Search

Scalability, power efficiency, and shorter time to market due to design reuse have favored the adoption of homogeneous multicore chips with identical processing units (cores) integrated together, offering enhanced computational power. Furthermore, chips with identical cores help cope with increasing defect rates refid="ref2"/ in delivering reasonable yield levels via the utilization of spare cores. In this paper, we propose a comparison-based test access mechanism (TAM) that is capable of handling spare identical cores. The proposed TAM guarantees the test of a chip through minimum bandwidth in minimum test time, while ensuring zero yield loss in the presence of spare identical cores, as its design is driven by the number of spare cores on the chip. The proposed solution also enables the identification of all the good cores in usable chips, supporting models where chips are priced based on the number of good cores. Furthermore, we provide a tradeoff analysis that enables the designers to make an informed decision regarding yield loss versus area cost. We also extend the proposed TAM by adding efficient diagnostic features, and adapting it for low-power test. [ABSTRACT FROM PUBLISHER]

Stringent performance requirements magnify the performance degradation impact of Design-for-Testability (DfT) techniques. As more aggressive performance optimizations are being employed, resulting in high-performance designs with reduced logic depth, the impact of scan multiplexers is becoming even more magnified. In this work, we propose a pair of scan cell transformation techniques that transfers the scan multiplexer delay from the input of the flip-flop to its output, enabling the removal of the scan multiplexer delay off the critical paths. The first technique is an ad-hoc technique, while the second one is the retiming technique applied on the scan logic. The proposed transformation techniques retain the test development (test data, quality, etc.) and application (test time, power dissipation, etc.) intact, fully complying with the conventional design and test flow. Experimental results justify the efficacy of the proposed techniques in eliminating the performance penalty of scan in a cost-effective way and thus enhancing the functional speed of integrated circuits. [ABSTRACT FROM AUTHOR]

Increasing complexity of integrated circuits has forced the industry to abandon partial scan, which necessitates a computationally demanding and unaffordable sequential automatic test pattern generation (ATPG), and to instead adopt full scan, despite its costs. In this paper, we propose a partial scan scheme driven by a computationally efficient test cube analysis. We tackle the challenges associated with the identification of the conditions to restore the controllability and observability compromised due to partial scan, and with the formulation of these conditions in terms of test cube operations. Upon the identification of a maximal-sized set of scan flip-flops that are converted to nonscan, a simple postprocessing of the test cubes helps compute the values to be loaded into the scan flip-flops, eliminating the need to rerun ATPG, while at the same time ensuring the quality of full scan. We further enhance this framework through techniques that process the test data before and after the application of the proposed test cube analysis-driven partial scan technique, in order to enlarge the size of the nonscan flip-flop set. The proposed scheme combines the simplicity of the conventional ATPG flow with the area, performance, test time, and test power reduction benefits of partial scan. The proposed test cube analysis-driven partial scan scheme is orthogonal and thus fully compatible with other test cost-reduction techniques, such as test data compression and test power reduction, which can be applied in conjunction. [ABSTRACT FROM AUTHOR]

Test response compaction offers test time and data volume reduction on the output side. An on-chip circuitry, denoted as the response compactor, is utilized, compressing the responses of the circuit, and thus enabling the storage of compacted responses on the tester memory. While the test cost is thus reduced, such a circuitry may result in error masking, and hence the degradation of the fault/error coverage level. Response bits that are unknown during simulation time pose additional challenges on the design of a response compactor, as they contribute to error masking also. Assumptions regarding a particular fault model and/or distribution of unknown response bits ease the design of a response compactor; however, the coverage loss of unmodeled faults is inevitable in the presence of such a compactor. Furthermore, modeled faults also may become unobserved if the distribution of unknown bits deviates from the assumed one. In this paper, we propose a response compaction technique that is independent of any fault model. We design the response compactor based on the expected responses of the circuit under test. As a result, any originally detectable unmodeled defect or modeled fault is still detectable with the proposed compactor, regardless of the number and the distribution of the unknown response bits. The output bit-width of the proposed response compactor is also the minimum that can be achieved when original defect and fault coverage levels are delivered. We also present an analysis that can be utilized for a quick computation of parameters, such as the lower and upper bounds and the expected value for the optimal output bandwidth, which the proposed compaction methodology is capable of attaining. As the proposed technique is a test set-dependent approach, it is more suitable for application in the domain of core-based system-on-chips (SOCs), wherein a set of test vectors and expected responses is delivered along with a core. Parallelism among core tests is increased by narrowing down the bit-width for each core, delivering test time reduction for the SOCs. [ABSTRACT FROM PUBLISHER]

Many fundamental problems in the area of distributed systems such as security, reliable routing, network survivability and broadening available bandwidth can be addressed through the use of disjoint paths between communication endpoints. Therefore, distributed solutions to the disjoint paths problem are of crucial importance to these fundamental problems. Disjoint paths naturally exist in traditional networks; however, these networks provide no guarantees regarding the presence and the number of available disjoint paths. On the other hand, network topologies structured based on Caley graphs such as hypercube, star networks and their variations possess many desirable properties related to disjoint paths. Therefore, it is anticipated that backbones of future networks will be structured following some Caley graph topologies. In this paper, we present a simple novel stabilizing and inherently stabilizing algorithm to route messages over all node-disjoint paths of optimal length from one non-faulty process to another in at most n+1 rounds in an n-dimensional hypercube network in the presence of crash failures. The proposed algorithm can tolerate up to 2n−⌈log (n+1)⌉ process/link failures in the network and a maximum of ⌊(L−2)/3⌋ process/link failures on each disjoint path, where L is the number of processes on a disjoint path and the distance between any two failed processes/links is at least three. The proposed algorithm tolerates a large number of process and link failures, while delivering all n messages over optimal-length disjoint paths in the presence of maximum permissible process/link failures on each path. This is achieved by a simple uniform distributed algorithm using only local knowledge of failure locations. [ABSTRACT FROM AUTHOR]

