Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
HardwareSecurity
1
ChesterRebeiroIITMadras
Physically Unclonable Functions
PhysicalUnclonableFunctionsandApplications:ATutorialhttp://ieeexplore.ieee.org/document/6823677/
EdgeDevices
3
1000softhemexpectedtobedeployedLowpower(solarorbatterypowered)SmallfootprintConnectedtosensorsandactuatorsExpectedtooperate24x7almostunmanned24x7thesedeviceswillbecontinuouslypumpingdataintothesystem,whichmayinfluencethewaycitiesoperateWillaffectusinmultipleways,andwemaynotevenknowthattheyexist.
AuthenticatingEdgeDevices• Storedkeys
– EEPROMmanufactureisanoverhead– Publickeycryptographyisheavy– Canbeeasilycopied/cloned
4
EncryptiondoneinedgedevicePublickeysstoredinserver
Privatekeys
PhysicallyUnclonableFunctions• Nostoredkeys• Nopublickeycryptography• Cannotbecloned/copied• Usesnano-scalevariationsinmanufacture.Notwodevicesareexactlyidentical
5
EncryptiondoneinedgedevicePublickeysstoredinserver
challenge/response
DigitalFingerprints
PUFs
6
Afunctionwhoseoutputdependsontheinputaswellasthedeviceexecutingit.
WhatisExpectedofaPUF?(InterandIntraDifferences)
7
challenge
response
response
challenge
Response
Response
(Reliable)SameChallengetoSamePUFDifferencebetweenresponsesmustbesmallonexpectationIrrespectiveoftemperature,noise,aging,etc.
(Unique)SameChallengetodifferentPUFDifferencebetweenresponsesmustbelargeonexpectationSignificantvariationduetomanufacture
WhatisExpectedofaPUF?(Unpredictability)
8
challenge
response
response
DifficulttopredicttheoutputofaPUFtoarandomlychosenchallengewhenonedoesnothaveaccesstothedevice
IntrinsicPUFs• Completelywithinthechip
– PUF– Measurementcircuit– Post-processing
• Nofancyprocessingsteps!– eg.MostSiliconbasedPUFs
9
SiliconPUFseg.RingOscillatorPUF
10
f = 12nt
FrequencyofringoscillatorNumberofstagesDelayofeachstage
fnt
RingOscillatorwithoddnumberofgates
Frequencyaffectedbyprocessvariation.
Whyvariationoccurs?
11
Whengate voltage is less than threshold no current flows When gate voltate is greater than threshold current flows from source to drain Threshold voltage is a function of doping concentration, oxide thickness
Delaydependsoncapacitance
ProcessVariations• Oxidethickness• Dopingconcentration• Capacitance
MOSTransistor CMOSInverter
SiliconPUFseg.RingOscillatorPUF
12
>enable
counter
counter
Nbitchallenge
1
2
3
N
N-1
N-2
1bitresponse
RA
RB
response = 10
fA > fBfA ≤ fB
⎧⎨⎪
⎩⎪
ResultsofaROPUF15Xilinx,Virtex4FPGAs;1024ROsineachFPGA;EachROhad5inverterstagesand1ANDgate
13
Physical Unclonable Functions for Device Authentication and Secret Key Generation https://people.csail.mit.edu/devadas/pubs/puf-dac07.pdf
InterChipVariations(Uniquenessmeasurement)
challenge
response
responseWhen128bitsareproduced,
Avg59.1bitsoutof128bitsdifferent
ResultsofaROPUF15Xilinx,Virtex4FPGAs;1024ROsineachFPGA;EachROhad5inverterstagesand1ANDgate
14
Physical Unclonable Functions for Device Authentication and Secret Key Generation https://people.csail.mit.edu/devadas/pubs/puf-dac07.pdf
IntraChipVariations(Reproducabilitymeasurement)
challenge
response
response0.61bitsonaverageoutof128bitsdiffer
120oC1.08V
20oC;1.2V
ArbiterPUF
15
0
0
1
10
0
1
1
01
IdeallydelaydifferencebetweenRedandBluelinesshouldbe0iftheyaresymmetricallylaidout.Inpracticevariationinmanufacturingprocesswillintroducerandomdelaysbetweenthetwopaths
Switch
Arbiter
16
DFFD
clk
Q ?
