Hardware Threats Research Articles

Cracking the Core: Hardware Vulnerabilities in Android Devices Unveiled

As Android devices become more prevalent, their security risks extend beyond software vulnerabilities to include critical hardware weaknesses. This paper provides a comprehensive and systematic review of hardware-related vulnerabilities in Android systems, which can bypass even the most sophisticated software defenses. We compile and analyze an extensive range of reported vulnerabilities, introducing a novel categorization framework to facilitate a deeper understanding of these risks, classified by affected hardware components, vulnerability type, and the potential impact on system security. The paper addresses key areas such as memory management flaws, side-channel attacks, insecure system-on-chip (SoC) resource allocation, and cryptographic vulnerabilities. In addition, it examines feasible countermeasures, including hardware-backed encryption, secure boot mechanisms, and trusted execution environments (TEEs), to mitigate the risks posed by these hardware threats. By contextualizing hardware vulnerabilities within the broader security architecture of Android devices, this review emphasizes the importance of hardware security in ensuring system integrity and resilience. The findings serve as a valuable resource for both researchers and security professionals, offering insights into the development of more robust defenses against the emerging hardware-based threats faced by Android devices.

Bio-mimicking DNA fingerprint profiling for HLS watermarking to counter hardware IP piracy

The multifaceted, multivendor-based global design supply chain induces hardware threats of intellectual property (IP) piracy for modern computing and electronic systems. Current hardware watermarking techniques fall short either in terms of watermark strength (size of covert constraints generated) or number of security layers/variables involved in the security constraints generation process. This paper presents a novel approach for high level synthesis (HLS) watermarking by bio-mimicking DNA fingerprint profiling to counter hardware IP piracy. The proposed approach effectively captures the vital DNA fingerprint profiling phases such as DNA sequencing, DNA fragmentation, fragment replication, DNA ligase, etc. and bio-mimics them to generate a digital watermarking framework. The presented approach has been demonstrated on convolutional layer and JPEG compression-decompression (CODEC) algorithms that are widely used in several medical and machine learning applications. The proposed approach has been thoroughly compared with several state-of-the-art approaches. The proposed approach depicts superior security in the probability of coincidence of up to ~ 104 and tamper tolerance of up to ~ 10368 at 0% overhead as compared to the prior approaches.

Implementation of a Finite Impulse Response Filter using PUFs to Avoid Trojans

In the modern era of signal processing, digital filters play an important role in real-time applications such as communication, consumer electronics, digital signal processing, audio, etc. In digital filter design, Finite Impulse Response (FIR) filters are highly preferable due to their linear phase and inherent stability. These filters benefit from being time-invariant and simple to implement with minimal computational requirements. Therefore, the hardware security of FIR filters is essential for good performance and reliable results. On the other hand, there is the possibility of hardware threats, such as tampering, reverse engineering, hardware Trojans, etc., as the design of an FIR filter involves many stages. Such hardware attacks on FIR filters can cause several problems, including performance degradation, leakage of confidential information, lack of stability, etc. This study presents the design and implementation of a Trojan-aware FIR filter using Physical Unclonable Functions (PUFs). The key feature of PUFs is that they generate a unique and unpredictable response for each given challenge. In the proposed design, PUFs were used to generate the FIR filter coefficients that are unique and unpredictable by attackers/trojans to improve security. The security of FIR with PUF was tested using ML-based challenges, and the results showed approximately 30% more reliability and consistency compared to the FIR without PUFs.

