to inflict these attacks with aplomb and for a variety of reasons: personal gain, economic harm, economic gain, bringing disrepute, and sheer fun among others.

For data-intensive applications, energy expended in on-chip computation constitutes only a small fraction of the total energy consumption. The primary contribution comes from transporting data between off-chip memory and on-chip computing elements-a limitation referred to as the Von-Neumann bottleneck. In such a scenario, improving the compute energy through parallel processing or on-chip hardware acceleration brings minor improvements to the total energy requirement of the system. We note that an effective solution to mitigate the Von-Neumann bottleneck is to develop a framework that enables computing in off-chip nonvolatile memory arrays, where the data reside permanently. In this paper, we present a malleable hardware (MAHA) reconfigurable framework that modifies nonvolatile CMOS-compatible flash memory array for on-demand reconfigurable computing. MAHA is a spatio-temporal mixed-granular hardware reconfigurable framework, which utilizes the memory for storage as well as lookup table-based computation (hence malleable) and uses a low-overhead hierarchical interconnect fabric for communication between processing elements. A detailed design of the malleable hardware together with a comprehensive application mapping flow is presented. Design overheads carefully estimated at the 45-nm technology node indicate that for a set of common kernels, MAHA achieves a 91X improvement in energy efficiency over a software-only solution with negligible impact on memory performance in normal mode. The proposed design changes incur only 6% memory area overhead.

Counterfeit chips in a supply chain have emerged as a major security concern in the semiconductor industry with serious potential consequences (such as performance degradation, revenue, and reputation loss). With rising incidences of this attack, wide-spread effort has been made in both industry and academia to develop effective countermeasures. However, existing solutions to protect against these attacks suffer from both robustness issue (in terms of detecting chips with minor functional/structural deviations) as well as design/area overhead and test cost. In addition, they cannot reliably detect different forms of cloning attacks. In this paper, we propose a novel characterization method to identify counterfeit chips - in particular, the cloned ones - based on extraction of scan path delay signatures of a chip. It uses the scan chain, a prevalent design-for-testability structure, to create a robust authentication signature. The proposed approach has two major advantages: 1) it comes at virtually zero design and hardware overhead, since it does not require any additional embedded structure; and 2) it alleviates the design house from characterizing each manufactured chip instance, thus mitigating test cost. In addition, a novel and practical method based on clock phase sweep is proposed to measure delay of short scan paths with high resolution. Using Monte Carlo simulation on the layouts of two ISCAS-89 benchmarks at 45-nm CMOS process, we observe that over 99% of counterfeit chips can be reliably identified even under large process variations. Effectiveness of the approach is also validated with delay measurements in field programmable gate array chips.

Rising incidences of counterfeit chips in the supply chain have posed a serious threat to the semiconductor industry. Recycling of used chips constitutes a major form of counterfeiting attacks. If undetected, they can lead to serious consequences including system performance/reliability issues during field operation and potential revenue/reputation loss for a trusted manufacturer. Existing validation approaches based on path delay analysis suffer from reduced robustness and sensitivity under large process variations. On the other hand, existing design solutions based on aging sensors require additional design/verification efforts and cannot be applied to legacy chips. In this paper, we present a novel recycled chip identification approach, CACI, that exploits differential aging in self-similar modules (e.g., different parts of an adder) to isolate aged chips under large inter- and intra-die process variations. It compares dynamic current (IDDT) signatures between two adjacent similar circuit structures in a chip. We derive an isolation metric based on multiple current comparisons to provide high level of confidence. CACI does not rely on any embedded structures for authentication, thus it comes at virtually zero design overhead and can be applied to chips already in the market. Through extensive simulations, we show that for 15% inter- and 10% intra-die variations in threshold voltage for a 45nm CMOS process, over 97% of recycled chips can be reliably identified.

Growing number of important application areas, including automotive and industrial applications as well as space, avionics, combustion engine, intelligent propulsion systems, and geo-thermal exploration require electronics that can work reliable at extreme conditions - in particular at a temperature > 250°C and at high radiation (1-30 Mrad), where conventional electronics fail to work reliably. Traditionally, existing wideband-gap semiconductors, e.g., silicon carbide (SiC) transistor-based electronics have been considered most viable for high temperature and high radiation applications. However, the large-size, high threshold voltage, low switching speed and high leakage current make logic design with these devices unattractive. Additionally, the leakage current markedly increases at high temperature (in the range of 10 μA for a 2-input NAND gate), which induces self-heating effect and makes power delivery at high temperature very challenging. To address these issues, in this paper we present a computing platform for low-power reliable operation at extreme environment using SiC electromechanical switches. We show that a device-circuit-architecture co-design approach can provide reliable long-term operation with virtually zero leakage power.

Energy-efficiency has emerged as a major barrier to performance scalability for modern processors. We note that significant part of processor's energy requirement is contributed by processor-memory communication. To address the energy issue in processors, we propose a novel hardware accelerator framework that transforms high-density memory array into a configurable computing resource to accelerate variety of tasks - both compute- and data-intensive. It exploits the block-based architecture of nanoscale memory to create a spatially connected array of lightweight processors, each of which uses a memory block as its local memory. The proposed framework provides some unique advantages for hardware acceleration compared to conventional accelerators: 1) memory array provides large set of parallel resources with high bandwidth, which can be configured to perform computing in spatio/temporal manner leading to dramatic reduction in processor-memory traffic; 2) it brings the computing engine close to the data, thus drastically minimizing the von Neumann bottleneck; 3) finally, it exploits the advances in memory technologies and integration approaches e.g. 3D integration to achieve better technology scalability compared to alternative reconfigurable accelerator platforms. Simulation results for several data-intensive applications show that the proposed computing approach provides significant improvement in energy-efficiency compared to software while achieving significantly lower hardware overhead.

Reconfigurable hardware including Field programmable gate arrays (FPGAs) are being used in a wide range of embedded applications including signal processing, multimedia, and security. FPGA device production is often outsourced to off-shore facilities for economic reasons. This opens up the opportunities for insertion of malicious design alterations in the foundry, referred to as hardware Trojan attacks, to cause logical and physical malfunction. The vulnerability of these devices to hardware attacks raises security concerns regarding hardware and design assurance. In this paper, we analyze hardware Trojan attacks in FPGA considering diverse activation and payload characteristics and derive a taxonomy of Trojan attacks in FPGA. To our knowledge, this is the first effort to analyze Trojan threats in FPGA hardware. Next, we propose a novel redundancy-based protection approach based on Trojan tolerance that modifies the application mapping process to provide high-level of protection against Trojans of varying forms and sizes. We show that the proposed approach incurs significantly higher security at lower overhead than conventional fault-tolerance schemes by exploiting the nature of Trojans and reconfiguration of FPGA resources.

Energy efficiency has emerged as a major design concern for embedded and portable electronics. Conventional approaches typically impact performance and often require significant design-time modifications. In this paper, we propose a novel approach for improving energy efficiency through judicious fusion of operations. The proposed approach has two major distinctions: (1) the fusion is enabled by operand truncation, which allows representing multiple operations into a reasonably sized lookup table (LUT); and (2) it works for large varieties of functions. Most applications in the domain of digital signal processing (DSP) and graphics can tolerate some computation error without large degradation in output quality. Our approach improves energy efficiency with graceful degradation in quality. The proposed fusion approach can be applied to trade-off energy efficiency with quality at run time and requires virtually no circuit or architecture level modifications in a processor. Using our software tool for automatic fusion and truncation, the effectiveness of the approach is studied for four common applications. Simulation results show promising improvements (19-90\%) in energy delay product with minimal impact on quality.

Stability across environmental variations such as temperature and voltage, is critically important for Physically Unclonable Functions (PUFs). Nearly all existing PUF systems to date need a mechanism to deal with “bit flips” when exact regeneration of the bitstring is required, e.g., for cryptographic applications. Error correction (ECC) and error avoidance schemes have been proposed but both of these require helper data to be stored for the regeneration process. Unfortunately, helper data adds time and area overhead to the PUF system and provides opportunities for adversaries to reverse engineer the secret bitstring. In this paper, we propose a non-volatile memory-based (NVM) PUF that is able to avoid bit flips without requiring any type of helper data. A voltage-to-digital converter technique is described for digitizing the analog entropy source and a robust median-finding algorithm is proposed as the reprograming strategy. Analysis on published experimental data is presented to demonstrate the practicability of our proposed strategy. We describe the technique in the context of emerging nano-devices, in particular, resistive random access memory (Memristor) cells, but the methodology is applicable to any type of NVM including Flash.

The rapidly rising incidences of counterfeit Integrated Circuits (ICs) in the semiconductor supply chain pose a significant threat to the electronic industry. These ICs may suffer from functional, performance or reliability issues and can affect design houses, chip manufacturers, system designers as well as end users. The standard chip/package/system level tests are often inadequate in detecting various forms of counterfeit ICs. On the other hand, design approaches that enable IC authentication are often not attractive due to significant design effort, hardware overhead and test cost. In this paper, we propose a novel defense against counterfeiting attacks through a “chip locking approach”, where an IC is made non-operational by locking select pins through insertion of Antifuse (AF) devices in input/output circuitry. It can be unlocked through application of a hard-to-clone key. The key is internally stored in a onetime programmable non-volatile memory. The key storage and comparison circuit is protected against reverse engineering and side-channel analysis attacks. Through mathematical analysis and simulation results, we demonstrate that the proposed mechanism provides high level of protection against all major forms of counterfeiting attacks (reselling, remarking and cloning) at ultralow overhead (<; 0.01% area).

