Frontiers in Securing IP Cores: Forensic detective control and obfuscation techniques

Description

This book presents advanced forensic detective control and obfuscation techniques for securing hardware IP cores by exploring beyond conventional technologies. The theme is important to researchers in various areas of specialization, because it encompasses the overlapping topics of EDA-CAD, hardware design security, VLSI design, IP core protection, optimization using evolutionary computing, system-on-chip design and finally application specific processor/hardware accelerator design for consumer electronics applications. The book begins by introducing forensic detective control and obfuscation mechanisms for hardware and IP core security. Further chapters cover hardware stenography, digital signature driven hardware authentication, fault-secured IP cores using digital signature-based watermarks, multi-level watermarking, cryptosystem-based multi-variable fingerprinting, multi-phase and hologram-based obfuscation, and security of functionally obfuscated DSP cores. Cover Contents Preface Acknowledgements About the author Foreword of the IET book 'Frontiers in Securing IP Cores: Forensic detective control and obfuscation techniques' Foreword for IET book 'Frontiers in Securing IP Cores: Forensic detective control and obfuscation techniques' List of acronyms 1 Introduction to hardware (IP) security: forensic detective control and obfuscation of digital signal processing (DSP) cores 1.1 Hardware security: an introduction 1.2 Hardware security of DSP cores: using high-level synthesis (HLS) framework or ESL 1.3 Security: energy trade-off in high-level synthesis for hardware security of DSP cores 1.4 Design space exploration systems used in HLS: utility in performing energy or area–security trade-offs 1.4.1 Genetic algorithm (GA)-based design space exploration framework 1.4.2 Particle swarm optimization (PSO)-based design space exploration framework 1.4.3 Bacterial foraging optimization algorithm (BFOA)-based design space exploration framework 1.4.4 Firefly algorithm (FA)-based design space exploration framework 1.5 Comparative perspective of different security techniques used for DSP cores 1.5.1 Hardware watermarking versus hardware steganography 1.5.2 Hardware watermarking versus digital signature 1.5.3 Hardware fingerprinting versus hardware steganography 1.5.4 Hardware obfuscation versus digital signature 1.6 Conclusion 1.7 Questions and exercises References 2 Forensic detective control using hardware steganography for IP core protection 2.1 Introduction 2.2 Threat model 2.3 Selected contemporary approaches 2.3.1 Steganography versus watermarking versus cryptography 2.3.2 Limitations of hardware watermarking 2.4 IP core steganography model 2.5 Forensic detective control using hardware (IP core) steganography 2.5.1 Problem solved by hardware steganography 2.5.2 Steganography framework 2.5.3 Detection (extraction) of steganography 2.5.4 Demonstration 2.6 Design process of a steganography-embedded IP core: a case study on 8-point DCT 2.6.1 Pre-processing phase before steganography 2.6.2 Stego-constraints implantation phase 2.7 Security features of hardware steganography 2.7.1 Security properties 2.7.2 How does steganography handle threats and attacks? 2.8 Analysis of case studies 2.8.1 Security analysis 2.8.1.1 Comparison with the contemporary approach (hardware watermarking) for DSP cores 2.8.2 Design cost analysis 2.8.2.1 Comparison with the contemporary approach (hardware watermarking) for DSP cores 2.9 Conclusion 2.10 Questions and Exercises References 3 Forensic detective control using a digital signature–based watermark for IP core protection 3.1 Introduction 3.2 Threat models of an IP core 3.3 Selected contemporary approaches 3.3.1 Prior work on IP core protection using watermarking 3.3.2 Limitations of contemporary hardware watermarking approaches and advantages of digital signature–based watermarking 3.4 Security modules employed