Hardware Intellectual Property Research Articles

Secure hardware IP of GLRT cascade using color interval graph based embedded fingerprint for ECG detector

This paper presents a security aware design methodology to design secure generalized likelihood ratio test (GLRT) hardware intellectual property (IP) core for electrocardiogram (ECG) detector against IP piracy and fraudulent claim of IP ownership threats. Integrating authentic (secure version) GLRT hardware IP core in the system-on-chip (SoC) of ECG detectors is paramount for reliable operation and estimation of ECG parametric data, such as Q wave, R wave and S wave (QRS) complex detection. A pirated GLRT hardware IP integrated into an ECG detector may result in an unreliable/erratic estimation of ECG parametric data that can be hazardous and fatal for the end patient. The proposed methodology presents an integrated design flow to secure micro GLRT and GLRT cascade hardware IP cores for the ECG detector, using the colored interval graph (CIG) framework based fingerprint biometric, during high level synthesis (HLS). The proposed approach integrates a fingerprint biometric based security constraint generation process for securing the GLRT hardware IP core. This paper also presents a secure register transfer level (RTL) datapath design corresponding to micro GLRT and GLRT cascade hardware IP cores with embedded IP vendor's fingerprint. The proposed secure GLRT hardware IP core embedded with fingerprint biometric achieves superior results in terms of probability of coincidence and tamper tolerance than other security approaches. More explicitly, the proposed approach reports a significantly lower value of probability of coincidence and stronger value for tamper tolerance. Further, the proposed approach incurs zero design cost overhead.

HLS-IRT: Hardware Trojan Insertion through Modification of Intermediate Representation During High-Level Synthesis

Modern integrated circuit (IC) design incorporates the usage of proprietary computer-aided design (CAD) software and integration of third-party hardware intellectual property (IP) cores. Subsequently, the fabrication process for the design takes place in untrustworthy offshore foundries that raises concerns regarding security and reliability. Hardware Trojans (HTs) are difficult to detect malicious modifications to IC that constitute a major threat, which if undetected prior to deployment, can lead to catastrophic functional failures or the unauthorized leakage of confidential information. Apart from the risks posed by rogue human agents, recent studies have shown that high-level synthesis (HLS) CAD software can serve as a potent attack vector for inserting Hardware Trojans (HTs). In this paper, we introduce a novel automated attack vector, which we term “HLS-IRT”, by inserting HT in the register transfer logic (RTL) description of circuits generated during a HLS based IC design flow, by directly modifying the compiler-generated intermediate representation (IR) corresponding to the design. We demonstrate the attack using a design and implementation flow based on the open-source Bambu HLS software and Xilinx FPGA, on several hardware accelerators spanning different application domains. Our results show that the resulting HTs are surreptitious and effective, while incurring minimal design overhead. We also propose a novel detection scheme for HLS-IRT, since existing techniques are found to be inadequate to detect the proposed HTs.

Security Evaluation of State Space Obfuscation of Hardware IP through a Red Team-Blue Team Practice

Due to the inclination towards a fab-less model of integrated circuit (IC) manufacturing, several untrusted entities get white-box access to the proprietary intellectual property (IP) blocks from diverse vendors. To this end, the untrusted entities pose security-breach threats in the form of piracy, cloning, and reverse-engineering, sometimes threatening national security. Hardware obfuscation is a prominent countermeasure against such issues. Obfuscation allows for preventing the usage of the IP blocks without authorization from the IP owners. Due to finite state machine (FSM) transformation-based hardware obfuscation, the design’s FSM gets transformed to make it difficult for an attacker to reverse-engineer the design. A secret key needs to be applied to make the FSM functional, thus preventing the usage of the IP for unintended purposes. Although several hardware obfuscation techniques have been proposed, due to the inability to analyze the techniques from the attackers’ standpoint, numerous vulnerabilities inherent to the obfuscation methods go undetected unless a true adversary discovers them. In this article, we present a collaborative approach between two entities—one acting as an attacker or red team and another as a defender or blue team , the first systematic approach to replicate the real attacker-defender scenario in the hardware security domain, which in return strengthens the FSM transformation-based obfuscation technique. The blue team transforms the underlying FSM of a gate-level netlist using state space obfuscation. The red team plays the role of an adversary or evaluator and tries to unlock the design by extracting the unlocking key or recovering the obfuscation circuitries. As the key outcome of this red team–blue team effort, a robust state space obfuscation methodology is evolved showing security promises.

