Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically

Abstract

The computer systems security arms race between attackers and defenders has largely taken place in the domain of software systems, but as hardware complexity and design processes have evolved, novel and potent hardware-based security threats are now possible. This paper presents a hybrid hardware/software approach to defending against malicious hardware.We propose BlueChip, a defensive strategy that has both a design-time component and a runtime component. During the design verification phase, BlueChip invokes a new technique, unused circuit identification (UCI), to identify suspicious circuitry-those circuits not used or otherwise activated by any of the design verification tests. BlueChip removes the suspicious circuitry and replaces it with exception generation hardware. The exception handler software is responsible for providing forward progress by emulating the effect of the exceptiongenerating instruction in software, effectively providing a detour around suspicious hardware. In our experiments, BlueChip is able to prevent all hardware attacks we evaluate while incurring a small runtime overhead.

WordRev: Finding word-level structures in a sea of bit-level gates

“…Finally, our technique is complementary to other recent work on malicious trojan circuit detection (e.g., [6], [13]). We do not seek to find trojans directly, instead focusing on providing visibility in terms of high-level structures to an unstructured netlist.…”

“…6 In addition, it used 176 instead of 182 latches. In this case, WordRev found 50 words, 4 less than the number of words found in "TR Router".…”

“…Hardware Trojan is a malicious modification of the circuity of an integrated circuit (IC) that aims to compromise the integrity, security and reliability of the IC. A hardware trojan can provide a foothold for software based attacks, where the attacks are orchestrated by colluding sofware [6]. It can also act as a portal for leaking sensitive information [9], or simply subvert the operation of the system under special conditions (e.g.…”

Reverse engineering circuits using behavioral pattern mining

“…We do not address the problem of untrusted manufacturing and IC piracy, where the designer is trusted, which can be tackled by techniques such as EPIC [19]. Our technique is complementary to other recent work on malicious trojan circuit detection (e.g., [12,21]). We do not seek to find trojans, instead focusing on detecting if a subcircuit exhibits correct behavior which is captured by a set of logical specifications; if our approach deems a sub-circuit to match an abstract component, it is guaranteed to do so due to the use of formal verification.…”

Wireless security techniques for coordinated manufacturing and on-line hardware trojan detection

“…Furthermore, wireless security imposes a technically challenging set of objectives and requirements. For example, side channel and fault induction security attacks [18] [19][24] [32][41] [45] are much more likely on cell phones and, in particular, on sensor nodes that may be deployed in unprotected or even hostile environments. Also, operational conditions and numerous design constraints such as low energy, low power, and low cost impose difficulties on security requirements.…”