in digital signature–based watermarks 3.4.1 Crypto-hash function–SHA-512 3.4.2 Crypto-encryption function – RSA 3.5 Forensic detective control using a digital signature–based watermark 3.5.1 Digital signature framework 3.5.1.1 Equivalent bitstream generation of an IP core 3.5.1.2 Hash-digest generation 3.5.1.3 Conversion of hash digest into RSA compatible input 3.5.1.4 RSA encryption of hash-bitstream 3.5.1.5 Formation of digital signature representing a vendor watermark 3.5.1.6 Digital signature encoding 3.5.1.7 Digital signature embedding process 3.5.2 Detection process of digital signature–based watermarks 3.5.2.1 Signature-constraints' generation and mapping of storage variables to a register 3.5.2.2 Signature inspection 3.5.2.3 Signature verification 3.6 Case study on 8-point DCT used in image compression 3.6.1 Digital signature generation corresponding to an 8-point DCT core 3.6.2 Embedding of digital signature as watermark into the 8-point DCT core 3.7 Desirable properties of a digital signature–based watermark 3.7.1 High resiliency 3.7.2 Strong tamper tolerance 3.7.3 Low design overheads 3.7.4 Correct functionality 3.7.5 Low-signature embedding and detection time 3.8 Threat scenarios and their countermeasures using digital signature–based watermarks 3.8.1 Unauthorized signature-constraints insertion 3.8.2 Original signature tampering 3.8.3 Unintended signature-constraints extraction 3.9 Analysis based on case studies 3.9.1 Security analysis 3.9.2 Design cost analysis 3.10 Conclusion 3.11 Questions and exercises References 4 Protection of fault-secured IP cores using digital signature–based watermarks 4.1 Introduction 4.1.1 Background on different IP core threats and countermeasures 4.1.2 Brief description of fault security for IP cores 4.2 Threat model 4.3 Selected contemporary approaches 4.3.1 Discussion on similar approaches 4.4 Forensic detective control of fault-secured IP cores using digital signature–based watermarks 4.4.1 Input/output 4.4.2 Fault-secured DSP–IP cores protection framework 4.4.3 Signature detection process 4.5 Case study on a fault-secured, finite impulse response (FIR) filter 4.5.1 Constructing a transient fault secured DSP design 4.5.2 Generating the digital signature 4.5.3 Embedding the digital signature 4.6 Analysis of case studies – DSP cores 4.6.1 Security analysis 4.6.2 Design cost analysis 4.6.2.1 Comparison with baseline design in terms of storage hardware 4.7 Conclusion 4.8 Questions and exercises References 5 Multi-level watermark for IP protection 5.1 Introduction 5.2 Discussion on selected approaches 5.3 Salient features and advantages of multi-level watermarks 5.4 Embedding signatures as secret marks 5.4.1 Problem formulation 5.4.2 Details of multi-level watermarks 5.4.2.1 Overview of multi-level watermarks 5.4.2.2 Signature encoding 5.4.2.3 Signature embedding process 5.5 Design process of a multi-level watermarked IP core 5.6 Signature detection in a multi-level watermarked IP core 5.7 Analysis based on case studies 5.7.1 Security and design cost analyses 5.7.2 Comparative study 5.8 Conclusion 5.9 Questions and exercises References 6 Protecting the rights of an IP buyer using cryptosystem-based multivariable fingerprinting 6.1 Introduction 6.1.1 Fingerprinting vs watermarking 6.2 Selected contemporary fingerprinting approach at architectural level 6.2.1 Overview, threat model and encoding process 6.2.2 Embedding process 6.3 Overview of cryptosystem-based multivariable fingerprinting 6.4 Details of cryptosystem-based multivariable fingerprinting 6.4.1 Evaluation models used 6.4.1.1 Area model 6.4.1.2 Delay model 6.4.2 Fingerprinting methodology: pre-processing phase and demonstration 6.4.2.1 Pre-processing phase 6.4.2.2 Demonstration on DCT core 6.4.3 Fingerprinting methodology: selection of fingerprint and embedding process and demonstration 6.4.3.1 Choice of fingerprint and the decoding and embedding process 6.4.3.2 Demonstration on DCT core 6.5 Analysis of case studies 6.5.1 Security