Third-party Intellectual Property Research Articles

Hardware Trojan Detection using Graph Neural Networks

The globalization of the Integrated Circuit (IC) supply chain has moved most of the design, fabrication, and testing process from a single trusted entity to various untrusted third party entities around the world. The risk of using untrusted third-Party Intellectual Property (3PIP) is the possibility for adversaries to insert malicious modifications known as Hardware Trojans (HTs). These HTs can compromise the integrity, deteriorate the performance, and deny the functionality of the intended design. Various HT detection methods have been proposed in the literature; however, many fall short due to their reliance on a golden reference circuit, a limited detection scope, the need for manual code review, or the inability to scale with large modern designs. We propose a novel golden reference-free HT detection method for both Register Transfer Level (RTL) and gate-level netlists by leveraging Graph Neural Networks (GNNs) to learn the behavior of the circuit through a Data Flow Graph (DFG) representation of the hardware design. We evaluate our model on a custom dataset by expanding the Trusthub HT benchmarks trusthub1. The results demonstrate that our approach detects unknown HTs with 97% recall (true positive rate) very fast in 21.1ms for RTL and 84% recall in 13.42s for Gate-Level Netlist.

Secure Instruction and Data-Level Information Flow Tracking Model for RISC-V

With the proliferation of electronic devices, third-party intellectual property (3PIP) integration in the supply chain of the semiconductor industry and untrusted actors/fields have raised hardware security concerns that enable potential attacks, such as unauthorized access to data, fault injection and privacy invasion. Different security techniques have been proposed to provide resilience to secure devices from potential vulnerabilities; however, no one technique can be applied as an overarching solution. We propose an integrated Information Flow Tracking (IFT) technique to enable runtime security to protect system integrity by tracking the flow of data from untrusted communication channels. Existing hardware-based IFT schemes are either fine-, which are resource-intensive, or coarse-grained models, which have minimal precision logic, providing either control-flow or data-flow integrity. No current security model provides multi-granularity due to the difficulty in balancing both the flexibility and hardware overheads at the same time. This study proposes a multi-level granularity IFT model that integrates a hardware-based IFT technique with a gate-level-based IFT (GLIFT) technique, along with flexibility, for better precision and assessments. Translation from the instruction level to the data level is based on module instantiation with security-critical data for accurate information flow behaviors without any false conservative flows. A simulation-based IFT model is demonstrated, which translates the architecture-specific extensions into a compiler-specific simulation model with toolchain extensions for Reduced Instruction Set Architecture (RISC-V) to verify the security extensions. This approach provides better precision logic by enhancing the tagged mechanism with 1-bit tags and implementing an optimized shadow logic that eliminates the area overhead by tracking the data for only security-critical modules.

Graph based heterogeneous feature extraction for enhanced hardware Trojan detection at gate-level using optimized XGBoost algorithm

The requirement of reduced production costs in the domain of integrated circuit(IC) manufacturing and constrained time-to-market are met at the cost of a plethora of security concerns in chip design. In the fourth industrial revolution, where system-on-chip forms the backbone of various electronics, malicious hardware modules known as hardware Trojans within the third-party intellectual property impose a significant security threat. The flexibility and ease of intrusion provided in the earlier stages of design, known as the pre-silicon stage, make it vulnerable to these hardware attacks. Such a scenario further emphasizes the need for effective pre-silicon detection schemes. Since this stage is more vulnerable to hardware attacks. Most existing pre-silicon schemes rely on domain knowledge for feature extraction to develop knowledge-driven but exhibit limited Trojan space exploration. Hence, a proposal that comprises four major stages, viz., multifaceted heterogeneous feature extraction, dynamic hybrid sampling, mutual information-based feature selection, and genetic algorithm-based optimization, has been attempted to handle the challenges. Experimentation on TRIT-TC benchmark circuits resulted in a better predictive value for the chosen test circuits, which proves that the proposal outperforms existing schemes.

High-Level Approaches to Hardware Security: A Tutorial

Designers use third-party intellectual property (IP) cores and outsource various steps in the integrated circuit (IC) design and manufacturing flow. As a result, security vulnerabilities have been rising. This is forcing IC designers and end users to re-evaluate their trust in ICs. If attackers get hold of an unprotected IC, they can reverse engineer the IC and pirate the IP. Similarly, if attackers get hold of a design, they can insert malicious circuits or take advantage of “backdoors” in a design. Unintended design bugs can also result in security weaknesses. This tutorial paper provides an introduction to the domain of hardware security through two pedagogical examples of hardware security problems. The first is a walk-through of the scan chain-based side channel attack. The second is a walk-through of logic locking of digital designs. The tutorial material is accompanied by open access digital resources that are linked in this article.

