Developing Trustworthy Hardware with Security-Driven Design and Verification
Total Page:16
File Type:pdf, Size:1020Kb
Developing Trustworthy Hardware with Security-Driven Design and Verification by Timothy D. Trippel A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy (Computer Science and Engineering) in The University of Michigan 2021 Doctoral Committee: Assistant Professor Matthew Hicks, Co-Chair, Virginia Tech Professor Kang G. Shin, Co-Chair Research Professor Peter Honeyman Assistant Professor Baris Kasikci Professor Euisik Yoon Timothy D. Trippel [email protected] ORCID iD: 0000-0002-3448-6868 © Timothy D. Trippel 2021 To my parents, Christine and Terrence. And to my siblings, Caroline and Christopher. ii ACKNOWLEDGEMENTS As my time as a Michigan graduate is student is coming to an end, I reflect on the people in my life that partook in making this experience both possible and exciting. First I would like to thank my advisor, Professor Kang G. Shin. While I did not start the Ph.D. program as a student in his lab, Professor Shin took a chance on me. He taught me the value of perseverance, and has kept me motivated throughout my studies. I would also like to thank my co-advisor, Matthew Hicks, for his support and mentor- ship throughout my academic career. I first met Matt when he was finishing his position as a post-doc at Michigan. During his first year as research staff at MIT Lincoln Laboratory, Matt convinced me to due a summer internship in his group. Little did I know, that intern- ship would set the path for the remainder of my dissertation work. Matt has always kept my best interests in mind, and has taught me how to become a successful researcher. Thank you to my remaining committee members—Baris Kasikci, Peter Honeyman, and Eusik Yoon—for their feedback and support. A special thank you to Peter Honeyman for always being available to chat, and guiding me through the ups and downs of graduate school. I will miss his end-of-term celebrations, and seeing him out around Ann Arbor. Thank you to my high school and undergraduate mentors who sparked my interests in scientific research and engineering. A special thank you to Matt Champion from the University of Notre Dame who gave me an early glimpse of academic research as a high school student. Through various successful science fair projects Matt sparked my creativity in engineering and always held me to a high standard. Additionally, I want to thank Cheng- kok Koh and David Meyer from Purdue University that gave me opportunities to continue iii pursuing scientific research and teaching during my time as undergraduate student. Without them, I would have never pursued graduate school to begin with. Thank you to Kevin Bush, my supervisor and close mentor at MIT Lincoln Labora- tory. I first met Kevin when I came to work in his group at Lincoln with Matt Hicks. The internship was such a success I decided to do two more during my graduate studies. Kevin’s support both academically and professionally has directly contributed to the suc- cess of many projects in my dissertation. I would also like to thank my industry mentors at Google—Alex Chernyakovsky, Garret Kelly, and Dominic Rizzo—for giving me the op- portunity to apply my research ideas to real-world commercial products, and for a great virtual internship experience, during unprecedented pandemic times. I would like to extend a thank you to my early lab mates, Ofir Weisse and Jeremy Erickson, who helped guide me early in the program, and have provided me countless hours of advice as I transition to the next chapter of my career. Additionally, thank you to all RTCL lab members who overlapped with me during my time at Michigan, especially, Kassem Fawaz, Eugene Kim, Yu-Chih Tung, Kyong Tak Cho, Youngmoon Lee, Hamed Yousefi, Arun Ganesan, Dongyao Chen, Chun-Yu Chen, Taeju Park, Mert Pese,´ Duc Bui, Juncheng Gu, Jinkyu Lee, Haichuan Ding, Youssef Tobah, Hsun-Wei Cho, Noah Curran, and Wei-Lun Huang. Additionally, thanks to all the friends I made at Michigan, especially my house mates and colleagues: Alejandro, Alex, Becky, Ian, Jonathan, Jule, Lauren, Max, Mo, and Richard. You made these years fly by with delicious food and good times. Thanks to my Grandma (June) and Grandpa (Ed) Garrow, and Grandma (Angie) and Grandpa (Jim) Trippel, for being supportive of me and watching me every summer as I grew up. I know if you were all still alive, you would be very proud of what I have accomplished. Thanks to my Uncle Bob (UB), Aunt Paula (AP), and my cousins Matthew and Sarah for being my second family and hosting me during my numerous summer internships in the Boston area. Thanks for all your support and encouragement and for making me feel at iv home every summer. I always looked forward to