Fighting against theft, cloning and counterfeiting of integrated - - PowerPoint PPT Presentation

fighting against theft cloning and counterfeiting of
SMART_READER_LITE
LIVE PREVIEW

Fighting against theft, cloning and counterfeiting of integrated - - PowerPoint PPT Presentation

Fighting against theft, cloning and counterfeiting of integrated circuits Lilian Bossuet Associate Professor, head of the secure embedded system group University of Lyon, Jean Monnet University, Saint-Etienne Laboratoire Hubert Curien CNRS


slide-1
SLIDE 1

Fighting against theft, cloning and counterfeiting of integrated circuits

Lilian Bossuet

Associate Professor, head of the secure embedded system group University of Lyon, Jean Monnet University, Saint-Etienne Laboratoire Hubert Curien – CNRS UMR 5516 S É M I N A I R E Confiance numérique

  • Jeudi 3 mars 2016 -
slide-2
SLIDE 2

Protection of the intellectual property

  • f the fabless designers

why ?

2

slide-3
SLIDE 3

Semiconductor market

Market increase

– + 45% from 2009 to 2015 (336 billion of US $)

SoC manufacturing cost rise

– SoC complexity increase (add value increase) – +40% from 32nm (92 M€)=> to 28nm (130 M€) – Reduction => 30% with 450mm wafer [ITRS 2011]

Manufacturing changes

– Outsourcing of the manufacture and the design (mainly in Asia) – Fabless semiconductor companies increase

Characteristics of counterfeiting targets

– High add-value products – Rapid functional obsolescence – Long design time – Cheap ways to design counterfeiting – Limited risks to the counterfeiter

Tech. Transistors Manufacturing costs 130 nm 9 millions 9 millions € 90 nm 16 millions 18 millions € 65 nm 30 millions 46 millions €

Taiwan Semiconductor Manufacturing Co., Ltd. Rapport Saunier, 2008

  • F. Koushanfar 2011

3

slide-4
SLIDE 4

Threat model during manufacturing, supply chain and use life

Fab Fabless Designer Mask Production Wafer test Bond & Package Device test Distribution IC Netlist

Wafer Chip Device

Legal Fab (not trusted)

Device

Use life

Device End-of-life device Device

Broker / Stockist (not trusted)

4

slide-5
SLIDE 5

Fab Fabless Designer Mask Production Wafer test Bond & Package Device test Distribution IC Netlist

Wafer Chip Device Overbulding chip

P Legal Fab (not trusted) Illegal Fab

Untested Device theft Mask theft Device

Use life

Device Discarded device (scrapheap) Illegal device copy/clone

Illegal Fab Repakaging Relabeling

Old-fashioned device Relabeled / repakaged falsifyed device

Illegal Fab Refurbishing

Like-new device End-of-life device Device Counterfeit Device Netlist / IP theft

Competitor designer + Fab Reverse Engeenering

Compertitor’s Device

Broker / Stockist (not trusted)

Threat model during manufacturing, supply chain and use life

5

Reverse engineering

Source: http://siliconzoo.org

Chip salvaging / refurbishing

slide-6
SLIDE 6

Definition

IP

Chip Package

BRAND IC ref Grad

Label

BBDNAR IC ref Grad B) Same Chip, other package and other label (chip theft, repackaging) BBDNAR IC ref Grad C) Same chip and package, other label (IC theft, relabeling) BRAND IC ref Grad D) Used chip, refurbisched package and label (Chip solvaging) BRAND IC ref Grad E) Other chip, same package and label (IC counterfeiting) A) Orignial chip, package and label

6

slide-7
SLIDE 7

Example of counterfeiting flash memory

Source : EE Times, August 2007

7

slide-8
SLIDE 8

More examples ….

8

slide-9
SLIDE 9

Counterfeiting in figures

In 2008 , the EU’s external border control secured 178 million of counterfeit items

– Watch, leather goods, article of luxury, clothing, pharmaceuticals, tabacco, electronics products

Estimation of counterfeiting of the word semiconductor market is between 7% and 10% [1]

– Financial loss of 23,5 billion $ in 2015 for the word market

From 2007 to 2010, the number of seizures of electronic devices counterfeiting of the US customs was 5.6 million [2]

– Numerous counterfeiting of military-grade device and aerospace device [3,4]