Security of a computer system has been traditionally related to the security of the software or the information being processed. The underlying hardware used for information processing has been considered trusted. The emergence of hardware Trojan attacks violates this root of trust. These attacks, in the form of malicious modifications of electronic hardware at different stages of its life cycle, pose major security concerns in the electronics industry. An adversary can mount such an attack with an objective to cause operational failure or to leak secret information from inside a chip-e.g., the key in a cryptographic chip, during field operation. Global economic trend that encourages increased reliance on untrusted entities in the hardware design and fabrication process is rapidly enhancing the vulnerability to such attacks. In this paper, we analyze the threat of hardware Trojan attacks; present attack models, types, and scenarios; discuss different forms of protection approaches, both proactive and reactive; and describe emerging attack modes, defenses, and future research pathways.

Field-programmable gate arrays (FPGAs) are being increasingly used as a preferred prototyping and accelerator platform for diverse application domains, such as digital signal processing (DSP), security, and real-time multimedia processing. However, mapping of these applications to FPGA typically suffers from poor energy efficiency because of high energy overhead of programmable interconnects (PI) in FPGA devices. This paper presents an energy-efficient heterogenous application mapping framework in FPGA, where the conventional application mappings to logic and DSP blocks (for DSP-enhanced FPGA devices) are combined with judicious mapping of specific computations to embedded memory blocks. A complete mapping methodology including functional decomposition, fusion, and optimal packing of operations is proposed and efficiently used to reduce the large energy overhead of PIs. Effectiveness of the proposed methodology is verified for a set of common applications using a commercial FPGA system. Experimental results show that the proposed heterogenous mapping approach achieves significant energy improvement for different input bit-widths (e.g., more than 35% of energy savings with 8 bit or smaller bit inputs compared to the corresponding mapping in configurable logic blocks). For further reduction of energy, we propose an energy/accuracy tradeoff approach, where the input operand bit-width is dynamically truncated to reduce memory area and energy at the expense of modest degradation in output-accuracy. We show that using a preferential truncation method, up to 88.6% energy savings can be achieved in a 32-tap finite impulse response filter with modest impact on the filter performance.

Static random access memory arrays designed in sub-90-nm technologies are highly vulnerable to process variation-induced read/write/access failures. In memory-based reconfigurable computing frameworks, which use large high-density memory array, such failures lead to incorrect execution of mapped applications. It causes loss in quality of service (QoS) for digital signal processing (DSP) applications. In this paper, we analyze the effect of parameter variations on QoS in a memory-based reconfigurable computing framework. Next, we propose a preferential design approach at both application mapping and circuit level, which can significantly improve QoS and yield under large parameter variations. The proposed application mapping process considers the reliability map of a memory array and maps the important components with respect to QoS to more reliable memory blocks under performance constraint. At circuit level, we exploit the read-dominant memory access pattern to skew the memory cells for better read stability leading to improved QoS. Such a architecture/circuit codesign approach can also tolerate increased failure rate at low operating voltage, thus facilitating low-power operation. The effect of the approach is studied for two common DSP applications, namely discrete cosine transform and finite-impulse response (FIR) filter. The simulation results for FIR application show 45% improvement in power at iso-QoS and 47% in yield for a target peak signal to noise ratio at 45-nm technology.

Physical Unclonable Functions (PUFs) have emerged as an attractive primitive to address diverse hardware security issues, such as chip authentication, intellectual property (IP) protection and cryptographic key generation. Existing PUFs, typically acquired and integrated in a design as a commodity, often incur considerable hardware overhead. Many of these PUFs also suffer from insufficient challenge-response pairs. In this paper, we propose ScanPUF, a novel PUF implementation using a common on-chip structure used for improving circuit testability, namely scan chain. It exploits path delay variations between the scan flip-flops in a scan chain to create high-quality (in terms of uniqueness and robustness) secret keys. Furthermore, since a scan chain provides large pool of scan paths to create a signature, we can achieve high volume of secret keys from each chip. Since it uses a prevalent on-chip structure, the overhead is extremely small (2.3% area of the RO-PUF), primarily contributed by small additional logic in the signature-generation cycle controller. Circuit-level simulation results with 1000 chips under inter- and intra-die process variations show high uniqueness of 49.9% average inter-die Hamming distance and good reproducibility of 5% intra-die Hamming distance below 85 °C. The temporal variations due to device aging effect e.g. bias temperature instability (BTI) lead to only 4% unstable bits for ten-year usage. The experimental evaluation on FPGA (Altera Cyclone-III) exhibits 47.1% average inter-Hamming distance, as well as 3.2% unstable bits at room temperature.

Side-channel attack (SCA) is a method in which an attacker aims at extracting secret information from crypto chips by analyzing physical parameters (e.g. power). SCA has emerged as a serious threat to many mathematically unbreakable cryptography systems. From an attacker's point of view, the difficulty of mounting SCA largely depends on Signal-to-Noise Ratio (SNR) of the side-channel information. It has been shown that SNR primarily depends on algorithmic and circuit-level implementation, measurement noise, as well as device thermal noise. However, to the best of our knowledge, there has not been any study on the effect of power delivery network (PDN) on SCA resistance. We note that the PDN plays a significant role in SNR of measured supply current. Furthermore, SCA resistance strongly depends on the operating frequency due to RLC structure of a power grid. In this paper, we analyze the effect of power grid on SCA and provide quantitative results to demonstrate the frequency-dependent SCA resistance due to PDN-induced noise. This property can potentially be exploited by an attacker to facilitate the attack by operating a device at favorable frequency points. On the other hand, from a designer's perspective, one can explore countermeasures to secure the device at all operating frequencies while minimizing the design overhead. Based on this observation, we propose a frequency-dependent noise-injection based compensation technique to efficiently protect against SCA. Simulation results using realistic PDN model as well as experimental measurements using FPGA test board validate the observations on role of PDN in SCA and the efficacy of the proposed compensation approach.

Physical Unclonable Functions (PUFs) have emerged as an attractive primitive to address diverse hardware security issues in Integrated Circuits (ICs). A majority of existing PUFs rely on a dedicated circuit structure for generating chip-specific signatures, which often imposes concerns due to area/power overhead and extra design efforts. Furthermore, existing PUF-based signature generation cannot be employed to authenticate chips already in the market. In this paper, we propose RESP, a novel PUF structure realized in embedded SRAM array, a prevalent component in processors and system-on-chips (SOCs), with virtually no design modification. RESP leverages on voltage-depend memory access failures (during write) to produce large volume of high-quality challenge-response pairs. Since many modern ICs integrate SRAM array of varying size with isolated power grid, RESP can be easily retrofitted into these chips. Circuit-level simulation of 1000 chips using realistic process variation model shows high uniqueness of 49.2% average inter-die Hamming distance and good reproducibility of 2.88% intra-die Hamming distance under temperature < 85°C. The device aging effect, e.g. bias temperature instability (BTI), results in only 4.95% estimated unstable bits for ten-year usage.

Hardware Trojan attack in the form of malicious modification of a design has emerged as a major security threat. Sidechannel analysis has been investigated as an alternative to conventional logic testing to detect the presence of hardware Trojans. However, these techniques suffer from decreased sensitivity toward small Trojans, especially because of the large process variations present in modern nanometer technologies. In this paper, we propose a novel noninvasive, multiple-parameter side-channel analysisbased Trojan detection approach. We use the intrinsic relationship between dynamic current and maximum operating frequency of a circuit to isolate the effect of a Trojan circuit from process noise. We propose a vector generation approach and several design/test techniques to improve the detection sensitivity. Simulation results with two large circuits, a 32-bit integer execution unit (IEU) and a 128-bit advanced encryption standard (AES) cipher, show a detection resolution of 1.12 percent amidst ±20 percent parameter variations. The approach is also validated with experimental results. Finally, the use of a combined side-channel analysis and logic testing approach is shown to provide high overall detection coverage for hardware Trojan circuits of varying types and sizes.

Memory-based computing (MBC) is promising for improving performance and energy efficiency in both data- and compute-intensive applications. In this paper, we propose a novel reconfigurable MBC framework for multicore architectures where each core uses caches for computation using Look Up Tables (LUTs). Experimental results demonstrate that on-demand memory-based computing in each core can significantly improve performance (up to 4.7X, 3.3X on average) as well as reduce energy consumption (up to 4.7X, 2X on average) in multicore architectures.

No abstract available.

Modern hardware and software implementations of cryptographic algorithms are subject to multiple sophisticated attacks, such as differential power analysis (DPA) and fault-based attacks. In addition, modern integrated circuit (IC) design and manufacturing follows a horizontal business model where different third-party vendors provide hardware, software and manufacturing services, thus making it difficult to ensure the trustworthiness of the entire process. Such business practices make the designs vulnerable to hard-to-detect malicious modifications by an adversary, termed as “Hardware Trojans”. In this paper, we show that malicious nexus between multiple parties at different stages of the design, manufacturing and deployment makes the attacks on cryptographic hardware more potent. We describe the general model of such an attack, which we refer to as Multi-level Attack, and provide an example of it on the hardware implementation of the Advanced Encryption Standard (AES) algorithm, where a hardware Trojan is embedded in the design. We then analytically show that the resultant attack poses a significantly stronger threat than that from a Trojan attack by a single adversary. We validate our theoretical analysis using power simulation results as well as hardware measurement and emulation on a FPGA platform.

