1. Protect Your Hardware from Hacking and Theft
Class 2: How Do You Implement Secure Hardware?
How do you implement secure hardware? This class will cover the key techniques used by modern devices to protect design IP from the most common threats. Starting with simple approaches to tamper protection, and then moving on to protection from copying, and cloning this class will begin to introduce key devices and features needed to successfully protect your design.
11/11/2014
Warren Miller

2. This Week’s Agenda
11/10/14 Stealing and Hacking Your Design- Easy 11/11/14 How Do You Implement Secure Hardware? 11/12/14 Secure Devices- An Overview 11/13/14 Protecting Your System in the Field 11/14/14 An Example Design- in Detail

3. Course Description Your IP… Easy to steal... Must protect it…
This course provides a practical and implementation oriented follow-on to a previous class, given in Dec 2013, that introduced many high level security concepts.
You CAN protect your design from reverse engineering or theft.

4. Today’s Topics and Goals
Protection- What is Required?
Simple Example
The Concept of a Secure Root of Trust
Know what this means for your designs
Available Devices Overview
MCUs, Specialized devices, FPGAs
Know about the key advantages and disadvantages of each

5. Technology to Thwart Threats
Typical Hardware (for this course)
MCU, FPGA, ASIC, Analog, Standard Devices, etc
All interconnected on a circuit board
Can be accessed when used in the field
Thwarting Threats (Keep design secret)
MCU code, FPGA code, Flash memory contents
Secret keys, SRAM data, Data going on/off board
Devices used, Board layout, Tamper detection
More detailed set-up for device specifics

6. Protect Your Design- An Example
Simple Sensor and Display
MCU
Overall control
Serial Flash
Display images
SPI Interface
Sensor (Temp, Magnetic, Gyro, etc)
Battery
LCD
MCU
Serial Flash
Sensor
Battery
UART
Aggregation
Hub

7. Security Concepts- Review
Secret Keys
Symmetric Keys
Asymmetric Keys
Public Key System
Protection of Secret Keys
Secure Storage
Tamper Detection
Standard Algorithms
“Difficult” Problems
Encryption
Decryption
Authentication
Certificates

8. Attacking Security Keys
Side Channel Analysis Attacks
Differential Power Analysis
(x1 gain)
Typical single trace
Obvious difference leaks secret
First published in 1999 by Paul Kocher and his associates at Cryptography Research, Inc. (now a division of Rambus)
Over 7 billion chips per year under license.
Observe a series of cryptographic transactions
Apply statistical tests to correlations in computational intermediates – Compare results from key hypotheses
Results recover the key and other secrets
Correct key guess
(an 8-bit portion of key)
Shows correlation peaks (x100 gain)
Random low correlation
(x100 gain)
Incorrect key guess
[Paul Kocher et al, Proc. CRYPTO 1999]

9. Secure Root of Trust
You must have a secure starting point to implement a secure system
Once you have a secure starting point you can extend trust to the rest of the system
What do you need?
Hardware that operates as expected every time
Secure storage- security keys, IDs, certificates, etc.
Security routines- AES, SHA, etc.

10. Protect MCUs MCU has Code in Flash so… Protect Code Access
Via JTAG, Via Debug, Via Reads, etc
Can be difficult/inconvenient to protect memory
Programming during manufacturing?
Protect from Tampering
Passwords, Lock Bits, Secure memory blocks
Voltage levels, Clock failure, Traces lifted, De-cap
Just an overview at this point

11. MCUs- What’s Available?
Regular MCUs
Flash on chip
Can make OTP, Turn-off JTAG, etc.
Secure MCUs
Additional security capabilities
Crypto, Tamper detection, Zeroization, Key storage
Specific applications (often)
ST, Renesas, TI, Maxim, etc

12. Protect FPGAs FPGA has Configuration Bit Stream Protect from Tampering
External memory?
Internal memory (Flash)?
Debug, JTAG, etc
Encrypt configuration (Protect your secret keys!)
Protect from Tampering
Passwords and Lock bits, Secure address space,
Battery Back-up, De-cap Detect, Circuit tricks
Just an overview at this point

13. FPGAs- What’s Available?
SRAM FPGAs
Configure SRAM-based fabric via external NVM
Some can use battery back-up to store keys
On-chip security hardware
Flash FPGAs
Configure via fabric-based NVM
Keys stored via on-chip NVM

14. Protect Your Circuit Board
Typical HW Hack- Divide and Conquer
Separate modules by lifting traces
Control clocks, Power
Snoop at interfaces
Inject fake data
Power and timing monitoring
Use Tamper Detection Traces and Layers
Capacitance change? Signal noise? Traces broken?
Just an overview at this point

15. How Do You Protect The Design?
MCU
Copy Protect
Serial Flash
Encrypt Data
Board
Tamper Detection
Data
LCD
MCU
Serial Flash
Sensor
Battery
UART
Protect Code Access
Via JTAG, Via Debug, Via Reads, etc
Can be difficult/inconvenient to protect memory
Programming during manufacturing?
Protect from Tampering
Passwords, Lock Bits, Secure memory blocks
Voltage levels, Clock failure, Traces lifted, De-cap
Typical HW Hack- Divide and Conquer
Separate modules by lifting traces
Control clocks, Power
Snoop at interfaces
Inject fake data
Power and timing monitoring
Use Tamper Detection Traces and Layers
Capacitance change? Signal noise? Traces broken?
Aggregation
Hub

16. Additional Resources
Previous Course: “Securing Your Embedded System” Security Blog, Schneier on Security: Department of Homeland Security- Federal Network Resilience SIA Report on Counterfeiting Coursera Cryptography Courses: (Search for Cryptography) Digi-Key TechZone Article Library: MCUs , Securing MCU Designs, 11/06/2013

17. This Week’s Agenda
11/10/14 Stealing and Hacking Your Design- Easy 11/11/14 How Do You Implement Secure Hardware? 11/12/14 Secure Devices- An Overview 11/13/14 Protecting Your System in the Field 11/14/14 An Example Design- in Detail