[1] M. Pecht, S. Tiku. Bogus! Electronic manufacturing and consumers confront a rising tide of counterfeit electronics. IEEE Spectrum, May 2006 [2] AGMA, Alliance for Gray Markets and Counterfeit Adatement, http://www.agmaglobal.org [3] S. Maynard. Trusted Foundry – Be Safe. Be Sure. Be Trusted Trusted Manufacturing of Integrated Circuits for the Department of

  • Defenses. NDIA Manufacturing Division Meeting, October 2010

www.trustedfoundryprogram.or [4] C. Gorman. Counterfeit Chips on the Rise. IEEE Spectrum, June 2012

9

slide-10
SLIDE 10

Amazing stories

Fake NEC compagny

– 2006 [1,2] – 50 counterfeit products (NEC or not)

  • Home entertainment systems, MP3

players, batteries, microphones, DVD players, computer peripheries …

VisonTech (USA)

– From 2006 to 2010, VisonTech sell more than 60 000 counterfeit integrated circuits [3] – VisionTech customers: US Navy, Raytheon Missile System …

[1] Next Step for Counterfeiters: Faking the Whole Compagny, New York Times, May 2006 http://www.nytimes.com/2006/05/01/technology/01pirate.html?pagewanted=all [2] Fake NEC compagny, says report, EE Times, April 2006 http://www.eetimes.com/electronics- news/4060352/Fake-NEC-company-found-says-report [3] http://eetimes.com/electronics-news/4229964/Chip-counterfeiting-case-exposes-defense- supply-chain-flaw

10

slide-11
SLIDE 11

32.4% 7.6% 8.3% 13.1% 13.4% 25.2%

1500 1200 900 600 300 2006 2007 2008 2009 2010 2011 Nombre de références saisies Transistors (25% consumers) Programmable Logic (30 % industry) Memory (53% computer) Micro-processors (85% computer) Analog devices (29% wireless) Others 1363 2001 2002 2003 2004 2005

The rise of electronic device counteirfetings

Target and evolution

– From US statistical studies [1-2]

[1] C. Gorman. Counterfeit Chips on the Rise. IEEE Spectrum, June 2012 [2] IHS-ERAI http://www.ihs.com/info/sc/a/combating-counterfeits/index.aspx

11

slide-12
SLIDE 12

32.4% 7.6% 8.3% 13.1% 13.4% 25.2%

1500 1200 900 600 300 2006 2007 2008 2009 2010 2011 Nombre de références saisies Transistors (25% consumers) Programmable Logic (30 % industry) Memory (53% computer) Micro-processors (85% computer) Analog devices (29% wireless) Others 1363 2001 2002 2003 2004 2005

The rise of electronic device counteirfetings

Target and evolution

– From US statistical studies [1-2]

[1] C. Gorman. Counterfeit Chips on the Rise. IEEE Spectrum, June 2012 [2] IHS-ERAI http://www.ihs.com/info/sc/a/combating-counterfeits/index.aspx

12

slide-13
SLIDE 13

Consequences of electronic products counterfeiting

Economic damage

– For legal provider: money losses – For purchaser: diagnostic/repairs

  • Ex: 2,7 million of US $ for US Navy missile systems

Social damage

– Employment losses

Customer dissatisfaction Reliability decrease Security not guarantee

– Potential malware insertion (hardware trojan)

Environmental pollution

– Non-compliance with legal standards

13

slide-14
SLIDE 14

CURRENT INDUSTRIAL SOLUTIONS 1/2 Counterfeiting physical detection

14

slide-15
SLIDE 15

Counterfeiting physical detection

Industrial means of detection

– Marking permanency testing, visual inspection – X-ray inspection – Unpackaging and high resolution optical inspection (reverse-engineering)

Before After Fake Atmel Fake Motorola

15

slide-16
SLIDE 16

More information on counterfeit parts detection [TGF2015]

Springer, 2015 – University of Connecticut, USA

16

slide-17
SLIDE 17

Taxonomy of defects in counterfeit components [TGF2015]

17

slide-18
SLIDE 18

Taxonomy of counterfeit detection methods [TGF2015]

18

slide-19
SLIDE 19

CURRENT INDUSTRIAL SOLUTIONS 2/2 Protection against the reverse engineering

19

slide-20
SLIDE 20

Circuit Camouflaging 1/2

Definition: set of means to physically hide details of a system from an

  • ptical inspection (which could use image processing techniques) without

any modification of the system behavior

20

? ?

  • J. Rajendran, M. Sam, O. Sinanoglu, R. Karri.