Many industrial systems, sensors and advanced propulsion systems demand electronics capable of functioning at high ambient temperature in the range of 500-600°C. Conventional Si-based electronics fail to work reliably at such high temperature ranges. In this paper we propose, for the first time, a high-temperature reconfigurable computing platform capable of operating at temperature of 500°C or higher. Such a platform is also amenable for reliable operation in high-radiation environment. The hardware reconfigurable platform follows the interleaved architecture of conventional Field Programmable Gate Array (FPGA) and provides the usual benefits of lower design cost and time. However, high-temperature operation is enabled by choice of a special device material, namely silicon carbide (SiC), and a special switch structure, namely Nano-Electro-Mechanical-System (NEMS) switch. While SiC provides excellent mechanical and chemical properties suitable for operation at extreme harsh environment, NEMS switch provides low-voltage operation, ultra-low leakage and radiation hardness. We propose a novel multi-layer NEMS switch structure and efficient design of each building block of FPGA using nanoscale SiC NEMS switches. Using measured switch parameters from a number of SiC NEMS switches we fabricated, we compare the power, performance and area of an all-mechanical FPGA with alternative implementations for several benchmark circuits.

Conventional Field Programmable Gate Array (FPGA) architectures leverage on the purely spatial computing model where a design is realized in the form of a small multiple-input single-output lookup tables (LUTs) connected through programmable interconnect switches. However, such a model incorporates an elaborate programmable interconnect network which becomes a major performance bottleneck and leads to poor scalability across process technology nodes. In this paper we evaluate an alternative two-dimensional static random access memory (SRAM) array based reconfigurable computing fabric, referred to as "Memory Based Computing" (MBC) that departs from a purely spatial architecture by advocating multi-cycle evaluation at each computational element. Within a computational element, it uses a dense two-dimensional SRAM array to map large multi-input multi-output functions as LUT and evaluate them in time-multiplexed topological fashion. Multi-cycle execution at each computing node is accomplished using a local interconnect architecture. The proposed framework substantially reduces the requirement for global interconnects by folding computational resources onto a single computational element. We explore the design space for MBC to optimize the major design parameters and compare the performance, power dissipation and energy-delay product for benchmark applications between MBC and conventional SRAM-based FPGA. Simulation results show that compared to a clustered FPGA model, the proposed framework achieves 57% improvement in performance, 30% improvement in Energy Delay Product (EDP) and 10% improvement in technological scalability of performance for standard benchmark circuits. Finally, we validate the functionality of MBC framework and timing of different operations by mapping several small applications on a Cyclone III FPGA platform from Altera.

Various design-for-security (DFS) approaches have been proposed earlier for detection of hardware Trojans, which are malicious insertions in Integrated Circuits (ICs). In this paper, we highlight our major findings in terms of innovative Trojan design that can easily evade existing Trojan detection approaches based on functional testing or side-channel analysis. In particular, we illustrate design and placement of sequential hardware Trojans, which are rarely activated/observed and incur ultralow delay/power overhead. We provide models, examples, theoretical analysis of effectiveness, and simulation as well as measurement results of impact of these Trojans in a hardened design. It is shown that efficient design and placement of sequential Trojan would incur extremely low side-channel (power, delay) signature and hence, can easily evade both post-silicon validation and DFS (e.g. ring oscillator based) approaches.

With increasing parameter variations in nanometer technologies, on-chip cache in processor is becoming highly vulnerable to runtime failures induced by “soft error,” voltage, or thermal noise and aging effects. Nondeterministic and unreliable memory operation due to these runtime failures can be addressed by: 1) designing the memory for worst-case scenarios and/or 2) runtime error detection and correction. Worst-case guard-banding can lead to overly pessimistic results for cell footprint and power. On the other hand, conventional error correcting code (ECC) used in processor cache has very limited correction capability, making it insufficient to protect memory in scaled technologies (sub-45 nm), which are vulnerable to multiple-bit failures in a word (64-bit). The requirement to tolerate multibit failures is accentuated with supply voltage scaling for low-power operation. We note that due to inter and intra-die parameter variations, different memory blocks move to different reliability corners. A uniform ECC protection for all memory blocks fails to account for the distribution of vulnerability across memory blocks. On the other hand, it can lead to overly pessimistic results if the worst-case vulnerability of a memory block is accounted for during ECC allocation. In this paper, we propose a reliability-driven ECC allocation scheme that matches the relative vulnerability of a memory block (determined using postfabrication characterization) with appropriate ECC protection. We achieve postfabrication variable ECC allocation by storing the check bits in the “ways” of an associative cache. We use shortened Bose-Chaudhuri-Hocquenghem (BCH) cyclic code with zero padding, which provides high random error correction capability with modest amount of check bits. Moreover, we propose efficient circuit/architecture-level optimizations of the ECC encoding/decoding logic to minimize the impact on area, performance, and energy. Simulation results for SPEC2000 benchmarks show that such a variable ECC scheme tolerates high failure rates with negligible performance (four percent) and area (0.2 percent) penalty.

VLSI systems in the nanometer regime suffer from high defect rates and large parametric variations that lead to yield loss as well as reduced reliability of operation. An architectural framework that ensures proper system operation when few functional units are defective or unreliable under process-induced or temporal parametric variations can be effective in improving manufacturing yield and overall system reliability. In this paper, we propose a novel memory-based computational framework that exploits the on-chip memory to perform computation on demand using a lookup table (LUT)-based approach. The framework achieves reliable operation by transferring activity to embedded memory of a processor from a defective or unreliable functional unit. This allows the die to run at a reduced (but acceptable) performance level instead of being completely discarded due to unit failure (in case of defective functional unit) or being throttled (in case of temporal parameter variations, e.g., temperature induced variations). We note that although the worst-case latency of memory based computation can be considerably higher than regular operation latency, the average latency is only modestly higher due to the abundance of narrow-width operands. Furthermore, the operands for a specific instruction (e.g., integer add, multiply, or floating point add) experience high locality of reference and thus require loading only part of the LUTs in the cache. Simulation results for a set of benchmark applications show that the proposed scheme can significantly improve yield and reliability at the cost of only a small loss in performance (on an average 0.8%) and 10 × less area overhead compared to hardware duplication based defect tolerance approach.

Hardware Trust is an emerging problem in semiconductor integrated circuit (IC) security due to widespread outsourcing and the stealthy nature of hardware Trojans. Conventional post-manufacturing testing, test generation algorithms and test coverage metrics cannot be readily extended to hardware Trojan detection. As a result there is a need to develop approaches that will ensure trusted in-field operation of ICs, and more generally trust in computing. We present a distributed software scheduling prototype, TADS (Trojan Aware Distributed Scheduling), to achieve a Trojan-activation tolerant trustworthy computing system in a multi-core processor potentially containing hardware Trojans. TADS is designed to be transparent to applications and can run on general purpose multicore PEs without modifications to the operating system or underlying hardware. TADS can, with high confidence, continue to correctly execute its specified queue of job subtasks in the presence of hardware Trojans in the multi-core PEs while learning the individual trustworthiness of the individual PEs. Specially crafted self-checking subtasks called bounty hunters are introduced to accelerate PE trust learning. Also, by learning and maintaining individual PE trustworthiness, the scheduler is able to achieve Trojan containment by scheduling subsequent job subtasks to PEs with high learned trust.

With increasing parameter variations, functional units (FUs) in a chip experience considerable local variations in maximum operating frequency. Effect of such within-die variations in a superscalar processor if addressed by worst-case frequency assignment, results in overly pessimistic yield in high-frequency bins. In this paper, we propose VAIL - a novel low-overhead instruction scheduling strategy that assigns best-case frequency by issuing the narrow-width (NW) operations to slower units. This exploits the abundance of NW operations (>70%) in a typical program and the fact that the critical path in FUs are not activated for these operations. Compared to existing vari-cycle approach, the proposed scheme demonstrates a large improvement in yield (~ 27% at highest performance bin) and profit (10-15%) for a set of benchmark applications. It also improves the thermal profile for the FUs. Finally, it provides large opportunistic power saving (~ 43%) in the slow units using supply gating of inactive bit-slices.

Security is rapidly becoming a critical factor in the IC design and test cycle. To provide higher levels of assurance and trust to designers, manufacturers and end users of integrated circuits (ICs), there is a need to integrate security measures during design, validation, and manufacturing test covering all aspects of security threats in hardware. These threats include secret information leakage, malicious hardware modifications in an untrusted foundry, hardware IP piracy and reverse engineering efforts. This session will have three presentations focusing on the design, validation, and test challenges for attack-resistant secure hardware systems.

Maximum operating frequency ( F max ) of a system often needs to be determined at multiple operating points, defined by voltage and temperatures. Such calibration is important for the speed binning process, where the voltage-frequency (V- F max ) relation needs to be accurately determined to sort chips into different bins that can be used for different applications. Moreover, adaptive systems typically require F max calibration at multiple operating points in order to dynamically change operating condition such as supply voltage or body bias for power, temperature, or throughput management. For example, a Dynamic Voltage and Frequency Scaling (DVFS) system requires accurate delay calibration at multiple operating voltages in order to apply the correct operating frequency corresponding to a scaled supply. In this article, we propose a low-overhead design technique that allows efficient characterization of F max at different operating voltages and temperatures. The proposed method selects a set of representative timing paths in a circuit based on their temperature and voltage sensitivities and dynamically configures them into a ring oscillator to compute the critical path delay. Compared to existing F max calibration approaches, the proposed approach provides the following two main advantages: (1) it introduces a delay sensitivity metric to isolate few representative timing paths; (2) it considers actual timing paths instead of critical path replicas, thereby accounting for local within-die delay variations. The all-digital calibration method is robust under process variations and achieves high delay estimation accuracy (> 4% error) at the cost of negligible design overhead (1.7% in delay, 0.3% in power, and 3.5% in die-area).