Split and Eliminate: A Region-Based Segmentation for Hardware Trojan Detection

Using third-party intellectual properties (3PIP) has been a norm in IC design development process to meet the time-to-market demand and at the same time minimizing the cost. But this flow introduces a threat, such as hardware trojan, which may compromise the security and trustworthiness of underlying hardware, like disclosing confidential information, impeding normal execution and even permanent damage to the system. In years, different detections methods are explored, from just identifying if the circuit is infected with hardware trojan using conventional methods to applying machine learning where it identifies which nets are most likely are hardware trojans. But the performance is not satisfactory in terms of maximizing the detection rate and minimizing the false positive rate. In this paper, a new hardware trojan detection approach is proposed where gate-level netlist is segmented into regions first before analyzing which nets might be hardware trojans. The segmentation process depends on the nets' connectivity, more specifically by looking on each fanout points. Then, further analysis takes place by means of computing the structural similarity of each segmented region and differentiate hardware trojan nets from normal nets. Experimental results show 100% detection of hardware trojan nets inserted on each benchmark circuits and an overall average of 1.38% of false positive rates which resulted to a higher accuracy with an average of 99.31%.

IP-Tag: Tag-Based Runtime 3PIP Hardware Trojan Detection in SoC Platforms

The complexity of modern system-on-chip (SoC) designs and the ever shortened time-to-market (TTM) makes the third-party intellectual property (3PIP) a cornerstone in the modern SoC supply chain. Various 3PIPs are involved in modern SoCs, performing functionality ranging from computation accelerating to sensitive data processing. The wide use of 3PIPs also raises security concerns, e.g., hardware Trojans inserted in 3PIPs may compromise the security of the whole system. While SoC integrators carefully evaluate the functionality of the acquired 3PIPs, there lack effective and low-cost solutions for third-party IP security validation in the SoC environment. Exacerbating the issue, Trojans may be located in multiple IPs and will only perform malicious tasks collaboratively. To address these limitations and to protect modern SoCs, we propose a runtime 3PIP Trojan detection framework. The new framework, named IP-Tag, is a tag-based structure to track the requests on SoC and enforce fine-grained access control in individual IPs. The proposed framework can detect and prevent illegal access and sensitive data leakage on IPs within the SoC environment. The proposed IP-Tag framework was demonstrated on an RISC-V-based SoC and also implemented on an FPGA platform for security and performance analysis. Our experimental results show that the developed IP-Tag can detect and prevent illegal access and sensitive data leakage in SoC with malicious IPs. The hardware overhead is 7.9% LUTs and 7.8% Flip-Flops and a performance overhead is 2.2%.

Golden Reference-Free Hardware Trojan Localization Using Graph Convolutional Network

The globalization of the integrated circuit (IC) supply chain has moved most of the design, fabrication, and testing process from a single trusted entity to various untrusted third-party entities worldwide. The risk of using untrusted third-Party Intellectual Property (3PIP) is the possibility for adversaries to insert malicious modifications known as Hardware Trojans (HTs). These HTs can compromise the integrity, deteriorate the performance, deny the service, and alter the functionality of the design. While numerous HT detection methods have been proposed in the literature, the crucial task of HT localization is overlooked. Moreover, a few existing HT localization methods have several weaknesses: reliance on a golden reference, inability to generalize for all types of HT, lack of scalability, low localization resolution, and manual feature engineering/property definition. To overcome their shortcomings, we propose a novel, golden reference-free HT localization method at the pre-silicon stage by leveraging graph convolutional network (GCN). In this work, we convert the circuit design into its intrinsic data structure, graph, and extract the node attributes. Afterward, the graph convolution performs automatic feature extraction for nodes to classify the nodes as Trojan or benign. Our approach is automated and does not burden the designer with manual code review. It locates the Trojan signals with 99.6% accuracy, 93.1% <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$F1$ </tex-math></inline-formula> -score, and a false-positive rate below 0.009%.

