Visible to the public Biblio

Filters: Author is Tehranipoor, Mark  [Clear All Filters]
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 
Nahiyan, Adib, Xiao, Kan, Yang, Kun, Jin, Yeir, Forte, Domenic, Tehranipoor, Mark.  2016.  AVFSM: A Framework for Identifying and Mitigating Vulnerabilities in FSMs. Proceedings of the 53rd Annual Design Automation Conference. :89:1–89:6.

A finite state machine (FSM) is responsible for controlling the overall functionality of most digital systems and, therefore, the security of the whole system can be compromised if there are vulnerabilities in the FSM. These vulnerabilities can be created by improper designs or by the synthesis tool which introduces additional don't-care states and transitions during the optimization and synthesis process. An attacker can utilize these vulnerabilities to perform fault injection attacks or insert malicious hardware modifications (Trojan) to gain unauthorized access to some specific states. To our knowledge, no systematic approaches have been proposed to analyze these vulnerabilities in FSM. In this paper, we develop a framework named Analyzing Vulnerabilities in FSM (AVFSM) which extracts the state transition graph (including the don't-care states and transitions) from a gate-level netlist using a novel Automatic Test Pattern Generation (ATPG) based approach and quantifies the vulnerabilities of the design to fault injection and hardware Trojan insertion. We demonstrate the applicability of the AVFSM framework by analyzing the vulnerabilities in the FSM of AES and RSA encryption module. We also propose a low-cost mitigation technique to make FSM more secure against these attacks.

Amir, Sarah, Shakya, Bicky, Forte, Domenic, Tehranipoor, Mark, Bhunia, Swarup.  2017.  Comparative Analysis of Hardware Obfuscation for IP Protection. Proceedings of the on Great Lakes Symposium on VLSI 2017. :363–368.

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

Duncan, Adam, Rahman, Fahim, Lukefahr, Andrew, Farahmandi, Farimah, Tehranipoor, Mark.  2019.  FPGA Bitstream Security: A Day in the Life. 2019 IEEE International Test Conference (ITC). :1—10.

Security concerns for field-programmable gate array (FPGA) applications and hardware are evolving as FPGA designs grow in complexity, involve sophisticated intellectual properties (IPs), and pass through more entities in the design and implementation flow. FPGAs are now routinely found integrated into system-on-chip (SoC) platforms, cloud-based shared computing resources, and in commercial and government systems. The IPs included in FPGAs are sourced from multiple origins and passed through numerous entities (such as design house, system integrator, and users) through the lifecycle. This paper thoroughly examines the interaction of these entities from the perspective of the bitstream file responsible for the actual hardware configuration of the FPGA. Five stages of the bitstream lifecycle are introduced to analyze this interaction: 1) bitstream-generation, 2) bitstream-at-rest, 3) bitstream-loading, 4) bitstream-running, and 5) bitstream-end-of-life. Potential threats and vulnerabilities are discussed at each stage, and both vendor-offered and academic countermeasures are highlighted for a robust and comprehensive security assurance.