Pipelined processor cores are conventionally designed to accommodate the critical paths in the critical pipeline stage(s) in a single clock cycle, to ensure correctness. Such conservative design is wasteful in many cases since critical paths are rarely exercised. Thus, configuring the pipeline to operate correctly for rarely used critical paths targets the uncommon case instead of optimizing for the common case. In this study, we describe Trifecta-an architectural technique that completes common-case, subcritical path operations in a single cycle but uses two cycles when the critical path is exercised. This increases slack for both single-and two-cycle operations and offers a unique advantage under process variation. In contrast with existing mechanisms that trade power or performance for yield, Trifecta improves the yield while preserving performance and power. We applied this technique to the critical pipeline stages of a superscalar out-of-order (OoO) and a single issue in-order processor, namely instruction issue and execute, respectively. Our experiments show that the rare two-cycle operations result in a small decrease (5% for integer and 2% for floating-point benchmarks of SPEC2000) in instructions per cycle. However, the increased delay slack causes an improvement in yield-adjusted-throughput by 20% (12.7%) for an in-order (InO) processor configuration.

Malicious hardware Trojan circuitry inserted in safety-critical applications is a major threat to national security. In this work, we propose a novel application of a key–based obfus-cation technique to achieve security against hardware Tro-jans. The obfuscation scheme is based on modifying the state transition function of a given circuit by expanding its reachable state space and enabling it to operate in two dis-tinct modes – the normal mode and the obfuscated mode. Such a modification obfuscates the rareness of the internal circuit nodes, thus making it difficult for an adversary to insert hard-to-detect Trojans. It also makes some inserted Trojans benign by making them activate only in the obfus-cated mode. The combined effect leads to higher Trojan detectability and higher level of protection against such at-tack. Simulation results for a set of benchmark circuits show that the scheme is capable of achieving high levels of security at modest design overhead.

Use of two-dimensional memory array for lookup table (LUT) based reconfigurable computing frameworks has been proposed earlier for improvement in performance and energy-delay product (EDP). In this paper, we propose an integrated solution for achieving significantly higher EDP in these frameworks by leveraging on the read-dominant memory access pattern. First, we propose to employ an asymmetric memory cell design, which provides higher read performance (~2X) and lower read power (~1.6X) in order to improve the overall EDP during operation. Exploiting the fact that the proposed memory cell provides better read power/performance for cells storing logic '0', next we propose a content-aware application mapping approach, which tries to maximize the logic '0' content in the LUTs. We show that the joint circuit and application mapping level optimization approach provides significant improvement in system EDP for a set of benchmark circuits.

Static Random Access Memory (SRAM) arrays designed in sub-90nm technologies are highly vulnerable to process variation induced read/write/access failures. In memory based reconfigurable computing frameworks, which use large high density memory array, such failures lead to incorrect execution of mapped applications. It causes loss in Quality of Service (QoS) for Digital Signal Processing (DSP) applications. We propose a Preferential Design approach at both application mapping and circuit level, which can significantly improve QoS and yield under large parameter variations. Such a architecture/circuit co-design approach can also tolerate increased failure rate at low operating voltage, thus facilitating low-power operation. Simulation results for a common DSP application show 45% improvement in power at iso--QoS and 47% in yield for a target Peak Signal to Noise Ratio (PSNR) at 45nm technology.

Among the emerging alternatives to CMOS, molecular electronics based diode-resistor crossbar fabric has generated considerable interest in recent times. Logic circuit design with future nano-scale molecular devices using dense and regular crossbar fabrics is promising in terms of integration density, performance and power dissipation. However, circuit design using molecular switches involve some major challenges: 1) lack of voltage gain of these switches that prevents logic cascading; 2) large output voltage level degradation; 3) vulnerability to parameter variations that affect yield and robustness of operation; and 4) high defect rate. In this article, we analyze some of the above challenges and investigate the effectiveness of asynchronous design methodology in a hybrid system design platform using molecular crossbar and CMOS interfacing elements. We explore different approaches of asynchronous circuit design and compare their suitability in terms of several circuit design parameters. We then develop the methodology and an automated synthesis flow to support two different asynchronous design approaches ( Micropipelines and Four phase Dual-rail ) for system designs using nano-crossbar logic stages and CMOS interface data-storage elements. Circuit-level simulation results for several benchmarks show considerable advantage in terms of performance and robustness at moderate area and power overhead compared to two different synchronous implementations.

Hardware intellectual-property (IP) cores have emerged as an integral part of modern system-on-chip (SoC) designs. However, IP vendors are facing major challenges to protect hardware IPs from IP piracy. This paper proposes a novel design methodology for hardware IP protection using netlist-level obfuscation. The proposed methodology can be integrated in the SoC design and manufacturing flow to simultaneously obfuscate and authenticate the design. Simulation results for a set of ISCAS-89 benchmark circuits and the advanced-encryption-standard IP core show that high levels of security can be achieved at less than 5% area and power overhead under delay constraint.

While the emerging nanoscale devices show promises in terms of integration density and computing power, system design with these devices involve some major challenges, such as bottom-up design approach, effective integration with CMOS and defect tolerance. To address some of these challenges, we propose MBARC, a reconfigurable framework using memory as the primary computing element. The proposed framework leverages on the reported advantages of memory array design with nanodevices, which are compatible to fabrication into dense and regular structures. The main idea is to partition a logic circuit, implement the partitions as multi-input multi-output lookup tables in a memory array, and then use a simple CMOS-based scheduler to evaluate the partitions in topological time-multiplexed manner. Compared to existing reconfigurable nanocomputing models, the proposed memory based computing has three major advantages: 1) it minimizes the requirement of programmable interconnects, thus, saving design cost; 2) it minimizes the number of CMOS interfacing elements (required for level restoration and cascading logic blocks); 3) existing techniques for defect tolerance in memory array can be easily extended to this framework. Simulation results for a set of ISCAS benchmarks show average improvement of 32% in area, 21% in delay and 34% in energy per vector compared to nanoscale FPGA implementation.

We present a novel computing framework consisting of multiple processing cores that exhibits swarm-like behavior. Conventional parallel processing paradigm typically requires a central controller for job assignment, inter-core communications and defect-tolerance. The proposed system leverages on the collective intelligence of a swarm of processing elements to avoid the bottleneck imposed by a central scheduler. Preliminary simulations show promising results for common signal processing applications.

Conventional FPGA architectures leverage on the spatial computing model where the design to be realized is represented in the form of multi-input single-output lookup tables (LUTs). However, such a model incorporates a reconfigurable interconnect network which leads to significant design overhead and poor scalability with process technology. In this paper, we propose a multi-cycle Memory Based Computational methodology that utilizes Content Addressable Memory (CAM) as the underlying reconfigurable fabric. The use of CAM in the proposed framework leads to significant reduction in memory requirement compared to LUT-based approach. Simulation results for standard benchmark circuits indicate that the proposed CAM based implementation improves the memory requirement significantly compared to its LUT counterpart, at the cost of little or no degradation in performance.

Energy-efficient performance has emerged as the key design objective of high-performance logic circuits to address power-induced reliability concerns and battery life requirements in portable devices. In the sub-65nm technology regime, these problems continue to grow as leakage power becomes the predominant form of power consumption. Among numerous power reduction techniques employed at the circuit and architectural levels, supply gating has been proven to be very effective for standby power reduction. In this paper, we propose application of fine-grained supply gating to large complex circuits for active leakage and dynamic power reduction. A design methodology and associated CAD tool is developed to synthesize combinational logic using hypergraph partitioning and Shannon decomposition, which reduces both leakage and switching power by disabling unused logic dynamically in small clusters of gates. Simulation results for a set of ISCAS-85 benchmarks show that the proposed approach can achieve up to 40% saving in total power in active mode (and up to 37% saving in standby power) with negligible impact on performance and die area for a predictive 32 nm technology.

There have been serious concerns recently about the security of microchips from hardware trojan horse insertion during manufacturing. This issue has been raised recently due to outsourcing of the chip manufacturing processes to reduce cost. This is an important consideration especially in critical applications such as avionics, communications, military, industrial and so on. A trojan is inserted into a main circuit at manufacturing and is mostly inactive unless it is triggered by a rare value or time event; then it produces a payload error in the circuit, potentially catastrophic. Because of its nature, a trojan may not be easily detected by functional or ATPG testing. The problem of trojan detection has been addressed only recently in very few works. Our work analyzes and formulates the trojan detection problem based on a frequency analysis under rare trigger values and provides procedures to generate input trigger vectors and trojan test vectors to detect trojan effects. We also provide experimental results.

Harvesting energy from previously unemployed ambient sources can play important role in saving energy and reducing the dependency to primary power sources (ACpower or battery) of an electronic system. High-performance integrated circuits such as microprocessor, typically suffers from high surface temperature (in the order of 80-100degC) resulting from the high power density and limited cooling capacity of the package. In this paper, we consider the scope of harvesting thermoelectric energy from the wasted heat in a microprocessor leveraging on the temperature gradient between processor die surface and environment. First, we develop analytical model to accurately estimate the recycled energy considering the non-uniformity of temperature distribution in the die surface. Next, we analyze the effectiveness of the approach for thermoelectric generator (TEG) with different efficiencies (measured in terms of its figure of merit, ZT) under varying processor workload. Finally, we propose a possible arrangement for using the TEG on a processor and provide measurement results on the amount of harvested energy. The measurements on a Pentium III processor running at 1 GHz show that we can harvest ~7 mW of power from the processor for average workload using a commercial TEG.

This paper describes an on-die di/dt voltage droop compensation scheme for use in high current, low voltage, VLSI circuits using current injection. The circuit was designed and simulated with SPICE. The circuit is able to source up to 150mA of current into a drooping node, has a bandwidth of 20MHz, and is able to lessen voltage droop magnitude. Since there is delay between the droop event and the current provided by this circuit, a predictive current injection scheme is proposed and some simulation and analysis of this method is performed.

