Hardware Security Training, Hands-on!

Preface
Acknowledgments
Contents
About the Authors
Acronyms
1 Physical Unclonable Functions (PUFs)
	1.1 Introduction
	1.2 Background
		1.2.1 RO PUF
		1.2.2 MiniZed Board Introduction
		1.2.3 FPGA Development Procedure
	1.3 PUF Performance Metrics
	1.4 Implementation Details of the RO PUF
	1.5 Performance Analysis and Discussion
		1.5.1 Randomness, Uniqueness, and Reliability
		1.5.2 NIST Statistical Test
		1.5.3 Entropy Estimation
	1.6 Conclusion
	References
2 True Random Number Generator (TRNG)
	2.1 Introduction
	2.2 Background
		2.2.1 Sources of Entropy
		2.2.2 Ring Oscillator-Based TRNG
	2.3 RO-Based TRNG Implementation
	2.4 Measures of the Quality of Randomness
		2.4.1 Entropy Estimation
		2.4.2 Restart Experiment
		2.4.3 Statistical Evaluation of the Output
	2.5 Conclusion
	References
3 Recycled Chip Detection Using RO-Based Odometer
	3.1 Introduction
	3.2 Background
		3.2.1 Motivations and General Flow
		3.2.2 Counterfeit Threats
	3.3 Recycled FPGA Detection
	3.4 FPGA Development Procedure
	3.5 Recycled Chip Detection Experiments
		3.5.1 Experimental FPGA Platform
		3.5.2 Experimental Flow
	3.6 Conclusion
	References
4 Recycled FPGA Detection
	4.1 Introduction
	4.2 Background
		4.2.1 Look-Up Table Structure
		4.2.2 RO Path Formation Using XNOR and XOR Logic
		4.2.3 Aging Mechanism
	4.3 Classification Using Supervised and Unsupervised Methods
		4.3.1 Supervised Classification Method
		4.3.2 Unsupervised Classification Method
	4.4 The Setup for the Experiment
		4.4.1 Bitstream Generation
		4.4.2 Bitstream Loading
		4.4.3 Capturing Output
	4.5 Capturing RO Frequencies and Recycled FPGA Detection
		4.5.1 Visualization of RO Frequencies
		4.5.2 Analysis Using Machine Learning
			4.5.2.1 Supervised Learning Method
			4.5.2.2 Unsupervised Learning Method
	4.6 Conclusion
	References
5 Hardware Trojan Insertion
	5.1 Introduction
	5.2 Hardware Trojan Attacks
		5.2.1 Modern Chip Design Flow and Threat Model
		5.2.2 Hardware Trojan Insertion
	5.3 Trojan-Infected Implementation on FPGA
		5.3.1 FPGA Development Flow
		5.3.2 Experimental Setup
		5.3.3 Trojan-Infected Design
		5.3.4 Compiling Target Design and Trigger Trojan
	5.4 Bitstream Tampering for Trojan Triggering
		5.4.1 FPGA Bitstream Format Preliminaries
		5.4.2 Bitstream Tampering Enabling Trojan Trigger
	5.5 Conclusion
	References
6 Hardware Trojan Detection
	6.1 Introduction
	6.2 Hardware Trojan Detection
		6.2.1 Overview of Hardware Trojan
		6.2.2 Pre-silicon Hardware Trojan Detection
			6.2.2.1 Code Coverage Analysis
			6.2.2.2 Formal Verification
			6.2.2.3 Structural Analysis
			6.2.2.4 Logic Testing
			6.2.2.5 Functional Analysis
		6.2.3 Post-silicon Hardware Trojan Detection
		6.2.4 Destructive Method
		6.2.5 Nondestructive Method
	6.3 Hardware Trojan Detection Experiment
		6.3.1 Experimental Setup
		6.3.2 Experimental Steps
	6.4 Conclusion
	References
7 Security Verification
	7.1 Introduction
	7.2 Background: Writing Properties
	7.3 SoC Security Verification Using Property Checking