Despite the advantages of performing response compaction in integrated-circuit testing, unknown response bits (x's) inevitably reflect into loss in test quality. The distribution of these x's within the captured response, which varies for each test pattern, directly impacts the number of scan cells observed through the response compactor. In this paper, we propose a unified 2-D x-alignment technique in order to judiciously manipulate the distribution of x's in the test response prior to its compaction. The controlled response manipulation is performed on a per pattern basis, in the form of scan chain delay and intra-slice rotate operations, and with the objective that x's are aligned within as few scan slices and chains as possible. Consequently, a larger number of scan cells are observed after compaction for any test pattern. In an effort to tackle the unified 2-D x-alignment problem and to achieve maximum overall observability, we first decipher the interaction between 1-D x-alignment operations, and formulate 1-D and 2-D x-alignment operations all as maximum satisfiability (MAX-SAT) problems; a weighted MAX-SAT formulation is necessitated in the 2-D case to identify the best possible 2-D x-alignment, which may differ from back to back application of the individual best possible 1-D alignments in two dimensions. The proposed technique is test set independent, leading to a generic, simple, and cost-effective hardware implementation. While we show in this paper that x-alignment improves horizontal and vertical compactors, covering a wide spectrum of compactors, it is expected to improve other types of compactors as well by manipulating the x-distribution properly. [ABSTRACT FROM PUBLISHER]

The node-disjoint paths problem deals with finding node-disjoint paths from a source node s to target node t, where t ≠ s. Two paths from s to t are said to be node-disjoint i ff they do not have any common vertices except for their endpoints. Distributed solutions to the node-disjoint paths problem have numerous applications such as secure message transmission, reliable routing, and network survivability. In this paper, we present a simple distributed algorithm that is both stabilizing and inherently stabilizing under a realistic model that describes system interfaces and implementation issues in detail to route messages over all shortest node-disjoint paths from one process to another in an n-dimensional hypercube network. [ABSTRACT FROM AUTHOR]

Various techniques can be used to reduce the test time and cost of chip development, some of which achieve their objective by reducing the test data volume through the implementation of compression technologies such as XOR-based decompressors. In the presence of XOR decompressor, the delivery of acceptable (encodable) test patterns might not be possible. The Align-Encode technique which manipulates the distribution of care bits in the test pattern could increase the delivery of more encodable test patterns. Yet a sequential algorithm, which computes the delay values for a test pattern given the XOR decompressor specifications, faces major drawbacks when applied on large test patterns. In this paper, we propose a parallel version of the Align-Encode algorithm which is designed to work on distributed memory architecture. It exploits the nature of the problem in order to make significant improvements in performance with respect to time as well as the number of encodable test patterns generated, and in test data compression as a result. [ABSTRACT FROM AUTHOR]

Scan architectures that provide compression capabilities have become mandatory due to the unbearable test costs imposed by high test data volume and prolonged test application. To alleviate these test costs, a stimulus decompressor and a response compactor block are inserted between the tester channels and the scan chains. As a result, a few tester channels drive a larger number of scan chains. In such an architecture, whether a particular test pattern can be delivered depends on the care bit distribution of that pattern. In this paper, we introduce a hardware block to be utilized in conjunction with a combinational stimulus decompressor block. This block, namely, Align-Encode, provides a deterministic per pattern control over care bit distribution of test vectors, improving pattern deliverability, and thus, the effectiveness of the particular stimulus decompressor. Align-Encode is reconfigured on a per pattern basis to delay the shift-in operations in selected scan chains. The number of cycles that a chain may be delayed can be between zero and the maximum allowable value, in order to align the scan slices in such a way that originally undeliverable test vectors become encodable. The reconfigurability of Align-Encode provides a test pattern independent solution, wherein any given set of test vectors can be analyzed to compute the proper delay information. We present efficient techniques for computing the scan chain delay values that lead to pattern encodability. Experimental results also justify the test pattern encodability enhancements that Align-Encode delivers, enabling significant test quality improvements and/or test cost reductions. [ABSTRACT FROM AUTHOR]

A cost effective system-on-a-chip (SOC) test strongly hinges on the parallel independent test of SOC cores, which can only be ensured through proper core isolation techniques. Whereas a core isolation mechanism can provide controllability and observability at the core I/O interface, its implementation may have various implications on area, functional timing, test time and data volume, and at-speed coverage on the core interface. In this paper, we provide an in-depth analysis of the soft core isolation problem by covering a wide spectrum of techniques ranging from the utilization of only functional registers to the utilization of only wrapper cells. We model the generalized problem of finding the minimum number of isolation registers, in the form of a mixture of functional registers and wrapper cells, by mapping the problem onto the maximum Boolean satisfiability problem; by utilizing the key findings in this mapping, we implement a computationally efficient heuristic for selecting a subset of core I/Os, on which wrapper cell insertion minimizes the total number of interface registers. Finally, we demonstrate the application of this heuristic, with area and performance constraints also accounted for, delivering a wide spectrum of tradeoff points for isolating a soft core. [ABSTRACT FROM AUTHOR]