Hardware intellectual property (IP) cores have emerged as an integral part of modern system-on-chip (SoC) designs. However, IP vendors are facing major challenges to protect hardware IPs and to prevent revenue loss due to IP piracy. In this paper, we propose a novel design methodology for hardware IP protection and authentication using netlist level authentication. The proposed methodology can be integrated in the SoC design and manufacturing flow to provide hardware protection to the IP vendors, the chip designer, and the system designer. Simulation results on ISCAS-89 benchmark circuits show that we can achieve high levels of security through a well-formulated obfuscation scheme at less than 10% area overhead under delay constraint.

Research efforts to develop a novel memory technology that combines the desired traits of non-volatility, high endurance, high speed and low power have resulted in the emergence of Spin Torque Transfer-RAM (STTRAM) as a promising next generation universal memory. However, the prospect of developing a non-volatile FPGA framework with STTRAM exploiting its high integration density remains largely unexplored. In this paper, we propose a novel CMOS-STTRAM hybrid FPGA framework; identify the key design challenges; and propose optimization techniques at circuit, architecture and application mapping levels. Simulation results show that a STTRAM based optimized FPGA framework achieves an average improvement of 48.38% in area, 22.28% in delay and 16.1% in dynamic power for ISCAS benchmark circuits over a conventional CMOS based FPGA design.

Design considerations for low-power operations and robustness with respect to variations typically impose contradictory design requirements. Low-power design techniques such as voltage scaling, dual-Vth and gate sizing can have large negative impact on parametric yield under process variations. In this tutorial, we focus on circuit/architectural design techniques for low power under parameter variations. We consider both logic and memory design and encompass modeling, analysis as well as design methodology to simultaneously achieve low power and variation tolerance. Design techniques to minimize power under parametric yield constraint as well as major process adaptation techniques using voltage scaling, adaptive body biasing or logic restructuring will be presented. Techniques to deal with within-die parameter variations in logic and memory circuits primarily caused by random dopant fluctuations will be discussed with emphasis on frequency assignments and body biasing. Finally, we will discuss temperature-aware design, dynamic adaptation to temperature and cover on-going research activities in related area such as low-power and variation tolerant multi-core processor design.

Within-die parameter variations can cause wide delay distribution among similar functional units in superscalar processors. Conventionally, the frequency of operation is reduced to accommodate the slowest unit, which in turn degrades throughput. We present a low-overhead design technique that sets the operating frequency in a superscalar processor based on the faster units and allows more cycles for the slower units. We propose an associated priority scheduling strategy to schedule instructions in the functional units to maximize throughput. Simulation results on a set of benchmarks show that, by assigning a higher scheduling priority to faster units, we can achieve 18 percent improvement in performance on average with negligible design overhead.

In this paper, a profit-aware design metric is proposed to consider the overall merit of a design in terms of power and performance. A statistical design methodology is then developed to improve the economic merit of a design considering frequency binning and product price profile. A low-complexity sensitivity-based gate sizing algorithm is developed to improve economic gain of a design over its initial yield-optimized design. Finally, we present an integrated design methodology for simultaneous sizing and bin boundary determination to enhance profit under an area constraint. Experiments on a set of ISCAS'85 benchmarks show in average 19% improvement in profit for simultaneous sizing and bin boundary determination, considering both leakage power dissipation and delay bounds compared to a design initially optimized for 90% yield at iso-area in 70-nm bulk CMOS technology.

In recent years, several alternative devices have been proposed to deal with inherent limitation of conventional CMOS devices in terms of scalability at nanometer scale geometry. The fabrication and integration cost of these devices, however, have been prohibitive and/or the devices do not allow smooth transition from the conventional design paradigm. To address some of these limitations, we have developed a new family of devices called "complementary nano electro-mechanical switches" (CNEMS) using carbon nanotubes as active switching/latching elements. The basic structure of these devices consists of three coplanar carbon nanotubes arranged so that the central nanotube can touch the two side carbon nanotubes upon application of a voltage pulse between them. Owing to the unique properties of carbon nanotubes, these devices have very low leakage current, low operation voltages, and have built-in energy storage to reduce computation power, resulting in very low overall power dissipation. CNEMS have stable on-off state and latching mechanism for non-volatile memory-mode operation. Besides, the devices can be readily integrated in the same substrate as CMOS transistors with high integration densities - thus, allowing easy manufacturability and hybridization with conventional CMOS devices. In this paper, we present the properties of these devices and based on our analysis, we propose a reconfigurable computation framework using these devices. For the first time, we demonstrate that these devices are promising in dynamically reconfigurable instant-on system development with about 25times lower power dissipation.

Determination of maximum operating frequencies (Fmax) during manufacturing test at different operating voltages is required to: (a) to ensure that, for a Dynamic Voltage and Frequency Scaling (DVFS) system, the adaptation hardware actually applies the correct operating frequency corresponding to a scaled supply and (b) to sort chips in different voltage- frequency (V-Fmax)bins, so that chips at different bins can be used for different applications. Existing speed binning approach requires extensive delay testing at all operating points with all possible frequencies, which increases test cost and test time significantly. In this paper, we propose a low-overhead solution for characterizing Fmaxof a circuit at different operating voltages that can eliminate the complex and expensive Fmaxcalibration at multiple voltage points. The basic idea is to choose a small set of representative paths in a circuit based on their voltage sensitivity and dynamically configuring them into ring oscillator to compute the Fmax. The proposed calibration mechanism is all-digital, robust to process variations, reasonably accurate (average 2.8% error) and incorporates minimal hardware overhead (average 1.7% delay, 3.5% area and 0.28% power overhead).

VLSI systems in the nanometer regime suffer from high defect rates and large parametric variations that lead to yield loss as well as reduced reliability of operation. In this paper, we propose a novel memory-based computation framework that exploits on-chip memory for reliable operation by transferring activity from a defective or unreliable functional unit to the embedded memory. This allows the die to run at a reduced performance level instead of being completely discarded or being throttled (in case of variations). We show that the proposed method improves yield and reliability in a superscalar out-of-order processor by tolerating defective functional units and allowing dynamic thermal management. The simulation results show that it entails only a small loss in performance (average 1.8%) at the cost of 9.5% of area overhead required with hardware duplication.

Bridging defects typically manifest themselves as increased path delays instead of stuck-at failures. On the other hand, parametric variations (both inter- and intra-die) increase the spread of the circuit delay. Low power design techniques such as voltage scaling, dual-Vth etc. deteriorate the delay spread further. These mechanisms for delay variations in nanoscaled technologies significantly affect the parametric yield. We propose a new design methodology to tolerate subtle delay failures that arise both due to manufacturing defects and parameter fluctuations. We synthesize the circuit to (a) isolate and predict the critical paths of a circuit; (b) create timing slack between critical and off-critical paths and ensure that they are activated rarely; and, (c) avoid the delay failures in these paths by adaptively stretching the clock period. Since critical paths are the most sensitive section of the circuit in terms of delay defects, we ensure fault-free operation by isolating them and providing extra computation time by predicting their activation. This allows us to achieve the required yield with small performance penalty (due to occasional clock stretching under critical path activation). We present application of the proposed methodology for both linear and non-linear pipeline designs. We also suggest two possible circuit-level implementations of clock stretching using clock gating and handshaking, respectively. Simulations on MCNC benchmark circuits with BPTM 70 nm devices show that the proposed technique can achieve good yield by tolerating increased path delays (under variations and bridging defects of various sizes) with small overhead in performance and ~14% die-area compared to the conventional design. For performance analysis, we have implemented the proposed methodology in simplein-orderpipeline in Simplescalar. Simulation results on SPEC2000 benchmarks show less that 2% of IPC (instructions-per-cycle) degradation.

High defect rate in emerging nano-devices mandates new computational models that can tolerate defects thereby rendering reliability of operation and reasonable manufacturing yield. In a bottom-up system design approach using nano-crossbar applications are typically mapped into a crossbar using either PLA or lookup table (LUT) implementation of a logic circuits. LUT-based implementation has some definite advantages over PLA-based one due its easy reconfigurability. In this paper, we consider a LUT-based logic design paradigm using nano-crossbar and propose a novel application mapping technique that can effectively take advantage of certain defects in the LUTs. The main idea is: 1) to identify and localize the unidirectional stuck-at faults in the LUTs and 2) then map an application in such a way that the a particular defective LUT is used to map a Boolean function which is compatible with the behavior of the LUT. The idea of exploiting certain defects to implement a function (as opposed to discard the defective location as unusable), improves yield considerably in LUT-based configurable nanocomputing. Our simulation with 5times5 and 5times1 LUT shows an average improvement of 87% in number of mapped function over conventional mapping for a defect rate of 10%.

Higher integration density of nanoscale CMOS causes two major design challenges in SRAM-based Field Programmable Gate Array (FPGA) designs: large power dissipation (contributed by both leakage and dynamic power) and reduced reliability of operation. In this paper, we propose a hybrid design approach for SRAM-based FPGA that can leverage on non-volatile carbon nanotube based nano electro-mechanical systems (NEMS) switches for low static and dynamic power. Simulations show that the proposed CMOS-NEMS lookup table (LUT) based circuits can achieve a reduction of up to 91% in total power at iso-performance, compared to the conventional CMOS-based LUT circuits.

