Israel Koren

Error analysis and detection procedures for a hardware implementation of the advanced encryption standard

The goal of the Advanced Encryption Standard (AES) is to achieve secure communication. The use of AES does not, however, guarantee reliable communication. Prior work has shown that even a single transient error occurring during the AES encryption (or decryption) process will very likely result in a large number of errors in the encrypted/decrypted data. Such faults must be detected before sending to avoid the transmission and use of erroneous data. Concurrent fault detection is important not only to protect the encryption/decryption process from random faults. It will also protect the encryption/decryption circuitry from an attacker who may maliciously inject faults in order to find the encryption secret key. In this paper, we first describe some studies of the effects that faults may have on a hardware implementation of AES by analyzing the propagation of such faults to the outputs. We then present two fault detection schemes: The first is a redundancy-based scheme while the second uses an error detecting code. The latter is a novel scheme which leads to very efficient and high coverage fault detection. Finally, the hardware costs and detection latencies of both schemes are estimated.

Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures

Implementations of cryptographic algorithms continue to proliferate in consumer products due to the increasing demand for secure transmission of confidential information. Although the current standard cryptographic algorithms proved to withstand exhaustive attacks, their hardware and software implementations have exhibited vulnerabilities to side channel attacks, e.g., power analysis and fault injection attacks. This paper focuses on fault injection attacks that have been shown to require inexpensive equipment and a short amount of time. The paper provides a comprehensive description of these attacks on cryptographic devices and the countermeasures that have been developed against them. After a brief review of the widely used cryptographic algorithms, we classify the currently known fault injection attacks into low-cost ones (which a single attacker with a modest budget can mount) and high-cost ones (requiring highly skilled attackers with a large budget). We then list the attacks that have been developed for the important and commonly used ciphers and indicate which ones have been successfully used in practice. The known countermeasures against the previously described fault injection attacks are then presented, including intrusion detection and fault detection. We conclude the survey with a discussion on the interaction between fault injection attacks (and the corresponding countermeasures) and power analysis attacks.

System-level power-aware design techniques in real-time systems

Power and energy consumption has recently become an important issue and consequently, power-aware techniques are being devised at all levels of system design; from the circuit and device level, to the architectural, compiler, operating system, and networking layers. In this paper, we concentrate on power-aware design techniques for real-time systems. While the main focus is on hard real-time, soft real-time systems are considered as well. We start with the motivation for focusing on these systems and provide a brief discussion on power and energy objectives. We then follow with a survey of current research on a layer-by-layer basis. We conclude with illustrative examples and open research challenges. This paper provides an overview of power-aware techniques for the real-time system engineer as well as an up-to-date reference list for the researcher.

Complete and partial fault tolerance of feedforward neural nets

A method is proposed to estimate the fault tolerance (FT) of feedforward artificial neural nets (ANNs) and synthesize robust nets. The fault model abstracts a variety of failure modes for permanent stuck-at type faults. A procedure is developed to build FT ANNs by replicating the hidden units. It exploits the intrinsic weighted summation operation performed by the processing units to overcome faults. Metrics are devised to quantify the FT as a function of redundancy. A lower bound on the redundancy required to tolerate all possible single faults is analytically derived. Less than triple modular redundancy (TMR) cannot provide complete FT for all possible single faults. The actual redundancy needed to synthesize a completely FT net is specific to the problem at hand and is usually much higher than that dictated by the general lower bound. The conventional TMR scheme of triplication and majority voting is the best way to achieve complete FT in most ANNs. Although the redundancy needed for complete FT is substantial, the ANNs exhibit good partial FT to begin with and degrade gracefully. The first replication yields maximum enhancement in partial FT compared with later successive replications. For large nets, exhaustive testing of all possible single faults is prohibitive, so the strategy of randomly testing a small fraction of the total number of links is adopted. It yields partial FT estimates that are very close to those obtained by exhaustive testing. When the fraction of links tested is held fixed, the accuracy of the estimate generated by random testing is seen to improve as the net size grows.