SOC test time minimization hinges on the attainment of core test parallelism; yet test power constraints hamper this parallelism as excessive power dissipation may damage the SOC being tested. We propose a test power reduction methodology for SOC cores through scan chain modification. By inserting logic gates between scan cells, a given set of test vectors & captured responses is transformed into a new set of inserted stimuli & observed responses that yield fewer scan chain transitions. In identifying the best possible scan chain modification, we pursue a decoupled strategy wherein test data are decomposed into blocks, which are optimized for power in a mutually independent manner. The decoupled handling of test data blocks not only ensures significantly high levels of overall power reduction but it furthermore delivers computational efficiency at the same time. The proposed methodology is applicable to both fully, and partially specified test data; test data analysis in the latter case is performed on the basis of stimuli-directed controllability measures which we introduce. To explore the tradeoff between the test power reduction attained by the proposed methodology & the computational cost, we carry out an analysis that establishes the relationship between block granularity & the number of scan chain modifications. Such an analysis enables the utilization of the proposed methodology in a computationally efficient manner, while delivering solutions that comply with the stringent area & layout constraints in SOC as well. [ABSTRACT FROM AUTHOR]

Conversion of the flip-flops of the circuit into scan cells helps ease the test challenge; yet test application time is increased as serial shift operations are employed. Furthermore, the transitions that occur in the scan chains during these shifts reflect into significant levels of circuit switching unnecessarily, increasing the power dissipated. Judicious encoding of the correlation among the test vectors and construction of a test vector through predecessor updates helps reduce not only test application time but also scan chain transitions as well. Such an encoding scheme, which additionally reduces test data volume, can be further enhanced through appropriately ordering and padding of the test cubes given. The experimental results confirm the significant reductions in test application time, test data volume and test power achieved by the proposed compression methodology. [Copyright &y& Elsevier]

Discusses the space and time compaction methodology that can maximize parallelism by minimizing the required test bandwidth at the core outputs. Limitations to parallel testing of cores; Guidelines to implementing compaction circuitry; Experimental results. INSET: Related work.

Layout camouflaging can protect the intellectual property of modern circuits. Most prior art, however, incurs excessive layout overheads and necessitates customization of active-device manufacturing processes, i.e., the front-end-of-line (FEOL). As a result, camouflaging has typically been applied selectively, which can ultimately undermine its resilience. Here, we propose a low-cost and generic scheme—full-chip camouflaging can be finally realized without reservations. Our scheme is based on obfuscating the interconnects, i.e., the back-end-of-line (BEOL), through design-time handling for real and dummy wires and vias. To that end, we implement custom, BEOL-centric obfuscation cells, and develop a CAD flow using industrial tools. Our scheme can be applied to any design and technology node without FEOL-level modifications. Considering its BEOL-centric nature, we advocate applying our scheme in conjunction with split manufacturing, to furthermore protect against untrusted fabs. We evaluate our scheme for various designs at the physical, DRC-clean layout level. Our scheme incurs a significantly lower cost than most of the prior art. Notably, for fully camouflaged layouts, we observe average power, performance, and area overheads of 24.96%, 19.06%, and 32.55%, respectively. We conduct a thorough security study addressing the threats (attacks) related to untrustworthy FEOL fabs (proximity attacks) and malicious end-users (SAT-based attacks). An empirical key finding is that only large-scale camouflaging schemes like ours are practically secure against powerful SAT-based attacks. Another key finding is that our scheme hinders both placement- and routing-centric proximity attacks; correct connections are reduced by $7.47\times $ , and complexity is increased by $24.15\times $ , respectively, for such attacks. [ABSTRACT FROM AUTHOR]

Increasing process variations, coupled with the need for highly adaptable circuits, bring about tough new challenges regarding circuit testing. Circuit adaptation for process and workload variability require costly characterization/test cycles for each chip, to extract particular V\mathrm{ dd/f\textrm {max}} behavior of the device under test (DUT). Consequently, the test cost associated with frequency binning and the f\textrm {max} search is significant. This cost is further increased for chips that support dynamic voltage scaling, necessitating the calibration of f\textrm {max} at multiple V\textrm {dd} levels. In order to reduce this burden, we propose an adaptive statistical technique to reduce the f\textrm {max} search space across multiple V\textrm {dd} levels by reusing the information previously obtained from the DUT during test-time. The proposed solution employs statistical relations between the speed of the ring oscillators sensitive to different process parameters and speed of the DUT as well as the correlation between the DUT speeds at multiple V\textrm {dd} levels in improving the prediction of the DUT’s f\textrm {max} . The proposed adaptive solution reduces the test/characterization time and cost at no area or test overhead; such an approach is being explored for the first time to the best of our knowledge. Experiments on a set of ISCAS benchmarks show up to 8x improvement in adaptively reducing the search space for f\textrm {max} at multiple V\textrm {dd} levels. [ABSTRACT FROM AUTHOR]

Process variations and device aging impose profound challenges for circuit designers. Without a precise understanding of the impact of variations on the delay of circuit paths, guardbands, which keep timing violations at bay, cannot be correctly estimated. This problem is exacerbated for advanced technology nodes, where transistor dimensions reach atomic levels and established margins are severely constrained. Hence, traditional worst-case analysis becomes impractical, resulting in intolerable performance overheads. Contrarily, process-variation/aging-aware static timing analysis (STA) equips designers with accurate statistical delay distributions. Timing guardbands that are small, yet sufficient, can then be effectively estimated. However, such analysis is costly as it requires intensive Monte-Carlo simulations. Further, it necessitates access to confidential physics-based aging models to generate the standard-cell libraries required for STA. In this work, we employ graph neural networks (GNNs) to accurately estimate the impact of process variations and device aging on the delay of any path within a circuit. Our proposed GNN4REL framework empowers designers to perform rapid and accurate reliability estimations without accessing transistor models, standard-cell libraries, or even STA; these components are all incorporated into the GNN model via training by the foundry. Specifically, GNN4REL is trained on a FinFET technology model that is calibrated against industrial 14-nm measurement data. Through our extensive experiments on EPFL and ITC-99 benchmarks, as well as RISC-V processors, we successfully estimate delay degradations of all paths—notably within seconds—with a mean absolute error down to 0.01 percentage points. [ABSTRACT FROM AUTHOR]

