分块制造下硬件木马攻击方法及安全性分析

doi:10.19665/j.issn1001-2400.2019.04.023

摘要/Abstract

摘要：

由于硬件木马对芯片的安全性构成了严重威胁,所以研究了分块制造防护芯片遭受硬件木马攻击时的效果。首先提出了分块制造下硬件木马的攻击模型;其次针对此攻击模型提出了两种可能的攻击方法,即改进的近似攻击和基于遗传算法的攻击。这两种方法分别利用了芯片后端设计过程泄露的不同物理信息。实验结果表明,两种攻击方法都能有效地对分块制造下的芯片进行硬件木马植入,其中基于遗传算法的攻击准确率可达到78.62%。同时表明分块制造本身在防护硬件木马攻击上的安全性是不够的,需要采取更多的措施提升分块制造的安全性。

关键词: 硬件安全, 分块制造, 硬件木马, 攻击, 遗传算法

Abstract:

The Hardware Trojan (HT) threats the security of chips greatly, and in order to explore the effectiveness of split manufacturing (SM) securing circuits from HT insertion, an HT threat model is first proposed under SM. Then we propose two possible attack methods: one is the improved proximity-based attack and the other is the genetic algorithm based attack, which leverage different physical heuristics revealed from the physical design process. Experimental results show that both the proposed methods are effective on inserting HTs under SM. Especially the genetic algorithm based attack method is shown to be the most effective with the attack accuracy of up to 78.62%, thus demonstrating that SM is not secure inherently and that more efforts need to be made in order to make SM more secure.

Key words: hardware security, split manufacturing, hardware Trojan, attack, genetic algorithm

中图分类号:

TN47

杨亚君,陈章. 分块制造下硬件木马攻击方法及安全性分析[J]. 西安电子科技大学学报, 2019, 46(4): 167-175.

YANG Yajun,CHEN Zhang. Hardware trojan attack methods and security analysis under split manufacturing[J]. Journal of Xidian University, 2019, 46(4): 167-175.

图/表 9

图1

图2

图3

图4

图5

图6

图7

表1

图8

参考文献 18

[1]	CHEN S Y, VEMURI R. Reverse Engineering of Split Manufactured Sequential Circuits Using Satisfiability Checking [C]// Proceedings of the 2018 36th IEEE International Conference on Computer Design. Piscataway: IEEE, 2019: 530-536.
[2]	王侃, 陈浩, 管旭光 , 等. 硬件木马防护技术研究[J]. 网络与信息安全学报, 2017,3(9):5-16.
	WANG Kan, CHEN Hao, GUAN Xuguang , et al. Research on Hardware Trojan Defense[J]. Chinese Journal of Network and Information Security, 2017,3(9):5-16.
[3]	秦茂源, 慕德俊, 胡伟 , 等. 硬件安全门级细粒度形式化验证方法[J]. 西安电子科技大学学报, 2018,45(5):143-148.
	QIN Maoyuan, MU Dejun, HU Wei , et al. Fine-granularity Gate Level Formal Verification Method for Hardware Security[J]. Journal of Xidian University, 2018,45(5):143-148.
[4]	毛保磊, 慕德俊, 胡伟 , 等. RSA时间信道滑动窗口攻击方法及量化分析[J]. 西安电子科技大学学报, 2017,44(5):114-120.
	MAO Baolei, Mu Dejun, HU Wei , et al. Quantitative Analysis of Sliding Window Attack for the RSA Timing Channel[J]. Journal of Xidian University, 2017,44(5):114-120.
[5]	HE J, ZHAOY, GUO X , et al. Hardware Trojan Detection through Chip-free Electromagnetic Side-channel Statistical Analysis[J]. IEEE Transactions on Very Large Scale Integration Systems, 2017,25(10):2939-2948.
[6]	JARVI R W, MCLNTYRE M G . Split Manufacturing Method for Advanced Semiconductor Circuits: US20040102019A1[P]. 2004.
[7]	JAGASIVAMANI M, GADFORT P, SIKA M. et al. Split Fabrication Obfuscation: Metrics and Techniques [C]//Proceedings of the 2014 IEEE International Symposium on Hardware-Oriented Security and Trust. Washington: IEEE Computer Society, 2014: 7-12.
[8]	IMESON F, EMTENAN A, GARG S. et al. Securing Computer Hardware Using 3D Integrated Circuit(IC) Technology and Split Manufacturing for Obfuscation [C]// Proceedings of the 2013 USENIX Conference on Security. Berkeley: USENIX Association, 2013: 495-510.
[9]	许强, 蒋兴浩, 姚立红 , 等. 硬件木马检测与防范研究综述[J]. 网络与信息安全学报, 2017,3(4):5-17.
	XU Qiang, JIANG Xinghao, YAO Lihong , et al. Overview of the Detection and Prevention Study of Hardware Trojans[J]. Chinese Journal of Network and Information Security, 2017,3(4):5-17.
[10]	VAIDYANATHAN K, DAS B P, SUMBUL E. et al. Building Trusted ICs Using Split Fabrication [C]//Proceedings of the 2014 IEEE International Symposium on Hardware-oriented Security and Trust. Washington: IEEE Computer Society, 2014: 1-6.
[11]	MAGANA J, SHI D, MELCHERT J , et al. Are Proximity Attacks a Threat to the Security of Split Manufacturing of Integrated Circuits?[J]. IEEE Transactions on Very Large Scale Integration Systems, 2017,25(12):3406-3419.
[12]	WANG Y, CHEN P, HU J , et al. The Cat and Mouse in Split Manufacturing[J]. IEEE Transactions on Very Large Scale Integration Systems, 2018,26(5):805-817.
[13]	ZHANG B, MAGANA J C, DAVOODI A. Analysis of Security of Split Manufacturing Using Machine Learning [C]// Proceedings of the 2018 Design Automation Conference. Piscataway: IEEE, 2018: a141.
[14]	XIE Y, BAO C, SRIVASTAVA A . Security-aware 2.5D Integrated Circuit Design Flow against Hardware IP Piracy[J]. Computer, 2017,50(5):62-71.
[15]	CHAKRABORTY R S, NARASIMHAN S, BHUNIA S. Hardware Trojan: Threats and Emerging Solutions [C]//Proceedings of the 2009 IEEE International High Level Design Validation and Test Workshop. Washington: IEEE Computer Society, 2009: 166-171.
[16]	CHEN Z, ZHOU P Q, HO T Y. et al. How Secure Is Split Manufacturing in Preventing Hardware Trojan? [C]// Proceedings of the 2016 IEEE Asian Hardware-Oriented Security and Trust. Piscataway: IEEE, 2016: 7835561.
[17]	HANSEN M C, YALCIN H, HAYES J P . Unveiling the ISCAS-85 Benchmarks:a Case Study in Reverse Engineering[J]. IEEE Design Test of Computer, 1999,16(3):72-80.
[18]	VISWANATHAN N, PAN M, CHU C. Fastplace 3.0:a Fast Multilevel Quadratic Placement Algorithm with Placement Congestion Control [C]//Proceedings of the 2007 Asia and South Pacific Design Automation Conference. Piscataway: IEEE, 2007: 135-140.

基准电路	c432b	c499b	c1908	c2670	c3540	c5315	c6288b	c7552
门数量	202	635	579	1 549	1 718	3 145	3 020	4 048
最大同类型门数量	38	190	208	459	547	1 016	623	1 172
N_group	100	100	100	200	200	400	400	400
P_mutating	0.15	0.15	0.15	0.15	0.15	0.15	0.15	0.15
N_g	400	500	500	400	300	150	200	200
N	40	100	200	400	500	900	600	1 000