Field Programmable Gate Arrays FPGAs combine the programmability of processors with performance closer and closer to custom ASIC. In the last decade, they have reached a sufficient level of cost and performance to represent an attractive solution for low-volume sensitive military or commercial application. This opens a new key issue related with the “trustworthiness” of the deployed FPGA circuit since the conventional design process is vulnerable to malicious insertions commonly referred as Hardware Trojan that could, under specific conditions, result in functional changes and/or catastrophic failure of the sensitive application. In order to reduce the threat of tampering or Trojan injection, it is necessary to introduce the idea of trusted FPGA design for which circuits must perform only the functionality for which they were originally designed, no more and no less. This idea needs to be enforced during all the circuit life, from its design to its deployment on the application field. Intuitively, FPGAs are designed to change their functionality so this malleability introduces uniques vulnerabilities. The availability of on-chip security techniques such as cryptography can protect the underlying design against unauthorized copy but are not sufficient to immu- nize from malicious insertions. Moreover, other alternative security approaches available in literature are relatively inefficient since none of them covers all the possible vulnerabilities of the FPGA design/deployment. From these premises it follows that we need a more comprehensive trojan detection technique that covers all the circuit life. This need has provided the main motivation of this thesis work. An explicit trust-checking for FPGA circuits can guarantee with very high probability that the functionality is the one for which the circuit was originally designed, no more and no less. Moreover, the used technique must be functionality-based and must operate on-chip in order to detect any intentional tampering or Trojan insertion. This thesis is thus concerned with the design of trusted FPGA circuits adopting trust-checking mechanisms, an emerging area of research according to DARPA. The main contribution of this thesis work is the developing of a trust-checking technique called improved Fully Integrated Embedding (iFIE) where a 2D ECC parity mechanism (based on the ideas proposed) is placed and routed along with the original design. The underlying goal is to deploy a monolithic FPGA circuit which is capable of self-detecting tampers or Trojans without using partial dynamic reconfiguration, a feature which excludes bitstream encryption. Differently from the original technique introduced where partial dynamic reconfiguration is required, our on-chip functional-based iFIE approach combines trust- checking with bitstream encryption, an highly desirable combination for sensitive military or commercial application. We can obtain an efficient iFIE trust-checking logic implementation by the means of: •A modification of the structural 2D ECC parity scheme in order to avoid the use of some trust-checking components originally required. • An iFIE structure based on the idea of cones which reduces the hardware overhead related with ECC-based functional trust-checking. • An heuristic algorithm for generating and selecting cones in order to minimize the hardware overhead related with trust-checking architecture. • A second heuristic algorithm for generating and selecting cones according to delay performance considerations. Another contribution of this work is a novel challenge-response trust-checking protocol which overperforms the basic protocol presented in terms of guar- anteed probability. We propose a Reconfigurable Error Correcting Code (RecECC) parity scheme that changes its composition at any challenge, generating an astronomically large number of combinations and hiding the iFIE structure from malicious eyes. Moreover, this novel protocol does not require ciphered communications so the released FPGA area used for encryption/decryption can be used for the required hardware overhead.
Le Field Programmable Gate Array (FPGA) combinano la programmabilita` di un processore a prestazioni sempre piu` vicine a circuiti ASIC customizzati. Nell’ultimo decennio, le FPGA hanno raggiunto un livello di costo e prestazione tale da rappresentare una soluzione attraente per delicate applicazioni militari o commerciali caratterizzate da un basso volume di produzione. Questo genera un nuovo problema chiave relativo all’ attendibilita` del circuito FPGA presente nel campo operativo poiche` il convenzionale processo di design e` vulnerabile ad inserimenti di circuiti malevoli comunemente conosciuti come Hardware Trojan, i quali possono, sotto specifiche condizioni, portare a cambiamenti funzionali e/o fallimenti catastrofici per la delicata applicazione associata Al fine di ridurre il pericolo di alterazioni circuitali o inserimento di Trojan, risulta necessaria l’introduzione dell’idea di trusted FPGA design secondo cui un circuito deve svolgere solo la funzionalita` per cui esso e` stato originariamente progettato, niente di piu` e niente di meno. Questa idea deve essere fatta rispettare durante tutta la vita del circuito, dalla sua progettazione alla suo uso applicativo. Intuitivamente, le FPGA sono intrinsecamente progettate per cambiare la loro funzionalita` e ovviamente questa malleabilita` introduce delle vulnerabilita`. L’integrazione on-chip di crittografia o altri sistemi di sicurezza puo` proteggere contro copie non autorizzate del sottostante design circuitale ma risulta insufficiente per immunizzarsi da inserimenti di circuiti malevoli. Inoltre, altre tecniche alternative di sicurezza presenti in letteratura sono relativamente inefficienti poiche` nessuna di esse copre tutte le possibili vulnerabilita` presenti nel ciclo di vita di un circuito basato su FPGA. Da queste premesse deriva la necessita` di una tecnica per il rilevamento di Trojan piu` comprensiva in modo tale che copra tutto il ciclo di vita del circuito. Da questa necessita` scaturisce poi la principale motivazione per questo lavoro di tesi. Un trust-checking esplicito per circuiti basati su FPGA puo` garantire con probabilita` molto alta che la funzionalita` sia quella per cui i circuiti sono stati originariamente progettati. Inoltre, la tecnica utilizzata deve essere basata sulla funzionalita` e deve operare on-chip in modo tale da poter rilevare ogni alterazione intenzionale o inserimento di Trojan. Questa tesi si preoccupa quindi del proget- to di trusted FPGA circuits adottando un meccanismo di trust-checking, un area