		7.3.1 Security Asset Identification
		7.3.2 Threat Model Identification
		7.3.3 Generating Security Properties
	7.4 Experimental Setup
		7.4.1 AES Design
		7.4.2 Security Property Development for Verification
		7.4.3 Property-to-Assertion Conversion
		7.4.4 Compiling Target Design and Property Verification
		7.4.5 Tool 1: JasperGold Security Path Verification (SPV)
		7.4.6 Tool 2: JasperGold Formal Property Verification
	7.5 Conclusion
	References
8 Power Analysis Attacks on AES
	8.1 Introduction
	8.2 Power Analysis Attacks
		8.2.1 Power Consumption Characteristics of CMOS
		8.2.2 Simple Power Analysis (SPA)
		8.2.3 Differential Power Analysis (DPA)
		8.2.4 Correlation Power Analysis (CPA)
	8.3 AES Implementation on FPGA
		8.3.1 Field-Programmable Logic Arrays
		8.3.2 AES Algorithm Overview
	8.4 Experiment Setup
		8.4.1 Hardware and Software
		8.4.2 Firmware Setup
		8.4.3 Hardware Setup
			8.4.3.1 CW305 Default Setup
			8.4.3.2 Connect a CW305 board to a ChipWhisperer-Lite/Pro board
	8.5 Power Measurements on the AES Chip
		8.5.1 AES Bitstream Generation
		8.5.2 Capture a Power Trace
	8.6 Performing AES CPA Attack
		8.6.1 CPA Attack Steps
	8.7 Conclusion
	References
9 EM Side-Channel Attack on AES
	9.1 Introduction
	9.2 Background
		9.2.1 Measuring EM Radiation
		9.2.2 Typical EM Side-Channel Attacks
	9.3 Implementation Details of Investigated AES Design
	9.4 Measurement Setup
	9.5 EM Measurements on the AES Chip
		9.5.1 Tool Setup
		9.5.2 Capture an EM Trace
	9.6 Performing Correlation Electromagnetic Analysis (CEMA) Attack
	9.7 Conclusion
	References
10 Logic-Locking Insertion and Assessment
	10.1 Introduction
	10.2 Background
		10.2.1 Logic Locking
		10.2.2 The Threat Model for Logic Locking
	10.3 Review of Existing Logic-Locking Solutions
		10.3.1 Combinational Locking
			10.3.1.1 Elementary Logic-Locking Solutions
			10.3.1.2 LUT and Routing Obfuscation
			10.3.1.3 Point Function-Based Logic Locking
			10.3.1.4 Combinational Cyclic Obfuscation
			10.3.1.5 Sequential Obfuscation
			10.3.1.6 Scan Obfuscation
			10.3.1.7 Parametric Logic Locking
			10.3.1.8 Locking at Higher Level of Abstraction
	10.4 Experimental Demonstration
		10.4.1 Experimental Setup
		10.4.2 Locking Gate Insertion
		10.4.3 Random Locking Gate Insertion
			10.4.3.1 Fault Analysis-Based Key Gate Insertion
			10.4.3.2 Security Evaluation
		10.4.4 Equivalency Checking
	10.5 Conclusion
	References
11 Clock Glitch Fault Attack on FSM in AES Controller
	11.1 Introduction
	11.2 Background
		11.2.1 Fault Models
		11.2.2 Clock Glitching
		11.2.3 Brief Description of AES
		11.2.4 Clock Glitch Attack on FSM in AES Controller
		11.2.5 ChipWhisperer CW305 Board
	11.3 Experimental Setup
	11.4 Performing Clock Glitch Attacks
		11.4.1 Performing Clock Glitch Attack
		11.4.2 Glitch Explorer
		11.4.3 Results
	11.5 Conclusion
	References
12 Voltage Glitch Attack on an FPGA AES Implementation
	12.1 Introduction
	12.2 Background
		12.2.1 Voltage Glitches
		12.2.2 Fault Models
		12.2.3 Brief Description of AES