Digitally Assisted Mixed-Signal Circuit Security

The design and manufacturing steps of a chip typically involve several parties. For example, a chip may comprise several third-party intellectual property (IP) cores and the integrated circuit (IC) fabrication may be outsourced to a third-party foundry. IP cores and ICs are shared with potentially untrusted third parties and, as a result, are subject to piracy attacks. Even more, any legally purchased chip may be reverse engineered to retrieve the design down to transistor level and, thereby, it is also subject to piracy attacks. In this article, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MixLock</i> , an anti-piracy countermeasure for mixed-signal IP cores and ICs. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MixLock</i> protection is based on inserting a lock mechanism into the design such that correct functionality is established only after applying a key which is the designer’s secret. The lock mechanism acts on the mixed-signal performances by leveraging logic locking of the digital part. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MixLock</i> presents several key attributes. It is generally applicable, it is nonintrusive to the sensitive analog section, it incurs no performance penalty and has very low area and power overheads, it is fully automated, and it is capable of co-optimizing security in both the analog and digital domains. We demonstrate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MixLock</i> on a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\Sigma \Delta $ </tex-math></inline-formula> analog-to-digital converter (ADC) using hardware measurements and an audio demonstrator.

Privacy-Preserving IP Verification

The rapid growth of the globalized integrated circuit (IC) supply chain has drawn the attention of numerous malicious actors that try to exploit it for profit. One of the most prominent targets of such parties is the third-party intellectual property (3PIP) vendors and their circuit designs. With the increasing number of transactions between vendors and system integrators, the threat of IP reuse and piracy has become a significant consideration for the IC industry. What is more, the correctness of 3PIP designs should be verified before integration, imposing another challenge for 3PIP vendors since they have to prove the functionality of their designs to system integrators while protecting the privacy of the circuit implementations. To eliminate this deadlock, we utilize the cryptographic technique of “zero-knowledge proofs” to enable 3PIP vendors to convince system integrators about various functional properties of a circuit (e.g., area, power, and frequency) without disclosing its netlist (i.e., in zero-knowledge). Our approach comprises a circuit compiler that transforms arbitrary netlists into a zero knowledge-friendly format and a library of modules that provide cryptographic guarantees for various properties of the netlist while hiding the actual gates. We evaluate our method using combinational and sequential circuits from the ISCAS and ITC benchmark suites.

Digital Watermarking for Detecting Malicious Intellectual Property Cores in NoC Architectures

System-on-chip (SoC) developers utilize intellectual property (IP) cores from third-party vendors due to increasing design complexity, cost, as well as time-to-market constraints. A typical SoC consists of a wide variety of IP cores [such as processor, memory, controller, and field-programmable gate array (FPGA)] that interact using a network-on-chip (NoC). This global trend of designing SoCs using third-party IPs raises serious concerns about security vulnerabilities. Since NoC facilitates communication between all IPs in an SoC, NoC is the ideal place for any hardware Trojans to hide and launch a plethora of attacks. Due to the resource-constrained nature of SoCs, developing security solutions against such attacks is a major challenge. In particular, in an eavesdropping attack, a Trojan-infected router copies packets transferred through the NoC and reroutes the duplicated packets to an accompanying malicious application running on another IP in an attempt to extract confidential information. While authenticated encryption can thwart such attacks, it incurs unacceptable overhead in resource-constrained SoCs. In this article, we propose a lightweight alternative defense based on digital watermarking techniques. We develop theoretical models to provide security guarantees. Experiments using realistic SoC models and diverse applications demonstrate that our approach can significantly outperform state-of-the-art methods.

Toward Building and Optimizing Trustworthy Systems Using Untrusted Components: A Graph-Theoretic Perspective

The globalization process for integrated circuits (ICs) raises serious concerns regarding hardware Trojans (HTs). Due to the stealth and variety of HTs, detecting them at test time can be very resource intensive. This situation becomes even worse when the device under test (DUT) contains untrusted third-party intellectual property (3PIP) cores. For systems on chip (SoCs) that rely on untrusted 3PIP cores, this paper solves the online HT detection and recovery problem from a graph-theoretic perspective. The proposed graph-theoretic models minimize the implementation cost of the system in terms of both the cost of purchasing different IP cores and the area overhead. To further enhance the security of the system, we also propose schemes to locate and replace an HT-infected IP core. The feasibility and efficiency of the proposed techniques are verified by experiments.

