Introduction Attack Model k -Security Layout Randomization Summary Securing Computer Hardware Using 3D Integrated Circuit (IC) Technology and Split Manufacturing for Obfuscation Frank Imeson ECE, University of Waterloo USENIX Security 13 Collaborators: Ariq Emtenan, Siddharth Garg, and Mahesh V. Tripunitara (Waterloo). Frank Imeson, Waterloo ECE 3D Hardware Security 1/26
Introduction Attack Model k -Security Layout Randomization Summary Computer Hardware – Computer Hardware = Digital IC – Physical realization of digital logic – Complex and ubiquitous Credit: http://www.newsplink.com/2009/05/20/the-silicon-valley-trail/ Frank Imeson, Waterloo ECE 3D Hardware Security 2/26
Introduction Attack Model k -Security Layout Randomization Summary Manufacturing Process HDL IC Netlist case(display_state) UPDATE : begin seg00_reg <= seg00; seg01_reg <= seg01; // update leds if (count00[0]) begin state <= UPDATE; end default : begin ons00 <= 0; count00 <= 0; display_state <= UPDATE; end endcase Credit: www.theverge.com/2011/11/16/2565638/mit-neural-connectivity-silicon-synapse Frank Imeson, Waterloo ECE 3D Hardware Security 3/26
Introduction Attack Model k -Security Layout Randomization Summary Threat Model External Foundry ICs Netlist News story, May 2012: “Security backdoor found in US military chip made in [foreign country].” Frank Imeson, Waterloo ECE 3D Hardware Security 4/26
Introduction Attack Model k -Security Layout Randomization Summary Attack Types Examples: Privilege escalation [King et al., LEET’08] Leaking private information [Skorobogatov et al., CHES 2012] Credit: King et al., LEET’08 Frank Imeson, Waterloo ECE 3D Hardware Security 5/26
Introduction Attack Model k -Security Layout Randomization Summary Premise Successful Attack ⇓ Uniquely identify at least one gate Credit: Cynthia Sturton, Matthew Hicks, David Wagner, and Samuel T. King. ”Defeating UCI: Building stealthy and malicious hardware.” In Security and Privacy (SP), 2011 IEEE Symposium on, pp. 64-77. IEEE, 2011. Frank Imeson, Waterloo ECE 3D Hardware Security 6/26
Introduction Attack Model k -Security Layout Randomization Summary Premise Successful Attack ⇓ Uniquely identify at least one gate Credit: Cynthia Sturton, Matthew Hicks, David Wagner, and Samuel T. King. ”Defeating UCI: Building stealthy and malicious hardware.” In Security and Privacy (SP), 2011 IEEE Symposium on, pp. 64-77. IEEE, 2011. Frank Imeson, Waterloo ECE 3D Hardware Security 6/26
Introduction Attack Model k -Security Layout Randomization Summary Example Full Adder Netlist C IN 3 S 4 A 1 B 5 C OUT 2 M T Malicious Gate Frank Imeson, Waterloo ECE 3D Hardware Security 7/26
Introduction Attack Model k -Security Layout Randomization Summary Example Full Adder Netlist C IN 3 S 4 A 1 B 0 0 5 C OUT 0 0 2 M 0 T Frank Imeson, Waterloo ECE 3D Hardware Security 7/26
Introduction Attack Model k -Security Layout Randomization Summary Example Full Adder Netlist C IN 3 S 4 A 1 B 0 1 5 C OUT 0 1 2 M 1 T Frank Imeson, Waterloo ECE 3D Hardware Security 7/26
Introduction Attack Model k -Security Layout Randomization Summary Our Solution – Circuit Obfuscation Full Adder Netlist C IN 3 S 4 A 1 B 5 C OUT 2 Obfuscated Netlist U W X Y V Frank Imeson, Waterloo ECE 3D Hardware Security 8/26
Introduction Attack Model k -Security Layout Randomization Summary Our Solution – Circuit Obfuscation Full Adder Netlist C IN 3 S 4 A 1 B 5 C OUT 2 Obfuscated Netlist U W X Y V Frank Imeson, Waterloo ECE 3D Hardware Security 8/26
Introduction Attack Model k -Security Layout Randomization Summary 3D IC Technology Top Tier (Hidden) Hidden Wires Bond Points IO Pins Two or more tiers Tiers are connected via bond points Wire only tiers are relatively inexpensive Substrate Unhidden Wires Transistors/Gates Bottom Tier (Obfuscated) Frank Imeson, Waterloo ECE 3D Hardware Security 9/26
Introduction Attack Model k -Security Layout Randomization Summary 3D Xilinx FPGA 6.8 billion transistors 1,954,560 logic cells 21.55 Mbits of SRAM 46,512 Kbits of RAM 1200 user I/O 2.5D Credit: http://www.electroiq.com/articles/ap/2011/10/xilinx-fpga-boasts-6-8b-transistors.html Frank Imeson, Waterloo ECE 3D Hardware Security 10/26