TROP: TRust-aware OPportunistic Routing in NoC with Hardware Trojans

Multiple software and hardware intellectual property (IP) components are combined on a single chip to form Multi-Processor Systems-on-Chips (MPSoCs). Due to the rigid time-to-market constraints, some of the IPs are from outsourced third parties. Due to the supply-chain management of IP blocks being handled by unreliable third-party vendors, security has grown as a crucial design concern in the MPSoC. These IPs may get exposed to certain unwanted practises like the insertion of malicious circuits called Hardware Trojan (HT) leading to security threats and attacks, including sensitive data leakage or integrity violations. A Network-on-Chip (NoC) connects various units of an MPSoC. Since it serves as the interface between various units in an MPSoC, it has complete access to all the data flowing through the system. This makes NoC security a paramount design issue. Our research focuses on a threat model where the NoC is infiltrated by multiple HTs that can corrupt packets. Data integrity verified at the destination’s network interface (NI) triggers re-transmissions of packets if the verification results in an error. In this article, we propose an opportunistic trust-aware routing strategy that efficiently avoids HT while ensuring that the packets arrive at their destination unaltered. Experimental results demonstrate the successful movement of packets through opportunistically selected neighbours along a trust-aware path free from the HT effect. We also observe a significant reduction in the rate of packet re-transmissions and latency at the expense of incurring minimum area and power overhead.

Scaling Attacks on Large Logic-Locked Designs

Researchers have developed numerous strategies to alleviate the threat of malicious third-party foundries, including logic locking and its numerous sophisticated variants for hardware intellectual property (IP) protection. Recent work at the register-transfer level has opened the door to “large-scale” locking of large IPs (comprising thousands of gates) with hundreds to thousands of key bits. Recent security evaluation of such techniques treats the locked design as a monolith and has suggested that large logic-locked designs are practically secure, even from powerful SAT-based attacks. In this work, we challenge such findings by proposing and evaluating a novel algorithmic method to de-obfuscate large logic-locked circuits by attacking a set of small sub-circuit cones. The algorithm chooses a sub-optimal set of sub-circuit cones and proposes an attack sequence on these cones by leveraging the observation that each locking key-bit is distributed across multiple sub-circuit cones of varying sizes. This Divide And Conquer SAT (DACSAT) attack framework can de-obfuscate large designs, like an AES IP comprising 300,000 gates, logic-locked with up to 50,000 keys in around 3600 seconds, while an out-of-the-box, state-of-the-art SAT attack tool fails.

Multi-cut based architectural obfuscation and handprint biometric signature for securing transient fault detectable IP cores during HLS

This paper presents a novel dual defense security methodology for fault detectable reusable hardware intellectual property (IP) core against reverse engineering and piracy using multi-cut based architectural obfuscation and handprint biometric signature, useful for consumer electronics (CE) systems. The proposed approach, firstly generates a fault detectable design corresponding to target application framework. Subsequently, multiple cut insertion is executed resulting in multi-checkpointing which in turn camouflages the hardware design architecture during high level synthesis (HLS), thereby making it uninterpretable for an adversary. Next, handprint biometric signature of IP vendor is covertly embedded into the fault detectable IP design, which provides robust and seamless detective countermeasure against piracy. The proposed methodology achieves the following: a) strength of obfuscation ∼14 % b) robust detective control against piracy using handprint biometric signature at 0.0 % design cost overhead c) robust security in terms of digital proof against piracy as evident from lesser probability of coincidence and higher tamper tolerance.