A data-driven VLSI array for arbitrary algorithms

The design of specialized processing array architectures, capable of executing any given arbitrary algorithm, is proposed. An approach is adopted in which the algorithm is first represented in the form of a dataflow graph and then mapped onto the specialized processor array. The processors in this array execute the operations included in the corresponding nodes (or subsets of nodes) of the dataflow graph, while regular interconnections of these elements serve as edges of the graph. To speed up the execution, the proposed array allows the generation of computation fronts and their cancellation at a later time, depending on the arriving data operands; thus it is called a data-driven array. The structure of the basic cell and its programming are examined. Some design details are presented for two selected blocks, the instruction memory and the flag array. A scheme for mapping a dataflow graph (program) onto a hexagonally connected array is described and analyzed. Two distinct performance measures-mapping efficiency and array utilization-and some performance results are discussed.<<ETX>>

On Area and Yield Considerations for Fault-Tolerant VLSI Processor Arrays

Fault-tolerance is undoubtedly a desirable property of any processor array. However, increased design and implementation costs should be expected when fault-tolerance is being introduced into the architecture of a processor array. When the processor array is implemented within a single VLSI chip, these cost increases are directly related to the chip silicon area. Thus, the increase in area should be weighed against the improved performance of the gracefully degrading fault-tolerant processor array. In addition, a larger chip area might reduce the wafer yield to an unaceptable level making the use of fault-tolerant VLSI processor arrays impractical. The objective of this paper is to devise performance measures for the evaluation of the effectiveness and area utilization of various fault-tolerant techniques. Another goal is to analyze the reduction in wafer yield and investigate the possibility of yield enhancement through redundancy.

Fault tolerance in VLSI circuits

The defects that can occur when manufacturing VLSI ICs and the faults that can result are described. Some commonly used restructuring techniques for avoiding defective components are discussed. Several defect-tolerant designs of memory ICs, logic ICs, and wafer-scale circuits are presented. Yield models for predicting the yield of chips with redundancy are introduced, and the optimal amount of redundancy is determined.<<ETX>>

Yield Models for Defect-Tolerant VLSI Circuits: A Review

The statistical models for estimating and predicting the manufacturing yields of VLSI circuits are reviewed. It is shown how defect clustering is taken into account, and how yield formulae for defect and fault tolerant VLSI circuits are developed. Different types of formulae for the yield of defect tolerant VLSI circuits have appeared in the literature. It is proven here for the first time that most of these approaches are equivalent.

A unified negative-binomial distribution for yield analysis of defect-tolerant circuits

It has been recognized that the yield of fault-tolerant VLSI circuits depends on the size of the fault clusters. Consequently, models for yield analysis have been proposed for large-area clustering and small-area clustering, based on the two-parameter negative-binomial distribution. The addition of a new parameter, the block size, to the two existing parameters of the fault distribution is proposed. This parameter allows the unification of the existing models and, at the same time, adds a whole range of medium-size clustering models. Thus, the flexibility in choosing the appropriate yield model is increased. Methods for estimating the newly defined block size are presented and the approach is validated through simulation and empirical data. >

Layout-synthesis techniques for yield enhancement

Several yield-enhancement techniques are proposed for the last two stages of VLSI design, i.e., topological/symbolic and physical layout synthesis. Our approach is based on modifications of the symbolic/physical layout to reduce the sensitivity of the design to random point defects without increasing the area, rather than fault tolerance techniques. A layout compaction algorithm is presented and the yield improvement results of some industrial layout examples are shown. This algorithm has been implemented in a commercial CAD framework. Some routing techniques for wire length and via minimization are presented, and the results of wire length reduction in benchmark routing examples are shown. We demonstrate through topological optimization for PLA-based designs that yield enhancement can be applied even at a higher level of design abstraction. Experimental results show that it is possible to achieve significant yield improvements without increasing the layout area by applying the proposed techniques during layout synthesis. >