IfthesignalatDreachesfirstthenQwillbesetto1IfthesignalatclkreachesfirstthenQwillbesetto0
DFF
ArbiterPUF
17
…challenge
rising Edge
1 if toppath is faster,else 0
D Q1
1
0
0
1
1
0
0
1
1
0
0
1 0 10 0 1
01
GThe image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again.
13.56MHzChipForISO14443Aspec.
ResultsforROPUF
18DesignandImplementationofPUF-Based“Unclonable”RFIDICsforAnti-CounterfeitingandSecurityApplicationsIEEEInt.Conf.onRFID,2008,S.Devdaset.Al.
ComparingROandArbiterPUF
19
NumberofChallenge:ResponsePairs:
NumberofChallenge:ResponsePairs:
N2
⎛
⎝⎜
⎞
⎠⎟ 2N
#CRPslinearlyrelatedtothenumberofcomponents
#CRPsexponentiallyrelatedtothenumberofcomponents
WEAKPUF STRONGPUF
WeakPUFvsStrongPUF
20
• ComparativelyfewnumberofChallengeResponsePairs(CRPs)
• HugenumberofChallengeResponsePairs(CRPs)
• CRPsmustbekeptsecret,becauseanattackermaybeabletoenumerateallpossibleCRPs
• WeakPUFsusefulforcreatingcryptographickeys
• ItisassumedthatanattackercannotEnumerateallCRPswithinafixedtimeinterval.ThereforeCRPscanbemadepublic
• Formally,anadversarygivenapoly-sizedsample
ofadaptivelychosenCRPscannotpredicttheResponsetoanewrandomlychosenchallenge.
• Typicallyusedalongwithacryptographicscheme(likeencryption/HMACetc)tohidetheCRP(sincetheCRPsmustbekeptsecret)
• Doesnotrequireanycryptographicscheme,sinceCRPscanbepublic.
WeakPUF StrongPUF
• VeryGoodInterandIntradifferences
PUFBasedAuthentication(withStrongPUF)
21
CRPs
challenge
response
Bootstrapping:Atmanufacture,serverbuildsadatabaseofCRPsforeachdevice.Atdeployment,serverpicksarandomchallengefromthedatabase,queriesthedeviceandvalidatestheresponse
PUFBasedAuthenticationManintheMiddle
22
CRPs
challengeresponse
ManinthemiddlemaybeabletobuildadatabaseofCRPsTopreventthis,CRPsarenotusedmorethanonce
PUFBasedAuthenticationCRPTables
23
CRPs
challengeresponse
EachdevicewouldrequireitsownCRPtableandsecurelystoredinatrustedserver.Tablesmustbelargeenoughtocatertotheentirelifetimeofthedeviceorneedstoberechargedperiodically(scalabilityissues)
CRPs
PUFbasedAuthentication(AlleviatingCRPProblem)
SecretModelofPUF
24
GateDelaysofPUFcomponents Bootstrapping:Atmanufacture,serverbuildsa
databaseofgatedelaysofeachcomponentinthePUF.Atdeployment,serverpicksarandomchallengeconstructsitsexpectedresponsefromsecretmodel,queriesthedeviceandvalidatestheresponse
StillRequiresSecureBootstrapping
andSecureStorage
PUFbasedAuthentication(AlleviatingCRPProblem)
• PPUF:PublicModelPUF
25
GateDelaysofPUFComponents(Public)
Trustedserver(PKI)
Bootstrapping:DownloadthepublicmodelofPUFfromthetrustedserver.Atdeployment,serverpicksarandomchallengeconstructsexpectedresponsefrompublicmodel,queriesthedeviceandvalidatestheresponse.Iftimeforresponseislessthanathresholdacceptresponseelserejects.
