Thermal Sensor Based Hardware Trojan Detection in FPGAs

Transcription

1 2017 Euromcro Conference on Dgtal System Desgn Thermal Sensor Based Hardware Trojan Detecton n FPGAs Lampros Pyrgas 1, Flppos Prplds 1, Alk Panayotarou 2, *Pars Ktsos 1,3 1. Dgtal IC desgn and Systems Laboratory (DICES Lab), TEI of Western Greece, Greece 2. Dpt. of Busness Admnstraton n Patras, TEI of Western Greece, Greece 3. Industral Systems Insttute of Athena RIC n ICT and Knowledge Technologes, Patras, Greece e-mals: lpyrgas@hotmal.com, pktsos@eee.org Abstract Ths paper ntroduces an effcent technque for the detecton of malcous hardware, based on thermal sensors. Each sensor conssts of a Rng Oscllator wth three nverters, a control multplexer and a compact Resdue Number System rng counter requrng only two FPGA slces. The sensors were placed n a 6x5 grd structure n equal dstance from each other, n order to cover the whole area of the FPGA mplementaton causng a total overhead of only 1.9 %. To emulate a Hardware Trojan, a 64-bt Lnear Feedback Shft Regster was used. We demonstrate the proposed technque wth an expermental system based on a XILINX Basys 3 board. The results from the experments llustrate the effcency of the proposed technque. Accordng to our knowledge we are the frst that we have used ths knd of sensor for Hardware Trojan Detecton. Keywords Chnese Remander Theorem; FPGA securty; hardware Trojan horse detecton; on-chp thermal sensor; rng counter; rng oscllator. I. INTRODUCTION Due to dfferent desgn and manufacturng phases of an Integrated Crcut (IC) can be performed at geographcally dfferent places, an adversary has enough space to tamper the supply chan by nsertng a Hardware Trojan (HT). HTs are mplemented n order to provde opportuntes for later explots. Common explots nclude montorng and/or controllng of the processed data, reducng the performance of the system or observng secret nformaton such as a prvate key [1-2]. HT detecton technques consst of methodologes and tools developed n order to detect malcous modfcaton of dgtal crcuts. There are many dfferent detecton technques that are categorzed based on the pont of the HT nserton. Three types of detecton technques n the IC lfecycle have been proposed n the lterature: 1) Durng desgn tme; 2) Test tme; and 3) Run tme. In Test tme technques, specal crcuts are used n order to enhance the detecton senstvty of suspect ICs wth comparsons of the I/Os and sde channels parameters (e.g. delay, power, current etc) wth a goldel IC. Desgn tme approaches [3] have been proposed to support Test tme detecton technques. In Run tme technques that are nvasve, some specal crcuts are used for montorng n order to utlze pre-exstng redundancy n the crcut. Last but not least a golden IC s not requred. Test tme technques may fal to detect Trojans that do not get actvated at Test tme [4], for example when the HT uses only one gate for trggerng. Run tme approaches have several advantages over ther counterparts because can be utlzed for the entre lfetme of the IC. So, when a Trojan s not detected durng Test tme t can be found later, when the Trojan gets actvated [5-7]. The man drawback of Run tme technques has been the performance and power consumpton overheads. On-chp dgtal sensors n the IC can be a helpful detecton technque by focusng the test efforts on specfc regons of an IC allowng a more fne-graned sgnal collecton, n order to detect any unantcpated behavor of nternal sgnals. Many dfferent types of on-chp dgtal sensors have been proposed n the lterature as means for Trojan detecton (some representatve examples n [8-11]). A Rng Oscllator (RO) s a closed loop chan of an odd number of nverters that s very senstve to parameters such as temperature, the sze of a crcut and the operatng characterstcs (e.g., voltage). Due to beng very senstve to process varatons [12] mnmal modfcatons of the crcut can result n a frequency change. Untl now, whle there are many works that use ROs as temperature/thermal sensors on FPGAs [13-17], there are not many that take advantage of temperature sensors for hardware Trojan detecton. Only n [18] the authors proposed a RO based sensor n order to detect a