Security analysis of integrated circuit

  • camouflaging. ACM Conference on Computer &

Communications Security, pp. 709 – 720, 2013.

slide-21
SLIDE 21

Circuit Camouflaging 2/2

Technology from SypherMedia International http://www.smi.tv/solutions.htm

SyperMedia Library – Circuit Camouflage

  • Technology. SMI Data Sheet, 2012.

21

slide-22
SLIDE 22

HARDWARE SOLUTION : SALWARE what ?

22

slide-23
SLIDE 23

Salutary hardware to design trusted IC

SALWARE definition Salutary hardware (SALWARE) is a (small piece of) hardware system, hardly detectable (from the attacker point of view), hardly circumvented (from the attacker point of view), inserted in an integrated circuit or an IP, used to provide intellectual property information and/or to remotely activate the integrated circuit or IP after manufacture and/or during use.

23

slide-24
SLIDE 24

ACTIVE SALWARE protection

24

slide-25
SLIDE 25

IC Activation (locking/unlocking)

(remote) activation after manufacturing (during life?)

– Stolen devices or clones are not exploitable – Need cryptographic protocol to secure the activation scheme – Many solutions

  • Logic “encryption”, FSM “obfuscation”
  • Data-path “encryption” (BUS, NoC)
  • Antifuse-based on-chip locks
  • FPGA bitstream encryption

Fab Fabless Designer Mask Production Wafer test Bond & Package Device test Distribution Remote IC activation system IC Netlist

Wafer Locked chip Locked device

Post-fab IC activation Unexploitable device Legal Fab (not trusted)

Locked device

Unlocked device Autorized trusted activator

Overbulding chip

P Illegal Fab

Untested Device theft Mask theft Discarded device (scrapheap) Illegal device copy/clone of locked device Netlist / IP theft

25

slide-26
SLIDE 26

Logic encryption

LOGIC

UC

inputs

  • utputs

26

slide-27
SLIDE 27

Logic encryption

27 LOGIC 1 LOGIC 2

UC FSM M1 M2

inputs

  • utputs
slide-28
SLIDE 28

Logic encryption

28 LOGIC 1 LOGIC 2

UC FSM M1 M2

inputs

  • utputs
  • J. Rajendran, Y. Pino, O. Sinanoglu, R. Karri. Logic Encryption: A

Fault Analysis Perspective. DATE 2012

slide-29
SLIDE 29

Logic locking

  • B. Colombier, L. Bossuet, D. Hely. Reversible Denial-of-Service by

Locking Gates Insertion for IP Cores Design Protection. ISVLSI 2015.

29

slide-30
SLIDE 30

Benchmark ISCAS’85

– 9-bit ALU – 2362 nodes – 178 inputs – 123 outputs

Graphe analysis

  • B. Colombier, L. Bossuet, D. Hely. Reversible Denial-of-Service by

Locking Gates Insertion for IP Cores Design Protection. ISVLSI 2015.

30

slide-31
SLIDE 31

Benchmark ISCAS’85

– 9-bit ALU – 2362 nodes – 178 inputs – 123 outputs

Graphe analysis

  • B. Colombier, L. Bossuet, D. Hely. Reversible Denial-of-Service by

Locking Gates Insertion for IP Cores Design Protection. ISVLSI 2015.

31

slide-32
SLIDE 32

Area overhead ≈ 3%

– 20 netlists from ITC’99 benchmark – From 1K à 225K logic gates

Analysis delay

– Rajendran et al. Use faults propagation analysis – Our method is scalable

Comparison with logic “encryption”

  • B. Colombier, L. Bossuet, D. Hely. Reversible Denial-of-Service by

Locking Gates Insertion for IP Cores Design Protection. ISVLSI 2015.

  • J. Rajendran, Y. Pino, O. Sinanoglu, R. Karri. Logic Encryption: A

Fault Analysis Perspective. DATE 2012

32

slide-33
SLIDE 33

A formal foundation for logic protection schemes

Logic encryption

– Formally : encryption of the Boolean function output

Logic masking Logic locking Logic obfuscation

– Develop and obscure A B C f’’’’ k0

ABC

f

ξf k (stored) ψ f

k f f’

Original logical circuit Encrypted logical circuit

A B C f’’’ k0 k1

f’’

A B C A B C

f

(a) Original Boolean function implementation (b) Boolean function implementation after a first step of logical obfuscation

  • B. Colombier, L. Bossuet, D. Hely. From Secured Logic to IP
  • Protection. Microprocessors and Microsystems, Embedded

Hardware Design, Elsevier, to be published soon.

