Yiorgos Makris

Hardware Trojan detection using path delay fingerprint

Trusted IC design is a recently emerged topic since fabrication factories are moving worldwide in order to reduce cost. In order to get a low-cost but effective hardware trojan detection method to complement traditional testing methods, a new behavior-oriented category method is proposed to divide trojans into two categories: explicit payload trojan and implicit payload trojan. This categorization method makes it possible to construct trojan models and then lower the cost of testing. Path delays of nominal chips are collected to construct a series of fingerprints, each one representing one aspect of the total characteristics of a genuine design. Chips are validated by comparing their delay parameters to the fingerprints. The comparison of path delays makes small trojan circuits significant from a delay point of view. The experimentpsilas results show that the detection rate on explicit payload trojans is 100%, while this method should be developed further if used to detect implicit payload trojans.

Experiences in Hardware Trojan design and implementation

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.

Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain

As the electronic component supply chain grows more complex due to globalization, with parts coming from a diverse set of suppliers, counterfeit electronics have become a major challenge that calls for immediate solutions. Currently, there are a few standards and programs available that address the testing for such counterfeit parts. However, not enough research has yet addressed the detection and avoidance of all counterfeit parts-recycled, remarked, overproduced, cloned, out-of-spec/defective, and forged documentation-currently infiltrating the electronic component supply chain. Even if they work initially, all these parts may have reduced lifetime and pose reliability risks. In this tutorial, we will provide a review of some of the existing counterfeit detection and avoidance methods. We will also discuss the challenges ahead for implementing these methods, as well as the development of new detection and avoidance mechanisms.

Proof-Carrying Hardware Intellectual Property: A Pathway to Trusted Module Acquisition

We present a novel framework for facilitating the acquisition of provably trustworthy hardware intellectual property (IP). The proposed framework draws upon research in the field of proof-carrying code (PCC) to allow for formal yet computationally straightforward validation of security-related properties by the IP consumer. These security-related properties, agreed upon a priori by the IP vendor and consumer and codified in a temporal logic, outline the boundaries of trusted operation, without necessarily specifying the exact IP functionality. A formal proof of these properties is then crafted by the vendor and presented to the consumer alongside the hardware IP. The consumer, in turn, can easily and automatically check the correctness of the proof and, thereby, validate compliance of the hardware IP with the agreed-upon properties. We implement the proposed framework using a synthesizable subset of Verilog and a series of pertinent definitions in the Coq theorem-proving language. Finally, we demonstrate the application of this framework on a simple IP acquisition scenario, including specification of security-related properties, Verilog code for two alter- native circuit implementations, as well as proofs of their security compliance.

Error Moderation in Low-Cost Machine-Learning-Based Analog/RF Testing

Machine-learning-based test methods for analog/RF devices have been the subject of intense investigation over the last decade. However, despite the significant cost benefits that these methods promise, they have seen a limited success in replacing the traditional specification testing, mainly due to the incurred test error which, albeit small, cannot meet industrial standards. To address this problem, we introduce a neural system that is trained not only to predict the pass/fail labels of devices based on a set of low-cost measurements, as aimed by the previous machine-learning-based test methods, but also to assess the confidence in this prediction. Devices for which this confidence is insufficient are then retested through the more expensive specification testing in order to reach an accurate test decision. Thus, this two-tier test approach sustains the high accuracy of specification testing while leveraging the low cost of machine-learning-based testing. In addition, by varying the desired level of confidence, it enables the exploration of the tradeoff between test cost and test accuracy and facilitates the development of cost-effective test plans. We discuss the structure and the training algorithm of an ontogenic neural network which is embodied in the neural system in the first tier, as well as the extraction of appropriate measurements such that only a small fraction of devices are funneled to the second tier. The proposed test-error-moderation method is demonstrated on a switched-capacitor filter and an ultrahigh-frequency receiver front end.

Hardware Trojans in Wireless Cryptographic ICs

The article studies the problem of hardware Trojans in wireless cryptographic ICs. The objective is to design Trojans to leak secret information through the wireless channel. The authors investigate challenges related to detection for such Trojans and propose using statistical analysis of the side-channel signals to help detect them.

Non-RF to RF Test Correlation Using Learning Machines: A Case Study

The authors present a case study that employs production test data from an RF device to assess the effectiveness of four different methods in predicting the pass/fail labels of fabricated devices based on a subset of performances and, thereby, in decreasing test cost. The device employed is a zero-IF down-converter for cell-phone applications and the four methods range from a sample maximum-cover algorithm to an advanced ontogenic neural network. The results indicate that a subset of non-RF performances suffice to predict correctly the pass/fail label for the vast majority of the devices and that the addition of a few select RF performances holds great potential for reducing misprediction to industrially acceptable levels. Based on these results, the authors then discuss enhancements and experiments that will further corroborate the utility of these methods within the cost realities of analog/RF production testing.

Nonlinear decision boundaries for testing analog circuits

A neural classifier that learns to separate the nominal from the faulty instances of a circuit in a measurement space is developed. Experimental evidence, which demonstrates that the required separation boundaries are, in general, nonlinear, is presented. Unlike previous solutions that build hyperplanes, the proposed classifier is capable of drawing nonlinear hypersurfaces. A new circuit instance is classified through a simple test, which examines the location of its measurement pattern with respect to these hypersurfaces. The classifier is trained through an algorithm that probably converges to the optimal separation boundary. Additionally, a feature selection algorithm interacts with the classifier to identify a discriminative low-dimensional measurement vector. Despite employing only a few measurements, the test criteria established by the neural classifier are strongly correlated to the performance parameters of the circuit and do not rely on a presumed fault model.

Instruction-Level Impact Analysis of Low-Level Faults in a Modern Microprocessor Controller

We investigate the correlation between low-level faults in the control logic of a modern microprocessor and their instruction-level impact on the execution of typical workload. Such information can prove immensely useful in accurately assessing and prioritizing faults with regards to their criticality, as well as commensurately allocating resources to enhance online testability and error/fault resilience through concurrent error detection/correction methods. To this end, we developed an extensive fault simulation infrastructure which allows injection of stuck-at faults and transient errors of arbitrary starting time and duration, as well as cost-effective simulation and classification of their repercussions into various instruction-level error types. As a test vehicle for our study, we employ a superscalar, dynamically-scheduled, out-of-order, Alpha-like microprocessor, on which we execute SPEC2000 integer benchmarks. Extensive fault injection campaigns in control modules of this microprocessor facilitate valuable observations regarding the distribution of low-level faults into the instruction-level error types that they cause. Experimentation with both Register Transfer (RT-) and Gate-Level faults, as well as with both stuck-at faults and transient errors, confirms the validity and corroborates the utility of these observations.

Independent test sequence compaction through integer programming

We discuss the compaction of independent test sequences for sequential circuits. Our first contribution is the formulation of this problem as an integer program, which we then solve through a well-known method employing linear programming relaxation and randomized rounding. The key contribution of this approach is that it yields the first polynomial time approximation algorithm for this problem. More specifically, it provides a provably good approximation guarantee while running in time polynomial with respect to the number of vectors in the original test sequences and the number of faults. Another virtue of our approach is that it provides a lower bound for the compacted set of test sequences and, therefore, a quality measure for the test compaction algorithm. Experimental results on benchmark circuits demonstrate that the proposed solution efficiently identifies nearly optimal sets of compacted test sequences.