Self-heating (SH) is a phenomenon that can induce excessive heat inside the transistor channel. SH represents an emerging and serious concern, especially in advanced technology nodes, where excessive heat acting on elevated channel geometries will notably shift the critical transistor parameters (e.g., threshold-voltage $V_{\text {th}}$ and carrier mobility $\mu $). The underlying 3-D device structures (e.g., FinFET, nanowire, or nanosheet structures), along with newly employed materials such as silicon-germanium (SiGe), which show worse thermal conductivity than traditional materials, can considerably exacerbate SH. On top of that, quantum confinement, a phenomenon that becomes dominant at sub-10nm, further increases the intensity of SH. In this article, we are the first to explore SH effects from the perspective of hardware security, rather than the performance, reliability standpoints covered in state-of-the-art (SOTA) work. As proof of concept, we devise an SH-based hardware trojan (HT) that exploits the SH-induced $V_{\text {th}}$ change in 7-nm FinFET circuits. Leveraging $V_{\text {th}}$ -dependent reconfigurable logic, we design a reconfigurable HT payload that maliciously changes its functional behavior once the SH-induced $V_{\text {th}}$ change takes effect. Following SOTA work, we present a comprehensive modeling and analysis of SH effects at the device level and highlight its impact on transistor $V_{\text {th}}$. Next, we study how fabrication-time changes in the transistor doping and geometry can promote the SH-assisted degradation. We then describe various payload configurations for the proposed HT, quantify its overheads, and discuss its resilience against standard HT detection techniques. Finally, we demonstrate two case studies using the proposed HT, one to leak the secret key from a pipelined design of an advanced encryption standard (AES) circuit, and another to showcase denial-of-service for a Gaussian-blur filter circuit. Our work utilizes industry-standard models with parameters extracted from measurements and calibrated with experiments. Our results are obtained from meticulous study and optimization across the device-, circuit-, and system-levels. [ABSTRACT FROM AUTHOR]

In order to keep pace with the growing complexity of integrated circuits (ICs), IC and system designers are increasingly using electronic system level (ESL) design tools. ESL tool sales were around $460 million in 2011. The value of the ICs designed using these tools is at least an order of magnitude more. Concurrently, advanced IC reverse engineering techniques are being developed and used by attackers. In response, several anti-reverse engineering techniques have been proposed for integration into the IC design flow. An important class of defenses hardens the controllers that orchestrate the functionality of designs generated by ESL tools. We demonstrate an attack to recover the controller in any ESL-generated design even if the controller has been hardened using state-of-the-art controller hardening techniques. The attack analyzes the unhardened parts of the controller (i.e., the controller output logic and datapath) and reconciles this information with the architectural, controller, and timing constraints implicit in and underlying all ESL design methodologies. We then propose a countermeasure that inserts decoy connections into an ESL tool-generated design to thwart reverse engineering. We introduce a security metric to quantify the effectiveness of the developed attacks and defenses. We demonstrate the attack and defenses on designs generated by state-of-the-art ESL tools. [ABSTRACT FROM AUTHOR]

The design and manufacturing steps of a chip typically involve several parties. For example, a chip may comprise several third-party intellectual property (IP) cores and the integrated circuit (IC) fabrication may be outsourced to a third-party foundry. IP cores and ICs are shared with potentially untrusted third parties and, as a result, are subject to piracy attacks. Even more, any legally purchased chip may be reverse engineered to retrieve the design down to transistor level and, thereby, it is also subject to piracy attacks. In this article, we propose MixLock, an anti-piracy countermeasure for mixed-signal IP cores and ICs. MixLock protection is based on inserting a lock mechanism into the design such that correct functionality is established only after applying a key which is the designer’s secret. The lock mechanism acts on the mixed-signal performances by leveraging logic locking of the digital part. MixLock presents several key attributes. It is generally applicable, it is nonintrusive to the sensitive analog section, it incurs no performance penalty and has very low area and power overheads, it is fully automated, and it is capable of co-optimizing security in both the analog and digital domains. We demonstrate MixLock on a $\Sigma \Delta $ analog-to-digital converter (ADC) using hardware measurements and an audio demonstrator. [ABSTRACT FROM AUTHOR]

This work introduces a generic, machine learning (ML)-based platform for functional reverse engineering (RE) of circuits. Our proposed platform GNN-RE leverages the notion of graph neural networks (GNNs) to: 1) represent and analyze flattened/unstructured gate-level netlists; 2) automatically identify the boundaries between the modules or subcircuits implemented in such netlists; and 3) classify the subcircuits based on their functionalities. For GNNs in general, each graph node is tailored to learn about its own features and its neighboring nodes, which is a powerful approach for the detection of any kind of subgraphs of interest. For GNN-RE, in particular, each node represents a gate and is initialized with a feature vector that reflects on the functional and structural properties of its neighboring gates. GNN-RE also learns the global structure of the circuit, which facilitates identifying the boundaries between subcircuits in a flattened netlist. Initially, to provide high-quality data for training of GNN-RE, we deploy a comprehensive dataset of foundational designs/components with differing functionalities, implementation styles, bit widths, and interconnections. GNN-RE is then tested on the unseen shares of this custom dataset, as well as the EPFL benchmarks, the ISCAS-85 benchmarks, and the 74X series benchmarks. GNN-RE achieves an average accuracy of 98.82% in terms of mapping individual gates to modules, all without any manual intervention or postprocessing. We also release our code and source data. [ABSTRACT FROM AUTHOR]

