Search

CeO2 nanostructures have been utilized for various biomedical, sensor, and catalysis applications owing to their unique defect structure, enabling them to have regenerative oxidative properties. Defect engineering in CeO2 nanostructures has major importance, enabling them to be utilized for specific applications. Despite various synthesis methods, it is challenging to have precise and reversible control over defect structures. Against this backdrop, in the current work, we have explored machine learning (ML) enhanced defect engineering of CeO2 nanofilms. In our earlier work [J. Vac. Sci. Technol. A 39, 060405 (2021)], we have developed an atomic layer deposition process for CeO2 using in situ ellipsometry measurements. In the current work, data collected through in situ spectroscopic ellipsometry and ex situ XPS have been correlated using two ML algorithms (gradient boost and random forest regressor) to exert better control over the chemical properties. Defect structures are one of the desired properties in CeO2 nanomaterials, characterized by the Ce3+/Ce4+ oxidation state ratio leading to its regenerative properties. We have shown that the defect structure of the CeO2 nanofilms can be predicted using in situ ellipsometry data in real time using a trained ML algorithm using two different methods. The first method involves an indirect approach of thickness prediction using an ML algorithm (k-nearest neighbors) followed by Ce3+/Ce4+ estimation using an experimental calibration curve. The second method with a more direct approach involves Ce3+/Ce4+ prediction using real-time ellipsometry data (amplitude ratio ψ and phase difference Δ) using gradient boost and random forest regressor. [ABSTRACT FROM AUTHOR]

The exponential proliferation of Malware over the past decade has threatened system security across a plethora of Internet of Things (IoT) devices. Furthermore, the improvements in computer architectures to include speculative branching and out-of-order executions have engendered new opportunities for adversaries to carry out microarchitectural attacks in these devices. Both Malware and microarchitectural attacks are imperative threats to computing systems, as their behaviors range from stealing sensitive data to total system failure. With the cat-and-mouse game between Anti-Virus Software (AVS) and attackers, the frequent bolstering of AVS induces large computational overhead. Consequently, hardware performance counter (HPC)-based detection strategies augmented with machine learning (ML) classifiers have gained popularity as a low overhead solution in identifying these malicious threats. However, ML models are operated as black boxes, which results in decisions that are not human understandable. Clarity of the models’ results facilitates the development of more robust systems. Existing explainable frameworks are only capable of determining each feature’s impact on a prediction which does not provide meaningful interpretable outcomes for HPC-based intrusion detection. In this article, we address this issue by proposing an explainable HPC-based double regression (HPCDR) ML framework. Our proposed technique provides relevant transparency through isolation of the most malevolent transient window of an application, thereby allowing a user to efficiently locate the pernicious instructions within the program. We evaluated HPCDR on five microarchitectural attacks and two Malware. HPCDR was successfully able to identify the most malicious function manifested in each intrusive application. [ABSTRACT FROM AUTHOR]

With an ever-increasing globalization of the semiconductor chip manufacturing supply chain coupled with soaring complexity of modern-day integrated circuits (ICs), intellectual property (IP) piracy, reverse engineering, counterfeiting, and hardware trojan insertion have emerged as severe threats that have compromised the security of critical hardware components. Logic locking (LL) is an IP protection technique that can mitigate these threats by locking a given IC with a secret key. Earlier LL demonstrations based on traditional silicon complementary metal-oxide-semiconductor (CMOS) technology and emerging memristors require significant hardware investment in the form of additional input gates and extensive CMOS peripherals, rendering them area- and energy-inefficient. In this article, we demonstrate multiple two-dimensional (2D) nanoscale memtransistor-based programmable logic gates such as AND, NAND, OR, XOR, and NOT gates, each of which can be locked/unlocked without requiring peripherals and at minuscule energy expenditure (<1 pJ). We also show that SAT-solver is unsuccessful in breaking into any of the ISCAS'85 benchmark circuits that utilize our LL scheme. The massive resilience to SAT-attack is attributed to the prowess of programmable 2D memtransistors which enable device-level LL of all the gates in each of the benchmark circuits. Given that 2D transistors are drawing increasing attention of chip manufacturing corporations like Intel, TSMC, etc., to replace and/or augment silicon at aggressively scaled technology nodes, our demonstration of area- and energy-efficient LL can be considered as a step toward the realization of secure ICs enabled by 2D nanoscale memtransistors. [ABSTRACT FROM AUTHOR]

