Securing the core root of trust (research in secure hardware design and test) Ramesh Karri ECE Department

Who can attack your system?  Hobby (class I)  Obsession (class II)  Job (class III) D. Abraham, G. Dolan, G. Double, and J. Stevens. Transaction Security System. IBM Systems Journal 30(2): , 1991.

How can your system be compromised?  Application software  Protocols  Operating system software

Is the problem worth my time? Source: page 168http:// US-China economic and security review commission hearing on China's proliferation practices and the development of its cyber and space warfare capabilities, testimony of Col. Gary McAlum.

How can your system be protected?  Fix applications  Fix protocols  Fix operating systems

“the core root of trust” is secure This assumes that…

“the core root of trust” is secure But…

Outline 1.threat models 2.defenses 3.conclusions

Threat models for hardware  Side channels  Power dissipation  Timing variation  Test infrastructure  Faults  interactions between side channels  Cloning  Overbuilding  Reverse Engineering  Trojans

An example: test infrastructure side channel

Data Encryption Standard (DES) LiLi RiRi Round Key K i + L i+1 R i+1 r Expansion + S-box Permutation a b c d

DES layout

 scan chain  test data input, TDI  test data output, TDO  test clock, TCK  test mode select, TMS  test reset chain all flip flops in a design test infrastructure

identify critical registers attack step 1

apply selected inputs attack step 2  3 plain texts  2 clock cycles in normal mode (plaintext reaches R,L)  198 clock cycles in test mode (R0, L0 scanned out)  1 clock cycle in normal mode (plaintext reaches R, L)  198 clock cycles in test mode (R1, L1 scanned out)  399×3=1197 clock cycles

Can leak secrets from DES, AES etc >80 % of all ASICs use scan chains for test/debug Readback/test infrastructure in FPGAs Load configuration stream Read-out bitstream for debug

test normal Secure normal Insecure Power off A fix: secure scan

test normal Secure normal Insecure Power off Secure scan Standards compliant 3 rd Prize, IEEE TTTC PhD dissertation contest

Hardware threat models  Side channels  Power dissipation  Timing variation  Test infrastructure  Faults  interactions between side channels  Cloning  Overbuilding  Reverse Engineering  Trojans

T D D F U U U Background: IC design process D: Design, F: Fabrication T: Test, U: User

Rev. engineering T D D F U U U Reverse engineering D: Design, F: Fabrication T: Test, U: User

3500 counterfeit Cisco networking components recovered estimated retail value ~ $3.5 million

cloning T D D F U U U Cloning D: Design, F: Fabrication T: Test, U: User

Trojans T D D F U U U Hardware Trojans D: Design, F: Fabrication T: Test, U: User

The kill switch ? IEEE Spectrum, 2008

Only 2% of ~$3.5 billion of DoD ICs manufactured in trusted foundries !!!

Taxonomy of trojans

Leak AES key 40 registrations, 10 finalists, 3 winners, 2 honorable mentions Trojan challenge

Trojans in the development cycle

Trojans at different abstractions

Location of the inserted trojans

Where are the trojans inserted?

Next steps  develop defenses  investigate effectiveness  developing benchmarks  metrics?

Physically unclonable functions Uses physical structure of a device to give a unique response Used as device IDs The ring oscillator frequency varies with process variations.

A trojan defense

PUF gives unique ID to hardware Can we give a unique ID to a design?

A preliminary defense

Next steps  develop defenses  investigate effectiveness  developing benchmarks  metrics?

Questions?