Logic locking as a solution for semiconductor intellectual property (IP) confidentiality has received considerable attention in academia, but has yet to produce a viable solution to protect against known threats. In part due to a lack of rigor, logic locking defenses have been historically short-lived, which is an unacceptable risk for hardware-based security solutions for critical systems that may be fielded for decades. Researchers have worked to map the concept of cryptographic indistinguishability to logic locking, as indistinguishability provides strong security guarantees. In an effort to bridge theory and practice, we highlight recent efforts that can be used to analyze the indistinguishability of logic locking techniques, and propose a new method of evaluation based on comparing distributions of k-cuts, which is akin to comparing against a library of sub-functions. We evaluate our approach on several different classes of logic locking and show up to 92

The complexity of the semiconductor design lifecycle and globalized manufacturing process creates concern over the threat of deliberate malicious alterations, or hardware Trojans, being inserted into microelectronic designs. This has resulted in a significant corpus of hardware Trojan research including Trojan design and benchmarking efforts and development of corresponding metrics and detection and prevention techniques, over the last two decades. In this survey, we first highlight efforts in Trojan design and benchmarking, followed by a cataloging of seminal and recent works in Trojan detection and prevention and their accompanied metrics. Given the volume of literature in this field, this survey considers only pre-silicon techniques. We make this distinction between pre- and post-silicon to properly scope and provide appropriate context into the capabilities of existing hardware Trojan literature. Each major section (design, prevention, and detection) is accompanied by insights, and common pitfalls, which we highlight can be addressed by future research.

Manufacturing and fielding sensitive government microelectronics requires ensuring the confidentiality and integrity of the design throughout the supply chain. This is particularly important for designs targeting technology nodes for which trusted foundries are not available. Logic locking has enjoyed significant attention as a potential solution to this problem. Though promising, existing locking research focuses on protecting against key recovery attacks and largely ignores concealing design intent. There is also a gap between theoretical security formalisms and approaches for evaluating locks against them. This presents a problem for government adoption of locking approaches as no thorough and practical evaluation criteria for logic locking exists. Therefore, in this work, we clearly outline a threat model for protecting the confidentiality of microelectronics and discuss necessary conditions for securing designs against capable adversaries. We then introduce a preliminary analysis approach for this threat model and evaluate popular locking techniques, finding that they do not satisfy the necessary conditions for secure locking.

Graph analysis in large integrated circuit (IC) designs is an essential tool for verifying design logic and timing via dynamic analysis (DA). IC designs resemble graphs with each logic gate as a vertex and the conductive connections between gates as edges. Using DA digital statistical correlations, graph condensation, and graph partitioning, it is possible to identify anomalies in high-entropy component centers (HECCs) and paths within an IC design. Identification of HECC aids in DA signal integrity analysis when comparing design iterations which effectively lowers the computational complexity of DA within large IC graphs. In this paper, a devised methodology termed IC layout subgraph component center identification (CCI) is described. For design deviation analysis in DA, CCI lowers design computational complexity by identifying design deviations within an IC's subgraphs. The CCI logic function signal integrity is verified using semi-supervised learning consisting of an unsupervised autoencoder anomaly detector to first identify anomalous subgraphs followed by efficient subgraph iterative refinement to locate specific deviated logic signals within the subgraphs.

Over the years, space systems have evolved considerably to provide high-quality services for demanding applications such as navigation, communication, and weather forecast. Modern space systems rely on extremely fast commercially available off-the-shelf (COTS) processing units, with built-in GPU, DSP, and FPGA in light-weight, energy-efficient hardware. Since such devices are not necessarily designed with security features as a priority, there must be an adaptive controller to protect this mission-critical space system from potential malicious attacks, such as memory leaks, packet drops, algorithmic trojans, and so on. These attacks can lead the system to substantial inefficiency or complete failure. Considering the hardware diversity in current space systems, we propose a framework to explore both diversity and redundancy not only of hardware but also of software to make the overall system fault-tolerant. Our approach deploys mechanisms for monitoring and orchestrating actions of redundancy, diversity, and randomization to render the system resilient unpredictably dynamic, and optimize efficiency as much as possible during abnormalities. Yet, we use rule-based and adaptive engines to keep track of the various computing units to learn the best strategies to take when the system is under attack. The robustness of our approach lies in the fact that it makes the system highly unpredictable to potential attackers and tolerates attacks to some extent, which is crucial for any mission-critical application.

Graph analysis in large integrated circuit (IC) designs is an essential tool for verifying design logic and timing via dynamic timing analysis (DTA). IC designs resemble graphs with each logic gate as a vertex and the conductive connections between gates as edges. Using DTA digital statistical correlations, graph condensation, and graph partitioning, it is possible to identify high-entropy component centers and paths within an IC design. Identification of high-entropy component centers (HECC) enables focused DTA, effectively lowering the computational complexity of DTA on large integrated circuit graphs. In this paper, a devised methodology termed IC layout subgraph component center identification (CCI) is described. CCI lowers DTA computational complexity by condensing IC graphs into reduced subgraphs in which dominant logic functions are verified.