Assumption:AdevicetakesmuchlesstimetocomputeaPUFresponsethananattackerwhomodelsthePUF.
T<T0?
PUFbasedAuthentication(AlleviatingCRPProblem)
HomomorphicEncryption
26
EncryptedCRPs
UntrustedCloud
Response
Conclusions• DifferenttypesofPUFsbeingexplored
– AnalogPUFs,SensorPUFsetc.
• CRPissuestillabigproblem
• SeveralattacksfeasibleonPUFs.– Modelbuildingattacks(SVMs)– TamperingwithPUFcomputation(eg.Forcingasine-waveonthegroundplane,
canaltertheresultsofthePUF)
• PUFsareaverypromisingwayforlightweightauthenticationofedgedevices.
27
HardwareTrojans
Hardware Security: Design, Threats, and Safeguards; D. Mukhopadhyay and R.S. Chakraborty Slides from R. S. Chakraborty, Jayavijayan Rajendran, Adam Waksman
HardwareTrojan
29
• MaliciousanddeliberatelystealthymodificationmadetoanelectronicdevicesuchasanIC
• ItcanchangethechipsfunctionalitytherebyunderminetrustinsystemsthatusethisIC
cryptoModule
key
inputciphertext
HardwareTrojan
30
• MaliciousanddeliberatelystealthymodificationmadetoanelectronicdevicesuchasanIC
• ItcanchangethechipsfunctionalitytherebyunderminetrustinsystemsthatusethisIC
cryptoModule
key
inputciphertext
1
0
cryptoModule
key
inputciphertext
ExampleofaHardwareTrojanCheatCode(combinationaltrojans)
31
Trigger
If(input==0xcafebeef)select=1elseselect=0
PropertiesofHardwareTrojan:• verysmall• mostlypassive
0xcafebeef1
0
cryptoModule
key
inputciphertext
ExampleofaHardwareTrojanSequentialTrojan(Timebombs)
32
Trigger
PropertiesofHardwareTrojan:• verysmall• mostlypassive
0xca0xaf0xee0xbe0xef
1
0
time
select=1select=0ca
af
eebe
ef
ICLifeCycle(VulnerableSteps)
33
IP ToolsStd. Cells Models
DesignSpecifications Fab Interface Mask Fab
WaferProbe
Dice and Package
PackageTest
Deploy and
Monitor
Trusted
Either
Untrusted
Wafer
*http://www.darpa.mil/MTO/solicitations/baa07-24/index.html
Offshore
Third-party
PropertiesofHardwareTrojan:*verysmall• mostlypassive• Canbeaddedatmultiplestages
HardwareTrojanStructure
34
PayloadTriggerCircuit
TriggerCircuit:Basedonaseldomoccurringevent.Forexample,• whenaddressonaddressbusis0xdeadbeef.• Aparticularlyrarepacketarrivesonnetwork• Sometimehaselapsed
Payload:Dosomethingnefarious:• Makeapageinmemory(un)privileged• Leakinformationtotheoutsideworldthroughnetwork,
covertchannels,etc• Causethesystemtofail
Trojancanbeinsertedanywhereinduringthemanufacturingprocess(eg.InthirdpartyIPcorespurchased,byfabricationplant,etc.)
TrojansinIPs• ThirdpartyIPs
– Cantheybetrusted?– Willtheycontainmalicious
backdoors
• Developersdon’t/can’tsearch1000soflinesofcodelookingoutfortrojans.