		12.2.4 Voltage Glitch Attack on FSM in AES Controller
		12.2.5 ChipWhisperer CW305 Board
	12.3 Experimental Setup
		12.3.1 Hardware Setup
		12.3.2 Software Setup
	12.4 Performing Voltage Glitch Attacks
		12.4.1 Steps in Performing Voltage Glitch Attacks
		12.4.2 Starting the Voltage Glitch Attack
		12.4.3 Results
	12.5 Conclusion
	References
13 Laser Fault Injection Attack (FIA)
	13.1 Introduction
	13.2 Laser Fault Injection Attacks
		13.2.1 Analysis of Laser Beams on MOSFETs
		13.2.2 Exploitation of Laser Attacks
	13.3 Device Under Test (DUT) Circuit on FPGA
		13.3.1 Field Programmable Logic Arrays
		13.3.2 Device Under Test (DUT)
	13.4 Experimental Setup
		13.4.1 Hardware and Software
		13.4.2 Hardware Setup
			13.4.2.1 Diode Laser
			13.4.2.2 Spider Tool
			13.4.2.3 AC701 Artix-7 Evaluation Board
		13.4.3 DUT Bitstream Generation
		13.4.4 Hardware Connection
		13.4.5 Placement of the FPGA
		13.4.6 Fault Injection Attack
			13.4.6.1 Fault Injection by Inspector
		13.4.7 Bitflip Observation
	13.5 Conclusion
	References
14 Optical Probing Attack on Logic Locking
	14.1 Introduction
	14.2 Background
		14.2.1 Optical Probing Overview
		14.2.2 Logic Locking
	14.3 Experiment Setup
		14.3.1 Programming the Sample
		14.3.2 Sample Preparation
		14.3.3 Measurement Setup
	14.4 Performing the Attack
		14.4.1 Attack on Combinational Logic Locking
		14.4.2 Attack on Sequential Logic Locking
	14.5 Conclusion
	References
15 Universal Fault Sensor
	15.1 Introduction
	15.2 Background
	15.3 FTC Sensor
	15.4 Hardware Implementation Setup
		15.4.1 Hardware and Software
		15.4.2 Bitstream Generation
		15.4.3 Capturing Output
	15.5 Results and Analysis
		15.5.1 EM Attack Analysis
		15.5.2 Voltage Glitch Attack Analysis
		15.5.3 Clock Glitch Attack Analysis
		15.5.4 Proximity Analysis
	15.6 Conclusion
	References
16 Scanning Electron Microscope Training
	16.1 Introduction
	16.2 Background
		16.2.1 Scanning Electron Microscopy
		16.2.2 Beam Interaction
		16.2.3 Display and Record System
		16.2.4 Specimen Preparation
	16.3 Setting Up the Experiment for Image Acquisition with the SEM
		16.3.1 Sample Preparation
		16.3.2 Sample Loading Inside the SEM
		16.3.3 SEM Image Acquisition
			16.3.3.1 Turning on the Electron Beam
			16.3.3.2 Imaging Mode
			16.3.3.3 Beam Intensity, Brightness, and Contrast
			16.3.3.4 Magnification, Focus, and Scan Speed
			16.3.3.5 Working Distance
			16.3.3.6 Column Centering (Wobbler Effect)
			16.3.3.7 Stigmatism Correction
			16.3.3.8 Image Acquisition
	16.4 Hardware Trojan (HT) Detection in ICs Using SEM Images
		16.4.1 Equipment and Software Needed for This Work
		16.4.2 Prerequisites
		16.4.3 Experimental Setup for HT Detection in ICs Using SEM
			16.4.3.1 Procedure
			16.4.3.2 Sample Preparation
		16.4.4 FIB and SEM Imaging
			16.4.4.1 FIB Delayering
			16.4.4.2 SEM Imaging
		16.4.5 Trojan Detection System
			16.4.5.1 Pre-processing
		16.4.6 Cell Extraction
		16.4.7 Synthetic Cell Image Generation
		16.4.8 Logical Cell Recognition
	16.5 Conclusion
	References
Index