temperature-trggered hardware Trojan. Fnally, n [19] and effcent methodology based on smulaton results usng state-of-the-art tools and avalable Trojan benchmarks s presented that can detect actve Trojans. However, ths method s workng better n ASICs rather that n FPGAs. Specfcally [13] utlzes the fact that the transstor swtchng speed s drectly proportonal to the temperature. The RO s mplemented on the de, and the frequency of oscllaton s used as a proxy for the temperature. In addton, a controller determnes when the sensors have to be enabled, and performs the steps requred to enable them and read back ther values. A Xlnx Vrtex-2 Pro FPGA s used. In addton, n [14] a fully dgtal temperature transducer s dynamcally nserted, utlzed, and fnally elmnated from the crcut under test usng Run tme reconfguraton. Also, a RO together wth a counter and a control unt s placed n the desgn. After the actual temperature of the de s captured, the value s read back va the FPGA confguraton port. Then, the * Collaboratng faculty wth the Industral Systems Insttute of Athena RIC n ICT and Knowledge Technologes. Ths work was fnancally supported by GSRT Acton Strategc Growth of Research and Technologcal Centers wth natonal and EU funds n the context of the research project I3T - MIS /17 $ IEEE DOI /DSD

2 sensor s elmnated from the chp n order to avod selfheatng effects. An approach for on-lne sensng, that ncludes a compact mult-use sensor wth a very compact counter and an mproved rng oscllator, s used n [15] and [17]. The proposed sensor can measure varatons n delay, statc power, dynamc power, and temperature. Fnally, n [16] the authors acheve to characterze the nondeal effects of workload varatons on a RO based thermometer over the FPGA. To do ths they collect nformaton about transent and steady-state temperature, supply current and rng-oscllator frequency n order to show how workload varaton mpacts rng-oscllator frequency. So, n ths paper an RO based on-chp thermal sensor grd s proposed for hardware Trojan detecton n a FPGA. Our major scope s to use a flexble, compact, and easy-to-use sensor applcable for FPGA desgn. Each of the used sensors s composed of three parts: a RO, a compact counter and a control multplexer. The rest of the paper s organzed as follows. In Secton II, we dscuss the sensor mplementaton n a FPGA. In Secton III, the expermental setup s descrbed and n Secton IV, the results of our experments are analyzed. Fnally, Secton V concludes the paper. II. THERMAL SENSOR IMPLEMENTATION Due to we wll use a large number of on-chp sensors, a very compact sensor desgn s necessary n order to avod a large amount of extra hardware resources. Therefore, a smlar verson of the sensor proposed n [15], [17] was selected. Each of the sensors s composed of three parts: a RO, a compact Resdue Number System (RNS) rng counter and a control multplexer. The archtecture of the proposed thermal sensor s depcted n Fgure 1. Each RO must be compact (to keep extra resources usage to a mnmum) as well as senstve to the quantty of nterest (must be able detect small HTs). A standard RO that ncludes three nversons was fnally selected, wth an on/off (enable) control sgnal. The nversons have the form of three NAND gates wth the enable sgnal as one of ther nputs. When the control sgnal, enable, s set to 1 the crcut oscllates; when t s set to 0, the feedback path s broken and there s no oscllaton. Ths RO desgn mnmzes the self-heatng phenomena snce a slow and sparse mplementaton has lower heat densty than a fast and dense one. Each NAND gate s mplemented wth the use of one 6-nput Look-Up-Table (LUT). Two man counter categores are usually consdered when a counter mplementaton s needed. The frst s the standard bnary counter that requres no specal decodng but consumes a large amount of hardware resources. The second s the Lnear Feedback Shft Regster counter (LFSR counter), whch n modern FPGAs can be mplemented usng shft regster LUTs (SRLs) thus leadng to a very compact desgn. However, the extracton of the count value requres solvng the dscrete logarthm problem, whch s a slow and dffcult process. Recently, a thrd counter desgn was proposed for FPGA mplementaton as an event counter, the Resdue Number System (RNS) rng counter [15], [17]. Ths alternatve counter s very compact and easy to decode, makng hm an deal canddate for the counter part of the sensors. The RNS counter s composed of multple rng counters of varyng lengths, a type of counter composed of a crcular shft regster. Each shft regster s ntalzed wth a smple pattern 1 on the MSB and 0 on all the other postons. A shft to the rght corresponds to an ncrement n the count value by one. Fgure 1. Thermal sensor archtecture. 269

