Producing Trustworthy Hardware Using Untrusted Components, Personnel and Resources
Creators: Waksman, Adam
Publisher: name: Columbia University
Year: 2014
Subjects: Computer science

description: Computer security is a full-system property, and attackers will always
      go after the weakest link in a system. In modern computer systems,
      the hardware supply chain is an obvious and vulnerable point of
      attack. The ever-increasing complexity of hardware systems, along with
      the globalization of the hardware supply chain, has made it unreasonable
      to trust hardware. Hardware-based attacks, known as backdoors, are easy
      to implement and can undermine the security of systems built on top of
      compromised hardware. Operating systems and other software can only be
      secure if they can trust the underlying hardware systems.
      The full supply chain for creating hardware includes multiple processes,
      which are often addressed in disparate threads of research, but which we
      consider as one unified process. On the front-end side, there is the soft
      design of hardware, along with validation and synthesis, to ultimately
      create a netlist, the document that defines the physical layout of
      hardware. On the back-end side, there is a physical fabrication process,
      where a chip is produced at a foundry from a supplied netlist, followed
      in some cases by post-fabrication testing. Producing a trustworthy chip
      means securing the process from the early design stages through to the
      post-fabrication tests.
      We propose, implement and analyze a series of methods for making
      the hardware supply chain resilient against a wide array of known and
      possible attacks. These methods allow for the design and fabrication of
      hardware using untrustworthy personnel, designs, tools and resources,
      while protecting the final product from large classes of attacks, some
      known previously and some discovered and taxonomized in this work.
      The overarching idea in this work is to take a full-process view of
      the hardware supply chain. We begin by securing the hardware design and
      synthesis processes uses a defense-in-depth approach.  We combine this
      work with foundry-side techniques to prevent malicious modifications
      and counterfeiting, and finally apply novel attestation techniques to
      ensure that hardware is trustworthy when it reaches users.
      For our design-side security approach, we use defense-in-depth
      because in practice, any security method can potentially subverted, and
      defense-in-depth is the best way to handle that assumption. Our approach
      involves three independent steps. The first is a functional analysis
      tool (called FANCI), applied statically to designs during the coding and
      validation stages to remove any malicious circuits. The second step is
      to include physical security circuits that operate at runtime. These
      circuits, which we call trigger obfuscation circuits, scramble data at
      the microarchitectural level so that any hardware backdoors remaining in
      the design cannot be triggered at runtime. The third and final step is to
      include a runtime monitoring system that detects any backdoor payloads
      that might have been achieved despite the previous two steps. We design
      two different versions of this monitoring system. The first, TrustNet, is
      extremely lightweight and protects against an important class of attacks
      called emitter backdoors. The second, DataWatch, is slightly more heavyweight
      (though still efficient and low overhead) that can catch a wider variety
      of attacks and can be adapted to protect against nearly any type of
      digital payload. We taxonomize the types of attacks that are possible
      against each of the three steps of our defense-in-depth system and show
      that each defense provides strong coverage with low (or negligible)
      overheads to performance, area and power consumption.
      For our foundry-side security approach, we develop the first foundry-side
      defense system that is aware of design-side security. We create a
      power-based side-channel, called a beacon. This beacon is essentially a
      benign backdoor. It can be turned on by a special key (not provided to
      the foundry), allowing for security attestation during post-fabrication
      testing. By designing this beacon into the design itself, the beacon
      requires neither keys nor storage, and as such exists in the final chip
      purely by virtue of existing in the netlist. We further obfuscate the
      netlist itself, rendering the task of reverse engineering the beacon
      (for a foundry-side adversary) intractable. Both the inclusion of the
      beacon and the obfuscation process add little to area and power costs
      and have no impact on performance.
      All together, these methods provide a foundation on which hardware
      security can be developed and enhanced. They are low overhead and
      practical, making them suitable for inclusion in next generation
      hardware. Moving forward, the criticality of having trustworthy hardware
      can only increase. Ensuring that the hardware supply chain can be trusted
      in the face of sophisticated adversaries is vital. Both hardware design
      and hardware fabrication are increasingly international processes, and
      we believe continuing with this unified approach is the correct path
      for future research. In order for companies and governments to place
      trust in mission-critical hardware, it is necessary for hardware to be
      certified as secure and trustworthy. The methods we propose can be the
      first steps toward making this certification a reality.