研究生: |
吳思妍 Wu, Ssu-Yen |
---|---|
論文名稱: |
應用於記憶體安全性之邏輯混淆方法 A Logic Obfuscation Scheme for Memory Security |
指導教授: |
張孟凡
Chang, Meng-Fan |
口試委員: |
洪浩喬
邱瀝毅 謝志成 |
學位類別: |
碩士 Master |
系所名稱: |
電機資訊學院 - 電機工程學系 Department of Electrical Engineering |
論文出版年: | 2019 |
畢業學年度: | 108 |
語文別: | 英文 |
論文頁數: | 46 |
中文關鍵詞: | 吳思妍 、記憶體 、安全 、邏輯混淆 、反向工程 、磁性記憶體 |
外文關鍵詞: | Wu, Ssu-Yen, memory, security, logic obfuscation, reverse engineering, MRAM |
相關次數: | 點閱:2 下載:0 |
分享至: |
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報 |
隨著半導體供應鏈的全球化,它帶來了越來越大的安全和隱私風險。其中兩個主要問題中,大多數是通過反向工程對電路的惡意修改以及IP被盜用。因此,邏輯混淆是可以阻止惡意的製造廠進行逆向工程的研究目標。
即使我們向攻擊者洩漏出了部分的設計,邏輯混淆是阻止這類攻擊的其中的一種方法。目前邏輯混淆技術是最流行的積體電路中保護技術之一。在本篇論文的設計概念是在記憶體內增加一些電路,使我們的記憶體電路具有邏輯混淆性。假如使用錯誤的密鑰來操作此電路,將會得到錯誤的資訊。因此,即使攻擊者透過逆向工程提取電路來竊取具有價值資訊的設計,我們也可以運用邏輯混淆來保護信息。
本篇論文提出一種用磁性記憶體為基礎之預解碼器邏輯混淆來保護記憶體內內容,這可以防止反向工程把電路反推出來。本文使用邏輯混淆來實現記憶體的地址被打亂。除此之外,在本文中提出的操作可以通過不需要多增加腳位的方式來執行此記憶體,其中包含寫密鑰模式和一般安全模式。
透過二十二奈米之邏輯製程技術,本篇論文實現了1Mb之基於磁性記憶體的預解碼器邏輯混淆。對於測量結果,與先前傳統電路相比,在安全模式下,本文的操作速度僅比ㄧ般記憶體模式下增加了1.96%。不過我們達到防止反向攻擊以及暴力破解法之攻擊。在安全模式下,本篇論文達到了0.9ns的量測讀取速度於零點八伏特之操作電壓下
With the globalization of the IC supply chain, it introduces increasing privacy risks and security. Most of important things are IP theft that can through reverse engineering technique and the design modified by malicious foundry. Therefore, logic obfuscation is the research target that can help to thwart reverse engineering by malicious foundries.
Logic obfuscation is one way to thwart reverse engineering, even though we disclose a partially ambiguous circuit to attackers. The logic obfuscation technique is one technique for popular IC protections. The design concept is adding some circuits in the memory, makes our circuit with logic obfuscation. If we use the wrong key to operate the function, we will get the fault result. Therefore, even though someone extracts a netlist the design to steal the valuable information by reverse engineering, we can use the logic obfuscation method to protect the information.
Here, we propose a pre-decoder based on MRAM to protect memory content, which can prevent reverse engineering to reverse the circuit. This circuit use logic obfuscation to achieve memory addresses scrambling. In addition, the proposed scheme operation can execute by special operation mode which does not need more pins to operate the mode including Write-key mode and Security-normal mode.
Based on 22nm CMOS logic process, we fabricate a 1Mb a pre-decoder logic obfuscation based on MRAM. This work only increases 1.96% in Security mode respectively than Normal mode. But we defense reverse engineering attack and brute force attack. For the measurement results, this work achieves 3.32ns at VDD=0.8V measured access time in Security mode.
[1] K. Itoh et al., “VLSI Memory Chip Design”, Springer-Verlag, pp. 1-46, 2001.
[2] ITRS, “2001 Technology Roadmap For Semiconductors,” IEEE Computer, vol. 35, issue 1, pp. 42–53, Jan. 2002.
[3] F. Menichelli et al., “Static Minimization of Total Energy Consumption in Memory Subsystem for Scratchpad-Based Systems-on-Chips,” IEEE Transactions on Very Large Scale Integration Systems, vol. 17, issue 2, pp. 161-171, Jan. 2009.