Key-based circuit obfuscation or logic-locking is a technique that can be used to hide the full design of an integrated circuit from an untrusted foundry or end-user. The technique is based on creating ambiguity in the original circuit by inserting "key" input bits into the circuit such that the circuit is unintelligible absent a correct secret key. Clock signals have traditionally been avoided in locking in order to not corrupt the timing behavior of the locked circuit. In this paper, we explore the case where the clock signal itself may be obfuscated by ambiguating its frequency or pattern. Along with discussing formal notions of security in this context, we present practical ways to deobfuscate such designs using techniques from multi-rate model-checking. We present experimental data on deobfuscation runtime on a set of sequential benchmark circuits. Our results show that naive random clock obfuscation may not provide more security per overhead than traditional random keyed-gate insertion. We discuss how clock obfuscation may be a more attractive choice for special circuit designs that are inherently multi-clock/asynchronous. [ABSTRACT FROM AUTHOR]

This article presents RTL-ConTest, a register transfer-level (RTL) security vulnerability detection algorithm, that extracts critical process flows from a RTL design and executes RTL-level concolic testing to generate security test cases for identifying critical exploits manifested in a System on Chip (SoC). The efficiency of the proposed approach is evaluated on opensource RISC-V-based SoCs. Our technique is successful in detecting the security vulnerabilities manifested in the processor core as well as in the rest of the SoC, e.g., debug modules, peripherals, etc., thereby providing a thorough vulnerability check on the entire hardware design. As demonstrated by our experimental results, in circumstances where conventional security verification tools are limited, RTL-ConTest furnishes significantly improved efficiency in detecting SoC security vulnerabilities. [ABSTRACT FROM AUTHOR]

In this work we demonstrate a novel CMOS reservoir computer (RC) prototype in 65nm CMOS that is capable of detecting Malware and micro-architectural attacks in real-time utilizing hardware performance counter (HPC) traces. A 65nm test chip achieves 96.8% and 96.5% accuracy when classifying Malware and micro-architectural attacks respectively, while achieving better classification performance than digital machine learning models and with lower energy consumption. The on-chip classifier consumes $38.2~\mu \text{W}$ from a 1.2V supply while running at 40kHz. [ABSTRACT FROM AUTHOR]

Anti-virus software (AVS) tools are used to detect malware in a system. However, AVS are vulnerable to attacks. A malicious entity can exploit these vulnerabilities to subvert the AVS. Recently, hardware components such as hardware performance counters have been used for malware detection. In this article, we propose preempts malware by examining embedded processor traces (PREEMPT), a zero overhead, high-accuracy, low-latency technique to detect malware by repurposing embedded trace buffer (ETB), a debug hardware component available in most modern processors. The ETB is used for postsilicon validation and debug and allows us to control and monitor the internal activities of a chip, beyond what is provided by the input/output pins. PREEMPT combines these hardware-level observations with machine learning-based classifiers to preempt malware before it causes damage. The benefits of reusing ETB for malware detection include the increased robustness against attacks and no performance penalties. PREEMPT can detect malware on an OpenSPARC T1 core running Linux operating system with a F1-score of 96.6%. [ABSTRACT FROM AUTHOR]

A machine learning approach is applied to estimate film thickness from in situ spectroscopic ellipsometry data. Using the atomic layer deposition of ZnO as a model process, the ellipsometry spectra obtained contains polarization data (Ψ, Δ) as a function of wavelength. Within this dataset, 95% is used for training the machine learning algorithm, and 5% is used for thickness prediction. Five algorithms—logistic regression, support vector machine, decision tree, random forest, and k-nearest neighbors—are tested. Out of these, the k-nearest neighbor performs the best with an average thickness prediction accuracy of 88.7% to within ±1.5 nm. The prediction accuracy is found to be a function of ZnO thickness and degrades as the thickness increases. The average prediction accuracy to within ±1.5 nm remains remarkably robust even after 90% of the (Ψ, Δ) are randomly eliminated. Finally, by considering (Ψ, Δ) in a limited spectral range (271–741 nm), prediction accuracies approaching that obtained from the analysis of full spectra (271–1688 nm) can be realized. These results highlight the ability of machine learning algorithms, specifically the k-nearest neighbor, to successfully train and predict thickness from spectroscopic ellipsometry data. [ABSTRACT FROM AUTHOR]