3 The fnal poston of the 1 bt represents the counter s value modulo the shft regster s length. A RNS counter can be mplemented by usng Xlnx s shft regster LUTs (SRLs). A total of four 6-nput LUT and four flp-flops are needed for a RNS counter. The total countng value s extracted by applyng the Chnese Remander Theorem (CRT): counts = k = 1 r M y mod M (1) where k s the number of modul, r s a resdue, M = M / m, wth m beng a modulus, M beng the κ 1 countng perod ( M = Π =1 m ) and y = M mod m. The m s each shft regster s length and r s gven by the fnal poston of the 1 bt. In the proposed sensor, the RNS counter was desgned wth four rng counters (modul) of wdth 31, 29, 27 and 25 leadng to a countng perod equal to Each sensor has two modes of operaton. Durng the frst mode t captures the number of oscllatons and durng the second mode outputs the measurement. As already stated, when the RO control sgnal, enable, s set to 1 the crcut oscllates and the output of the RO feeds the counter s nput. Then, the RNS counter captures the number of oscllatons. In order to output the measurement (and therefor obtan the correspontng resdue r ), the system clock (read_clock) s now drven to the counter s nput and one by one the counter s bts are shfted to the output Q. The mode of operaton s selected by the read_enable sgnal, whch controls the nput to the RNS counter. The total hardware resources needed for each sensor nstance are eght 6-nput LUT and four flp-flops, whch can be provded by only two slces. III. EXPERIMENTAL SETUP For our experment, we desgned and mplemented a FPGA-based system on a Dglent Basys 3 FPGA development board (see Fgure 2). The Basys 3 board features the Xlnx Artx-7-FPGA XC7A35T-1CPG236C. Its 5,200 slces provde 33,280 logc cells wth each slce contanng four 6-nput LUTs and eght flp-flops. In addton, the board has fve user pushbuttons, a USB HID Host, and a USB-UART brdge. Frst, we mplemented the well-known AES cryptographc algorthm. We chose the open source AES mplementaton that s provded n [20]. Then we placed 30 of the proposed sensors on top of the prevous mplementaton. Sensor locatons can be easly specfed by usng the XILINX place constrant statements such as BEL and LOC. The sensors were placed n equdstant from each other, both vertcally and horzontally, formng a 6x5 grd, n order to cover the whole area of the mplementaton. In a general manner, we have to use more sensors for bgger mplementatons. The total area overhead caused by the addton of our sensor grd and ts supportng hardware s only 1.9 % of the FPGA resources. As an HT, a 64-bt Lnear Feedback Shft Regster (LFSR) [21] was mplemented smlar to [11]. The LFSR s enabled by usng the clock gated n order to be able to only observe the mpact of the addtonal gated whle there s no swtchng actvty of the LFSR tself when s nactve. Therefore, we can smulate the dynamc mpact of any sequental HT (when t s actve) as well as the statc effect of any combnatonal or sequental HT. The LFSR was placed all around the sensor 9 (Lne 2, Column 4). The fnal layout s shown n Fgure 3 wth the 30 thermal sensors (yellow color) and the 64-bt LFSR as HT (blue color). The next step was to buld an emprcal model for temperature calculaton by usng the System Montor as reference [22]. The System Montor was mplemented on the XADC ste (XADC_X0Y0) whch s n the center of the board. It ncludes a dual 12-bt, 1 Mega sample per second (MSPS) ADC and several on-chp sensors that, among others, support measurement of the on-chp de temperature. It s not necessary to nstantate the XADC n a desgn to access ts onchp montorng capablty. Fgure 2. Basys3 FPGA development board. Fgure 3. Layout of AES, 30 thermal sensors, and 64-bt LFSR. 270