and design cost analysis 6.5.2 Comparative study 6.6 Conclusion 6.7 Questions and exercises References 7 Multi-phase obfuscation for fault-secured DSP circuits 7.1 Introduction 7.2 Functional obfuscation vs. structural obfuscation 7.3 Problem formulation 7.4 Discussion on selected approaches 7.5 Structural obfuscation of fault-secured DSP circuits 7.5.1 Overview 7.5.2 Evaluation models 7.5.2.1 Area model 7.5.2.2 Delay model 7.5.2.3 Cost function 7.5.3 Details of multi-phase obfuscation for fault-secured DSP circuits 7.5.3.1 Phase-1: Structural obfuscation using HLT and FUT 7.5.3.2 Fault-secured design process 7.5.3.3 Phase-2: structural obfuscation using FU reallocation and mux/demux reconfiguration 7.6 Demonstration of structural obfuscation of fault-secured DSP circuits 7.6.1 Demonstration of phase-1 obfuscation 7.6.2 Demonstration of fault-secured design process 7.6.3 Demonstration of phase-2 obfuscation 7.7 Analyses of case studies 7.7.1 Security analysis 7.7.2 Design cost analysis 7.8 Conclusion 7.9 Questions and exercises References 8 Hologram-based structural obfuscation for DSP cores 8.1 Introduction 8.2 Background on hologram 8.3 Applying hologram concept for structural obfuscation 8.4 Hologram-based obfuscation methodology 8.4.1 Features of hologram-based obfuscation (Sengupta and Rathor, 2019) 8.4.2 Threat model 8.4.3 Overview 8.4.4 Details of hologram-based obfuscation 8.5 Illustrative examples of hologram-based obfuscation for DSP cores 8.5.1 Case study of IIR–FIR filter obfuscated design 8.5.2 Case study of 4-point DCT–IDCT obfuscated design 8.6 Determination of gate count affected due to hologram-based obfuscation of DSP cores 8.7 Structural obfuscation of DSP cores (circuits) using high-level transformation (Sengupta et al., 2017a) 8.7.1 Example 1: 4-point DCT 8.7.2 Example 2: 8-point DCT 8.7.3 Example 3: 8-point IDCT 8.7.4 Example 4: FIR filter 8.7.5 Example 5: IIR filter 8.7.6 Example 6: 4-point IDCT 8.8 Design of non-obfuscated (baseline versions) DSP circuits 8.8.1 Example 1: 4-point DCT (Sengupta and Mohanty, 2019) 8.8.2 Example 2: 4-point IDCT 8.8.3 Example 3: 4-point DIT–FFT 8.8.4 Example 4: 8-point DIT–FFT 8.8.5 Example 5: 8-point DCT 8.8.6 Example 6: 8-point IDCT 8.8.7 Example 7: FIR filter 8.8.8 Example 8: IIR filter 8.9 Analyses of case studies 8.9.1 Strength of obfuscation analysis 8.9.2 Design area analysis 8.9.3 Design delay analysis 8.10 Conclusion 8.11 Questions and exercises References 9 Security of functionally obfuscated DSP cores 9.1 Introduction 9.2 Attack scenarios and threat models of functional obfuscation 9.3 Functional obfuscation of DSP cores 9.4 Selected approaches for securing functionally obfuscated DSP cores against removal attacks 9.4.1 Threat model 9.4.2 Discussion on selected approaches 9.4.2.1 Security of functionally obfuscated DSP core against removal attacks using custom AES-128–based ILBs–key generation hardware (Sengupta et al., 2019) 9.4.2.2 Security of functionally obfuscated DSP cores against removal attacks using custom SHA-512–based ILBs–key generation hardware (Sengupta and Rathor, 2019) 9.4.2.3 Security of a functionally obfuscated DSP core against removal attack using custom lightweight anti-removal logic unit (Rathor and Sengupta, 2019) 9.4.3 Demonstration of ILB structure reconfiguration 9.5 Analyses of case studies 9.5.1 Security analysis 9.5.1.1 Comparative study between obfuscated DSP core with custom SHA-512–based key encryption hardware vs. obfuscated DSP core with custom AES-128–based key encryption hardware 9.5.1.2 Comparative study between obfuscated DSP core with ARL unit vs. obfuscated DSP core with AES-128–based key encryption hardware 9.5.2 Design cost analysis: comparative study between obfuscated DSP core with SHA-512 vs. obfuscated DSP core with AES-128 9.5.3 Resource usage analysis: comparative study between obfuscated DSP cores with AES vs. obfuscated DSP cores with ARL unit 9.6 Conclusion 9.7 Questions and exercises References Index Back Cover