Exploration of optimal functional Trojan-resistant hardware intellectual property (IP) core designs during high level synthesis

Hardware Trojans that have the capability to change the computed functional output in intellectual property (IP) cores, integrated into computing systems can be a vital reliability concern in the context of correct system operation. Therefore, determining an optimal Trojan-resistant hardware design architecture that considers multi-objective orthogonal parameters such as area and delay is crucial. This paper presents a novel exploration of optimal hardware IP core design methodology with Trojan defense capability (i.e., detection and isolation) during high level synthesis (HLS) that provides isolation of functional Trojan in a system design to ensure reliable and correct functional behavior. The proposed methodology is robust and provides the capability to yield the correct output value using HLS-based triple modular redundancy (TMR) logic and a distinct multivendor allocation policy. Therefore, the proposed HLS methodology can generate an optimal hardware IP core/system-on-chip (SoC) design with functional Trojan defense capability. The paper presents an overall flow of the proposed methodology along with a demonstrative case study on designing optimal Trojan resistant finite impulse response filter (FIR) hardware SoC design. Results of the proposed approach are evaluated in terms of design cost, convergence time, security and optimality analysis, and comparison with prior works. The proposed approach is able to generate fully functional Trojan-resistant optimal SoC designs with minimum overhead, as evident from optimality analysis and design cost.

A Framework for Automated Exploration of Trojan Attack Space in FPGA Netlists

Field Programmable Gate Arrays (FPGAs) provide a flexible compute platform for quick prototyping or hardware acceleration in diverse application domains. However, similar to the global semiconductor life-cycle in the modern supply chain, FPGA-based product development includes processes and interactions with potentially untrusted parties outside the traditional scrutiny of a completely in-house development cycle. An untrusted party or software can maliciously alter a hardware intellectual property (IP) block mapped to an FPGA device during various stages of the FPGA life-cycle. Such malicious alterations, also known as hardware Trojan attacks, have garnered significant research into their detection and prevention in the context of application-specific integrated circuit (ASIC) design flow. However, Trojan attacks in FPGAs have not enjoyed this same attention. Designers often rely on mapping ASIC-specific solutions and evaluation benchmarks to the FPGA domain, which leaves much of the FPGA-specific Trojan space uncovered. We note that the distinctive business model as well as the architectural configurations of FPGAs present unique opportunities for Trojan attacks to an adversary. To this end, we introduce a framework to automatically explore the hardware Trojan attack space in FPGA netlists. It is capable of inserting different types of FPGA-specific Trojans in a netlist enabling rapid exploration of potential Trojan attacks in an FPGA design: soft-template, monolithic, and distributed dark silicon. Soft template Trojans use behavioral templates with random synthesis constraints to increase Trojan structural diversity. Monolithic and distributed dark silicon Trojans use the under-utilized input space (FPGA dark silicon) in FPGA primitives to realize Trojans with effectively zero area and power footprint. Further optimizations are also presented to remove any potential delay impact. We then generate over 1300 Trojan-inserted benchmarks using each of the introduced FPGA Trojan classes, and compare their impact on utilization, delay, and power. Finally, we evaluate our Trojans against a machine learning-based Trojan detection to highlight their evasiveness.

Exploration of optimal crypto-chain signature embedded secure JPEG-CODEC hardware IP during high level synthesis

The design process of the JPEG-CODEC as a reusable hardware intellectual property (IP) core for electronic and multimedia systems involves conflicting design goals such as area and latency, alongside providing hardware security against IP piracy and false claims of IP ownership during high-level synthesis (HLS). The proposed work introduces the following novelties: (a) firefly algorithm (FFA)-driven design space exploration (DSE) for generating optimal design solution of secure JPEG-CODEC hardware IP design during HLS, (b) covert security constraints generation process based on key-driven crypto-chain driven hardware security methodology during performing area-latency tradeoff, (c) embedding process that integrates covert security constraints into the design of the JPEG-CODEC. The proposed approach enables the detection of IP piracy and false IP ownership claim. The proposed methodology obtains stronger tamper tolerance ability of > ∼10,116 times and enhanced digital evidence (probability of coincidence) of > ∼102 times than similar recent techniques at lesser design cost. Moreover, the proposed approach attains stronger entropy value of > ∼1078 times than similar recent techniques.