PSO based exploration of multi-phase encryption based secured image processing filter hardware IP core datapath during high level synthesis

Image processing filter intellectual property (IP) cores perform different critical operations on images such as blurring, sharpening, edge detection, etc., which are essential functions in several multimedia systems. The design process of the image filter cores as a dedicated IP needs to consider multiple objectives such as area, delay, and security against various hardware threats such as IP piracy (counterfeiting and cloning) and fraudulent claim of IP ownership during design space exploration (DSE) in high level synthesis (HLS). This paper presents the following novelties: (a) particle swarm optimization (PSO) driven exploration of secured image processing filter IP core datapath architecture during HLS capable of providing detective control against IP piracy threat (b) the proposed approach incorporates embedding of covert security constraints based on the proposed multi-phase encryption algorithm during performing area-delay tradeoff via PSO based DSE. The proposed approach achieves stronger security in terms of digital proof of > 2X and higher tamper tolerance as well as attains a lower design cost of 56.92% in terms of area-delay than recent approaches. The proposed approach also achieves optimal solution as evident from the optimality analysis performed on metrics such as generational distance, spacing, spreading, and weighted sum.

A Neural Network-Based Cognitive Obfuscation Toward Enhanced Logic Locking

Logic obfuscation is introduced as a pivotal defense against multiple hardware threats on Integrated Circuits (ICs), including reverse engineering (RE) and intellectual property (IP) theft. The effectiveness of logic obfuscation is challenged by the recently introduced Boolean satisfiability (SAT) attack and its variants. A plethora of countermeasures has also been proposed to thwart the SAT attack. Irrespective of the implemented defense against SAT attacks, large power, performance, and area overheads are indispensable. In contrast, we propose a cognitive solution: a neural network-based unSAT clause translator, SATConda, that incurs a minimal area and power overhead while preserving the original functionality with impenetrable security. SATConda is incubated with an unSAT clause generator that translates the existing conjunctive normal form (CNF) through minimal perturbations such as the inclusion of pair of inverters or buffers or adding a new lightweight unSAT block depending on the provided CNF. For efficient unSAT clause generation, SATConda is equipped with a multi-layer neural network that first learns the dependencies of features (literals and clauses), followed by a long-short-term-memory (LSTM) network to validate and backpropagate the SAT-hardness for better learning and translation. Our proposed SATConda is evaluated on ISCAS85 and ISCAS89 benchmarks and is seen to defend against multiple state-of-the-art successfully SAT attacks devised for hardware RE. In addition, we also evaluate our proposed SATCondas empirical performance against MiniSAT, Lingeling and Glucose SAT solvers that form the base for numerous existing deobfuscation SAT attacks.

CIST: A Serious Game for Hardware Supply Chain

The globalisation and outsourcing of the IC supply chain have led to a more complex production cycle. Using threat models to understand the attacks can help engineers build stronger countermeasures and evaluate against different options to create better protection from attacks. Gamification is an alternative to teaching engineers threats using threat models and trying to keep up to date with new threats. Playing a serious game based on the IC hardware supply chain allows players to take control of self-learning and build knowledge through experiences in the gameplay. This paper propose CIST: A serious game for hardware supply chain, designed for hardware security and uses a threat model called CIST, designed to overcome the different requirements for hardware threats and gaps in current generic security threat models. The CIST game covers hardware-related risks through the complete IC life cycle from design, manufacturing, using the IC within a system and finally, recycling the ICs.

Secured Convolutional Layer IP Core in Convolutional Neural Network Using Facial Biometric

This paper presents a novel methodology to design a secured custom reusable intellectual property (IP) core for the convolutional layer of convolutional neural network (CNN). Since the reusable IP cores used in system-on-chips (SoCs) of consumer electronics (CE) systems are susceptible to the hardware threat of IP counterfeiting. Therefore, this paper also presents the security of the proposed convolutional layer reusable IP core against the threat of IP counterfeiting using facial biometrics. This enables the integration of secured reusable IP cores in the SoCs of CE systems, thereby ensuring the safety of end consumers. In the proposed approach, the convolutional layer IP core is designed through high-level synthesis (HLS) process and secured by embedding secret biometric security information into the design during register allocation phase of the HLS process. The qualitative and quantitative analysis of the proposed approach exhibits significantly lower probability of coincidence (Pc) (up to 47% less) and higher tamper tolerance (1.93E+25) than recent approaches. Further, it offers robust security with zero design overhead.