In the nanometer technology regime, power dissipation and process parameter variations have emerged as major design considerations. These problems continue to grow with leakage power becoming a dominant form of power consumption. On the other hand, variations in the device parameters, both systematic and random, translate into variations in circuit parameters like delay and leakage, leading to loss in parametric yield. Numerous design techniques have been investigated for both logic and memory circuits to address the growing issues with power and variations. Low-power and process-tolerant designs, however, impose new test challenges and may even have conflicting requirements for test - affecting delay fault coverage, IDDQtestability, parametric yield, and even stuck-at tests. Hence, there is a need to consider test and yield, while designing for low-power and robustness under variations. In this paper, we provide an overview of major low-power and variation-tolerant design techniques; discuss related test issues and focus on effectiveness of self-calibration/self-repair solutions to maintain high yield while achieving low power dissipation.

Scan-based DFT enhances the testability of a system by making its internal nodes more observable and controllable. However, in case of a secure chip, scan chain increases its vulnerability to attack, where the attacker can extract secret information by scanning out states of internal nodes. This paper presents VIm-Scan: a low overhead scan design methodology that maintains all the advantages of a traditional scan-based testing yet prevents secure key extraction through the scan out process. Experimental results show that the proposed approach entails significantly lesser design overhead (~5times reduction in number of additional gates) with comparable or better protection against attack than existing techniques.

Design considerations for robustness with respect to variations and low-power operations typically impose contradictory design requirements. Low-power design techniques such as voltage scaling, dual- , etc., can have a large negative impact on parametric yield. In this paper, we propose a novel paradigm for low-power variation-tolerant circuit design called critical path isolation for timing adaptiveness (CRISTA), which allows aggressive voltage scaling. The principal idea includes the following: 1) isolate and predict the set of possible paths that may become critical under process variations; 2) ensure that they are activated rarely; and 3) avoid possible delay failures in the critical paths by dynamically switching to two-cycle operation (assuming all standard operations are single cycle), when they are activated. This allows us to operate the circuit at reduced supply voltage while achieving the required yield. Simulation results on a set of benchmark circuits with Berkeley-predictive-technology-model [BPTM 70 nm: Berkeley predictive technology model] 70-nm devices that show an average of 60% improvement in power with small overhead in performance and 18% overhead in die area compared to conventional design. We also present two applications of the proposed methodology that include the following: 1) pipeline design for low power and 2) temperature-adaptive circuit design.

Structural transformation of a design to enhance its testability while satisfying design constraints on power and performance can result in improved test cost and test confidence. In this article, we analyze the testability in a new style of logic design based on Shannon's decomposition and supply gating . We observe that the tree structure of a logic circuit due to Shannon's decomposition makes it intrinsically more testable than a conventionally synthesized circuit, while at the same time providing an improvement in active power. We have analyzed four different aspects of the testability of a circuit: a) IDDQ test sensitivity, b) test power during scan-based testing, c) test length (for both ATPG-generated deterministic and random patterns), and d) noise immunity. Simulation results on a set of MCNC benchmarks show promising results on all these aspects (an average improvement of 94% in IDDQ sensitivity, 50% in test power, 19% (21%) in test length for deterministic (random) patterns, and 50% in coupling noise immunity). We have also demonstrated that the new logic structure can improve parametric yield (6% on average) of a circuit under process variations when considering a bound on circuit leakage.

Dual-Vtdesign technique has proven to be extremely effective in reducing subthreshold leakage in both active and standby mode of operation of a circuit in submicrometer technologies. However, aggressive scaling of technology results in different leakage components (subthreshold, gate and junction tunneling) to become significant portion of total power dissipation in CMOS circuits. High-Vtdevices are expected to have high junction tunneling current (due to stronger halo doping) compared to low-Vtdevices, which in the worst case can increase the total leakage in dual-Vtdesign. Moreover, process parameter variations (and in turn Vtvariations) are expected to be significantly high in sub-50-nm technology regime, which can severely affect the yield. In this paper, we propose a device aware simultaneous sizing and dual-Vtdesign methodology that considers each component of leakage and the impact of process variation (on both delay and leakage power) to minimize the total leakage while ensuring a target yield. Our results show that conventional dual-Vtdesign can overestimate leakage savings by 36% while incurring 17% average yield loss in 50-nm predictive technology. The proposed scheme results in 10%-20% extra leakage power savings compared to conventional dual-Vtdesign, while ensuring target yield. This paper also shows that nonscalability of the present way of realizing high-Vtdevices results in negligible power savings beyond 25-nm technology. Hence, different dual-Vtprocess options, such as metal gate work function engineering, are required to realize high-performance and low-leakage dual-Vtdesigns in future technologies.

Designing high-performance systems with high yield under parameter variations has raised serious design challenges in nanometer technologies. In this paper, we propose a profit-aware yield model, based on which we present a statistical design methodology to improve profit of a design considering frequency binning and product price profile. A low-complexity sensitivity-based gate sizing algorithm is developed to improve the profitability of design over an initial yield-optimized design. We also propose an algorithm to determine optimal bin boundaries for maximizing profit with frequency binning. Finally, we present an integrated design methodology for simultaneous sizing and bin placement to enhance profit under an area constraint. Experiments on a set of ISCAS85 benchmarks show up to 26% (36%) improvement in profit for fixed bin (for simultaneous sizing and bin placement) with three frequency bins considering both leakage and delay bounds compared to a design optimized for 90% yield at iso-area.

With technology scaling, soft error resilience is becoming a major concern in circuit design. This paper presents a class of low-overhead flip-flops suitable for soft error detection and correction. The proposed design reuses logic elements typically available in a standard-cell implementation of a flip-flop to reduce hardware overhead. We demonstrate that the proposed flip-flops are also suitable for enhanced scan based delay fault testing, which allows arbitrary two-pattern test application for the best combinational path testability. The proposed flip-flops show an average power reduction of 16% and area improvement of 17% compared to the best alternative techniques with no additional delay overhead

Clock power consumes a significant fraction of total power dissipation in high speed precharge/evaluate logic styles. In this paper, we present a novel low-cost design methodology for reducing clock power in the active mode for dynamic circuits with fine-grained clock gating. The proposed technique also improves switching power by preventing redundant computations. A logic synthesis approach for domino/skewed logic styles based on Shannon expansion is proposed, that dynamically identifies idle parts of logic and applies clock gating to them to reduce power in the active mode of operation. Results on a set of MCNC benchmark circuits in predictive 70nm process exhibit improvements of 15% to 64% in total power with minimal overhead in terms of delay and area compared to conventionally synthesized domino/skewed logic

This paper presents a novel design methodology for ultralow power design (in bulk and double-gate SOI technology) using sub-threshold leakage as the operating current (suitable for medium frequency of operation: tens to hundreds of MHz). It has been shown that a complete co-design at all levels of hierarchy (device, circuit and architecture) is necessary to reduce the overall power consumption. Simulation results of co-design on a five-tap FIR filter shows ~2.5times (for bulk) and ~3.8times (for SOI) improvement in throughput at iso-power compared to a conventional design. It has been further demonstrated that the double-gate SOI technology is better suited for sub-threshold operation

Design considerations for robustness with respect to variations and low power operations typically impose contradictory design requirements. Low power design techniques such as voltage scaling, dual-Vth etc. can have a large negative impact on parametric yield. In this paper, we propose a novel paradigm for low-power variationtolerant circuit design, which allows aggressive voltage scaling. The principal idea is to (a) isolate and predict the set of possible paths that may become critical under process variations, (b) ensure that they are activated rarely, and (c) avoid possible delay failures in the critical paths by dynamically switching to two-cycle operation (assuming all standard operations are single cycle), when they are activated. This allows us to operate the circuit at reduced supply voltage while achieving the required yield. Simulation results on a set of benchmark circuits at 70nm process technology show average power reduction of 60% with less than 10% performance overhead and 18% overhead in die-area compared to conventional synthesis. Application of the proposed methodology to pipelined design is also investigated.

Delay failures are becoming a dominant failure mechanism in nanometer technologies. Diagnosis of such failures is important to ensure yield and robustness of the design. However, the increasing circuit size limits the granularity of diagnosis, resulting in large suspect fault list. In this paper, we present a methodology for improving delay fault localization in test-per-scan BIST using on-die delay sensing at selective test points. It is demonstrated that the proposed technique can improve the resolution of fault localization for both transition and segment delay fault models. Experimental results for a set of ISCAS89 benchmarks show up to 49% (82%) average improvement in fault localization for transition (segment) delay fault models. The area overhead due to delay sensing hardware have been limited to 4%

Under inter-die and intra-die parameter variations, the delay of a pipelined circuit follows a statistical distribution. This paper presents analytical models to estimate yield for a pipelined design based on delay distributions of individual pipe stages. Using the proposed models, it is shown that a change in logic depth and an imbalance between stage yields can improve the design yield and the area of a pipeline a circuit. A novel statistical methodology is developed to enhance yield of a pipelined circuit under an area constraint. Based on the concept of area borrowing, the results show that incorporating a proper imbalance among stage areas in a four-stage pipeline improves design yield up to 15.4% for the same area (and reduces area up to 8.4% under a yield constraint) compared with a balanced design

A novel integrated approach for delay-fault testing in external (automatic-test-equipment-based) and test-per-scan built-in self-test (BIST) using on-die delay sensing and test point insertion is proposed. A robust, low-overhead, and process-tolerant on-chip delay-sensing circuit is designed for this purpose. An algorithm is also developed to judiciously insert delay-sensor circuits at the internal nodes of logic blocks for improving delay-fault coverage with little or no impact on the critical-path delay. The proposed delay-fault testing approach is verified for transition- and segment-delay-fault models. Experimental results for external testing (BIST) show up to 31% (30%) improvement in fault coverage and up to 67.5% (85.5%) reduction in test length for transition faults. An increase in the number of robustly detectable critical-path segments of up to 54% and a reduction in test length for the segment-delay-fault model of up to 76% were also observed. The delay and area overhead due to insertion of the delay-sensing hardware have been limited to 2% and 4%, respectively

In nanoscale complementary metal-oxide-semiconductor (CMOS) devices, a significant increase in subthreshold, gate, and reverse-biased junction band-to-band-tunneling (BTBT) leakage results in large leakage power in logic circuits. Leakage components interact with each other at the device level (through device geometry and the doping profile) and at the circuit level (through the node voltages). Due to the circuit-level interaction of the different leakage components, the leakage of a logic gate depends on the circuit topology, i.e., the number and the nature of the other logic gates connected to its input and output. In this paper, the effect of loading on a leakage of a circuit is analyzed for the first time. The authors have also proposed a method to accurately estimate the total leakage in a logic circuit from its logic-level description considering the impact of loading and transistor stacking.

