ASAP 2017 - The 28th Annual IEEE International Conference on Application-specific Systems, Architectures and Processors July 10th-12th 2017, Seattle, WA, USA DoSGuard: Protecting Pipelined MPSoCs Against Hardware Trojan Based DoS Attacks Amin Malekpour, Roshan Ragel, Aleksandar Ignjatovic, and Sri Parameswaran School of Computer Science and Engineering University of New South Wales, Sydney, Australia

Outline Introduction Related Work Proposed Architecture Comparison with State of the Art

Introduction Hardware Trojans (HTs) - malicious modifications to ICs ICs vulnerabilities to HT: Economic pressure Design outsourcing Reliance on IPs Unverified design automation tools HT free components - arduous task #efforts to reduce time to market##Ensuring components are free #even the best detection techniques are not able to detect all the malicious modifications

Functional/Data Modification Denial of Service (DOS) Introduction Table 1: hardware Trojan Taxonomy Logic Type Physical Layout Location Abstraction Insertion Triggering Mechanism Payload Sequential Large Processor System Specification Always on Information Leakage Combinational Small Memory RTL Design Internally Functional/Data Modification Hybrid Augmented I/O Logic Fabrication Externally Denial of Service (DOS) Clustered Power Supply Transistor Testing Distributed Clock Grid Physical Assembly #efforts to reduce time to market##Ensuring components are free #even the best detection techniques are not able to detect all the malicious modifications

Introduction Most researches - detecting an HT or preventing its activation No guarantee - detection or prevention Solution - methods for safely operating in HT presence DoSGuard contributions: DoS attack detection Identification and isolation Fast recovery Therefore We must pursue methods for safely operating in Trojan presence assuming they will be active within our system #A simple system-level #A mechanism to limit data leakage and make the leaked data less usable by an adversary is proposed#

Related Work Most of the techniques presented here…. Table 2: Effectiveness of the Different Techniques Technique Detection Identification Recovery Bloom09 [6] ✓ ✕ Beaumont12 [4] Cui14 [8] Rajendaran16 [16] Most of the techniques presented here…. Data leakage is the chalenging part

Architecture Stream programming - parallelism of many-core architectures Applications – Network processing, Multimedia, and DSP Processor Pipelines – Improve throughput and performance Pipelined MPSoC Architecture paradigm for exploiting the parallelism of many-core architectures Processor pipelines are used to improve throughput and performance of streaming applications

Architecture - PMPSoC Color Conversion Motion Estimation Motion Compensation TQE Inverse TQ Write Back # an PMPSoC with 6 stages running H.264 application is presented here. Each stage of the pipeline is responsible for a particular task. For instance the first stage is responsible for …TQE: Transform Quantize Encode Pipelined MPSoC Architecture Running H.264 Application

#cores in the sleeping pool are clock gated. Architecture – DoSGuard V1 V3 V2 V1 V2 V3 V1 V3 V1 V3 V2 Sleeping Pool Untrusted Pool V3 V2 V1 Monitor Cores TMR V3 V2 V1 #cores in the sleeping pool are clock gated. # We use the read/write delay of the pipeline buffers to detect DoS attacks caused by hardware Trojans # delays in the buffers immediately preceding and succeeding the processor # When a core is under DoS attack, its input buffer would be full, and/or its output buffer would be empty as the affected core will not be reading from, or/and writing to its buffers. V3 V2 V1 V3 V2 V1

Architecture – RwD Sleeping Pool Untrusted Pool Monitor Cores TMR

Architecture – RaD Sleeping Pool Untrusted Pool Testing Monitor Cores TMR # an PMPSoC with 6 stages running H.264 application is presented here. Each stage of the pipeline is responsible for a particular task. For instance the first stage is responsible for …TQE: Transform Quantize Encode

Results Throughput vs. # of Attacks and Monitoring Interval for H.264 Failed Failed Failed Throughput vs. # of Attacks and Monitoring Interval for H.264 Throughput for Different Benchmarks

Comparison - Related Work Table 3: Effectiveness of the Different Techniques Technique Detection Identification Recovery Bloom09 [6] ✓ ✕ Beaumont12 [4] Cui14 [8] Rajendaran16 [16] DoSGuard - RaD DoSGuard - RwD

Comparison with State of the Art J. Rajendran, O. Sinanoglu, and R. Karri. “Building trustworthy systems using untrusted components: A high-level synthesis approach”, IEEE Transactions on VLSI Systems, 2016. Base System – M cores, 2 cores per each stage Table 5: Hardware Trojan Infected Cores Identification Table 4: Hardware Trojan Attacks Detection Technique # of Cores Dyn. Power Sta. Power State of the Art 3M PD*(3M) PS*(3M) DoSGuard - RaD 1.5M + 3 PD*(M+3) PS*(1.5M+3) Technique # of Cores Dyn. Power Sta. Power State of the Art 2M PD*(2M) PS*(2M) DoSGuard M + 3 PD*(M+3) PS*(M+3) Using duplication and diversity techniques to detect hardware Trojan that affect the output of the system or deny service For identification of the Trojan infected cores, proposed to triplicate the number of cores (TMR) PMPSoC with state of the art will have …… PMPSoC with Trojan guard will have …..

Attack Scenarios - DoS attacks PMPSoC - failure of one stage - failure of the entire system Monitoring System - TMR !!!! Input - True/False Signals + Buffer Delays Time bomb Trojans – Resetting the Cores TMR TMR TMR TMR Therefore we argue that it is unlikely for Ht to get triggered in …. Monitors are scheduler TMR

Summary DoSGuard: Detect, Identify, and Recover – DoS attacks Fewer number of cores, Less power, No throughput reduction In comparison to the other thechniques trojanguard will do these by fewer

Thank You! I would be glad to see you at poster presentation for more discussion on Trojanguard