spending summers on the Cape, enjoying countless hours of boating, golfing, and eating. Thanks to my older sister, Caroline, and younger brother Christopher. You are the best siblings I could ever ask for. Thank you for sparking my competitive edge that keeps me motivated and brings out the best in myself. You give me someone to look up to, and always set the bar high. Most importantly, thank you to my parents, Christine and Terrence who have instilled in me the values of perseverance and education from a young age. You taught me I could do anything and become anyone if I put my mind to it, and always encouraged me to take on tough challenges. Thank you for always ensuring I got the best education, and for signing me up for piano and golf lessons. These activities taught me how to focus and never give up. Thank you for exposing me to computers and electronics at a young age and encouraging me to pursue my interests in science and technology. Lastly, thank you for teaching how to enjoy life through cooking and sharing good food, something my house mates and I have continued throughout graduate school. Additionally, thank you Lauren for being my best friend, and biggest fan. Your hard work and perseverance through your teaching inspires me everyday. Thanks for keeping me active and encouraging me to try new things through our numerous bike rides, ski trips, hikes, and dining endeavors across Michigan. You make time fly by, and I can’t wait for our next adventure. Lastly, thank you to the several funding agencies that supported the work described in this dissertation, including: 1) the Under Secretary of Defense for Research and En- gineering under Air Force Contract No. FA8702-15-D-0001, 2) the US National Science Foundation under Grant CNS-1646130, 3) the National Science Foundation Graduate Re- search Fellowship Program under Grant No. DGE 1256260, 4) the US Army Research Office under Grant W911NF-21-1-0057, and 5) the Defense Advanced Research Projects Agency. Any opinions, findings, and conclusions or recommendations expressed in this v dissertation are those of the author and do not necessarily reflect the views of the funding agencies. vi TABLE OF CONTENTS DEDICATION ::::::::::::::::::::::::::::::::::: ii ACKNOWLEDGEMENTS :::::::::::::::::::::::::::: iii LIST OF FIGURES :::::::::::::::::::::::::::::::: xii LIST OF TABLES ::::::::::::::::::::::::::::::::: xx LIST OF APPENDICES :::::::::::::::::::::::::::::: xxi LIST OF ABBREVIATIONS ::::::::::::::::::::::::::: xxii ABSTRACT ::::::::::::::::::::::::::::::::::::: xxv CHAPTER I. Introduction .................................1 1.1 Motivation . .1 1.2 Hardware Development Trends . .2 1.3 Research Challenges & Thesis Statement . .2 1.4 Dissertation Contributions . .3 1.4.1 Security-Driven (Layout) Design . .3 1.4.2 Security-Driven (RTL) Verification . .4 1.5 Road Map . .5 II. Background .................................6 2.1 IC Design Process . .6 2.2 Hardware Trojans . .7 2.2.1 Trojan Trigger . .7 2.2.2 Trojan Payload . .8 2.3 Threat Models . .8 2.3.1 Fabrication-Time Attacks . .8 2.3.2 Design-Time Attacks . 10 vii III. ICAS ..................................... 11 3.1 Introduction . 11 3.2 Background . 14 3.2.1 IC Layouts . 14 3.2.2 Fabrication-Time Trojan Implementations . 15 3.3 Threat Model . 16 3.4 Untrusted Foundry Defenses . 17 3.4.1 Undirected . 18 3.4.2 Directed . 18 3.5 Unified Attack Metrics . 19 3.5.1 Challenges of Trojan Placement . 19 3.5.2 Challenges of Victim/Trojan Integration . 20 3.5.3 Challenges of Intra-Trojan Routing . 23 3.6 Extensible Coverage Assessment Framework . 24 3.6.1 Nemo . 25 3.6.2 GDSII-Score . 28 3.7 Evaluation . 32 3.7.1 Experimental Setup . 33 3.7.2 Undirected Defense Coverage . 35 3.7.3 Directed Defense Coverage . 41 3.8 Discussion . 43 3.8.1 ICAS-Driven Defensive Layout . 43 3.8.2 Constrained Security Metrics . 44 3.8.3 Extensibility of Security Metrics . 44 3.8.4 Extensibility of CAD Tools . 44 3.8.5 Extensibility of Process Technologies . 45 3.8.6 Limitations . 45 3.8.7 Justification for Metrics . 46 3.9 Related Work . 47 3.9.1 Untrusted-foundry Attacks . 47 3.9.2 Untrusted-foundry Defenses . 47 3.10 Conclusion . 48 3.11 Citation . 49 IV. T-TER .................................... 50 4.1 Introduction . 50 4.2 Background . 54 4.2.1 Fabrication-Time Attack Steps . 54 4.2.2 Layout-Level Defenses. 54 4.2.3 Time-Domain Reflectometry (TDR) . 55 4.2.4 IC Interconnect Models . 55 4.2.5 TDR for IC Fault Analysis . 56 viii 4.3 Threat Model . 57 4.4 Targeted Tamper-Evident Routing (T-TER) . 58 4.4.1 Identifying Security-Critical Nets to Guard . 58 4.4.2 Guard Wire Bypass Attacks . 59 4.4.3 Tamper-Evident Guard Wires . 59 4.5 Implementation . 62 4.5.1 Place-&-Route Process . 62 4.5.2 Automated Toolchain . 63 4.6 Evaluation .