Introduction Attack Model k -Security Layout Randomization Summary Circuit Obfuscation with 3D Technology 3 1 4 C IN 5 2 3 S Place Hide A 1 and B 4 Wires Route 5 C OUT 2 X U W Y V Hidden Circuit Fabrication 4 5 In House 1 2 3 Stacking Obfuscated Circuit Fabrication Outsourced Frank Imeson, Waterloo ECE 3D Hardware Security 11/26
Introduction Attack Model k -Security Layout Randomization Summary Circuit Obfuscation with 3D Technology 3 1 4 C IN 5 2 3 S Place Hide A 1 and B 4 Wires Route 5 C OUT 2 X U W Y V Hidden Circuit Fabrication 4 5 In House 1 2 3 Stacking Obfuscated Circuit Fabrication Outsourced Frank Imeson, Waterloo ECE 3D Hardware Security 11/26
Introduction Attack Model k -Security Layout Randomization Summary Circuit Obfuscation with 3D Technology 3 1 4 C IN 5 2 3 S Place Hide A 1 and B 4 Wires Route 5 C OUT 2 X U W Y V Hidden Circuit Fabrication 4 5 In House 1 2 3 Stacking Obfuscated Circuit Fabrication Outsourced Frank Imeson, Waterloo ECE 3D Hardware Security 11/26
Introduction Attack Model k -Security Layout Randomization Summary Attack Model Summary Original Netlist G C IN 5 3 S 2 4 4 A 1 B 3 1 5 C OUT 2 H Y W X W V U Y V X Obfuscated U Circuit Frank Imeson, Waterloo ECE 3D Hardware Security 12/26
Introduction Attack Model k -Security Layout Randomization Summary Attack Model Summary Original Netlist G C IN 5 3 S 2 4 4 A 1 B 3 1 5 C OUT 2 H Y W X W V U Y V X Obfuscated U Circuit Frank Imeson, Waterloo ECE 3D Hardware Security 12/26
Introduction Attack Model k -Security Layout Randomization Summary What an Attacker Needs to Do H G Input graphs G and H 5 Y 2 W 4 V 3 X 1 U Frank Imeson, Waterloo ECE 3D Hardware Security 13/26
Introduction Attack Model k -Security Layout Randomization Summary What an Attacker Needs to Do H G Input graphs G and H 5 Y Find subgraph 2 W 4 V isomorphisms 3 X 1 U Frank Imeson, Waterloo ECE 3D Hardware Security 13/26
Introduction Attack Model k -Security Layout Randomization Summary What an Attacker Needs to Do H G Input graphs G and H 5 Y Find subgraph 2 W 4 V isomorphisms 3 X 1 U M1 M2 M3 M4 5 5 5 5 4 4 2 2 2 2 4 4 3 1 1 3 1 3 3 1 Frank Imeson, Waterloo ECE 3D Hardware Security 13/26
Introduction Attack Model k -Security Layout Randomization Summary k -Security S(w) = 2 H G Y 5 W 2 V 4 X 3 U 1 A vertex v ∈ H is k -secure if there exist at least k subgraph isomorphisms each of which maps v to a distinct vertex in G . An obfuscated graph (circuit) H is k -secure if every vertex (gate) in H is k -secure. Frank Imeson, Waterloo ECE 3D Hardware Security 14/26
Introduction Attack Model k -Security Layout Randomization Summary k -Security S(w) = 2 H G Y 5 S(v),S(u),S(x) = 2 W 2 V 4 X 3 U 1 A vertex v ∈ H is k -secure if there exist at least k subgraph isomorphisms each of which maps v to a distinct vertex in G . An obfuscated graph (circuit) H is k -secure if every vertex (gate) in H is k -secure. Frank Imeson, Waterloo ECE 3D Hardware Security 14/26
Introduction Attack Model k -Security Layout Randomization Summary k -Security S(w) = 2 H G Y 5 S(v),S(u),S(x) = 2 W 2 V 4 S(y) = 1 X 3 U 1 A vertex v ∈ H is k -secure if there exist at least k subgraph isomorphisms each of which maps v to a distinct vertex in G . An obfuscated graph (circuit) H is k -secure if every vertex (gate) in H is k -secure. Frank Imeson, Waterloo ECE 3D Hardware Security 14/26
Introduction Attack Model k -Security Layout Randomization Summary k -Security S(w) = 2 H G Y 5 S(v),S(u),S(x) = 2 W 2 V 4 S(y) = 1 X 3 S(H) = 1 U 1 A vertex v ∈ H is k -secure if there exist at least k subgraph isomorphisms each of which maps v to a distinct vertex in G . An obfuscated graph (circuit) H is k -secure if every vertex (gate) in H is k -secure. Frank Imeson, Waterloo ECE 3D Hardware Security 14/26
Introduction Attack Model k -Security Layout Randomization Summary Computational Complexity � G , H � is k -secure ∈ NP -complete. We investigated two approaches: Reduction to Subgraph Isomorphism and use of VF2 solver Reduction to SAT and use of MiniSAT solver Avg Time 100 vf2 1 sat 0.01 0.0001 1e-06 0 200 400 600 800 1000 1200 1400 Number of Vertices Frank Imeson, Waterloo ECE 3D Hardware Security 15/26
Introduction Attack Model k -Security Layout Randomization Summary Cost vs. Security Cost = Number of hidden edges G 5 6 Goal: Explore Cost vs. Security trade-off 2 4 3 1 Greedy approach Start with no edges in H . H 5 6 2 4 3 1 Frank Imeson, Waterloo ECE 3D Hardware Security 16/26
Recommend
More recommend
