1. Threats and Challenges in FPGA Security Ted Huffmire Naval Postgraduate School December 10, 2008

2. Overview Foundry Trust Physical Attacks Design Tools Design Theft Problem Areas Attacks Trojan horse Backdoor Kill switch Probing Sand and Scan Side Channels Data Remanence Covert channels Side channels Bypass Cloning Reverse engineer Readback attack Solutions Trusted foundries FPGAs X-Ray Inspection Sand and Scan Tamper sensing Adding noise Degaussing Logical isolation Tracing wires Sanitization Continuous power Encrypt bitstream Watermarking Authentication Future Research All of supply chain Lessons from S/W Red teams Side channels Trusted tools Verification Languages CM High-assurance Partial reconfig PUFs High-assurance CMPs Tagging Dynamic security Reference monitor Defense in depth User training Security usability DoS Authentication Complex designs System Assurance

3. Reconfigurable Hardware FPGA Chip SDRAM (off-chip) DRAM Reference Monitor Crypto Core CPU Core AES μPμP μPμP

4. Protection Alternatives Separation Kernels DRAM app1 app3 app2 kernel Reconfigurable Protection DRAM app1 app2 app3 Reference Monitor Physical Software SpatialTemporal

5. Design Flows

6. Intertwined Cores

7. Moats FPGA Chip SDRAM (off-chip) DRAM Reference Monitor Crypto Core CPU Core AES

8. Moats 1.0

9. Moats 2.0

10. Moats and Drawbridges

11. Interconnect Tracing FPGA Chip SDRAM (off-chip) DRAM Reference Monitor Crypto Core CPU Core AES μPμP μPμP X X

12. Communication Architecture FPGA Chip SDRAM (off-chip) DRAM Arbiter/Reference Monitor Crypto Core CPU Core AES μPμP μPμP

13. Memory Protection FPGA Chip SDRAM (off-chip) DRAM Crypto Core CPU Core AES Reference Monitor X X

14. Policy Compiler

15. SoC Application

16. Questions?  http://faculty.nps.edu/tdhuffmi