The contemporary Network on Chips (NoCs) are becoming intricate in design to serve the high throughput and low latency demands of multicore platforms. The complexity level of interconnect module makes it extremely difficult to ensure the functional correctness at the presilicon verification stage. Hence, post-silicon debug is performed on NoC as a necessary step to capture the escaped network design faults. The traditional store and forward trace-based debug methods encounter the problems of large trace buffer requirement and limited availability of trace communication bandwidth. These constraints become more stringent for short-lived network faults (misroute, packet drop, etc.), which demand more frequent trace collection for their detection. In this regard, we propose WiND, which is wireless-enabled NoC for post-silicon debug. WiND is a robust NoC debug framework that optimally uses the limited trace buffer space and can efficiently speed up the trace communication. The proposed method augments wireless interfaces (WIs) on top of the baseline wired NoC for validation purposes. The wireless medium is utilized for long-range test payload communication to reduce the volume of trace. The WIs are also used for high-speed interchip trace transfer. A modified router architecture is used to enable the trace collection, and to enhance the trace communication. WiND platform is examined with several synthetic and SPLASH-2 benchmark workloads, and compared with the traditional wired platform. An overall improvement of 15%–26% on fault detection and 27%–34% on path reconstruction in the case of different faults is observed for the same trace buffer size. [ABSTRACT FROM AUTHOR]

Process development in atomic layer deposition (ALD) is often time-consuming, requiring optimization of saturation curves and temperature windows for controlled deposition rates. Any ALD process should be self-limiting in nature, exhibiting a temperature window of nominal deposition and a linear deposition rate. Meeting these criteria usually requires several ALD experiments, followed by film characterization, which are generally time, cost, and labor-intensive. Against this backdrop, we report a methodology using in situ ellipsometry to rapidly develop the ALD process for cerium oxide using Ce(iPrCp)2(N-iPr-amd) and water. The entire optimized process was realized in ten experiments of sequential pulsing as a function of temperature, requiring less than a day. In the traditional approach, tens of experiments and ex situ characterization may be required. The approach reported here generated a contour visualization of the time-temperature-thickness parameter space delineating the optimal deposition conditions. The cerium oxide deposition rate deposited in the ALD temperature window was ∼0.15 nm/cycle; the deposited film was further characterized using x-ray photoelectron spectroscopy, x-ray diffraction, and atomic force microscopy to probe the film composition and quality further. [ABSTRACT FROM AUTHOR]

In the era of Internet of Things (IoT), Malware has been proliferating exponentially over the past decade. Traditional anti-virus software are ineffective against modern complex Malware. In order to address this challenge, researchers have proposed hardware-assisted Malware detection (HMD) using hardware performance counters (HPCs). The HPCs are used to train a set of machine learning (ML) classifiers, which in turn, are used to distinguish benign programs from Malware. Recently, adversarial attacks have been designed by introducing perturbations in the HPC traces using an adversarial sample predictor to misclassify a program for specific HPCs. These attacks are designed with the basic assumption that the attacker is aware of the HPCs being used to detect Malware. Since modern processors consist of hundreds of HPCs, restricting to only a few of them for Malware detection aids the attacker. In this article, we propose a moving target defense (MTD) for this adversarial attack by designing multiple ML classifiers trained on different sets of HPCs. The MTD randomly selects a classifier; thus, confusing the attacker about the HPCs or the number of classifiers applied. We have developed an analytical model which proves that the probability of an attacker to guess the perfect HPC-classifier combination for MTD is extremely low (in the range of $10^{-1864}$ for a system with 20 HPCs). Our experimental results prove that the proposed defense is able to improve the classification accuracy of HPC traces that have been modified through an adversarial sample generator by up to 31.5%, for a near perfect (99.4%) restoration of the original accuracy. [ABSTRACT FROM AUTHOR]

Micro-architectural footprints can be used to distinguish one application from another. Most modern processors feature hardware performance counters to monitor the various micro-architectural events when an application is executing. These ready-made hardware performance counters can be used to create program fingerprints and have been shown to successfully differentiate between individual applications. In this paper, we demonstrate how ready-made hardware performance counters, due to their coarse-grain nature (low sampling rate and bundling of similar events, e.g., number of instructions instead of number of add instructions), are insufficient to this end. This observation motivates exploration of tailor-made hardware performance counters to capture fine-grain characteristics of the programs. As a case study, we evaluate both ready-made and tailor-made hardware performance counters using post-quantum cryptographic key encapsulation mechanism implementations. Machine learning models trained on tailor-made hardwareperformance counter streams demonstrate that they can uniquely identify the behavior of every post-quantum cryptographic key encapsulation mechanism algorithm with at least 98.99% accuracy. [ABSTRACT FROM AUTHOR]