Retinal Biometric for Securing JPEG-Codec Hardware IP Core for CE Systems

Fake/pirated hardware intellectual property (IP) cores integrated in consumer electronics systems can cause reliability hazards and jeopardize the safety of end consumer. Robust detection and isolation of such pirated IP cores before integration is therefore crucial. Existing approaches do not provide robust security against replication or evasion of IP detection resulting into higher probability of coincidence (Pc) and lesser tamper tolerance (TT) compared to the proposed approach. Further, compared to existing biometric based hardware security methodologies, the proposed approach provides more distinctive features and does not require image enhancement; while compared to non-biometric based hardware security methodologies, the proposed approach provides natural uniqueness and non-replicability of features through retinal image. This paper presents a novel retina biometric-based hardware security methodology for securing JPEG compression-decompression (CODEC) hardware IP core against IP piracy. The proposed result reports the following: (a) variation in Pc metric for different sizes of embedded retinal signature and different retinal images (b) variation of TT for proposed approach for different retinal images (c) security comparison of proposed approach with facial, fingerprint biometric and encrypted digital signature-based hardware security approaches (d) Pc-design cost tradeoff for proposed retinal biometric approach. Results indicate enhancement in security at zero design overhead.

A survey on security analysis of machine learning-oriented hardware and software intellectual property

Intellectual Property (IP) includes ideas, innovations, methodologies, works of authorship (viz., literary and artistic works), emblems, brands, images, etc. This property is intangible since it is pertinent to the human intellect. Therefore, IP entities are indisputably vulnerable to infringements and modifications without the owner’s consent. IP protection regulations have been deployed and are still in practice, including patents, copyrights, contracts, trademarks, trade secrets, etc., to address these challenges. Unfortunately, these protections are insufficient to keep IP entities from being changed or stolen without permission. As for this, some IPs require hardware IP protection mechanisms, and others require software IP protection techniques. To secure these IPs, researchers have explored the domain of Intellectual Property Protection (IPP) using different approaches. In this paper, we discuss the existing IP rights and concurrent breakthroughs in the field of IPP research; provide discussions on hardware IP and software IP attacks and defense techniques; summarize different applications of IP protection; and lastly, identify the challenges and future research prospects in hardware and software IP security.

SoC Reconfigurable Architecture for Implementing Software Trained Recurrent Neural Networks on FPGA

Recurrent neural networks (RNNs) are used extensively in time series data applications. Modern RNNs consist of three layer types: recurrent, Fully-Connected (FC), and attention. This paper introduces the design, acceleration, implementation, and verification of a complete reconfigurable RNN using a system-on-chip approach on an FPGA. This design is suitable for small-scale projects and Internet of Things (IoT) end devices as the design utilizes a small number of hardware resources compared to previous configurable architectures. The proposed reconfigurable architecture consists of three layers. The first layer is a Python software layer that contains a function serving as the architecture’s user interface. The output of the python function is three binary files containing the RNN architecture description and trained parameters. The embedded software layer implemented on an on-chip ARM microcontroller is the second layer of that architecture. This layer reads the first layer output files and configures the hardware layer with the required configuration and parameters to execute each layer in the RNN. The hardware layer consists of two Intellectual Properties (IPs) with different configurations. The Recurrent Layer Hardware IP implements the recurrent layer using either Long Short Term Memory (LSTM) or Gated Recurrent Unit (GRU) as basic building blocks, while the ATTENTION/FC IP implements the attention layer and the FC layer. The proposed design allows the implementation of a recurrent layer on an FPGA with variable input and a hidden vector length of up to 100 elements for each vector. It also supports implementing an attention layer with up to 64 input vectors and a maximum vector length of 100 items. The FC layers can be configured to support a maximum value of 256 for the input vector length and the number of neurons in each layer. The hardware design of the recurrent layer achieves a maximum performance of 1.958 and 2.479 GOPS for the GRU and LSTM models, respectively. The maximum performance of the attention and FC layers is 2.641 GOPS and 634.3 MOPS, respectively. The hardware design works at a maximum frequency of 100 MHz.

