Yousra Alkabani

Remote activation of ICs for piracy prevention and digital right management

We introduce a remote activation scheme that aims to protect integrated circuits (IC) intellectual property (IP) against piracy. Remote activation enables designers to lock each working IC and to then remotely enable it. The new method exploits inherent unclonable variability in modern manufacturing for unique identification (ID) and integrated the IDs into the circuit functionality. The objectives are realized by replication of a few states of the finite state machine (FSM) and adding control to the state transitions. On each chip, the added control signals are a function of the unique IDs and are thus unclonable. On standard benchmark circuits, the experimental results show that the novel activation method is stable, unclonable, attack-resilient, while having a low overhead and a unique key for each IC.

Trusted Integrated Circuits: A Nondestructive Hidden Characteristics Extraction Approach

We have developed a methodology for unique identification of integrated circuits (ICs) that addresses untrusted fabrication and other security problems. The new method leverages nondestructive gate-level characterization of ICs post-manufacturing, revealing the hidden and unclonable uniqueness of each IC. The IC characterization uses the externally measured leakage currents for multiple input vectors. We have derived several optimization techniques for gate-level characterization. The probability of collision of IDs in presence of intra- and inter-chip correlations is computed. We also introduce a number of novel security and authentication protocols, such as hardware metering , challenge-based authentication and prevention of software piracy , that leverage the extraction of a unique ID for each IC. Experimental evaluations of the proposed approach on a large set of benchmark examples reveals its effectiveness even in presence of measurement errors.

Consistency-based characterization for IC Trojan detection

A Trojan attack maliciously modifies, alters, or embeds unplanned components inside the exploited chips. Given the original chip specifications, and process and simulation models, the goal of Trojan detection is to identify the malicious components. This paper introduces a new Trojan detection method based on nonintrusive external IC quiescent current measurements. We define a new metric called consistency. Based on the consistency metric and properties of the objective function, we present a robust estimation method that estimates the gate properties while simultaneously detecting the Trojans. Experimental evaluations on standard benchmark designs show the validity of the metric, and demonstrate the effectiveness of the new Trojan detection.

Input vector control for post-silicon leakage current minimization in the presence of manufacturing variability

We present the first approach for post-silicon leakage power reduction through input vector control (IVC) that takes into account the impact of the manufacturing variability (MV). Because of the MV, the integrated circuits (ICs) implementing one design require different input vectors to achieve their lowest leakage states. We address two major challenges. The first is the extraction of the gate- level characteristics of an IC by measuring only the overall leakage power for different inputs. The second problem is the rapid generation of input vectors that result in a low leakage for a large number of unique ICs that implement a given design, but are different in the post-manufacturing phase. Experimental results on a large set of benchmark instances demonstrate the efficiency of the proposed methods. For example, the leakage power consumption could be reduced in average by more than 10.4%, when compared to the previously published IVC techniques that did not consider MV.

Active control and digital rights management of integrated circuit IP cores

We introduce the first approach that can actively control multiple hardware intellectual property (IP) cores used in an integrated circuit (IC). The IP rights owner(s) can remotely monitor, control, enable, or disable each individual IP on each chip. The approach introduces a paradigm shift in the microelectronic business model, nurturing smaller businesses, and supporting the design-reuse paradigm. The IPs can be controlled by the original designer or by the designers who reuse them. Each IP has a built-in functional lock that pertains to the unique unclonable ID of the chip. A control structure that coordinates the locking and unlocking of the IPs is embedded within the IC. We introduce a trusted third party approach for issuing certificates of authenticity, in case it is required for the applications. We present methods for safeguarding the approach against two attack sources: the foundry (fab), and the reuser. Experimental results show that our approach can be implemented with low area, power, and delay overheads making it suitable for embedded systems. The introduced control method is also low overhead in terms of the added steps to the current design and manufacturing flow.

