1. Securing the core root of trust (research in secure hardware design and test) Ramesh Karri (rkarri@duke.poly.edu) ECE Department

2. Who can attack your system?  Hobby (class I)  Obsession (class II)  Job (class III) D. Abraham, G. Dolan, G. Double, and J. Stevens. Transaction Security System. IBM Systems Journal 30(2): 206-229, 1991.

3. How can your system be compromised?  Application software  Protocols  Operating system software

4. Is the problem worth my time? Source: http://www.uscc.gov/annual_report/2008/annual_report_full_09.pdf,, page 168http://www.uscc.gov/annual_report/2008/annual_report_full_09.pdf US-China economic and security review commission hearing on China's proliferation practices and the development of its cyber and space warfare capabilities, testimony of Col. Gary McAlum.

5. How can your system be protected?  Fix applications  Fix protocols  Fix operating systems

6. “the core root of trust” is secure This assumes that…

7. “the core root of trust” is secure But…

8. Outline 1.threat models 2.defenses 3.conclusions

9. Threat models for hardware  Side channels  Power dissipation  Timing variation  Test infrastructure  Faults  interactions between side channels  Cloning  Overbuilding  Reverse Engineering  Trojans

10. An example: test infrastructure side channel

11. Data Encryption Standard (DES) LiLi RiRi Round Key K i + L i+1 R i+1 r Expansion + S-box Permutation a b c d

12. DES layout

13.  scan chain  test data input, TDI  test data output, TDO  test clock, TCK  test mode select, TMS  test reset chain all flip flops in a design test infrastructure

14. identify critical registers attack step 1

15. apply selected inputs attack step 2  3 plain texts  2 clock cycles in normal mode (plaintext reaches R,L)  198 clock cycles in test mode (R0, L0 scanned out)  1 clock cycle in normal mode (plaintext reaches R, L)  198 clock cycles in test mode (R1, L1 scanned out)  399×3=1197 clock cycles

16. Can leak secrets from DES, AES etc >80 % of all ASICs use scan chains for test/debug Readback/test infrastructure in FPGAs Load configuration stream Read-out bitstream for debug

17. test normal Secure normal Insecure Power off A fix: secure scan

18. test normal Secure normal Insecure Power off Secure scan Standards compliant 3 rd Prize, 2008-2009 IEEE TTTC PhD dissertation contest

19. Hardware threat models  Side channels  Power dissipation  Timing variation  Test infrastructure  Faults  interactions between side channels  Cloning  Overbuilding  Reverse Engineering  Trojans

20. T D D F U U U Background: IC design process D: Design, F: Fabrication T: Test, U: User

21. Rev. engineering T D D F U U U Reverse engineering D: Design, F: Fabrication T: Test, U: User

22. 3500 counterfeit Cisco networking components recovered estimated retail value ~ $3.5 million

23. cloning T D D F U U U Cloning D: Design, F: Fabrication T: Test, U: User

24. Trojans T D D F U U U Hardware Trojans D: Design, F: Fabrication T: Test, U: User

25. The kill switch ? IEEE Spectrum, 2008

26. Only 2% of ~$3.5 billion of DoD ICs manufactured in trusted foundries !!!

27. Taxonomy of trojans

28. Leak AES key 40 registrations, 10 finalists, 3 winners, 2 honorable mentions http://isis.poly.edu/csaw/embedded Trojan challenge

30. Trojans in the development cycle

31. Trojans at different abstractions

32. Location of the inserted trojans

33. Where are the trojans inserted? 2 1 3 4

34. Next steps  develop defenses  investigate effectiveness  developing benchmarks  metrics?

35. Physically unclonable functions Uses physical structure of a device to give a unique response Used as device IDs The ring oscillator frequency varies with process variations.

36. A trojan defense

37. PUF gives unique ID to hardware Can we give a unique ID to a design?

38. A preliminary defense

39. Next steps  develop defenses  investigate effectiveness  developing benchmarks  metrics?

40. Questions? rkarri@duke.poly.edu, 917 363 9703rkarri@duke.poly.edu