4 By placng one sensor adjacent to the System Montor (SLICE_X30Y82 - SLICE_X31Y82), we were able to assocate that sensor s count wth the System Montor s temperature measurement. Usng many count-temperature measurement pars of data (over 100 data pars were collected), we were able to fnd an accurate model for temperature calculaton usng MATLAB. The count temperature relaton s shown n Fgure 4. We can observe the lnear dependence of the counter value vs temperature. Fgure 4. Count dependence on temperature for proposed sensor desgn. IV. EXPERIMENTAL RESULTS AND DISCUSSION Ten pars of plantext and key were provded to the AES algorthm for each executon. All the sensors were actvated before the frst executon of the AES algorthm and they were deactvated after 400 consecutve AES executons. The values of the counters (each counter s selected by the pushbuttons), are dsplayed on the Basys 3 dsplay and recorded for further processng (estmaton of the total counts through Chnese Remander Theorem) n MATLAB. Two dstnctve groups of nput pars, for the AES algorthm, were used: the frst group contaned ten pars that dd not actvate the Trojan whle the second group contaned ten pars that all actvate the Trojan. In order to obtan accurate measurements, we repeated the experment 100 tmes and then we calculated a mean value of each RO s count value for both the above nput groups. Then we calculated the count dfference between the two groups for each of the 30 ROs. Fnally, usng the emprcal model that we buld we calculated the correspondng temperature dfference for each sensor. The mean count values, for each sensor, for dle and actve Trojan, ther dfference and the calculated temperature dfference are presented n TABLE 1. When the sensor s far away from the Trojan t s not senstve whether the Trojan s dle or actve. When the Trojan s close to the sensor the count value n actve mode s very dfferent compared to the count value when s n dle mode. It s obvous the presence of the Trojan around the nnth sensor because the count dfference corresponds to a dfference n temperature between the dle and actve mode equal to o C. These values are also shown n a grd form n Fgure 4a. (count dfference) and n Fgure 4b (temperature dfference). The yellow sub-regon denotes the presence of the Trojan. The results prove that the proposed detecton technque s very effcent when enough sensors are placed n the FPGA n order for one of them to be close to the HT. (a) Count dfference (b) Temperature Dfference Fgure 5. Trojan actve vs Trojan dle count and temperature dfferences. V. CONCLUSIONS AND FUTURE WORKS In ths paper, a thermal sensor based methodology s proposed n order to detect the presence of malcous hardware n a FPGA. The sensor s very compact; t uses a RO wth three nverters and an RNS based rng counter. The sensors were placed n equdstance from each other, n a 6x5 grd structure n order to cover the whole area of the FPGA mplementaton. The proposed approach s sutable for lowcost thermal sensng because the total area overhead caused by the addton of our sensor grd s only equal to 1.9 % of the FPGA resources. Actually, we have proved that an already 271

5 known sensor desgn methodology s very effcent and sutable for hardware Trojan Detecton. Future work ncludes more experments, n XILINX and ALTERA devces, wth dfferent RO lengths (wth 5 and/or 7 nverters) n order to verfy the sensor senstvty, and an nvestgaton of a better model for temperature calculaton ncludng addtonal physcal parameters and operatng characterstcs such as voltage. Sensor poston (Lne, Column) TABLE 1: Mean count values for dle and actve Trojan, ther dfference and the correspondng temperature dfference. Trojan Status Dfference Sensor poston Accumulatve Idle Actve Count (Lne, Temperature Column) Trojan Status Idle Actve Count Dfference Accumulatve Temperature (1, 1) ,27 (4, 1) ,31 (1, 2) ,35 (4, 2) ,10 (1, 3) ,47 (4, 3) ,20 (1, 3) ,26 (4, 4) ,32 (1, 5) ,12 (4, 5) ,36 (2, 1) ,18 (5, 1) ,26 (2, 2) ,07 (5, 2) ,20 (2, 3) ,45 (5, 3) ,51 (2, 4) Trojan ,60 (5, 4) ,39 adjacent (2, 5) ,41 (5, 5) ,26 (3, 1) ,13 (6, 1) ,55 (3, 2) ,37 (6, 2) ,39 (3, 3) ,48 (6, 3) ,21 (3, 4) ,17 (6, 4) ,22 (3, 5) ,15 (6, 5) ,54 REFERENCES [1] M. Tehranpoor and F. Koushanfar, A survey of hardware Trojans: Taxonomy and detecton, IEEE Desgn and Test of Computers, vol. 27, no. 1, pp , Jan./Feb [2] P. Ktsos and A. G. Voyatzs,, Towards a Hardware Trojan Detecton Methodology, 2nd EUROMICRO/IEEE Workshop on Embedded and Cyber-Physcal Systems (ECYPS 2014), Budva, Montenegro, 15-19, June [3] H. Salman, M. Tehranpoor, and J. Plusquellc, A novel technque for mprovng hardware Trojan detecton and reducng Trojan actvaton tme, IEEE Transacton on Very Large Scale Integraton Systems, vol. 20, no. 1, pp , Jan [4] S. We, K. L, F. Koushanfar, and M. Potkonjak, Hardware Trojan horse benchmark va optmal creaton and placement of malcous crcutry, 49th IEEE Desgn Autom. Conf. (DAC), San Francsco, CA, USA, 2012, pp [5] S. Narasmhan, W. Yueh, X. Wang, S. Mukhopadhyay, and S. Bhuna, Improvng IC securty aganst Trojan attacks through ntegraton of securty montors, IEEE Desgn and Test of Computers, vol. 29, no. 5, pp , Oct [6] P. Ktsos, D. E. Smos, J. Torres-Jmenez, A. G. Voyatzs, Exctng FPGA Cryptographc Trojans usng Combnatoral Testng, 26th IEEE Internatonal Symposum on Software Relablty Engneerng (ISSRE 2015), Gathersburg, MD, USA, November 2-5, [7] A. G. Voyatzs, K. G. Stefands, P. Ktsos, Effcent Trggerng of Trojan Hardware Logc, 19th IEEE Internatonal Symposum on Desgn and Dagnostcs of Electronc Crcuts and Systems (DDECS 2016), Kosce, Slovaka, Aprl 20-22, [8] X. Zhang and M. Tehranpoor, "RON: An on-chp rng oscllator network for hardware Trojan detecton", Desgn, Automaton & Test n Europe 2011, Grenoble, France, March, [9] P. Ktsos and A. G. Voyatzs, FPGA Trojan Detecton Usng Lengthoptmzed Rng Oscllators, 17th Euromcro Conference on Dgtal Systems (DSD'14), Verona, Italy, August, [10] S. Kelly, X. Zhang, M. Tehranpoor, A. Ferrauolo, "Detectng Hardware Trojans usng On-chp Sensors n an ASIC Desgn", Journal of Electronc Testng, Volume 31, Issue 1, pp: 11 26, February [11] M. Lecomte, J. Fourner, P. Maurne, "An On-Chp Technque to Detect Hardware Trojans and Assst Counterfet Identfcaton", IEEE Transactons on Very Large Scale Integraton (VLSI) Systems, Vol.: PP, Issue: 99, pp: 1-14, December [12] J. Guajardo, S. Kumar, G.-J. Schrjen, and P. Tuyls, FPGA ntrnsc PUFs and ther use for IP protecton, Cryptographc Hardware and Embedded Systems (CHES 2007), Venna, Austra, 2007, pp

6 [13] S. Velusamy, W. Huang, J. Lach, M. Stan, and K. Skadron, Montorng Temperature n FPGA based SoCs, Internatonal Conference on Computer Desgn (ICCD '05), San Jose, Calforna, 2005, pp: [14] S. Lopez-Buedo, J. Garrdo, and E. I. Boemo, Dynamcally Insertng, Operatng, and Elmnatng Thermal Sensors of FPGA-Based Systems, IEEE Transactons on Components on Packagng Technologes, vol. 25, no. 4, pp , [15] K. M. Zck and J. P. Hayes, "On-Lne Sensng for Healther FPGA Systems", 18th annual ACM/SIGDA nternatonal symposum on Feld programmable gate arrays, Monterey, Calforna, USA February 21-23, 2010, pp: [16] M. Sayed and P. Jones, "Characterzng Non-deal Impacts of Reconfgurable Hardware Workloads on Rng Oscllator-Based Thermometers", ReConFg, 2011 Internatonal Conference on, Dec. 2011, pp [17] K. M. Zck and J. P. Hayes, Low-cost sensng wth rng oscllator arrays for healther reconfgurable systems, ACM Transacton Reconfgurable Technology and Systems, vol. 5, no. 1, pp. 1:1 1:26, Mar [18] X. L and B. Carron Schafer, "Temperature-trggered Behavoral IPs HW Trojan Detecton Method wth FPGAs", 25th Internatonal Conference on Feld Programmable Logc and Applcatons (FPL 2015), London, Unted Kngdom, 2-4 September [19] D. Forte, C. Bao, A. Srvastava, "Temperature trackng: an nnovatve run-tme approach for hardware Trojan detecton", Proc. of the Internatonal Conference on Computer-Aded Desgn (ICCAD '13), San Jose, Calforna, November 18-21, [20] [21] M. Abramovc, M. A. Breuer, A. D. Fredman, Dgtal Systems Testng and Testable Desgn, IEEE Press, New York, 1990, pp [22] XILINX UG580 (v1.7), UltraScale Archtecture System Montor user gude, December 20, On lne avalable at: ultrascale-sysmon.pdf 273