33

slide-34
SLIDE 34

LOGIC

UC

inputs

  • utputs

FSM obfuscation

FSM obfuscation

34

Only one key for a set of devices!!!!

LOGIC

UC

inputs

  • utputs

FSM M

  • Y. A. Alkabani, F. Koushanfar. Active Hardware Metering for

Intellectual Property Protection Scheme. USENIX 2007

slide-35
SLIDE 35

LOGIC

UC

inputs

  • utputs

FSM obfuscation

FSM obfuscation

35 LOGIC

UC

inputs

  • utputs

FSM M

  • R. S. Chakrabotry, S. Bhunia. Security Through Obscurity: An Approach for

Protecting Register Transfert Level Hardware IP. In Proceedings of HOST 2009

slide-36
SLIDE 36

FSM obfuscation

FSM obfuscation – output register encryption

– Dedicated Key per device – Needs an device identification (PUF)

  • J. Rajendran, Y. Pino, O. Sinanoglu, R. Karri. Logic Encryption: A

Fault Analysis Perspective. DATE 2012

  • Y. Alkabani, F. Koushanfar, M. Potkonjak. Remote Activation of Ics for

Piracy Prevention and Digital Right Managment. ICCAD 2007

  • J. Bringer, H. Chabanne, T. Icart. On Physical Obfuscation of

cryptographic Algorithlms. INDOCRYPT 2009

36 LOGIC

UC

inputs

  • utputs

FSM M KEY

key

PUF

slide-37
SLIDE 37

Design obfuscation

  • B. Liu, and B. Wang. Embedded Reconfigurable Logic for ASIC Design Obfuscation Against Supply

Chain Attacks. DATE 2014

Obfuscation by using reconfigurable area

– Countermeasure to reverse-engineering – “High-information” parts have to be included in the reconfigurable area

  • Control Unit
  • Processor instruction decoder

– Need encryption of the bitstream

  • Anti-cloning
  • One bitsream (encrypted) by device (one secret key by device)

Integrated Circuit

Bitstream (Config. File)

Embedded Reconfigurable Area

37

slide-38
SLIDE 38

Security of FPGA bitstream (SRAM and FLASH)

Encryption of the FPGA bistream

– Threats: probing / cloning / reverse-engineering / replay /denial – Solutions: partial and dynamic reconfiguration [1]-[2], embedded cipher with hash function [3], remote update protection [4], anti-replay [5], disposable config. [6] …

[1] L. Bossuet, G.Gogniat and W. Burleson. Dynamically Configurable Security for SRAM FPGA Bitstreams. RAW, IPDPS 2004 [2] A.S. Zeineddini, and K.Gaj. Secure partial reconfiguration of FPGAs. FPT 2005. [3] Y. Hori, A. Satoh, H.Sakane, and K. Toda. Bitstream encryption and authentication with AES-GCM in dynamically reconfigurable systems. FPL 2008 [4] S. Drimer and M. G. Kuhn. A Protocol for Secure Remote Updates of FPGA Configurations. ARC 2009. [5] F. Devic, B. Badrignans, and L. Torres. Secure Protocol Implementation for Remote Bitstream Update Preventing Replay Attacks on FPGAs. FPL 2010. [6] L. Bossuet, V. Fischer, L. Gaspar, L. Torres, G. Gogniat. Disposable Configuration of Remotely Reconfigurable Systems. Microprocessors and Microsystems, Embedded Hardware Design, Elsevier, 2015.

T1 T2 T3

Configuration bus

FPGA

Bitstream memory T1 C2 C3 D UC D FPGA KEY CU ICAP Encrypted Bitsream

CAD + D-1

OPB

38

slide-39
SLIDE 39

IOB locking

Using antifuse

– Strong permanent lock – e-fuse for test – Hard to program without the key – One key par IC family – Dedicated to ASIC – Need an external programmer device – Only one final bit for the “program enable”

  • Z. Liu, Y. Li, R. Geiger, and D. Chen. Active Defense against Counterfeiting Attacks through Robust

Aantifuse-based On-Chip-Lock. VLSI Test Symposium 2014

39

slide-40
SLIDE 40

Locking of a System-on-Chip

What it is possible to lock in a SoC?