Scan design is a de facto design-for-testability (DfT) technique that enhances access during manufacturing test process. However, it can also be used as a back door to leak secret information from a secure chip. In existing scan attacks, the secret key of a secure chip is retrieved by using both the functional mode and the test mode of the chip. These attacks can be thwarted by applying a reset operation when there is a switch of mode. However, the mode-reset countermeasure can be thwarted by using only the test mode of a secure chip. In this paper, we perform a detailed analysis on the test-mode-only scan attack. We propose attacks on an advanced encryption standard (AES) design with a basic scan architecture as well as on an AES design with an advanced DfT infrastructure that comprises decompressors and compactors. The attack results show that indeed the secure chips are vulnerable to test-mode-only attacks. The secret key can be recovered within 1 s even in the presence of decompressors and compactors. We then propose new countermeasures to thwart these attacks. The proposed countermeasures incur minimal cost while providing high success rate. [ABSTRACT FROM PUBLISHER]

Emerging nonvolatile memory devices such as phase change memories and memristors are replacing SRAM and DRAM. However, nonvolatile main memories (NVMM) are susceptible to probing attacks even when powered down. This way, they may compromise sensitive data such as passwords and keys that reside in the NVMM. To eliminate this vulnerability, we propose sneak-path encryption (SPE), a hardware intrinsic encryption technique for memristor-based NVMMs. SPE is instruction set architecture independent and has minimal impact on performance. SPE exploits the physical parameters, such as sneak-paths in crossbar memories, to encrypt the data stored in a memristor-based NVMM. SPE is resilient to a number of attacks that may be performed on NVMMs. We use a cycle accurate simulator to evaluate the performance impact of SPE-based NVMM and compare against other security techniques. SPE can secure an NVMM with a $\sim 1.3$ % performance overhead. [ABSTRACT FROM PUBLISHER]

Given their non-invasiveness and demonstrated effectiveness, power analysis attacks (PAAs) are concerning and to be accounted for in modern circuit design. That is especially relevant for technology-dependent verification of PAA countermeasure implementations. Prior art proposed various countermeasures against PAAs, including masking and hiding, voltage switching, noise injection, etc. Aside from the proven working principles of such countermeasures, it is important to understand that their effectiveness is primarily technology- and implementation-dependent. Hence, before deployment, especially for integrated circuits, such countermeasures require accurate circuit-level studies. This work investigates an industrial-grade 14 nm fin field-effect transistor (FinFET) technology at design-time in the context of PAAs. We leverage device-level measurement data from Intel high-volume manufacturing processes, build up accordingly well-characterized standard-cell libraries, and utilize a commercial-grade computer-aided design (CAD) flow for PAA evaluation at design-time. Our study is focused on (1) the effectiveness of voltage switching as a countermeasure, (2) the advanced encryption standard (AES) cipher as a representative circuit, and (3) the correlation power analysis (CPA) as an attack framework. We show that, to improve the resilience against the CPA attack in particular and to lower information leakage in general, specific voltage configurations are more promising than others for the 14 nm FinFET technology. • We study design-time technology evaluation for power side-channel attacks (PSCAs). • We focus on industrial-grade 14 nm fin field-effect transistor (FinFET) technology. • We use device-level measurement data from Intel high-volume manufacturing nodes. • We build up accordingly well-characterized standard-cell libraries. • We utilize a commercial-grade computer-aided design flow for PSCA evaluation. • We study voltage switching as countermeasure against correlation power analysis (CPA). • Resilience against CPA increases the more we switch, the larger the voltage difference. • But, information leakage is increasing for such configurations as well. • Thus, careful study of voltage differences, switching ratios is required. • Such study requires technology-accurate design-time evaluation, as proposed here. • Our findings are robust: we conduct batches of randomized-but-reproducible CPA runs. • Our findings are conservative: we use technology-accurate, zero-delay simulations. • Our findings serve as guidelines for secure design, e.g., for key refresh rates. [ABSTRACT FROM AUTHOR]

Split manufacturing was introduced as a countermeasure against hardware-level security threats such as IP piracy, overbuilding, and insertion of hardware Trojans. However, the security promise of split manufacturing has been challenged by various attacks which exploit the wellknown working principles of design tools to infer the missing back-end-of-line (BEOL) interconnects. In this work, we define the security of split manufacturing formally and provide the associated proof, and we advocate accordingly for a novel, formally secure paradigm. Inspired by the notion of logic locking, we protect the front-end-of-line (FEOL) layout by embedding secret keys which are implemented through the BEOL in such a way that they become indecipherable to foundrybased attacks. At the same time, our technique is competitive with prior art in terms of layout overhead, especially for large-scale designs (ITC'99 benchmarks). Furthermore, another concern for split manufacturing is its practicality (despite successful prototyping). Therefore, we promote an alternative implementation strategy, based on package-level routing, which enables formally secure IP protection without splitting at all, and thus, without the need for a dedicated BEOL facility. We refer to this as "poor man's split manufacturing" and we study the practicality of this approach by means of physical-design exploration. [ABSTRACT FROM AUTHOR]