PSO based exploration of multi-phase encryption based secured image processing filter hardware IP core datapath during high level synthesis

Image processing filter intellectual property (IP) cores perform different critical operations on images such as blurring, sharpening, edge detection, etc., which are essential functions in several multimedia systems. The design process of the image filter cores as a dedicated IP needs to consider multiple objectives such as area, delay, and security against various hardware threats such as IP piracy (counterfeiting and cloning) and fraudulent claim of IP ownership during design space exploration (DSE) in high level synthesis (HLS). This paper presents the following novelties: (a) particle swarm optimization (PSO) driven exploration of secured image processing filter IP core datapath architecture during HLS capable of providing detective control against IP piracy threat (b) the proposed approach incorporates embedding of covert security constraints based on the proposed multi-phase encryption algorithm during performing area-delay tradeoff via PSO based DSE. The proposed approach achieves stronger security in terms of digital proof of > 2X and higher tamper tolerance as well as attains a lower design cost of 56.92% in terms of area-delay than recent approaches. The proposed approach also achieves optimal solution as evident from the optimality analysis performed on metrics such as generational distance, spacing, spreading, and weighted sum.

SeVNoC: Security Validation of System-on-Chip Designs With NoC Fabrics

Modern System-on-Chip (SoC) designs include a variety of Network-on-Chip (NoC) fabrics to implement coordination and communication of integrated hardware intellectual property (IP) blocks. An important class of security vulnerabilities involves a rogue hardware IP interfering with this communication to compromise the integrity of the system. Such interference includes message mutation, misdirection, delivery prevention, or IP masquerading, among others. In this article, we propose a scalable RTL-level SoC validation scheme, SeVNoC, for the systematic detection of security violations in inter-IP communications for SoC designs with NoC fabrics. Given a target security property to be validated, SeVNoC entails extraction of the control-flow graph of the relevant SoC, which is analyzed through a security property-based model comparison, without incurring state-space explosion. Our experiments on full-scale realistic SoC designs with multiple IPs and NoC architecture indicate that SeVNoC detects security violations in NoC communications with near-perfect accuracy, within only a few minutes.

A Gate-Level Information Leakage Detection Framework of Sequential Circuit Using Z3

Hardware intellectual property (IP) cores from untrusted vendors are widely used, raising security concerns for system designers. Although formal methods provide powerful solutions for detecting malicious behaviors in hardware, the participation of manual work prevents the methods from reaching practical applications. For example, Information Flow Tracking (IFT) represents a powerful approach to preventing leakage of sensitive information. However, existing IFT solutions either introduce hardware overheads or lack practical automatic working procedures, especially for hardware sequential logic. To alleviate these challenges, we propose a framework that fully automates information leakage detection at the gate level of hardware. This framework introduces Z3, an SMT solver, to automatically check the violation of confidentiality. On the other hand, an automatic tool is developed to remove the manual workload further. In this tool, the gate level hardware is converted to the formal model firstly, and the integrity of the model is assessed. Along with the model converting step, the property for leakage detection is generated as well. The proposed solution is tested on 25 gate-level netlist benchmarks, where sequential designs are included to validate the effectiveness. As a result, Trojans leaking information from circuit outputs can be automatically detected. The measured time consumption of the entire working procedure validates the efficiency of the proposed approach.

Quadruple phase watermarking during high level synthesis for securing reusable hardware intellectual property cores

Reusable hardware intellectual property (IP) cores play a significant role in the modern system on chip (SoC) designs. However, raging threats of IP piracy and IP ownership infringement sabotage revenue and reputation of genuine IP vendors. This paper presents a novel quadruple phase watermarking for securing hardware IP cores during high level synthesis (HLS). The proposed approach introduces several novelties: graph partitioning, encoding tree, and eightfold mapping to generate a robust watermarking signature. Further, embedding signature during four phases of HLS viz. scheduling, register binding, resource binding and interconnect binding leads to a high-quality watermark. The proposed results indicate multiple times lower Pc and higher tamper tolerance than previous approaches, at negligible design cost overhead. We achieved improvements in Pc and tamper tolerance up to 1018 and 1052 times respectively than related works. Finally, security and design cost tradeoff for various signature strengths is presented.