Resilient and Secure Hardware Devices Using ASL

Due to the globalization of Integrated Circuit (IC) design in the semiconductor industry and the outsourcing of chip manufacturing, Third-Party Intellectual Properties (3PIPs) become vulnerable to IP piracy, reverse engineering, counterfeit IC, and hardware trojans. To thwart such attacks, ICs can be protected using logic encryption techniques. However, strong resilient techniques incur significant overheads. Side-channel attacks (SCAs) further complicate matters by introducing potential attacks post fabrication. One of the most severe SCAs is power analysis (PA) attacks, in which an attacker can observe the power variations of the device and analyze them to extract the secret key. PA attacks can be mitigated via adding large extra hardware; however, the overheads of such solutions can render them impractical, especially when there are power and area constraints. All Spin Logic Device (ASLD) is one of the most promising spintronic devices due to its unique properties: small area, no spin-charge signal conversion, zero leakage current, non-volatile memory, high density, low operating voltage, and its compatibility with conventional CMOS technology. In this article, we extend the work in Reference [1] on the usage of ASLD to produce secure and resilient circuits that withstand IC attacks (during the fabrication) and PA attacks (after fabrication), including reverse engineering attacks. First, we show that ASLD has another unique feature: identical power dissipation through the switching operations, where such properties can be effectively used to prevent PA and IC attacks. We then evaluate the proposed ASLD-based on performance overheads and security guarantees.

Processor Energy–Performance Range Extension Beyond Voltage Scaling via Drop-In Methodologies

This work introduces reconfiguration for energy–performance adaptation beyond conventional voltage scaling in microcontroller-based systems. Coordinated thread-level processor and row-level memory reconfiguration are enabled by an architecture-agnostic methodology. The latter requires low design and integration effort while reusing existing macros, including third-party intellectual properties (IPs) in an obfuscated or encrypted form. The methodology represents a drop-in solution that is applicable to extend the energy–performance tradeoff in existing designs. The proposed approach was demonstrated with a testchip implementing an ARM Cortex-M0 processor with 16-KB SRAM in 40 nm. The system demonstrates 1.8X throughput boost at nominal voltage (1.1 V) and 1.3X energy reduction at the minimum energy point (0.51 V) compared to voltage scaling with no reconfiguration. Such energy–performance range extension is achieved at 10.3% area overhead, which is mostly due to processor reconfiguration. Overall, the proposed approach reduces energy in the common case and increases performance when demanded, surpassing the capabilities of conventional voltage scaling, while reusing existing IPs and retaining the original software stack.

Automatic Floorplanning and Standalone Generation of Bitstream-Level IP Cores

Partially reconfigurable designs on field-programmable gate array (FPGA) bring an opportunity for developers to license third-party intellectual property (IP) cores. There are multiple IP licensing models that can be used by the FPGA IP market. Their focus is mainly on feasibility and security; however, two major challenges have been ignored by almost all of them. First, both academic or industrial tools do not provide a flow to generate IPs in a standalone environment. Second, these tools only offer manual floorplanning of the IPs, which is both time and performance inefficient. In this work, we present a framework, that can be used by multiple parties to generate different parts of a design independently, that are compatible with each other. It also provides automatic floorplanning based on mixed-integer linear programming (MILP) that considers the distribution of heterogeneous resources in modern FPGAs, with efficient resource utilization as the main objective. The proposed floorplanning is evaluated with benchmarks from the related work. Furthermore, a use case of internal and open-source designs is used for the validation and evaluation of the independent IP generation and the floorplanner.

Ten years of hardware Trojans: a survey from the attacker's perspective

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in-house design team attacks, third-party intellectual property vendor attacks, computer-aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field-programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti-detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

Towards IP integration on SoC: a case study of high‐throughput and low‐cost wrapper design on a novel IBUS architecture

To integrate third-party intellectual properties (IPs) into a new system-on-chip (SoC) architecture is a big challenge. Therefore, this study first presents a new bus protocol named as integrated bus (IBUS), and more important, a configurable bus wrapper for connecting AXI3-interfaced IPs into IBUS is further proposed, aiming to finding the optimal balance between bus efficiency and resource cost in terms of field-programming gate array slice count, bus transfer latency, and energy consumption. As a case study, the authors implemented three IBUS wrappers for integrating three AXI3-interfaced verification IPs into an IBUS SoC. Experimental results show that their proposed work achieves a higher valid data throughput ( 1.35 × in the block test and 1.52 × in the cipher test) compared with the designs on conventional bridge-based SoC integration, as well as a large reduction in the normalised slice-time-power (18.73% in the block benchmark and 23.45% in the cipher benchmark) when setting the same weights of slice number, data transfer latency, and energy dissipation.