High accuracy and ever-increasing computing power have made deep neural networks (DNNs) the algorithm of choice for various machine learning, computer vision, and image processing applications across the computing spectrum. To this end, Google developed the tensor processing unit (TPU) to accelerate the computationally intensive matrix multiplication operation of a DNN on its systolic array architecture. Faults manifested in the datapath of such a systolic array due to latent manufacturing defects or single-event effects may lead to functional safety (FuSa) violation. Although DNNs are known to resist minor perturbations with their inherent fault-tolerant characteristics, we show that the classification accuracy of the model plummets from 97.4% to 7.75% with a minimal fault rate of 0.0003% in the accelerator, implying catastrophic circumstances when deployed across mission-critical systems. Hence, to ensure FuSa of such accelerators, this article provides an extensive FuSa assessment of the accelerator exposed to faults in the datapath, by varying the network parameters, position, and characteristics of the induced error across multiple exhaustive data sets. Furthermore, we propose two novel strategies to obtain a diminutive set of functional test patterns to detect FuSa violation in a DNN accelerator. Our experimental results demonstrate that the obtained test sets can achieve an average of 92.63% (in some cases, up to 100%) fault coverage with cardinality as low as 0.1% of the entire test data set. [ABSTRACT FROM AUTHOR]

Malware can range from simple adware to stealthy kernel control-flow modifying rootkits. Although anti-virus software is popular, an ongoing cat-and-mouse cycle of anti-virus development and malware that thwarts the anti-virus has ensued. More recently, trusted hardware-based malware detection techniques are being developed on the premise that it is easier to bypass software-based defenses than hardware-based counterparts. One such approach is the use of hardware performance counters (HPCs) to detect malware for Linux and Android platforms. This paper, for the first time, presents an analytical framework to investigate the security provided by HPC-based malware detection techniques. The HPC readings are periodically monitored over the duration of the program execution for comparison with a golden HPC reading. We develop a mathematical framework to investigate the probability of malware detection, when HPCs are monitored at a pre-determined sampling interval. In other words, given a program, a set of HPCs, and a sampling rate, the framework can be employed to analyze the probability of malware detection. [ABSTRACT FROM AUTHOR]

Silicon debugging is carried out in multiple sessions which are characterized by run-and-halt intervals. One of the important criteria for the success of this method is that the debugging infrastructure should capture only the erroneous data which can add important insights to the debugging process. However, identification of such suspect clock cycles is not a trivial exercise and requires an systematic approach. We propose a debugging architecture for enhancing the multisession procedure using the technique of on-chip debug data compression. The first session assists in identifying those erroneous clock cycles, and the useful debug data are collected in the second session with the help of markers called tag bits. At the cost of a minimal increase in area overhead, the proposed architecture achieves finer temporal visibility expansion because of the debug data collection in a segregated manner. During the offline analysis of the collected debug data, error localization can be achieved to a finer resolution. We evaluate our methodology on several designs for different kinds of error configurations. Experimental results show that the proposed methodology can achieve better on-chip storage utilization and the expansion in the temporal observation window compared to similar techniques in the literature. [ABSTRACT FROM AUTHOR]

Incorporating on-chip trace buffers (TBs) helps to overcome the limited observability by tracing selected signals during post-silicon validation. The effectiveness of TB-based techniques largely relies on selection of appropriate trace signals. For processor-based systems, the selection becomes relatively easier because important signals can be identified. However, for a general digital block in a complex system-on-chip, recognizing necessary trace signals becomes extremely challenging and requires a systematic approach. Previous research on trace signal selection has mainly focused on improving reconstruction of unknown signal values with the help of traced signals. Even though it serves as a good selection principle, an effective signal selection must consider other important factors such as error detection (ED) with the traced signals, which in turn assist in localization and root-cause discovery. Additionally, from practical point of view, the signal selection algorithm needs to cater to factors like routing congestion and minimizing routing wire length. The proposed methodology of signal selection attempts to combine these three crucial factors of signal selection: restoration of untraced signal states, ED with traced signals and routing considerations. The concurrent maximization of all these three parameters is difficult as they have conflicting preference of the candidate trace signals. Hence, the proposed signal selection approach presents a methodology of judiciously mixing the choices of these three objectives. Furthermore, the restored and traced signal states are analyzed for the purpose of error localization at the gate level for several design error models. [ABSTRACT FROM AUTHOR]