35
FANCI:IdentificationofStealthyMaliciousLogic
• FANCI:evaluatehardwaredesignsautomaticallytodetermineifthereisanypossiblebackdoorshidden
• Thegoalistopointouttotestersofpossibletrojanlocationsinahugepieceofcode
36
http://www.cs.columbia.edu/~simha/preprint_ccs13.pdf(someofthefollowingslidesareborrowedfromAdamWaksman’sCCStalk)
BackdoorsareStealthy• Small
– Typicallyafewlinesofcode/area• Stealth
– Cannotbedetectedbyregulartestingmethodologies(raretriggers)– Passivewhennottriggered
37
Unfortunately…Withsomuchofcodeitishighlylikelythatstealthyportionsofthecodearemissedornottestedproperly.
38
FANCI:willdetectthesestealthycircuits.ThesepartsaremostlikelytohaveTrojans.Theaimistohavenofalsenegatives.Afewfalsepositivesareacceptable
ControlValues
A B C O
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 1
1 1 0 0
1 1 1 039
ByhowmuchdoesaninputinfluencetheoutputO?
A
B
C
O
ControlValues
A B C O
0 0 0 0
1 0 0 1
0 0 1 1
1 0 1 1
0 1 0 1
1 1 0 0
0 1 1 0
1 1 1 040
Byhowmuchdoesainputinfluencetheoutput0?
A:hasacontrolof0.5ontheoutput(Amattersinthisfunction)
1 1 0 0A B C 0
A
B
C
O
ControlValues
A B C O
0 0 0 0
1 0 0 0
0 0 1 1
1 0 1 1
0 1 0 0
1 1 0 0
0 1 1 0
1 1 1 041
Byhowmuchdoesainputinfluencetheoutput0?
A:hasacontrolof0ontheoutput(Adoesnotmatterinthisfunction)(Aiscalledunaffecting)
1 1 0 0A B C 0
A
B
C
O
ControlValuesforaTriggerinaTrojan
42
if (addr == 0xdeadbeee) then{ trigger = 1 }
A31 A30 A2 A1 A0 trigger
0 0 … 0 0 0 0
0 0 … 0 0 1 0
0 0 … 0 1 0 0
0 0 … 0 1 1 0
: : : : : :
1 1 1 1 0 1
: : : : : :
1 1 1 1 1 1 0
A31hasacontrolvalue1/216
EasiertohideatrojanwhenlargerinputsetsareconsideredAlowchanceofaffectingtheoutputLendsitselftostealthinessàeasiertohideamaliciouscode
AnExampleofaMux
43
<A,B,C,D,S1,S2>=<0.25,0.25,0.25,0.25,0.5,0.5>
Notrojanpresenthere(intutively):*Allmuxinputshaveacontrolvaluearoundmidrange(nottoocloseto0)
AnExampleofaMaliciousMux
44
66extraselectlineswhichareonlymodifyMwhenwheyaresettoaparticularvalue
M
ThecontrolvaluesEandS3toS66aresuspiciousbecausetheyrarelyinfluencethevalueofM.Perfectfordisguisingmaliciousbackdoors
JustsearchingforMINvaluesisoftennotenough.Bettermetricsareneeded.
ComputingStealthfromControl
45
ComputingStealthfromControl
46
FANCI:TheCompleteAlgorithm
47
ICLifeCycle(TheFab)
48
IP ToolsStd. Cells Models
DesignSpecifications Fab Interface Mask Fab
WaferProbe
Dice and Package
PackageTest
Deploy and
Monitor
Trusted
Either
Untrusted
Wafer
*http://www.darpa.mil/MTO/solicitations/baa07-24/index.html
Third-party
DetectingTrojansinICs• OpticalInspectionbasedtechniques
ScanningOpticalMicroscopy(SOM),ScanningElectronMicroscopy(SEM),andpico-secondimagingcircuitanalysis(PICA)
– Drawbacks:CostandTime!