Prognostics and Secure Health Management (PSHM) of Electronic Systems in Zero-Trust Environment

The Prognostics and Health Management (PHM) of electronic systems has reached high levels of maturity, with both generic and system-specific PHM techniques available. While these techniques are able to detect naturally occurring faults and predict their impact on the system lifetime, they might not be able to do so if the faults are maliciously induced. Maliciously induced faults could be due to hardware threats; i.e., electronic products that are recycled, remarked, defective, cloned, or tampered (through the insertion of hardware trojans). Increased outsourcing in the fabrication of electronic products has made them susceptible to the insertion of hardware threats in untrusted manufacturing facilities. In many cases, hardware threats are more destructive than software ones as they cannot be remedied by a software patch and are difficult to remove. Hardware threats can cause undesired system behavior such as information leakage, functional failure, maliciously induced aging, etc.
 The proliferation of hardware threats could outpace the implementation of their detection mechanisms. This might lead to a scenario where all products manufactured by untrusted manufacturing facilities are suspect until verified otherwise. This has parallels to Zero-Trust Architecture, a network security concept developed to help prevent data breaches by removing the notion of trust from an organization's network architecture. To extend the concept of Zero-Trust Architecture from the network to the hardware domain and to ensure hardware security, a paradigm shift from PHM to PSHM (Prognostics and Secure Health Management) is needed. This paper lays out a compelling case for the need for this shift and how the PHM community can adapt its research to ensure the safe, reliable, and secure operation of systems in this challenging new environment.

RETRACTED ARTICLE: A Threat Categorization of Risk-Based approach for analyzing Security Threats early phase in SDLC

The security risk assessment is a daunting process that usually requires an in-depth knowledge of the pertinent attack scenarios and the technical understanding of all the security measures implemented in the organization. Small and medium-sized businesses are especially challenged as they can often not operate a full information security department. Sometimes the shortage of security skills and security data for the reason of limited IT resources. Software threats are progressively being used in internet-based, web-data servers, web services, and GUI-based applications. The type of threat modeling is intended for each phase before the accomplishment of the software product. Finding software and hardware threat is the most critical task in the software development life cycle (SDLC). The threat modeling process is included in SDLC at the beginning stage for minimizing the risks. This paper investigates threat attacks in the software development life cycle (SDLC) using threat categorization of risk-based approaches for security threats in the early phase. The intrusion detection attack has been identified for a web application of the healthcare management system. It is classified based on the severity of stages in the Life cycle. The proposed method findings are compared with the Microsoft stride to identify the boundaries of components, ranking of the attacks, and better understand software development and operation threats in software development process.

Methods for assessing the state of protection of enterprises from cybersecurity threats

Nine methods of enterprise security assessment are considered: vulnerability assessment method, network assessment method, virus detection assessment method, authentication assessment method, penetration test assessment method, social engineering threat assessment method, hardware threat assessment method, policy and countermeasures assessment method and a method for assessing natural hazards.

Dynamic power-aware scheduling of real-time tasks for FPGA-based cyber physical systems against power draining hardware trojan attacks