– Control unit : FSM outputs masking/ FSM state registers masking / microprocessor obfuscation – Treatment unit: Logic masking/locking/obfuscation – Internal communication: bus encryption / Cross Bar routing masking/ NoC locking/encryption – Memory: DMA and bus encryption (bus @ / bus data), data encryption, – Configuration (eFPGA / multi-mode-IP): bitstream encryption – IOB: locking – Analog parts calibration (performance downgrading): ex. PLL, DAC, ADC …

Source STMicroelectronics – STW22000 microcontroller

40

slide-41
SLIDE 41

Active Salware Design

Strong security

– Use cryptographic functions to obtain the usual crypto services

  • Confidentially, integrity, authentication

– Use protected hardware implementation

  • Protection against side-channel analysis and fault injection (trusted zone)

– One activation key per device

  • Use device identification (PUF, NVM)

– Many bits for activation

Very low overhead

– Locking system is rarely used – No system performance decrease

Flexibility

– Locking  unlocking – Test available

Mutual actions

– Different payload – Digital / Analog parts

Internal secret ID storage (NVM / PUF) (Trusted area) =? Cryptographic Function (Trusted area) Enable key

Integrated Circuit

Locking circuitry

key

Remote (un)locking request

41

slide-42
SLIDE 42

More information on active salware

Springer 2012

– M. Tehranipoor, Univ. Connecticut – C. Wang, US Army Research Office

Springer fall 2016: Foundations of Hardware IP Protection

– L. Bossuet, Univ. Lyon – L. Torres, Univ. Montpellier

Springer 2016

– C.H. Chang, Nanyang Tech. Univ. – M. Potkonjak, UCLA

42

slide-43
SLIDE 43

PASSIVE SALWARE IC identification / authentication

43

slide-44
SLIDE 44

Fingerprint / Watermark

Fingerprint

– Measurement of a physical (or behavioral) characteristics

Silicon PUF (Physical Unclonable Function) Watermark

– Additional (hidden) information (steganography)

Silicon Watermark

44

slide-45
SLIDE 45

PUF

Identification of IC

– Set of ICs – Challenges / responses protocol – Extraction of entropy from CMOS process variations

45

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

slide-46
SLIDE 46

ID IC AF30 37B1 8992 FE72 E90B 5129 8C9D 253A

PUF

Identification of IC

– Set of ICs – Challenges / responses protocol – Extraction of entropy from CMOS process variations

46

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

slide-47
SLIDE 47

47

PUF 01101010011011 Response 101001011 Entropy extraction Challenge 01101010011011 Unpredictable High steadiness

Fingerprint of IC – Silicon PUF

slide-48
SLIDE 48

PUF

48

PUF PUF PUF

IC_A IC_B IC_C

Challenge 01101010011011

Fingerprint of IC – Silicon PUF

Unique Unique Response A 101001011 Response B 01100010 Response C 110011101 Unique

slide-49
SLIDE 49

CMOS process variations

Example

– Oxide thickness – Metal line – Number of dopant atoms – Position of dopants – Doping density

49

slide-50
SLIDE 50

PUF principe: compare (theoretically) identical things !

Example of an athletic race of clones

– All the runners are identical (same doping ) – Theoretically, all the lines on the stadium are the same – Lines length / runners speed mismatch measurement

50

slide-51
SLIDE 51

PUF Architectures

Three main architectures

– Race of delays between two symmetrical delay lines – Arbiter PUF – Frequency mismatch in multiple ring-oscillators – RO-PUF, loop-PUF – Metastability of a couple of cross-coupled elements – SRAM PUF, Butterfly PUF

  • E. Holcomb, W. Burleson, K. Fu. Power-Up SRAM State as an

Identifying Fingerprint and Source of True Random Numbers. IEEE Transations on Computers, Vol. 58, No. 9, 2009.

  • B. Gassend, D. Lim, D. Clarke, M. Van Dijk, S. Devadas.

Identification and authentication of integrated circuits. Concurrency and Computation: Practice & Experience, 16(11):1077-1098, 2004.

  • G. Edward Suh, S. Devadas. Physical unclonable functions for device

authentication and secret key generation. In DAC, pp. 9-14, 2007.

51

slide-52
SLIDE 52

Some PUF challenges

Future works

– Experimental characterization of all PUF architectures in corner conditions on FPGA and ASIC – Aging compensation – Security analysis

  • Sensitivity to EM perturbation/analysis
  • Sensitivity to optical analysis

– Construction of stochastic models of microelectronic process variations – Construction of physical model

Current project

– European H2020 HECTOR project – http://www.hector-project.eu/ – Technikon, KU Leuven, Univ. Jean Monnet, TU Graz, ThalesCommunications & Security SAS, STMicroelectronics Rousset SAS, STMicroelectronics SRL, Micronic AS, Brightsight

52

slide-53
SLIDE 53

Watermark

Detection of IC counterfeiting

– Set of good referenced ICs

Detection of IP theft (illegal copy/use)

53

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

RSMicro

XTN6652200 IF4 PW 224

= +

W

?