• Testingtechniques– Notaverypowerfultechnique
• Sidechannelbasedtechniques– Nonintrusivetechnique– Compareside-channelswithagoldenmodel
49ASurveyonHardwareTrojanDetectionTechniqueshttp://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7169073
SideChannelBasedTrojanDetection
50
LightweightPRESENTImplementation PowerTraces
Hardwaretrojandesignanddetection:apracticalevaluationhttps://dl.acm.org/citation.cfm?id=2527318
SideChannelBasedTrojanDetection(ICwithTrojan)
51
DifferenceofDistributions
52
HardwareTrojanPrevention(Ifyoucan’tdetectthenprevent)
53
SilencingHardwareBackdoorswww.cs.columbia.edu/~simha/preprint_oakland11.pdfSlidestakenfromAdamWaksman’sOaklandtalk
HardwareTrojanPrevention
54
EnsurethatahardwareTrojanisneverdeliveredthecorrectTrigger
Example(A5stageprocessor)
55
Example(A5stageprocessor)
56
TypesofTrojans
57
TickingTimebomb
58
TickingTimebomb
59
CheatCodes
60
CheatCodes
61
SequenceCheatCodes
62
HardwareTrojanSilencing(withObfuscation)
63
SilencingTickingTimebombs• PowerResets:flushpipeline,writecurrentIPandregistersto
memory,savebranchhistorytargets
64
SilencingTickingTimebombs• Cantriggerbestoredtoarchitecturalstateandrestoredlater
– No.Unitvalidationtestspreventthis– Reasonfortrustingvalidationepoch
LargevalidationteamsOrganizedhierarchically
• Cantriggersbestoredinnon-volatilestateinternaltotheunit?– Eg.Malwareconfiguresahiddennon-volatilememory
• UnmaskableInterrupts?– UseaFIFOtostoreunmaskableinterrupts
• PerformanceCountersarehiddentimebombs 65
DataObfuscation
66
HomomorphicEncryption(Gentry2009)IdealsolutionButpracticalhurdles
DataObfuscation
67
DataObfuscation
68
StoreData5toAddress7
DataObfuscation(ComputationalCase)
69
SequenceBreaking(Reordering)
70Ensurefunctionalityismaintained
SequenceBreaking(Insertingevents)
71Insertarbitraryeventswhenreorderingisdifficult
CatchAll(Duplication)
72
Expensive:Non-recurring:design;verificationcostsduetoduplicationRecurring:Powerandenergycosts
PowerAnalysis
73
CMOSTechnology• AlmosteverydigitaldeviceisbuiltusingCMOS
technology.• CMOS–complimentarymetaloxide
semiconductor
74
CMOSInverter
• Whentheinputswitchesfrom0à1,TransistorT1turnsonandT2turnsoff.CapcitorCLgetscharged.
• Whentheinputswitchsfrom1à0,transitorT1isturnedoffandT2turnson.CapacitorCLdischarges.
75
T1
T2
PowerConsumptionofaCMOSInverter
• PowerisconsumedwhenCLchargesordischarges(i.e.thereisatransitionintheoutputfrom0à1or1à0)
• Usinganoscilloscopewecanmeasurethepowertodeterminewhentheinverteroutputchangesstate
76
Outputofinverter
Powerconsumption
SynchronousDigitalCircuits• Mostelectronicequipmentuseaclockasreference• Allstatetransitionsaredonewithrespecttothisclock
– Powerconsumptionisthereforeatclockedges
77
EssenceofPowerAnalysis• Wedon’tknowwhatishappeninginsidethedevice,butweknowthepower
consumption• Canwededucesecretinformationfromthepowerconsumption
78
TheTypesofPowerAnalysis• SPA:SimplePowerAnalysis