In this work, we advance the security promise of split manufacturing through judicious handling of interconnects. First, we study the cost-security tradeoffs underlying for split manufacturing, which are limiting its adoption. Next, aiming to resolve these concerns, we propose three effective and efficient strategies to dedicatedly lift nets to higher metal layers. Toward this end, we design custom “elevating cells” and devise procedures for routing blockages. All our techniques are employed in a commercial-grade computer-aided design (CAD) framework. For our security analysis, we leverage various state-of-the-art attacks (network flow-based attack, routing-congestion-aware attack, and deep learning-based attack), established metrics (correct connection rate, output error rate, and Hamming distance), and advanced metrics (percentage of netlist recovery and mutual information). Our extensive experiments show that our scheme provides superior protection. Simultaneously, we induce reasonably low and controllable overheads on power and performance, without any silicon area costs. Besides, we support higher split layers, which helps to alleviate concerns on the practicality of split manufacturing. [ABSTRACT FROM AUTHOR]

Concurrent Error Detection (CED) methods provide some level of error detection capability at the cost of some area and power overhead. Incorporating CED schemes into Integrated Circuits (ICs) is becoming increasingly more important, as the continuous technology scaling leads to an ever-higher transient error-related failure rate. For many applications, the error detection capability must be reconfigured dynamically, in order to adapt to the available power budget, criticality of the processed data, etc. In this work, we propose a reconfigurable duplication-based CED infrastructure for ICs. While duplication provides high CED coverage, its power budget requirement of having two circuits operate all the time limits its application. The key idea of reconfiguration is to enable/disable the operation of the duplicate circuit according to a set of control conditions. When CED is disabled, the inputs to the duplicate circuit retain their previous values (i.e., reduction in power dissipation via elimination of switching activity), yet errors are not detected (i.e., reduction in CED coverage). Experimental results using random and judicious selection of control conditions indicate that power dissipation is commensurate with CED coverage, supporting the use of LFSR structures to easily generate and adjust conditions dynamically to adapt to the power constraints of the system during its operation. Moreover, online testing using nonidentical input vectors can also be incorporated, improving the tradeoff between power dissipation and CED coverage. [ABSTRACT FROM AUTHOR]

Scan-based testing of integrated circuits results in significant switching activity during the shift operations, dissipating excessive power levels. When such levels are beyond the peak power level under which the chip can functionally operate at, it may lead to an unexpected behavior of the design, resulting in a yield loss. One of the most effective solutions to reduce peak shift power is to partition the scan chains into multiple groups, wherein a single group is active at any time instance within a shift cycle. The partitioning of the chains into groups can be performed statically, i.e., per test set, or dynamically, i.e., per test pattern. In this work, we address the application of dynamic scan chain partitioning for reducing peak shift power. First, we address the application of dynamic partitioning to test delay faults in at-speed test techniques. Then, we formulate the scan chain partitioning problem via Integer Linear Programming (ILP), in order to evenly distribute the transitions produced by any pattern over multiple time instances within the shift cycle, maximally reducing the peak shift power. Finally, we evaluate the power reduction benefit of dynamic partitioning through an extensive set of experiments using different scan configurations and test set characteristics of benchmark circuits as well as industrial designs. The results indicate that dynamic partitioning provides significant reduction to peak shift power over static partitioning methods, and that the benefit is accentuated in scan architectures with fewer scan chains, test sets with more don’t care bits, and designs with larger variances of weight differences for transitions in the scan cells. [ABSTRACT FROM AUTHOR]

Split manufacturing of integrated circuits means to delegate the front-end-of-line (FEOL) and back-end-of-line (BEOL) parts to different foundries, in order to prevent overproduction, intellectual property (IP) piracy, or targeted insertion of hardware Trojans (i.e., threats arising from adversaries in the FEOL foundry). This article challenges the security promise of split manufacturing by formulating various layout-level placement and routing hints as vector-based and image-based features that enable a sophisticated deep neural network (DNN), which can infer the missing BEOL connections with high accuracy. Compared with the network-flow attack (Wang et al., 2018), we achieve on average $1.21 \times $ and $1.12 \times $ of their correct connection rate (CCR; the higher, the better) when splitting after M1 and M3, respectively, with less than 1% of their runtime (across the same set of ISCAS-85 and ITC-99 benchmarks). Compared with Zeng et al. (2019), ours reduces the candidate list (the smaller, the better) by 47% with only 1% loss of accuracy, and we further achieve an average CCR of $2.2 \times $ of that of Zeng et al. (2019). Aside from these superior results, we propose a randomized, routing-blockage-centric defense strategy to escalate the resilience against our and other attacks. Our defense strategy, which can be integrated into any commercial design flow, leads on average to $22.78~pp$ (percentage points) degradation in CCR when compared with unprotected layouts, while inducing only 3.3% and 3.2% overheads on power and timing, respectively, within the same die outlines (i.e., zero area cost). The source code of our heterogeneous feature extraction is available at https://github.com/cuhk-eda/split-extract , and the source code of our DNN is available at https://github.com/cuhk-eda/split-attack. [ABSTRACT FROM AUTHOR]

While logic locking is a promising defense to protect hardware designs, many attacks have been shown to undermine its security by retrieving the secret key. All the powerful attacks rely on a working chip, i.e., an oracle, and in particular, heavily use the test access. The proposed technique DisORC turns the oracle into a dishonest one whenever a potential attack is detected. DisORC works on the premise that structural testing of chips need not be performed with the correct functionality. We implement this capability by adding circuitry around a logic-locked design that reconfigures its functionality upon detecting access to scan chains. Any attempt to access scan chains disconnects the secret key from the circuit, and clears all of its traces, isolating and securing it. We also pair this defense with a truly random logic locking (TRLL) scheme that makes random decisions in inserting key gates and retaining signal polarities without relying on any logic synthesis technique to perform bubble pushing. Any netlist analysis-based attack, known or anticipated, will then learn nothing useful to infer the key values. The combined defense DisORC + TRLL thwarts oracle-based and netlist analysis-based attacks while delivering sufficient corruption levels at the outputs. We also show that the proposed defense is cost effective and can be integrated into the design flow easily. The proposed logic locking defense provides protection against untrusted foundry, testing facility, end users, and any combination of them colluding together. [ABSTRACT FROM AUTHOR]