The present era has witnessed deployment of reconfigurable hardware or field-programmable gate arrays (FPGAs) in diverse domains like automation and avionics, which are cyber physical in nature. Such cyber physical systems are associated with strict power budgets. Efficient real-time task-scheduling strategies exist that ensure execution of maximum number of tasks within the power budget. However, these do not consider hardware threats into account. Recent literature has exposed the existence of hardware trojan horses (HTHs). HTHs are malicious circuitry that remain dormant during testing and evade detection, but get activated at runtime to jeopardize operations. HTHs can be etched into the FPGA fabric by adversaries in the untrustworthy foundries, during fabrication of the FPGAs. Even vendors selling reconfigurable intellectual properties or bitstreams that configure the FPGA fabric for task operation may insert HTHs during writing the bitstream codes. HTHs may cause a variety of attacks which may affect the basic security primitives of the system like its integrity, confidentiality or availability. In this work, we explore how power draining ability of HTHs may reduce lifetime of the system. A self-aware approach is also proposed which detects the affected resources of the system and eradicates their use in future to facilitate system reliability. An offline–online scheduling strategy is proposed for periodic tasks which can ensure reliability of their operations till the expected lifetime of the system. Accommodating non-periodic tasks in the periodic task schedule based on available power is also focused. For experimentation, we consider tasks associated with EPFL benchmarks and demonstrate results based on the metric task success rate for periodic tasks and metric task rejection rate for non-periodic tasks.

Enhanced Security of DSP Circuits Using Multi-Key Based Structural Obfuscation and Physical-Level Watermarking for Consumer Electronics Systems

Security of Digital Signal Processing (DSP) based Intellectual Property (IP) core is very important for the overall security and reliability of Consumer Electronics (CE) systems. These DSP based IP cores are highly vulnerable to threats such as reverse engineering (RE) leading to Trojan insertion, counterfeiting and cloning. Thus developing robust defense mechanisms is highly significant for these DSP circuits used in CE systems, especially to thwart the aforesaid threats. This article presents for the first time a double line of defense mechanism using robust multi-key based structural obfuscation integrated with tamper-tolerant physical level watermarking to counter such hardware threats. The proposed approach introduces novel key-driven partitioning based obfuscation and key-driven folding knob based obfuscation, along with other key-driven transformation based obfuscations. Additionally, the proposed approach presents novel multi-variable signature encoding based physical-level watermarking on key-based structurally obfuscated DSP circuits. The presented double line of defense incurs zero overhead as well yields high tamper tolerance during hardware watermarking. The proposed approach yields stronger strength of obfuscation, lower probability of co-incidence and larger key-space at low design cost against attacks.

Design Flow of Secured N-Point DFT Application Specific Processor Using Obfuscation and Steganography

An N-point Discrete Fourier Transform (DFT) has wide application such as speech signal amplitude/phase/frequency spectrum analysis and solving complex numerical problems etc. However a N-point DFT Application Specific Processor (ASP) can be prone to several hardware threats such as reverse engineering, counterfeiting, cloning and fraudulent ownership. This letter proposes a novel design flow of secured N-point DFT application specific processor using high-level transformation based structural obfuscation and crypto-steganography. The proposed design methodology integrates both obfuscation and steganography to yield a robust secured N-point DFT application specific processor design that is capable of achieving 75.28 percent obfuscation at gate-level structure and 99.5 percent enhanced in security w.r.t key-size than recent hardware steganography approach.

Generalized Architecture for Reconfigurable Hardware Security Incorporating PKI

Software-based techniques represent the dominant paradigm for the implementation of network security. Due to the rapidly growing and dynamic nature of contemporary networks security threats are becoming challenging and the overheads of a purely software approach are mounting to enormous proportions. Higher scales of hardware integration have also produced novel types of hardware threats and attacks which cannot be addressed by a purely software approach. Hence the interest in hardware security approaches is increasing. In this paper, we propose a general architecture for hardware-based security that can address the custom security needs of the users. The architecture incorporates the security model adopted in the Public Key Infrastructure (PKI) model for security.