[4] H. Qin, et al., “SRAM leakage suppression by minimizing standby supply voltage,” in IEEE International Symposium on Quality Electronic Design, pp. 55-60, 2004.
[5] K. Nii, et al., “A Low Power SRAM using Auto-Backgate-Controlled MT-CMOS,”in IEEE International Symposium on Low Power Electronics and Design, pp. 293-298, Aug. 1998.
[6] C. Morishima, et al., “A 1-V 20-ns 512-Kbit MT-CMOS SRAM with Auto-Power-Cut Scheme Using Dummy Memory Cells,”in IEEE European Solid-State Circuit Conference , pp. 452-455, Sept. 1998.
[7] A. G. Hanlon et al., “Content-Addressable and Associative Memory Systems a Survey,” IEEE Transactions on Electronic Computers, vol. EC-15, no.4, pp.509-521, Aug. 1966.
[8] C. C. Wang et al., “An Adaptively Dividable Dual-Port BiTCAM for Virus-Detection Processors in Mobile Devices,” IEEE International Solid-State Circuits Conference (ISSCC), pp.390-622, Feb. 2008.
[9] J. Li et al., “1 Mb 0.41 µm² 2T-2R Cell Nonvolatile TCAM With Two-Bit Encoding and Clocked Self-Referenced Sensing,” IEEE Journal of Solid-State Circuits (JSSC), vol. 49, Issue 4, pp. 896-907, Apr. 2014.
[10] M. F. Chang et al., “A 3T1R Nonvolatile TCAM Using MLC ReRAM with Sub-1ns Search Time,” IEEE International Solid-State Circuits Conference (ISSCC), pp. 1-3, Feb. 2015.
[11] D. Smith et al., “A 3.6ns 1Kb ECL I/O BiCMOS U.V. EPROM,” IEEE International Symposium on Circuits and Systems (ISCAS), vol. 3, pp. 1987-1990, May. 1990.
[12] C. Kuo et al., “A 512-kb flash EEPROM embedded in a 32-b microcontroller,” IEEE Journal of Solid-State Circuits (JSSC), vol. 27, Issue 4, pp. 574-582, Apr. 1992.
[13] S. H. Kulkarni et al., “A 4 kb Metal-Fuse OTP-ROM Macro Featuring a 2 V Programmable 1.37 μm2 1T1R Bit Cell in 32 nm High-k Metal-Gate CMOS,” IEEE Journal of Solid-State Circuits (JSSC), vol. 45, Issue 4, pp. 863-868, Apr. 2010.
[14] Y. H. Tsai et al., “45nm Gateless Anti-Fuse Cell with CMOS Fully Compatible Process,” IEEE International Electron Devices Meeting (IEDM), pp. 95-98, Dec. 2007.
[15] Webfeet Inc., “Semiconductor industry outlook,” Non-Volatile Memory Conference, 2002.
[16] S. L. Min et al., “Current trends in flash memory technology,” IEEE Asia and South Pacific Conference on Design Automation, pp. 24-27, Jan. 2006.
[17] F. Masuoka et al., “New ultra high density EPROM and flash EEPROM with NAND structure cell,” IEEE International Electron Devices Meeting (IEDM), vol. 33, pp. 552-555, 1987.
[18] A. Bergemont et al., “NOR virtual ground (NVG)-a new scaling concept for very high density flash EEPROM and its implementation in a 0.5 um process,” IEEE International Electron Devices Meeting (IEDM), pp. 15-18, Dec. 1993.
[19] Jeyavijayan Rajendran et al., “Security Analysis of Integrated Circuit Camouflaging.” ACM Conf. on Computer & Communications Security. 709–720
[20] R. Torrance et al., “The State-of-the-Art in Semiconductor Reverse Engineering,” ACM/EDAC/IEEE Design Automation Conference (DAC), pp. 5-9, 2011
[21] Shahed E Quadir et al., “ A survey on chip to system reverse engineering,” ACM J. on Emerging Technologies in Computing Systems, 13, 1 (2016), 6:1–6:34.
[22] J. Rajendran et al., “Is split manufacturing secure?” DATE, 2013.
[23] Meng Li et al., “ A practical split manufacturing framework for Trojan prevention via simultaneous wire lifting and cell insertion,” Asia and South Pacific Design Automation Conf. 265–270, 2018.