• DPA:DifferentialPowerAnalysis
Requiresmorestrategyandstatisticstogleansecretinformation
• Templatebasedattacks
79
DifferentialPowerAnalysis(asaglance)
80
Inputdata
Key
Guessedkey
deviceundertest
Modelof
device
StatisticallyCompare
Powerconsumption Hypotheticalpowerconsumption
HypotheticalPowerConsumption• CMOScircuitsfollowtheHammingweightandHammingdistancepower
models• HammingDistanceModel
– ConsidertransitionsofregisterR
• HammingWeightModel
TheHammingweightmodelwillwork,whenRisprechargedtoeither0or1
81
K
P CFR
(1011)à(1101)à(1001)à(0010)à(0011)3131#toggles
(1011)à(1101)à(1001)à(0010)à(0011)3213#toggles
ASmallExample
P K C
0000 1010 1010
0001 1010 1011
0010 1010 1000
0011 1010 1001
0100 1010 1110
0101 1010 1111
.. … …82
K
P C
Device
Malloryhascontrolofthisdevice.--Shecanmonitoritspowerconsumption--ShecanfeedinputsP--Sheevenknowswhatoperationsgoesoninside.Thethingsshedoesn’tknowisKandCHeraimistoobtainthesecretkeyK
F
DPAAttack
83
P Kguess C HypotheticalPower
RealPowerMeasured
0000 1111 1111 4
0001 1111 1110 3
0010 1111 1101 3
0011 1111 1100 2
0100 1111 1011 3
0101 1111 1010 2
⁞ ⁞ ⁞ ⁞ ⁞
notethatthisisawaveformwhichchangesw.r.ttime
P=0000
P=0001
P=0010Chereiscomputedwrttotheguessedkeyi.e.C=F(P,Kguess)
84
DPA:WhatwemeanbycorrelationHypotheticalPower
4
3
3
Thesewaveformsarediscrete,theyhaveseveralpointsPerformcorrelationofhypotheticalPowerwrteachpointinthewaveformsConsideronlythemaximumcorrelation
correlate
DPA:Asmallexample
85
P Kguess C HypotheticalPower
RealPowerMeasured
0000 1111 1111 4 xx
0001 1111 1110 3 xx
0010 1111 1101 3 xx
0011 1111 1100 2 xx
0100 1111 1011 3 xx
0101 1111 1010 2 xx
⁞ ⁞ ⁞ ⁞ ⁞
correlate
ρ15
P Kguess C HypotheticalPower
RealPowerMeasured
0000 1110 1110 3 xx
0001 1110 1111 4 xx
0010 1110 1100 2 xx
0011 1110 1101 3 xx
0100 1110 1010 2 xx
0101 1110 1011 3 xx
⁞ ⁞ ⁞ ⁞ ⁞correlate
ρ14
P Kguess C HypotheticalPower
RealPowerMeasured
0000 1101 1101 3 xx
0001 1101 1100 2 xx
0010 1101 1111 4 xx
0011 1101 1110 3 xx
0100 1101 1001 2 xx
0101 1101 1000 1 xx
⁞ ⁞ ⁞ ⁞ ⁞correlate
ρ13 ρ12 ρ11 ρ10Findmaximumcorrelation
SampleOutput
86https://iis-people.ee.ethz.ch/~kgf/acacia/acacia.html
StatisticalComparison• Correlation:
Providesavaluebetween-1and+1.Avalueclosertothesignifieslineardependencebetweenthehypotheticalpowerandtherealpowerconsumption
• MutualInformationQuantifiesmutualdependencebetweenhypotheticalpowerandrealpowerconsumption
87
StatisticalComparison• BayesAnalysisWhatistheprobabilityofahypothesisgivenaspecificleakage
Pr[Hypothesis|Leakage]• DifferenceofMeansnext…
88
DifferenceofMeans• Guessakey:kguess• ComputeCguess=F(P,Kguess)• Findthekguesssuchthat|AVG(B0)–AVG(B1)|ismaximum
89
Device
B0 B1
BIT(Cguess,0)=0
P=0000Cguess=1111
P=0001Cguess=1110
P=0010Cguess=1101
K
P CF
BIT(Cguess,0)=1
PreventingDPA• Byhardwaremeans
– Differentiallogic• ByImplementation
– Masking
• ByAlgorithm– DPAresistantciphers(DRECON)– Rekeying
90