Toward Hardware-Based IP Vulnerability Detection and Post-Deployment Patching in Systems-on-Chip

System integrators create heterogeneous systems-on-chip (SoCs) by integrating numerous third-party intellectual property blocks (3PIPs) to achieve application-specific design goals. With increasing intellectual property (IP) complexity, 3PIPs can suffer from hardware bugs or they can inadvertently introduce other software-exploitable security threats to the SoC. To ensure the ongoing survivability of new SoCs, we need infrastructure for patching newly discovered IP issues after an SoC has been deployed. To address the increasing risks from 3PIPs, we explore the feasibility and limitations of implementing monitoring and mitigation capabilities in hardware. Our proposed monitoring and mitigation patch (MoP) blocks provide a defensive foundation against critical IP-centric issues, focusing on situations where a system integrator only has interface-level visibility of 3PIP designs. The MoPs are distributed throughout the SoC to monitor and mitigate issues directly in hardware and transparently for potentially compromised software-the MoPs are resilient against run-time compromised software and firmware. We ensure that these monitors are reconfigurable after deployment by implementing them using embedded-FPGAs or as a reprogrammable, fixed-design module. We perform a case study of numerous IP-types and model a selection of security-relevant issues and bugs in the IPs, exploring the relative complexity and potential resource overhead. Our study shows the utility of our proposed approach, with MoP blocks requiring less than ~1.5% of the adaptive logic modules (ALMs) in a Cyclone V FPGA for interface monitoring and issue mitigation per IP.

Heterogeneous co-simulation for embedded and cyber-physical systems design

The growing complexity of embedded and cyber-physical systems makes the design of all system components from scratch increasingly impractical. Consequently, already from early stages of a design flow, designers rely on prior experience, which comes in the form of legacy code or third-party intellectual property (IP) blocks. Current approaches partly address the co-simulation problem for specific scenarios in an ad hoc style. This work suggests a general method for co-simulation of heterogeneous IPs with a system modeling and simulation framework. The external IPs can be integrated as high-level models running in an external simulator or as software- and hardware-in-the-loop simulation with minimal effort. Examples of co-simulation scenarios for wrapping models with different semantics are presented together with their practical usage in two case studies. The presented method is also used to formulate a refinement-by-replacement workflow for IP-based system design.

Practical Attacks on Deep Neural Networks by Memory Trojaning

Deep neural network (DNN) accelerators are widely deployed in computer vision, speech recognition, and machine translation applications, in which attacks on DNNs have become a growing concern. This article focuses on exploring the implications of hardware Trojan attacks on DNNs. Trojans are one of the most challenging threat models in hardware security where adversaries insert malicious modifications to the original integrated circuits (ICs), leading to malfunction once being triggered. Such attacks can be conducted by adversaries because modern ICs commonly include third-party intellectual property (IP) blocks. Previous studies design hardware Trojans to attack DNNs with the assumption that adversaries have full knowledge or manipulation of the DNN systems' victim model and toolchain in addition to the hardware platforms, yet such a threat model is strict, limiting their practical adoption. In this article, we propose a memory Trojan methodology that implants the malicious logics merely into the memory controllers of DNN systems without the necessity of toolchain manipulation or accessing to the victim model and thus is feasible for practical uses. Specifically, we locate the input image data among the massive volume of memory traffics based on memory access patterns and propose a Trojan trigger mechanism based on detecting the geometric feature in input images. Extensive experiments show that the proposed trigger mechanism is effective even in the presence of environmental noises and preprocessing operations. Furthermore, we design and implement the payload and verify that the proposed Trojan technique can effectively conduct both untargeted and targeted attacks on DNNs.

Designing Energy-Efficient MPSoC with Untrustworthy 3PIP Cores

The adoption of large-scale MPSoCs and the globalization of the IC design flow give rise to two major concerns: high power density due to continuous technology scaling and security due to the untrustworthiness of the third-party intellectual property (3PIP) cores. However, little work has been undertaken to consider these two critical issues jointly during the design stage. In this paper, we propose a design methodology that minimizes the energy consumption while simultaneously protecting the MPSoC against the effects of hardware trojans. The proposed methodology consists of three main stages: 1) Task scheduling to introduce core diversity in the MPSoC in order to detect the presence of malicious modifications in the cores, or mute their effects at runtime, 2) Vendor assignment to the cores using a novel heuristic that chooses vendor-specific cores with operating speed that minimizes the total energy consumption of the MPSoC, and 3) Explore optimization opportunities for further energy savings by minimizing idle periods on the cores, which are caused by the inter-task data dependencies. Experimental results show that our solutions consume only 1/3 energy of existing solutions without increasing schedule length while satisfying the security constraints.