Criticality based reliability against hardware Trojan attacks for processing of tasks on reconfigurable hardware

An important aspect of mixed critical systems is to execute tasks of varied criticality on the same platform. The property of full or partial reconfiguration at runtime of reconfigurable hardware or field programmable gate arrays (FPGAs) has satisfied this criterion and facilitated the processing of mixed critical tasks directly on hardware, with the aid of reconfigurable intellectual properties (IPs) or bitstreams procured from various third party IP (3PIP) vendors. However, the existing literature in this arena does not consider the associated hardware threats. Such threats are particularly dangerous as related malware like Hardware Trojan Horses (HTHs) remain dormant during testing and evade detection, but get activated at runtime and jeopardize mission critical applications. Though several works exist on hardware security, none focus on reliability driven mixed critical task processing on reconfigurable hardware against HTH attacks. In this work, we initially explore how HTHs implanted by 3PIP vendors in the bitstreams may cause active attacks. Then, we develop strategies to ensure reliability for processing of mixed critical tasks on reconfigurable hardware. Both periodic and non-periodic, i.e. aperiodic or sporadic tasks are considered. We also focus on resource constrained environments, where we adhere to frequency scaling to facilitate accommodation of tasks on limited resources. We experiment with a variety of bitstreams and performance evaluation is performed via metrics such as task success rate, task rejection rate and task preemption rate.

Protecting DSP Kernels Using Robust Hologram-Based Obfuscation

Digital signal processing (DSP) kernels-based intellectual property cores are important components of modern consumer electronics. However, hardware threats such as reverse engineering and Trojan insertion have raised serious concerns about the protection of DSP kernels. Structural obfuscation is one of the protection mechanisms that make DSP design architecture un-obvious to interpret, thereby making it harder to reverse engineer. A novel methodology is presented in this paper called “hologram-based structural obfuscation” for protection of DSP kernels. The proposed hologram-based obfuscation integrates two DSP kernel architectures in a camouflaged fashion without change of functionality of each DSP kernel, such that it becomes complex and un-interpretable to an adversary. This approach of simultaneous protection of two DSP kernels via hologram obfuscation is presented first time in the literature. We propose multiple robust obfuscation algorithms in this paper to design hologram-based obfuscated designs and demonstrate using popular DSP kernels. Proposed approach is compared with a recent work on protecting DSP kernels and experimental results indicate that proposed approach yields significantly lesser area and stronger obfuscation. Results of proposed obfuscation on DSP kernels achieve approximately 33.5% reduction in gate count and ~14 times stronger obfuscation than recent work.

Robust Logic locking for Securing Reusable DSP Cores

A System on Chip (SoC) used in Consumer Electronics (CE) systems integrates a number of reusable Intellectual Property (IP) cores from digital signal processing (DSP), multimedia etc. However, these DSP based IP cores are susceptible to various hardware threats such as piracy, Trojan insertion, overbuilding and reverse engineering. Thus, security of DSP cores is very crucial. An IP core can be secured against aforementioned hardware threats by employing logic locking based security mechanisms. This paper presents a novel robust logic locking using hybrid locking cells for securing DSP cores. The proposed logic locking is based on a novel advanced encryption standard (AES) based reconfigurable hybrid locking cell architecture that ensures strong security against key sensitization, removal and SAT attacks. The strength of the proposed approach has been assessed in terms of probability of obtaining correct key of a locked design in exhaustive trials. Results of proposed work on DSP cores yielded higher logic locking strength and lower design overhead compared to recent prior works.

Security of Functionally Obfuscated DSP Core Against Removal Attack Using SHA-512 Based Key Encryption Hardware

Digital signal processing (DSP) kernel-based intellectual property (IP) core forms an integral ingredient of consumer electronics devices. Thus, protection of these IP cores against reverse engineering attack is crucial. Functional obfuscation serves as a powerful mechanism to counter this hardware threat. However, functional obfuscation methodologies for DSP cores use security logics that are not lightweight and are prone to removal attack by an adversary. This paper presents a novel security mechanism for protecting functionally obfuscated DSP core against removal attack using low-cost, low-power key encryption hardware. The proposed methodology using lightweight secure hashing algorithm (SHA-512)-based key encryption custom hardware reconfigures the key-bits (resulting into structural reconfiguration) of the locking logic in a functionally obfuscated DSP design augmented with the complete logic synthesis of the design. This hinders the detection of the locking logic in the obfuscated design due to camouflaging. The proposed mechanism integrated with the functional obfuscation framework yielded lower power, lower gate count, and enhanced security compared with an existing approach. An average reduction of 25.86 % in gate count and power as well as the average enhancement of 43.75 % in security against removal attack was obtained in the proposed approach compared with a recent existing approach.