The use of untrusted design tools, components, and designers, coupled with untrusted device fabrication, introduces the possibility of malicious modifications being made to integrated circuits (ICs) during their design and fabrication. These modifications are known as hardware trojans. The widespread use of commercially purchased 3rd party intellectual property (3PIP) and commercial design tools extends even into trusted design flows. Unfortunately, due to the theoretical result that there is no program that can decide whether any other program will eventually halt, we know that the properties of a program, or circuit, cannot be known in advance of running it. While we can design a circuit to meet some functional specification and generate a simulation or test suite to obtain at least probabilistic confidence that the circuit implements the intended functionality, we cannot test a circuit for unintended functionality due to the combinatorially large state space. To address these concerns, we have developed a design-time method for automatically and systematically modifying portions of a design that exhibit characteristics of hardware trojans. After each modification, the functionality of the design is verified against a comprehensive simulation suite to ensure that the intended circuit functionality has not been changed. This approach can be applied to any digital circuit and does not rely on secret keys or obfuscation.

In this work we examine approaches for using implementation diversity to disrupt or disable hardware trojans. We explore a variety of general frameworks for building diverse variants of circuits in voting architectures, and examine the impact of these on attackers and defenders mathematically and empirically. This work is augmented by analysis of a new majority voting technique. We also describe several automated approaches for generating diverse variants of a circuit and empirically study the overheads associated with these. We then describe a general technique for targeting functional circuit modifications to hardware trojans, present several specific implementations of this technique, and study the impact that they have on trojanized benchmark circuits.

Critical infrastructure systems continue to foster predictable communication patterns and static configurations over extended periods of time. The static nature of these systems eases the process of gathering reconnaissance information that can be used to design, develop, and launch attacks by adversaries. In this research effort, the early phases of an attack vector will be disrupted by randomizing application port numbers, IP addresses, and communication paths dynamically through the use of overlay networks within Industrial Control Systems (ICS). These protective measures convert static systems into "moving targets," adding an additional layer of defense. Additionally, we have developed a framework that automatically detects and defends against threats within these systems using an ensemble of machine learning algorithms that classify and categorize abnormal behavior. Our proof-of-concept has been demonstrated within a representative ICS environment. Performance metrics of our proof-of-concept have been captured with latency impacts of less than a millisecond, on average.

Counterfeiting or surreptitious modification of electronic systems is of increasing concern, particularly for critical infrastructure and national security systems. Such systems include avionics, medical devices, military systems, and utility infrastructure. We present experimental results from an approach to uniquely identify printed circuit boards (PCBs) on the basis of device unique variations in surface mount passive components and wire trace patterns. We also present an innovative approach for combining measurements of each of these quantities to create unique, random identifiers for each PCB and report the observed entropy, reliability, and uniqueness of the signatures. These unique signatures can be used directly for verifying the integrity and authenticity of the PCBs, or can serve as the basis for generating cryptographic keys for more secure authentication of the devices during system acquisition or field deployment. Our results indicate that the proposed approaches for measuring and combining these quantities are capable of generating high-entropy, unique signatures for PCBs. The techniques explored do not require system designers to utilize specialized manufacturing processes and implementation is low-cost.

This report summarizes a two-year LDRD project that investigated the problem of representing complex supply chains, identifying the worst risks and evaluating mitigation options. Our team developed a framework that includes a representation for business processes, risk assessment questions, risk indicators and methods for analyzing and summarizing the data. In our approach, the Process Matrix represents an overall supply chain for an end product in a high-level, tabular form. It connects the various touch-points of a business process including people, external vendors, tools, storage locations and transportation services while capturing the flow of both physical and intellectual artifacts. We believe these direct connections are exactly the things that a process owner can typically control. These material flows (both physical and intellectual) are also represented in a graph. This enables us to use graph-oriented analysis such as fault tree analysis and attack graph generation. Our approach is top-down, which helps users to get a more holistic understanding for a given amount of resources. Understanding the provenance of materials is difficult and it is easy to exhaust the analysts' resources. Rather than a tool to do vendor analysis or product comparison, our framework enables an enterprise-level analysis. The risk assessment questionnaires have a varying levels of detail and cover various aspects of the supply chain such as process steps, artifacts, suppliers, etc. and connections between these aspects such as artifact-storage, artifact-supplier, etc. Each question is further associated with one of seven risk indicators which can be used to summarize the risk. These risk indicators can also be weighted to reflect a user's concerns. We have successfully applied our framework to several use cases in various stages of its development and provided valuable insights to our partners, but it can also be applied to other complex systems outside of the supply chain security problem.