Provably secure obfuscation of diverse watermarks for sequential circuits

This paper presents a provably secure method for embedding multiple watermarks in sequential designs. A number of different watermarks signed with the IP owners secret key from a public key cryptography system are generated. The owners watermarks are then dissembled into the states and transitions of the original sequential design. Hiding the multiple watermarks in the states and transitions is shown to be an instance of obfuscating a multi-point function with a generalized output. We draw on the theoretical cryptographic results of provable obfuscation of this function family to build a secure sequential multi-watermark system by construction. An iterative synthesis method for integrating the collection of watermarks to the original design is introduced. Analysis of watermark properties and the attack resiliency of the new multiple watermarking construction is presented. Experimental evaluations on benchmark circuits demonstrate practicality and low overhead of the new provably secure multiple watermarks construction method.

Extended abstract: Designer’s hardware Trojan horse

We introduce the first approach for pre-synthesis embedding of hardware Trojan horses (HTHs) by the designer. The embedded HTH gives the designer a low layer control over the hardware that can be exploited post-manufacturing. We identify the essential components for the exploit, outline the pre-synthesis implementation, and discuss detection. The new HTH embedding approach is low-overhead, effective, and hard to detect/remove. We emphasize that the diagnosis and isolation of designerpsilas HTHs is a standing research challenge.

N-variant IC design: methodology and applications

We propose the first method for designing N-variant sequential circuits. The flexibility provided by the N-variants enables a number of important tasks, including IP protection, IP metering, security, design optimization, self-adaptation and fault-tolerance. The method is based on extending the finite state machine (FSM) of the design to include multiple variants of the same design specification. The state transitions are managed by added signals that may come from various triggers depending on the target application. We devise an algorithm for implementing the N-variant IC design. We discuss the necessary manipulations of the added signals that would facilitate the various tasks. The key advantage to integrating the heterogeneity in the functional specification of the design is that we can configure the variants during or post-manufacturing, but removal, extraction or deletion of the variants is not viable. Experimental results on benchmark circuits demonstrate that the method can be automatically and efficiently implemented. Because of its lightweight, N-variant design is particularly well-suited for securing embedded systems. As a proof-of-concept, we implement the N-variant method for content protection in portable media players, e.g., iPod. We discuss how the N-variant design methodology readily enables new digital rights management methods.

A unified submodular framework for multimodal IC Trojan detection

This paper presents a unified formal framework for integrated circuits (IC) Trojan detection that can simultaneously employ multiple noninvasive measurement types. Hardware Trojans refer to modifications, alterations, or insertions to the original IC for adversarial purposes. The new framework formally defines the IC Trojan detection for each measurement type as an optimization problem and discusses the complexity. A formulation of the problem that is applicable to a large class of Trojan detection problems and is submodular is devised. Based on the objective function properties, an efficient Trojan detection method with strong approximation and optimality guarantees is introduced. Signal processing methods for calibrating the impact of interchip and intra-chip correlations are presented. We propose a number of methods for combining the detections of the different measurement types. Experimental evaluations on benchmark designs reveal the low-overhead and effectiveness of the new Trojan detection framework and provides a comparison of different detection combining methods.

System-level protection and hardware Trojan detection using weighted voting.

The problem of hardware Trojans is becoming more serious especially with the widespread of fabless design houses and design reuse. Hardware Trojans can be embedded on chip during manufacturing or in third party intellectual property cores (IPs) during the design process. Recent research is performed to detect Trojans embedded at manufacturing time by comparing the suspected chip with a golden chip that is fully trusted. However, Trojan detection in third party IP cores is more challenging than other logic modules especially that there is no golden chip. This paper proposes a new methodology to detect/prevent hardware Trojans in third party IP cores. The method works by gradually building trust in suspected IP cores by comparing the outputs of different untrusted implementations of the same IP core. Simulation results show that our method achieves higher probability of Trojan detection over a naive implementation of simple voting on the output of different IP cores. In addition, experimental results show that the proposed method requires less hardware overhead when compared with a simple voting technique achieving the same degree of security.