Power consumption in datapath modules due to redundant switching is an important design concern for high-performance applications. Operand isolation schemes that reduce this redundant switching incur considerable overhead in terms of delay, power, and area. This paper presents novel operand isolation techniques based on supply gating that reduce overheads associated with isolating circuitry. The proposed schemes also target leakage minimization and additional operand isolation at the internal logic of datapath to further reduce power consumption. We integrate the proposed techniques and power/delay models to develop a synthesis flow for low-power datapath synthesis. Simulation results show that the proposed operand isolation techniques achieve at least 40% reduction in power consumption compared to original circuit with minimal area overhead (5%) and delay penalty (0.15%)

Under inter- and intra-die parameter variations, delay of a pipelined circuit follows a statistical distribution. Hence, a pipelined circuit suffers yield loss with respect to violation of target delay constraint unless an overly pessimistic worst-case design approach is followed. We propose a statistical approach for pipeline design to enhance yield with respect to a target delay under an area budget. Right choice of the number of pipeline stages to enhance yield under an area constraint is addressed using simple statistical yield models. Next, individual stages are designed for maximizing yield under area constraint for the stages. Once the independently optimized stages are combined to form a pipeline, we propose a final global optimization step to improve pipeline yield with no area overhead, based on a concept of area borrowing. Optimization results show that, the proposed statistical design approach for pipeline improves the overall yield up to 12% over conventional design for equal area.

Structural transformation of a design to enhance its testability while satisfying design constraints on power and performance, can result in improved test cost and test confidence. In this paper, we analyze the testability in a new style of logic design based on Shannon’s decomposition and supply gating. We observe that tree structure of a logic circuit due to Shannon’s decomposition makes it intrinsically more testable than conventionally synthesized circuit, while at the same time entailing an improvement in active power. We have analyzed three different aspects of testability of a circuit: a) IDDQ test sensitivity b) test power during scan-based testing, and c) test length (for both ATPG-generated deterministic and random patterns). Simulation results on a set of MCNC benchmarks show promising results on all the above aspects. We have also demonstrated that the new logic structure can improve parametric yield of a circuit under process variations when considering a bound on circuit leakage.

Due to exponential increase in subthreshold leakage with technology scaling and temperature increase, leakage power is becoming a major fraction of total power in the active mode. We present a novel low-cost design methodology with associated synthesis flow for reducing both switching and active leakage power using dynamic supply gating. A logic synthesis approach based on Shannon expansion is proposed that dynamically applies supply gating to idle parts of general logic circuits even when they are performing useful computation. Experimental results on a set of MCNC benchmark circuits in a predictive 70nm process exhibits improvements of 15% to 88% in total active power compared to the results obtained by a conventional optimization flow.

With increasing process fluctuations in nano-scale technology, testing for delay faults is becoming essential in manufacturing test to complement stuck-at-fault testing. Design-for-testability techniques, such as enhanced scan are typically associated with considerable overhead in die-area, circuit performance, and power during normal mode of operation. This paper presents a novel test technique, which can be used as an alternative to the enhanced scan based delay fault testing method, with significantly less design overhead. Instead of using an extra latch as in the enhanced scan method, we propose using supply gating at the first level of logic gates to hold the state of a combinational circuit. Experimental results on a set of ISCAS89 benchmarks show an average reduction of 33% in area overhead with an average improvement of 71% in delay overhead and 90% in power overhead during normal mode of operation, compared to the enhanced scan implementation.

Operating frequency of a pipelined circuit is determined by the of the slowest pipeline stage. However, under statistical delay variation in sub-100 nm technology regime, the slowest stage is not readily identifiable and the estimation of the pipeline yield with respect to a target delay is a challenging problem. We have proposed analytical models to estimate yield for a pipelined design based on delay distributions of individual pipe stages. Using the proposed models, we have shown that change in logic depth and imbalance between the stage delays can improve the yield of a pipeline. A statistical methodology has been developed to optimally design a pipeline circuit for enhancing yield. Optimization results show that, proper imbalance among the stage delays in a pipeline improves design yield by 9% for the same area and performance (and area reduction by about 8.4% under a yield constraint) over a balanced design.

In nanometer scaled CMOS devices, a significant increase in the subthreshold, the gate and the reverse biased junction band-to-band-tunneling (BTBT) leakage results in a large increase of the total leakage power in a logic circuit. Leakage components interact with each other at the device level (through device geometry, doping profile) and also at the circuit level (through node voltages). Due to the circuit level interaction of the different leakage components, the leakage of a logic gate strongly depends on the circuit topology, i.e., the number and nature of the other logic gates connected to its input and output. For the first time, we analyze the loading effect on leakage and propose a method to estimate accurately, from its logic level description, the total leakage in a logic circuit, considering the impact of loading and transistor stacking.

We propose a delay fault testing methodology using on-chip delay measurement hardware. We have designed a process-tolerant, low-overhead delay measurement hardware and developed an algorithm to judiciously insert the hardware at internal nodes of logic blocks. Experimental results for a set of ISCAS89 benchmarks show up to 16.9% improvement in transition fault coverage and up to 10.5% increase in the number of detected faults for segment delay fault model, with fixed test length. The reduction in test length is up to 59% for transition fault, with fixed target coverage. The delay and area overhead due to additional DFT logic is limited to 2% and 4% respectively.

Power consumption in datapath modules due to redundant switching is an important design concern for high-performance applications. Operand isolation schemes are adopted to reduce redundant switching in datapaths. However, they incur considerable overhead in terms of delay, power, and area. This paper presents novel operand isolation techniques based on supply gating that reduce the overheads associated with isolating circuitry. The proposed schemes also target leakage minimization and application of operand isolation at the internal logic of datapath to further reduce power consumption. We integrate the proposed techniques and power/delay models to develop a complete flow for low-power datapath synthesis. Simulation results show that the proposed operand isolation techniques can achieve at least 40% reduction in power consumption compared to the original circuit with minimal area overhead (5%) and small delay penalty (0.15%).

In nanoscale technology, large variations in process parameters produce wide delay spread in high performance circuit. In this paper the authors developed analytical models for yield prediction with respect to delay variation of pipeline design. The converse problem of estimating the design space for individual pipe stages based on a target yield has been addressed. For an example 4 stage pipelined circuit proposed analytical models are verified to predict yield within 2% of results obtained from Monte-Carlo Hspice simulation

This paper explores the effectiveness of dual-V/sub t/ design under aggressive scaling of technology, which results in significant increase in all components of leakage (subthreshold, gate and junction tunneling) while having large variations in process parameters. The present way of realizing high-V/sub t/ devices results in high junction tunneling leakage compared to low-V/sub t/, devices, which in turn may result in negligible leakage savings for dual-V/sub t/, designs in scaled technologies. Moreover, increase in process variation severely affects the yield of such designs. This paper suggests important measures that need to be incorporated in conventional dual-V/sub t/, design to achieve total leakage power improvement while ensuring yield. It also shows that different process options, such as metal gate work function engineering, are required to realize high-performance and low-leakage dual- V/sub t/ designs in sub-50nm technologies.

In this paper, we have made a complete analysis of the emerging SRAM failure mechanisms due to process variations and mapped them to fault models. We have proposed two efficient test solutions for the process variation related failures in SRAM: (a) modification of March sequence, and (b) a low-overhead DFT circuit to complement the March test for an overall test time reduction of 29%, compared to the existing test technique with similar fault coverage.

Reducing the energy consumption of a real-time system has emerged as an important design concern. In this paper, we propose GAARP, an adaptive scalable architecture targeted toward algorithm-specific tasks for just-in-time performance using the right amount of power. The architecture consists of Globally Asynchronous and Locally Synchronous (GALS) building blocks, where the processing hardware is realized by a set of smaller slices of similar structure, each running synchronously with independent clocks. We demonstrate that, for different real-time commercial applications with algorithm-specific jobs like online transaction processing, digital filtering, Fourier transform, etc., the proposed architecture allows dynamic load-balancing and adaptive intertask voltage scaling based on the load in each of the processing units. Compared to a synchronous implementation of the same functionality, we show that the proposed hardware can achieve higher efficiency in terms of power and performance by exploiting the flexibility to balance the load and change the supply voltage. The architecture also lends itself to process tolerance since it can detect process-shifts for the individual processing units and determine the appropriate operating voltage/frequency for each unit. Simulation results for two representative applications show that, for a modest system configuration and random job distribution, we obtain up to 67 percent improvement in MOPS/W (millions of operations per second per watt) over a fully synchronous implementation.