[24] Ronald P. Cocchi et al., “ Circuit Camouflage Integration for Hardware IP Protection,” IEEE/ACM Design Automation Conf. Article 153, 5 pages, 2014
[25] Meng Li, et al., “ Provably Secure Camouflaging Strategy for IC Protection,” Int. Conf. on Computer Aided Design. Article 28, 8 pages, 2016
[26] G. T. Becker et al., “Stealthy dopant-level hardware Trojans: Extended version,” J. Cryptograph. Eng., vol. 4, no. 1, pp. 19–31, 2014.
[27] L.-W. Chow, et al., “ Integrated circuits protected against reverse engineering and method for fabricating the same using an apparent metal contact line terminating on field oxide,” U.S. Patent 7 294 935, Nov. 13, 2007.
[28] S. Malik, et al., “Development of a layout-level hardware obfuscation tool,” IEEE Annu. Symp. VLSI, 2015, pp. 204–209
[29] Y.-W. Lee and N. A. Touba, “Improving logic obfuscation via logic cone analysis,” IEEE Latin–Amer. Test Symp., 2015, pp. 1–6.
[30] J. Zhang et al., “A Practical Logic Obfuscation Technique for Hardware Security,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, pp. 1193-1197, 2015
[31] J. A. Roy et al., “EPIC: Ending piracy of integrated circuits,” in Proc. Design, Autom. Test Eur, pp. 1069-1074, 2008
[32] J. C. S. Kools, "Exchange-biased spin-valves for magnetic storage," in IEEE Transactions on Magnetics, vol. 32, no. 4, pp. 3165-3184, Jul 1996.
[33] S. Tehrani, J. M. Slaughter, E. Chen, M. Durlam, J. Shi and M. DeHerren, "Progress and outlook for MRAM technology," in IEEE Transactions on Magnetics, vol. 35, no. 5, pp. 2814-2819, Sep 1999.
[34] S. Tehrani et al., "Recent developments in magnetic tunnel junction MRAM," in IEEE Transactions on Magnetics, vol. 36, no. 5, pp. 2752-2757, Sep 2000.
[35] K. C. Chun, H. Zhao, J. D. Harms, T. H. Kim, J. P. Wang and C. H. Kim, "A Scaling Roadmap and Performance Evaluation of In-Plane and Perpendicular MTJ Based STT-MRAMs for High-Density Cache Memory," in IEEE Journal of Solid-State Circuits, vol. 48, no. 2, pp. 598-610, Feb. 2013.
[36] Alexander Driskill-Smith, "New Samsung Open Innovation Program For STT-MRAM Technology - An Interview With Alexander Driskill-Smith" AZO Materials Sep, 2013
[37] E. Seevinck et al., "Static-noise margin analysis of MOS SRAM cells," in IEEE Journal of Solid-State Circuits, vol. 22, pp. 748-754, Oct. 1987.
[38] A. Agarwal, et al., "A 320mV-to-1.2V On-Die Fine-Grained Reconfigurable Fabric for DSP/Media Accelerators in 32nm CMOS,"in IEEE International Solid-State Circuits Conference, pp. 328-329, Feb. 2010.
[39] M. Wieckowski, et al., "A portless SRAM Cell using stunted wordline drivers," in IEEE International Symposium on Circuits and Systems, pp. 584-587, 2008.
[40] M. Wieckowski, et al., "Portless SRAM-A High-Performance Alternative to the 6T Methodology," in IEEE Journal of Solid-State Circuits, vol. 42, pp. 2600-2610, Nov. 2007.
[41] R. Alves Fonseca, et al., "On Using Address Scrambling to Implement Defect Tolerance in SRAMs," in IEEE International Test Conference, pp. 20-22, Sept. 2011.
[42] Jacques J.A. Fournier, et al., "Memory address scrambling revealed using fault attacks," in IEEE Workshop on Fault Diagnosis and Tolerance in Cryptography, pp. 21-21, Aug. 2010.
[43] Ad. J. van de Goor, et al., "Address and Data Scrambling: Causes and Impact on Memory Tests," in IEEE International Workshop on Electronic Design, Test and Applications, pp. 29-31, Jan. 2002.
[44] K. Xiao, et al., "Hardware trojans: Lessons learned after one decade of research". ACM Transactions on Design Automation of Electronic Systems (TODAES), 22(1):6, 2016
[45] Kaveh. Shamsi, et al., “Cyclic Obfuscation for Creating SAT-Unresolvable Circuits”. In IEEE Great Lakes Symp. on VLSI, 2017