Park, Jungmin, Xu, Xiaolin, Jin, Yier, Forte, Domenic, Tehranipoor, Mark.  2018.  Power-Based Side-Channel Instruction-Level Disassembler. Proceedings of the 55th Annual Design Automation Conference. :119:1-119:6.
Modern embedded computing devices are vulnerable against malware and software piracy due to insufficient security scrutiny and the complications of continuous patching. To detect malicious activity as well as protecting the integrity of executable software, it is necessary to monitor the operation of such devices. In this paper, we propose a disassembler based on power-based side-channel to analyze the real-time operation of embedded systems at instruction-level granularity. The proposed disassembler obtains templates from an original device (e.g., IoT home security system, smart thermostat, etc.) and utilizes machine learning algorithms to uniquely identify instructions executed on the device. The feature selection using Kullback-Leibler (KL) divergence and the dimensional reduction using PCA in the time-frequency domain are proposed to increase the identification accuracy. Moreover, a hierarchical classification framework is proposed to reduce the computational complexity associated with large instruction sets. In addition, covariate shifts caused by different environmental measurements and device-to-device variations are minimized by our covariate shift adaptation technique. We implement this disassembler on an AVR 8-bit microcontroller. Experimental results demonstrate that our proposed disassembler can recognize test instructions including register names with a success rate no lower than 99.03% with quadratic discriminant analysis (QDA).
Park, Jungmin, Cho, Seongjoon, Lim, Taejin, Bhunia, Swarup, Tehranipoor, Mark.  2019.  SCR-QRNG: Side-Channel Resistant Design using Quantum Random Number Generator. 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). :1–8.
Random number generators play a pivotal role in generating security primitives, e.g., encryption keys, nonces, initial vectors, and random masking for side-channel countermeasures. A quantum entropy source based on radioactive isotope decay can be exploited to generate random numbers with sufficient entropy. If a deterministic random bit generator (DRBG) is combined for post-processing, throughput of the quantum random number generator (QRNG) can be improved. However, general DRBGs are susceptible to side-channel attacks. In this paper, we propose a framework called SCR-QRNG framework, which offers Side-Channel Resistant primitives using QRNG. The QRNG provides sources of randomness for modulating the clock frequency of a DRBG to obfuscate side-channel leakages, and to generate unbiased random numbers for security primitives. The QRNG has robustness against power side-channel attacks and is in compliance with NIST SP 800-22/90B and BSI AIS 31. We fabricate a quantum entropy chip, and implement a PCB module for a random frequency clock generator and a side-channel resistant QRNG on an FPGA.
Chhotaray, Animesh, Nahiyan, Adib, Shrimpton, Thomas, Forte, Domenic, Tehranipoor, Mark.  2017.  Standardizing Bad Cryptographic Practice: A Teardown of the IEEE Standard for Protecting Electronic-design Intellectual Property. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. :1533–1546.

We provide an analysis of IEEE standard P1735, which describes methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP. We find a surprising number of cryptographic mistakes in the standard. In the most egregious cases, these mistakes enable attack vectors that allow us to recover the entire underlying plaintext IP. Some of these attack vectors are well-known, e.g. padding-oracle attacks. Others are new, and are made possible by the need to support the typical uses of the underlying IP; in particular, the need for commercial system-on-chip (SoC) tools to synthesize multiple pieces of IP into a fully specified chip design and to provide syntax errors. We exploit these mistakes in a variety of ways, leveraging a commercial SoC tool as a black-box oracle. In addition to being able to recover entire plaintext IP, we show how to produce standard-compliant ciphertexts of IP that have been modified to include targeted hardware Trojans. For example, IP that correctly implements the AES block cipher on all but one (arbitrary) plaintext that induces the block cipher to return the secret key. We outline a number of other attacks that the standard allows, including on the cryptographic mechanism for IP licensing. Unfortunately, we show that obvious "quick fixes" to the standard (and the tools that support it) do not stop all of our attacks. This suggests that the standard requires a significant overhaul, and that IP-authors using P1735 encryption should consider themselves at risk.

Le, Thao, Di, Jia, Tehranipoor, Mark, Forte, Domenic, Wang, Lei.  2016.  Tracking Data Flow at Gate-Level Through Structural Checking. Proceedings of the 26th Edition on Great Lakes Symposium on VLSI. :185–189.

The rapid growth of Internet-of-things and other electronic devices make a huge impact on how and where data travel. The confidential data (e.g., personal data, financial information) that travel through unreliable channels can be exposed to attackers. In hardware, the confidential data such as secret cipher keys are facing the same issue. This problem is even more serious when the IP is from a 3rd party and contains scan-chains. Thus, data flow tracking is important to analyze possible leakage channels in fighting against such hardware security threats. This paper introduces a method for tracking data flow and detecting potential hardware Trojans in gate-level soft IPs using assets and Structural Checking tool.