Logic locking is a holistic solution to counter manufacturing threats, such as intellectual property (IP) piracy and overbuilding at the hardware level. However, years of research has exposed various flaws in locking, including a Boolean satisfiability (SAT)-based attack. Consequently, several SAT-resilient locking techniques, such as SARLock, Anti-SAT, and SFLL have been proposed, although certain instances of them have also been broken by a class of attacks, called removal attack. In this article, we approach logic locking by leveraging well-known principles from very large-scale integration (VLSI) testing and elicit logic locking properties that dictate the resilience of a locking technique against different attacks. We present a revised version of SFLL, namely SFLL-rem, that not only retains all security properties of SFLL, delivering resilience to all the state-of-the-art attacks SFLL can thwart, but also to the latest removal attacks that broke some SFLL instances. Further, we develop a security-aware CAD framework integrated with industry tools that incurs only −1.5%, 0%, and 4.13% overhead for power, performance, and area, respectively. We demonstrate a silicon implementation of SFLL-rem on ARM Cortex-M0 microprocessor in 65 nm. Moreover, we provide a framework for an SoC designer to customize logic locking based on the SoC blocks and their threat models; this is illustrated by locking a multimillion-gate SoC provided by DARPA, and taking the SoC all the way to GDSII layout. [ABSTRACT FROM AUTHOR]

For the first time, we leverage the 2.5D interposer technology to establish system-level security in the face of hardware- and software-centric adversaries. More specifically, we integrate chiplets (i.e., third-party hard intellectual property of complex functionality, like microprocessors) using a security-enforcing interposer. Such hardware organization provides a robust 2.5D root of trust for trustworthy, yet powerful and flexible, computation systems. The security paradigms for our scheme, employed firmly by design and construction, are: 1) stringent physical separation of trusted from untrusted components and 2) runtime monitoring. The system-level activities of all untrusted commodity chiplets are checked continuously against security policiesvia physically separated security features. Aside from the security promises, the good economics of outsourced supply chains are still maintained; the system vendor is free to procure chiplets from the open market, while only producing the interposer and assembling the 2.5D system oneself. We showcase our scheme using the Cortex-M0 core and the AHB-Lite bus by ARM, building a secure 64-core system with shared memories. We evaluate our scheme through hardware simulation, considering different threat scenarios. Finally, we devise a physical-design flow for 2.5D systems, based on commercial-grade design tools, to demonstrate and evaluate our 2.5D root of trust. [ABSTRACT FROM AUTHOR]

Side-channel attacks have empowered bypassing of cryptographic components in circuits. Power side-channel (PSC) attacks have received particular traction, owing to their noninvasiveness and proven effectiveness. Aside from prior art focused on conventional technologies, this is the first work to investigate the emerging negative capacitance transistor (NCFET) technology in the context of PSC attacks. We implement a CAD flow for the PSC evaluation at design time. It leverages industry-standard design tools, while also employing the widely accepted correlation power analysis (CPA) attack. Using standard-cell libraries based on the 7-nm FinFET technology for NCFET and its counterpart CMOS setup, our evaluation reveals that NCFET-based circuits are more resilient to the classical CPA attack, due to the considerable effect of negative capacitance on the switching power. We also demonstrate that the thicker the ferroelectric layer, the higher the resiliency of the NCFET-based circuit, which opens new doors for optimization and tradeoffs. [ABSTRACT FROM AUTHOR]

The fabless business model has given rise to many security threats, including piracy of intellectual property (IP), overproduction, counterfeiting, reverse engineering (RE), and hardware Trojans (HT). Such threats severely undermine the benefits of the fabless model. Among the countermeasures developed to thwart piracy and RE attacks, logic locking has emerged as a promising and versatile solution that is being adopted by both academia and industry. The idea behind logic locking is to lock the design using a “keying” mechanism; only the rightful owner has control over the locked design. Therefore, the design remains nonfunctional without the knowledge of the key. In this article, we survey the evolution of logic locking over the last decade. We introduce various “cat-and-mouse” games involved in logic locking along with its novel applications—including, processor pipelines, graphics processing units (GPUs), and analog circuits. We aim this article to be a primer for researchers interested in developing new logic-locking techniques and employing logic locking in different application domains. [ABSTRACT FROM AUTHOR]

Protecting intellectual property (IP) has become a serious challenge for chip designers. Most countermeasures are tailored for CMOS integration and tend to incur excessive overheads, resulting from additional circuitry or device-level modifications. On the other hand, power density is a critical concern for sub-50 nm nodes, necessitating alternate design concepts. Although initially tailored for error-tolerant applications, imprecise computing has gained traction as a general-purpose design technique. Emerging devices are currently being explored to implement ultralow-power circuits for inexact computing applications. In this paper, we quantify the security threats of imprecise computing using emerging devices. More specifically, we leverage the innate polymorphism and tunable stochastic behavior of spin-orbit torque (SOT) devices, particularly, the giant spin-Hall effect (GSHE) switch. We enable IP protection (by means of logic locking and camouflaging) simultaneously for deterministic and probabilistic computing, directly at the GSHE device level. We conduct a comprehensive security analysis using state-of-the-art Boolean satisfiability (SAT) attacks; this paper demonstrates the superior resilience of our GSHE primitive when tailored for deterministic computing. We also demonstrate how probabilistic computing can thwart most, if not all, existing SAT attacks. Based on this finding, we propose an attack scheme called probabilistic SAT (PSAT) which can bypass the defense offered by logic locking and camouflaging for imprecise computing schemes. Further, we illustrate how careful application of our GSHE primitive can remain secure even on the application of the PSAT attack. Finally, we also discuss side-channel attacks and invasive monitoring, which are arguably even more concerning threats than SAT attacks. [ABSTRACT FROM AUTHOR]