In this paper, we present a novel design methodology for synthesizing multiple configurations (or modes) into a single programmable core that can be used in embedded systems. Recent portable applications require reconfigurability of a system along with efficiency in terms of power, performance, and area. The field programmable gate arrays (FPGAs) provide a reconfigurable platform; however, they are slower in speed with significantly higher power and area than achievable by a customized application-specific integrated circuits (ASIC). Implementation of a system in either FPGA or ASIC represents a trade-off between programmability and design efficiency. In this work, we have developed techniques to realize efficient reconfigurable cores for a set of user-specified applications. The resultant system, named asmultimodesystem, can easily switch configurations throughout the set of configurations it is designed for. A data flow graph transformation method coupled with efficient scheduling and allocation is used to automatically synthesize aMulti-Modesystem from its behavior-level specifications. Experimental results on several applications demonstrate that our implementations can achieve about 60X power reduction on average and run 3.5X faster over corresponding FPGA implementations.

Reduction in test power is important to improve battery lifetime in portable electronic devices employing periodic self-test, to increase reliability of testing, and to reduce test cost. In scan-based testing, a significant fraction of total test power is dissipated in the combinational block. In this paper, we present a novel circuit technique to virtually eliminate test power dissipation in combinational logic by masking signal transitions at the logic inputs during scan shifting. We implement the masking effect by inserting an extra supply gating transistor in the supply to ground path for the first-level gates at the outputs of the scan flip-flops. The supply gating transistor is turned off in the scan-in mode, essentially gating the supply. Adding an extra transistor in only one logic level renders significant advantages with respect to area, delay, and power overhead compared to existing methods, which use gating logic at the output of scan flip-flops. Moreover, the proposed gating technique allows a reduction in leakage power by input vector control during scan shifting. Simulation results on ISCAS89 benchmarks show an average improvement of 62% in area overhead, 101% in power overhead (in normal mode), and 94% in delay overhead, compared to the lowest cost existing method.

Transient current (IDD) testing has been often cited and investigated as an alternative and/or supplement to quiescent current (IDDQ) testing. In this correspondence, we present a novel integrated method for fault detection and localization using wavelet transform-based IDD waveform analysis. The time-frequency resolution property of wavelet transform helps us detect as well as localize faults in digital CMOS circuits. Experiments performed on measured data from a fabricated 8-bit shift register, and simulation data from more complex circuits show promising results for both detection and localization. Wavelet-based detection method shows better sensitivity than spectral and time-domain methods. Effectiveness of the localization method in presence of complex power supply network, measurement noise, and process variation is also addressed.

With increasing inter-die and intra-die parameter variations in sub-100-nm process technologies, new failure mechanisms are emerging in CMOS circuits. These failures lead to reduction in reliability of circuits, especially the area-constrained SRAM cells. In this paper, we have analyzed the emerging failure mechanisms in SRAM caches due to transistor V/sub t/ variations, which results from process variations. Also we have proposed solutions to detect those failures efficiently. In particular, in this work, SRAM failure mechanisms under transistor V/sub t/ variations are mapped to logic fault models. March test sequences have been optimized to address the emerging failure mechanisms with minimal overhead on test time. Moreover, we have proposed a design for test circuit to complement the March test sequence for at-speed testing of SRAMs. The proposed technique, referred as double sensing, can be used to test the stability of SRAM cells during read operations. Using the proposed March test sequence along with the double sensing technique, a test time reduction of 29% is achieved, compared to the existing test techniques with the same fault coverage. We have also demonstrated that double sensing can be used during SRAM normal operation for online detection and correction of any number of random read faults.

This paper presents a novel design methodology for ultralow-power design using subthreshold leakage as the operating current (suitable for medium frequency of operation: tens to hundreds of millihertz). Standard design techniques suitable for super-threshold design can be used in the subthreshold region. However, in this study, it has been shown that a complete co-design at all levels of hierarchy (device, circuit, and architecture) is necessary to reduce the overall power consumption while achieving acceptable performance (hundreds of millihertz) in the subthreshold regime of operation. Simulation results of co-design on a five-tap finite-impulse-response filter shows /spl sim/2.5/spl times/ improvement in throughput at iso-power compared to a conventional design.

Wavelet transform has the property of resolving signal in both time and frequency unlike Fourier transform. In this work, we show that time-domain information obtained from wavelet analysis of supply current can be used to efficiently trim analog filters. The pole/zero locations in the frequency response of analog filters shift due to change in component values with process variations. Wavelet analysis of supply current can be a promising alternative to test frequency specification of analog filters, since it needs only one test stimulus and is virtually unaffected by transistor threshold variation. Simulation results on two test circuits demonstrate that we can estimate pole/zero shift with less than 3% error.

Reduction in test power is important to improve battery life in portable devices employing periodic self-test, to increase reliability of testing and to reduce test-cost. In scan-based testing, about 80% of total test power is dissipated in the combinational block. In this paper, we present a novel circuit technique to virtually eliminate test power dissipation in combinational logic by masking signal transition at the logic inputs during scan shifting. We realize the masking effect by inserting an extra supply gating transistor in the VDD to GND path for the first level cells at output of the scan flops. The supply gating transistor is turned off in the scan-in mode, essentially gating the supply. Adding an extra transistor in only one logic level renders significant advantage with respect to area, delay and power (in normal mode of operation) overhead compared to existing methods, which use gating logic at the output of scan flops. Simulation results on ISCAS89 benchmarks show up to 79% improvement in area, up to 32% in power (in normal mode) and up to 7% in delay compared to lowest-cost known alternative.

With the scaling of technology and the need for higher performance and more functionality, power dissipation is becoming a major bottleneck for microprocessor designs. Because clock power can be significant in high-performance processors, we propose a deterministic clock-gating (DCG) technique which effectively reduces clock power. DCG is based on the key observation that for many of the pipelined stages of a modern processor, the circuit block usage in the near future is known a few cycles ahead of time. Our experiments show an average of 19.9% reduction in processor power with virtually no performance loss for an eight-issue, out-of-order superscalar by applying DCG to execution units, pipeline latches, D-cache wordline decoders, and result bus drivers.

With the scaling of technology and the need for higher performance and more functionality, power dissipation is becoming a major bottleneck for microprocessor designs. Pipeline balancing (PLB), a previous technique, is essentially a methodology to clock-gate unused components whenever a program's instruction-level parallelism is predicted to be low. However, no nonpredictive methodologies are available in the literature for efficient clock gating. This paper introduces deterministic clock gating (DCG) based on the key observation that for many of the stages in a modern pipeline, a circuit block's usage in a specific cycle in the near future is deterministically known a few cycles ahead of time. Our experiments show an average of 19.9% reduction in processor power with virtually no performance loss for an 8-issue, out-of-order superscalar processor by applying DCG to execution units, pipeline latches, D-Cache wordline decoders, and result bus drivers. In contrast, PLB achieves 9.9% average power savings at 2.9% performance loss.

Quiescent supply current (IDDQ) testing is a useful test method for static CMOS RAM and can be combined with functional testing to reduce total test time and to increase reliability. However the sensitivity of IDDQ testing deteriorates significantly with technology scaling as intrinsic leakage of CMOS circuits increases. In this paper, we use a design technique for a high-performance cache, which greatly improves leakage current and hence the IDDQ testability of the cache with technology scaling. We utilize the concept of gated-ground (NMOS transistor inserted between ground line and SRAM cell) to achieve reduction in leakage energy due to the stacking effect of the transistor without significantly affecting performance. Simulation results for a 64 K cache show 20% average improvement in IDDQ sensitivity for TSMC 0.25 /spl mu/m technology, while the improvement is more than 1000% for the 70 nm predictive technology model.

Transient current (IDD) based testing has been often cited and investigated as an alternative and/or supplement to quiescent current (IDDQ) testing. While the potential of IDD testing for fault detection has been established, there is no known efficient method for fault diagnosis using IDD analysis. In this paper, we present a novel integrated method for fault detection and localization using wavelet transform based IDD waveform analysis. The time-frequency resolution property of wavelet transform helps us detect as well as localize faults in digital CMOS circuits. Experiments performed on measured data from a fabricated 8-bit shift register and simulation data from more complex circuits show promising results for both detection and localization. Wavelet based detection method shows superior sensitivity than spectral and time domain methods. The effectiveness of the localization method in presence of process variation, measurement noise and complex power supply network is addressed.

We present a novel integrated method for fault detection and localization using wavelet transform of transient current (IDD) waveform. The time-frequency resolution property of wavelet helps us detect as well as localize faults in digital CMOS circuits. Experiments performed on an 8-bit ALU show promising results for both detection and localization.

A combinatorial characterization of a gray-tone image called Euler vector is discussed. The Euler vector comprises a 4-tuple, where each element is an integer representing the Euler number of the partial binary image formed by the four most significant bit planes of the gray-tone image. The vector is topologically invariant and can be used for image indexing and retrieval. The Euler vector for all the images in the database can be arranged using any multidimensional data structure. For retrieval, a query range is to be defined around the query image vector. We use a simple statistical technique to specify the query range. Next, we propose a modification in the Kd-Tree construction to build a simple hybrid tree that supports efficient adaptive clustering and indexing. The same data structure is used for clustering and indexing.

Dynamic supply current (IDD) analysis has emerged as an effective way for defect oriented testing of analog circuits. In this paper, we propose using wavelet decomposition of IDD for fault detection in analog circuits. Wavelet transform has the property of resolving events in both time and frequency domain simultaneously unlike Fourier expansion which localizes a signal in terms of frequency only. Wavelet transform also has better sub-banding property and it can be easily adapted to current waveforms from different circuits. These make wavelet a more suitable candidate for fault detection in analog circuits than pure time-domain or pure frequency-domain methods. We have shown that for equivalent number of spectral components, sensitivity of wavelet based fault detection is much higher than Fourier or time-domain analysis for both catastrophic and parametric faults. Simulation results on benchmark circuits show that wavelet based method is on average 25 times more sensitive than DFT (Discrete Fourier Transform) for parametric faults and can be considered as a promising alternative for analog fault detection amidst measurement hardware noise and process variation.