Hardware Trojans are a major concern for integrated circuits. All parts of the electronics supply chain are vulnerable to this threat. Trojans can be inserted directly by a rogue employee or through a compromised computer-aided design tool at each step of the design cycle, including an alteration of the design files in the early stages and the fabrication process in a third-party malicious foundry. While Trojan insertion during the latter stages has been largely investigated, we focus on high-level synthesis (HLS) tools as a likely attack vector. HLS tools are used to generate intellectual property blocks from high-level specifications. To demonstrate the threat, we compromised an open-source HLS tool to inject three examples of HLS-aided hardware Trojans with functional and nonfunctional effects. Our results show that a black-hat HLS tool can be successfully used to maliciously alter electronic circuits to add latency, drain energy, or undermine the security of cryptographic hardware cores. This threat is an important security concern to address. [ABSTRACT FROM AUTHOR]

Post-silicon validation is one of the most important and expensive tasks in modern integrated circuit design methodology. The primary problem governing post-silicon validation is the limited observability due to storage of a small number of signals in a trace buffer. The signals to be traced should be carefully selected in order to maximize restoration of the remaining signals. Existing approaches have two major drawbacks. They depend on partial restorability computations that are not effective in restoring maximum signal states. They also require long signal selection time due to inefficient computation as well as operating on gate-level netlist. We have proposed a signal selection approach based on total restorability at gate-level, which is computationally more efficient (10 times faster) and can restore up to three times more signals compared to existing methods. We have also developed a register transfer level signal selection approach, which reduces both memory requirements and signal selection time by several orders-of-magnitude. [ABSTRACT FROM PUBLISHER]

Higher circuit densities in system-on-chip (SOC) designs have led to drastic increase in test data volume. Larger test data size demands not only higher memory requirements, but also an increase in testing time. Test data compression addresses this problem by reducing the test data volume without affecting the overall system performance. This paper proposes a novel test data compression technique using bitmasks which provides a substantial improvement in the compression efficiency without introducing any additional decompression penalty. The major contributions of this paper are as follows: 1) it develops an efficient bitmask selection technique for test data in order to create maximum matching patterns; 2) it develops an efficient dictionary selection method which takes into account the bitmask based compression; and 3) it proposes a test compression technique using efficient dictionary and bitmask selection to significantly reduce the testing time and memory requirements .We have applied our method on various test data sets and compared our results with other existing test compression techniques. Our algorithm outperforms existing dictionary-based approaches by up to 30%, giving a best possible test compression of 92%. [ABSTRACT FROM AUTHOR]

Reverse engineering (RE) is one of the major security threats to the semiconductor industry due to the involvement of untrustworthy parties in an increasingly globalized chip manufacturing supply chain. RE efforts have already been successful in extracting device level functionalities from an integrated circuit (IC) with very limited resources. Camouflaging is an obfuscation method that can thwart such RE. Existing work on IC camouflaging primarily involves transformable interconnects and/or covert gates where variation in doping and dummy contacts hide the circuit structure or build cells that look alike but have different functionalities. Emerging solutions, such as polymorphic gates based on a giant spin Hall effect and Si nanowire field effect transistors (FETs), are also promising but add significant area overhead and are successfully decamouflaged by the satisfiability solver (SAT)-based RE techniques. Here, we harness the properties of two-dimensional (2D) transition-metal dichalcogenides (TMDs) including MoS 2 , MoSe 2 , MoTe 2 , WS 2 , and WSe 2 and their optically transparent transition-metal oxides (TMOs) to demonstrate area efficient camouflaging solutions that are resilient to SAT attack and automatic test pattern generation attacks. We show that resistors with resistance values differing by 5 orders of magnitude, diodes with variable turn-on voltages and reverse saturation currents, and FETs with adjustable conduction type, threshold voltages, and switching characteristics can be optically camouflaged to look exactly similar by engineering TMO/TMD heterostructures, allowing hardware obfuscation of both digital and analog circuits. Since this 2D heterostructure devices family is intrinsically camouflaged, NAND/NOR/AND/OR gates in the circuit can be obfuscated with significantly less area overhead, allowing 100% logic obfuscation compared to only 5% for complementary metal oxide semiconductor (CMOS)-based camouflaging. Finally, we demonstrate that the largest benchmarking circuit from ISCAS'85, comprised of more than 4000 logic gates when obfuscated with the CMOS-based technique, is successfully decamouflaged by SAT attack in <40 min; whereas, it renders to be invulnerable even in more than 10 h when camouflaged with 2D heterostructure devices, thereby corroborating our hypothesis of high resilience against RE. Our approach of connecting material properties to innovative devices to secure circuits can be considered as a one of a kind demonstration, highlighting the benefits of cross-layer optimization.