YES – it is probably not a counterfeit IC NO – it is probably a counterfeit IC

= +

W

?

YES – it is probably a copy of the IP NO – it is probably not a copy of the IP MWO

AZR5526 IF6 PZ 224

RSMicro IP

slide-54
SLIDE 54

In the supply chain

– Contactless => quick check – High data rate => direct use in a supply chain (large set of ICs) – Very-low area overhead => used few times only during the device life

Automatic detection of IC counterfeiting

Electromagnetic probe Amplifier

No identified IP Identified IP REF : F18BC9D Validity check ok

54

slide-55
SLIDE 55

1 Input data Enable

N delays K delays

Transmission on the EM channel (contactless) Configurable ring-oscillator

– Two frequencies generator f0 > f1 – Two parameters N and K – Size in number of LUT4 = 1+K+N

Ultra lightweight BFSK transmitter

With Microsemi FUSION FPGA (FLASH - 130 nm CMOS) 55

slide-56
SLIDE 56

1 Input data Enable

N delays K delays

Transmission on the EM channel (contactless) Configurable ring-oscillator

– Two frequencies generator f0 > f1 – Two parameters N and K – Size in number of LUT4 = 1+K+N

Ultra lightweight BFSK transmitter

With Microsemi FUSION FPGA (FLASH - 130 nm CMOS) 100 200 300 400 1 2 3 4 100 200 300 400 1 2 3 4

  • scillation frequency f0
  • scillation frequency f1

N N K=1 K=2 K=3 K=4 K=5 measurment simulation measurment simulation f0=385 MHz f0=119 MHz f1=280 MHz f1=70 MHz

56

slide-57
SLIDE 57

Spectral cartography (amplitude vs time)

– By using slippery window spectral analysis

First experimentation – BFSK only

0101000111110011 0101000111110011

@f1:119 MHZ @f0:289 MHZ

57

slide-58
SLIDE 58

Comparison with state-of-the art spy circuits

Spy circuits in the literature

– Applications: Hardware Trojan (malware) or IP Protection (salware) – Used side channel (SC): Thermal emanation (TH), Power consumption (PC) Electromagnetic emanation (EM) – Year of publication (YoP): since 2008 Ref YoP SC Hardware resources Bite rate [5] 2008 TH 255 Spartan-3 Slices 7.10-3 bps [6] 2008 PC 16*16 bit circular shift-register 200 bps [9] 2009 PC 8 parallel Dff or 16 bit circular shift register 485 bps [7] 2010 PC 16-bit circular shift register 500 bps [10] 2013 PC 16-bit circular shift register per bit 976 bps Our work 2015 EM 1 configurable RO 1 Mbps

1024 times bigger data rate

58

slide-59
SLIDE 59

More information on PUF and Watermarking

Springer 2013, Graz University of Technology, Austria

– eBook is provided DRM-free on the Springer web page

Kluwer 2003, UCLA, USA Springer 2013, KU Leuven, Belgium

59

slide-60
SLIDE 60

Conclusion

60

slide-61
SLIDE 61

Synthesis

Strategic issue for developed countries

– Leadership on the semiconductor market – Limitation of illegal / malicious activities

Many threats / many solutions

– Filter out numerous publications (lot of publication noise) – Use a realistic threat model – Propose realistic and industrial solutions – Combine proposed solutions

Need to develop specific skills

– VLSI design / analog design – IC manufacturing – Hardware security – Applied cryptographic (need very-lightweight crypto) 61

slide-62
SLIDE 62

"The SALWARE project has received funding from the French ANR research and innovation programme under grant agreement number ANR-13-JS03-0003. It also supported by the French FRAE”

If you need further information, please contact the coordinator: lilian.bossuet@univ-st-etienne.fr Project web site: http://www.univ-st-etienne.fr/salware/

This work was part of the project

slide-63
SLIDE 63

lilian.bossuet@univ-st-etienne.fr

slide-64
SLIDE 64

For fun: are you sure to be free of counterfeit parts?

Friday 27th February 2015, 2 p.m.

– Fire alarm in my Laboratory – Localization: the office next door (opposite)

Fire’s origin

– A “Xilinx” Platform Cable USB for FPGA configuration – Chinese label, unknown and untraceable provider: 306Studio.com