emergente di ricerca secondo DARPA. Il contributo principale di questo lavoro di tesi e` lo sviluppo di un tecnica di trust-checking chiamata improved Fully Integrated Embedding (iFIE) in cui un meccanismo di parita` 2D ECC (basato sull’idee proposte) risulta placed- and-routed accanto al circuito originale. L’obiettivo sottostante e` di distribuire un circuito FPGA monolitico che sia capace di auto-rilevare alterazioni o Trojan senza l’uso di riconfigurazione dinamica parziale, una caratteristica che se usata esclude la possibilita` di bitstream encryption. Diversamente dalla tecnica originale introdotta in dove la riconfigurazione dinamica parziale e` necessaria, il nostro approccio funzionale on-chip iFIE combina trust-checking e bitstream encryption, una combinazione desiderabile in delicate applicazioni militari o commerciali. Possiamo poi ottenere un’ efficiente implementazione per l’architettura iFIE di trust-checking grazie a: • Una modifica dello schema strutturale di parita` 2D ECC in modo tale da evitare l’uso di alcuni componenti originariamente richiesti. • Una nuova struttura iFIE basata sull’idea di coni capace di ridurre l’ hardware overhead associato con l’architettura di trust-checking. • Un algoritmo euristico per la generazione e la selezione di coni in modo tale da minimizzare l’hardware overhead. • Un secondo algoritmo euristico per la generazione e la selezione di coni con considerazioni riguardanti le prestazioni. Un altro contributo di questo lavoro e` una nuovo protocollo richiesta-risposta di trust-checking che supera il protocollo base presentato in termini di probabilita` garantita. Viene quindi proposto uno schema di parita` Reconfigurable Error Correcting Code (RecECC) che cambia la sua composizione ad ogni richiesta, generando un numero astronomico di combinazioni e nascondendo la struttura iFIE da occhi malevoli. Inoltre, questo nuovo protocollo non richiede comunicazioni cifrate cosı` l’area usata per implementare le funzioni di encryption/decryption puo` venire tranquillamente riutilizzata per l’hardware overhead associato all’architettura iFIE.
Trojan-free FPGA circuits using ECC-based functional trust-checking
MAGGIONI, MARCO
2009/2010
Abstract
Field Programmable Gate Arrays FPGAs combine the programmability of processors with performance closer and closer to custom ASIC. In the last decade, they have reached a sufficient level of cost and performance to represent an attractive solution for low-volume sensitive military or commercial application. This opens a new key issue related with the “trustworthiness” of the deployed FPGA circuit since the conventional design process is vulnerable to malicious insertions commonly referred as Hardware Trojan that could, under specific conditions, result in functional changes and/or catastrophic failure of the sensitive application. In order to reduce the threat of tampering or Trojan injection, it is necessary to introduce the idea of trusted FPGA design for which circuits must perform only the functionality for which they were originally designed, no more and no less. This idea needs to be enforced during all the circuit life, from its design to its deployment on the application field. Intuitively, FPGAs are designed to change their functionality so this malleability introduces uniques vulnerabilities. The availability of on-chip security techniques such as cryptography can protect the underlying design against unauthorized copy but are not sufficient to immu- nize from malicious insertions. Moreover, other alternative security approaches available in literature are relatively inefficient since none of them covers all the possible vulnerabilities of the FPGA design/deployment. From these premises it follows that we need a more comprehensive trojan detection technique that covers all the circuit life. This need has provided the main motivation of this thesis work. An explicit trust-checking for FPGA circuits can guarantee with very high probability that the functionality is the one for which the circuit was originally designed, no more and no less. Moreover, the used technique must be functionality-based and must operate on-chip in order to detect any intentional tampering or Trojan insertion. This thesis is thus concerned with the design of trusted FPGA circuits adopting trust-checking mechanisms, an emerging area of research according to DARPA. The main contribution of this thesis work is the developing of a trust-checking technique called improved Fully Integrated Embedding (iFIE) where a 2D ECC parity mechanism (based on the ideas proposed) is placed and routed along with the original design. The underlying goal is to deploy a monolithic FPGA circuit which is capable of self-detecting tampers or Trojans without using partial dynamic reconfiguration, a feature which excludes bitstream encryption. Differently from the original technique introduced where partial dynamic reconfiguration is required, our on-chip functional-based iFIE approach combines trust- checking with bitstream encryption, an highly desirable combination for sensitive military or commercial application. We can obtain an efficient iFIE trust-checking logic implementation by the means of: •A modification of the structural 2D ECC parity scheme in order to avoid the use of some trust-checking components originally required. • An iFIE structure based on the idea of cones which reduces the hardware overhead related with ECC-based functional trust-checking. • An heuristic algorithm for generating and selecting cones in order to minimize the hardware overhead related with trust-checking architecture. • A second heuristic algorithm for generating and selecting cones according to delay performance considerations. Another contribution of this work is a novel challenge-response trust-checking protocol which overperforms the basic protocol presented in terms of guar- anteed probability. We propose a Reconfigurable Error Correcting Code (RecECC) parity scheme that changes its composition at any challenge, generating an astronomically large number of combinations and hiding the iFIE structure from malicious eyes. Moreover, this novel protocol does not require ciphered communications so the released FPGA area used for encryption/decryption can be used for the required hardware overhead.| File | Dimensione | Formato | |
|---|---|---|---|
|
2010_07_Maggioni.pdf
accessibile in internet per tutti
Descrizione: Testo della Tesi
Dimensione
2.13 MB
Formato
Adobe PDF
|
2.13 MB | Adobe PDF | Visualizza/Apri |
I documenti in POLITesi sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
https://hdl.handle.net/10589/2217