Outsourcing of integrated circuit (IC) fabrication to external foundries has lead to many new security vulnerabilities, including IC piracy, overbuilding, and reverse engineering. In this regard, logic locking (LL) was introduced to protect intellectual property from such threats. In this paper, we evaluate the strength of various LL techniques, including earlier works, such as random LL (RLL) and fault analysis-based LL (FLL), against power-based side-channel attack. We have developed attacks where at least 60% of the key bits can be successfully recovered for 60% of the circuits for both RLL and FLL using a 32-bit key. However, the success rate reduces to 45% and 35% for RLL and FLL, respectively, when using a 64-bit key. We demonstrate the practicality of our proposed attack by mounting it against RLL and FLL implementations of ISCAS’85 and MCNC benchmark circuits on Spartan-6 FPGA platform. Further, we present differential power analysis (DPA) results on mutual information analysis on LL techniques that capture any dependence between the intermediate data and the captured power traces. We also formally establish that resilience to satisfiability-based (SAT) attack implies resilience to DPA attack as well for an LL technique. We validate this further via experiments on Spartan-6 FPGA on SAKURA-G development board for a recent LL technique that is known to thwart the SAT attack. [ABSTRACT FROM AUTHOR]

Creating backdoors in integrated circuits (ICs), stealing hardware intellectual property, counterfeiting electronic components, reverse engineering ICs, and injecting malware in ICs are no longer nation state acts requiring specialized, expensive, and unlimited resources. Democratization of IC design has created numerous opportunities for rogues throughout the IC supply chain to inflict these attacks with aplomb and for a variety of reasons: personal gain, economic harm, economic gain, bringing disrepute, and sheer fun among others. [ABSTRACT FROM PUBLISHER]

Due to globalization of integrated circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware Trojans. EPIC locks the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the locked netlist, in a time linear to the number of keys, by sensitizing the key-bits to the output. We then develop techniques to fix this vulnerability and make an attacker’s effort truly exponential in the number of inserted keys. We introduce a new security metric and a method to deliver strong logic locking. [ABSTRACT FROM PUBLISHER]

During the past few decades, the electronics community has witnessed a growing demand for packing more and more functionalities onto a single chip. The CMOS industry has been fulfilling this demand by continually shrinking the feature sizes, now down to the 20-nm regime. However, scaling of CMOS technology beyond 20 nm is challenging because of exacerbated short-channel effects, process variations, and reliability problems. These drawbacks of CMOS technology have led to the exploration of new nanotechnologies such as nanoelectromechanical systems (NEMS) and carbon nanotube (CNT). These emerging technologies are considered promising alternatives to CMOS technology because of their potential benefits in power, performance, and reliability. However, security analysis of these emerging technologies, which is critical for current pervasive applications, remains unaddressed. In this article, the authors offer a security analysis of NEMS and CNT. They highlight the key technology-specific features of these post-CMOS technologies that can inform the design of secure systems. [ABSTRACT FROM AUTHOR]

Memristors are an attractive option for use in future memory architectures but are prone to high defect densities due to the nondeterministic nature of nanoscale fabrication. Several works discuss memristor fault models and testing. However, none of them considers the memristor as a multilevel cell (MLC). The ability of memristors to function as an MLC allows for extremely dense, low-power memories. Using a memristor as an MLC introduces fault mechanisms that cannot occur in typical two-level memory cells. In this paper, we develop fault models for memristor-based MLC crossbars. The typical approach to testing a memory subsystem entails testing one memory cell at a time. However, this testing strategy is time consuming and does not scale for dense, memristor memories. We propose an efficient testing technique that exploits sneak-paths inherent in crossbar memories to test several memory cells simultaneously. In this paper, we integrate solutions for detecting and locating faults in memristors. We develop a power aware built-in self-test solution to detect these faults. We also propose a hybrid diagnosis scheme that uses a combination of sneak-path and March testing to reduce diagnosis time. The proposed schemes enable and leverage sneak-paths during fault detection and diagnosis modes, while disabling sneak-paths during normal operation. The proposed hybrid scheme reduces fault detection and diagnosis time by 24.69% and 28%, respectively, compared to traditional March tests. [ABSTRACT FROM PUBLISHER]

Globalization of the integrated circuit (IC) design industry is making it easy for rogue elements in the supply chain to pirate ICs, overbuild ICs, and insert hardware Trojans. Due to supply chain attacks, the IC industry is losing approximately $4 billion annually. One way to protect ICs from these attacks is to encrypt the design by inserting additional gates such that correct outputs are produced only when specific inputs are applied to these gates. The state-of-the-art logic encryption technique inserts gates randomly into the design, but does not necessarily ensure that wrong keys corrupt the outputs. Our technique ensures that wrong keys corrupt the outputs. We relate logic encryption to fault propagation analysis in IC testing and develop a fault analysis-based logic encryption technique. This technique enables a designer to controllably corrupt the outputs. Specifically, to maximize the ambiguity for an attacker, this technique targets 50% Hamming distance between the correct and wrong outputs (ideal case) when a wrong key is applied. Furthermore, this 50% Hamming distance target is achieved using a smaller number of additional gates when compared to random logic encryption. [ABSTRACT FROM AUTHOR]