A SEPIC-based three-port converter system using a mode-specific power flow management control for solar energy harvesting

The growing demand of renewable energy sources in the energy sector has a considerable impact on the development of stand-alone solar photovoltaic (PV) systems. Three-port converter (TPC) topologies are widely used as a gateway between solar PV, energy storage, and loads. This paper proposes a three-port converter with buck and boost operating modes. The topology is SEPIC-based rather than the conventional buck-boost or Cuk circuit, hence eliminates the inverting output and reduce the input current ripple. The series capacitor in a SEPIC converter endows the TPC with inherent protection against short-circuit output. The TPC has four modes of operation: Dual Output (DO) mode, Dual Input (DI) mode, Single Input Single Output-1 (SISO-1) mode and Single Input Single Output-2 (SISO-2) mode. The power flow management algorithm employs a mode-specific voltage regulation strategy that distributes the duty cycle for each switch via time-sharing control scheme. Small signal model of the TPC is developed in each operating mode and based on this, voltage controller parameters are derived. When the TPC changes modes, the algorithm modifies the controller parameters to the mode-specific values. The proposed system is implemented by utilising the FPGA Cyclone-III comprising the Nios-II processor core with necessary hardware intellectual property (IP) forming a System on a Programmable Chip (SoPC). The system is evaluated in real time using a 120W solar PV as the energy source and lead-acid battery as the storage.

Hardware obfuscation of AES IP core using combinational hardware Trojan circuit for secure data transmission in IoT applications

SummaryIn semiconductor industry, reusability‐based System‐on‐Chip architecture using hardware intellectual property (IP) cores play a prominent role in Internet‐of‐Things (IoT) applications for secure data transmission. The advent of IoT makes it possible for physical things to transmit, process, compute, and receive data over internet. But, it also introduces in‐device communication security vulnerabilities. Advanced Encryption Standard (AES) IP has been used to address security vulnerabilities in IoT. It is an efficient and high‐performance crypto algorithm used in IoT devices for secure and fast data encryption. However, due to rise of many attacks, the security of AES IP is also under threat. Hardware obfuscation is one such prominent countermeasure that mitigates hardware attacks such as tampering, reverse engineering, and malicious alteration. This article presents secure AES IP mechanism using the potential technique of obfuscation inspired by the concept of combinational hardware Trojan. Experimental results show that the proposed technique is resilient against reverse‐engineering, malicious alteration, Boolean satisfiability attack, and key‐sensitizing attacks. The confusion and diffusion features of obfuscated AES IP are higher in terms of Hamming distance, avalanche effect, and balance rate. The proposed technique is implemented in Basys‐3 FPGAs within 5% of power and area overhead while maintaining high throughput.

A fast prototype for modeling IP cores using in SoC with UML Marte.

The gap between production systems and technological development has been growing in recent times, leading to the reuse of predesigned and preverified components called Intellectual Property (IP). The growth of the latter is not going to happen without encountering some difficulties; we include among some a lack of standards for the implementation of IPs, making integration difficult, only one incentive to some types of hardware or software IPs and generally an incomplete development approach. In this paper, we present a comprehensive approach for modeling an IPs starting from a metamodeling. The approach is based in a Model-Driven Engineering (MDA) methodology, used standards for SoC (Systems-on-Chip) specification, MARTE and Hardware Description Languages (HDLs). We illustrate our methodology in the case of USB 3.1, using Papyrus for modeling. Results are encouraging and show that the proposed approach allows creating cores of any size

A Configurable RO-PUF for Securing Embedded Systems Implemented on Programmable Devices

Improving the security of electronic devices that support innovative critical services (digital administrative services, e-health, e-shopping, and on-line banking) is essential to lay the foundations of a secure digital society. Security schemes based on Physical Unclonable Functions (PUFs) take advantage of intrinsic characteristics of the hardware for the online generation of unique digital identifiers and cryptographic keys that allow to ensure the protection of the devices against counterfeiting and to preserve data privacy. This paper tackles the design of a configurable Ring Oscillator (RO) PUF that encompasses several strategies to provide an efficient solution in terms of area, timing response, and performance. RO-PUF implementation on programmable logic devices is conceived to minimize the use of available resources, while operating speed can be optimized by properly selecting the size of the elements used to obtain the PUF response. The work also describes the interface added to the PUF to facilitate its incorporation as hardware Intellectual Property (IP)-modules into embedded systems. The performance of the RO-PUF is proven with an extensive battery of tests, which are executed to analyze the influence of different test strategies on the PUF quality indexes. The configurability of the proposed RO-PUF allows establishing the most suitable “cost/performance/security-level” trade-off for a certain application.