Perniciousness analysis of IC hardware Trojan based on characteristic function deployment

New hardware security threats are emerging, meanwhile detection and recognition technologies are immature for unknown types. This paper introduces a relation matrix to analysis perniciousness of IC hardware Trojan. The relation matrix is based on characteristic deployment includes concealment of trigger and harmfulness of payload. Results of this paper can be used to measure the perniciousness of different types of hardware Trojan, also provide a way to predict new hardware threats, in this way help to defend unknown hardware attacks and improve detection efficiency.

Guest Editorial Securing IoT Hardware: Threat Models and Reliable, Low-Power Design Solutions

It is well understood that for Internet of Things (IoT), security of underlying hardware is the key to safe and reliable operation. IoT service stack relies on security of network, software, and firmware, all of which, in turn, depend on functionality provided by the underlying hardware. The hardware may be compromised or attacked by multiple threat actors. The designer may create a backdoor that leaks vital information such as encryption key used in secure channel; the manufacturer may tamper the design by inserting hardware Trojans or introducing artifacts with known reliability vulnerabilities. Either of these actors may enable writing into protected memory areas that may store secure hash of trusted code base, allowing malware to boot directly on the hardware. Today’s designs integrate IP blocks from multiple vendors; manufactured, tested, and repaired by different companies spanning across the globe. Consequently, there are many entry points for the hardware to be compromised. For a trusted hardware design, protection and security of intellectual property cores are of paramount importance. This special section aims to publish novel solutions for security problems related to hardware used in IoT. • Secured IoT Hardware : Induction of any form of third-party intervention in the hardware design methodology may raise grave security concern for IoT hardware. Securing IoT hardware can be in the form of protecting intellectual property cores against false claim of ownership/piracy/counterfeit. The first form of security measure requires anti-piracy methodologies such as digital watermarking, hardware metering, computational forensic engineering, and obfuscation that can nullify the false claim of ownership or detect unauthorized pirated designs. The second form of threat, which is formally called “hardware Trojan,” is an act of deliberate insertion into a design (such as intellectual property core, hardware) by a rogue designer or vendor, and also requires detection/correction strategies as a security measure. Both hardware threats discussed above may occur in any of the design abstraction levels (behavioral, register transfer, layout, etc.). Handling the threats higher in the abstraction level provides more assurance against possible attacks, however, it requires a more sophisticated approach. Further more, the level at which protective measure is applied often dictates the preprocessing or postprocessing style of the approach. These calls for novel technique that embeds hardware security measure a higher abstraction level for protection of IoT devices. • Reliable IoT Hardware : Due to multiple factors affecting reliability of hardware used in IoT devices, these devices are always at a risk of malfunctioning. For example, a manufacturer may deliberately change the width of a metal line for causing premature electromigration defect, possibly triggering a timed Trojan. Multiple trigger mechanisms may be used to attack hardware such as: 1) reducing device dimensions; 2) scaling supply voltage; and 3) modulating frequency of operation. Methodologies should incorporate techniques that provide resiliency/tolerance against such faults at higher abstraction levels to assure greater reliability from the beginning of design flow. • Low-Cost IoT Hardware: Another design aspect of hardware for IoT devices is performance and power. Consumer demand drives integration of multiple functionalities, often achieved by integrating dedicated IP cores and general purpose processors working in tandem. This creates a unique challenge in maintaining security and integrity of data passing through various IP blocks. Standard solutions involving redundancy, diversity, and check run up against power, performance, and latency constraints.