Emerging Hardware Security Technologies

Abstract

Various emerging technologies provide the potential for advancing the development of hardware security concepts. A review of some emerging technologies includes spintronics, memristors, carbon nanotubes and related transistors, nanowires and related transistors, as well as 3D and 2.5D integration. These emerging devices share some interesting characteristics that are difficult to achieve with traditional CMOS technology. This article discusses the applications of emerging hardware security technologies in enhancing hardware security and outlines the associated challenges.

Keywords: hardware security, spintronics, memristors, carbon nanotubes, nanowire transistors, 3D integration, 2.5D integration, reverse engineering, tampering

1. Introduction

Figure 1 shows the emerging hardware security technologies discussed in this article, along with the characteristics related to hardware security that are beneficial for hardware security, the corresponding security solutions, and the security threats that these solutions address.

Figure 1

2. Emerging Devices

The emerging devices share some interesting characteristics that are difficult to achieve with traditional CMOS technology. More specifically, spintronics, memristors, carbon nanotube transistors, and NWFET can be customized to include significant variability, randomness, reconfigurability, polymorphic behavior, resilience against reverse engineering, and may also be used to separate trusted and untrusted components (the latter through split manufacturing). Therefore, these devices can effectively serve in PUF, TRNG, and IP protection schemes while shielding against side-channel leakage. Additionally, memristors can provide anti-tamper resilience through destructive data management.

The practical implementation prospects of security solutions based on emerging devices depend on various aspects, from general circuit design and security analysis to manufacturing capabilities and device maturity, among others. Other papers have also reviewed emerging devices in the context of hardware security, see for example [1-3].

2.1 Spintronics

Current research has proposed polymorphic behavior and/or reconfigurability for IP protection. For instance, Alasad et al. [4] used all-spin logic for camouflage. However, they proposed some uniquely device-specific primitive layouts that can be easily distinguished in image-based reverse engineering. Moreover, their primitive energy consumption is relatively high, with ns-range delays consuming around 350µW. In [5], the authors introduced a reconfigurable lookup table (LUT) based on spintronics, aimed at design obfuscation. However, these methods may not meet expectations in terms of resilience against SAT attacks. It is also noteworthy that this approach conceptually resembles the use of traditional field-programmable gate arrays (FPGAs) for design obfuscation. In [7] and [6,8], polymorphic and fuzzy logic were studied based on domain wall motion devices and giant spin Hall effect (GSHE) devices, respectively. The latter logic study has significant advantages over the former in that each of their devices supports all 16 possible functions; this makes these devices superior in SAT resilience compared to others.

In [9], the concept of “dynamic camouflage” based on polymorphic electromagnetic spin-orbit (MESO) devices was proposed. Unlike conventional camouflage, this concept can also protect against “adversaries” in manufacturing and testing facilities, as the true functionality is only configured in a later polymorphic fabric. Thus, “dynamic camouflage” is conceptually similar to logic locking. However, unlike locking, achieving this security does not require additional devices or gates.

It is noted that spintronics can provide some resilience against side-channel attacks. For example, the magnetoelectric switches of these devices do not emit photons, which can first eliminate related attacks. Since spintronics used for logic, fault injection based on magnetic field or temperature curves, and side-channel attacks may be more challenging to implement, this differs from spintronics used for memory. Furthermore, in [10], the authors used spintronics to construct polymorphic circuits and different circuit templates, randomly switching at runtime to shield power side channels.

In [11], the authors advocated for manufacturing nanowires in PUF’s domain wall memory. In [12], the authors leveraged the inherent random spin switching mechanism of nanomagnets in TRNG. Through device-level simulations, they demonstrated that their TRNG devices can operate over a wide temperature range, unaffected by process variations, and can achieve significantly smaller layout costs compared to CMOS TRNGs. In [13], the authors proposed an antiferromagnetic secure memory scheme that provides protection against tampering, side-channel, and read-out attacks, ensuring lower bit energy than STT-RAM or PCM.

Most research has focused on circuit design and security analysis, with little exploration on the technical aspects. Although spintronics has made rapid progress in applications, it seems important to consider technical exploration in related security research.

2.2 Memristors

The potential of using memristors in hardware security solutions was recognized years ago, for example, in 2013, utilizing process variations and random operations of memristors for PUF. Recently, another PUF concept was proposed that leverages the nonlinear I-V characteristics (“hysteresis”) of memristors, and applies memristor conductance simulation tuning to enhance the performance and practicality of such PUFs while reducing the complexity of peripheral circuits. The authors of [14] provided experimental demonstrations and measurement results for their PUF concept.

Memory crossbar arrays are central to key security management. The authors suggest combining the unique fingerprint of memristor devices with key value storage within these devices. They constructed control circuits that destroy the key once the fingerprint is extracted (used to verify the authenticity of the chip). Thus, the secret key remains “active” on the chip to enable its functionality (following the concept of logic locking) until any read operation is executed. The authors provided experimental proof and measurement results for their concept. Such a concept is an important step for the practicality of logic locking, which requires anti-tamper memory to ensure its security against malicious end-users in the field.

In [15], the authors also proposed polymorphic circuits for obfuscation in the context of memristors. This is possible because, in principle, the functionality of memristor devices in this fuzzy logic can be reconfigured. Although the authors provided the first study at the circuit and layout level—despite lacking details on technical exploration and library descriptions—they did not provide any experimental demonstrations. Additionally, other studies warned about the delay and power consumption of memristor-based logic, which seems to conflict with the principle of obfuscation unless the circuit structure is optimized.

2.3 Carbon Nanotubes and Carbon Nanotube Field Effect Transistors

In [16], the authors proposed utilizing carbon nanotubes for manufacturing variable PUFs and the concept of Lorenz chaotic systems. The latter serves to enhance the decorrelation of inputs and outputs of PUFs, making them more resilient against machine learning attacks. In [17], the authors conducted a simulation-based study on Trojan detection, power side-channel leakage, and camouflage with CNTFET, finding CNTFETs to be more promising in all aspects compared to traditional CMOS technology. In [2], the authors reviewed the applications of CNTs in PUFs and TRNGs, proposing that this technology could be used for new types of sensors to detect microprobes or other invasive attacks.

Table 1: Selected works on enhancing hardware security using 2.5D/3D integration

2.4 Silicon Nanowire and Nanowire Field Effect Transistors

In [18], the authors proposed silicon nanowire field effect transistors for camouflage. More specifically, they utilized the controllable bipolarity in NWFET to establish a camouflage primitive that includes NAND, NOR, XOR, and XNOR functions. The authors also established a polymorphic NAND/NOR gate and provided circuit simulation results. However, in [6], research showed that these primitives are susceptible to SAT attacks.

In [19], the authors first explored how to utilize transistor-level reconfigurability for logic locking and split manufacturing within the context of silicon nanowire field effect transistor models. Secondly, they investigated how to induce short-circuit currents or open-circuit configurations using reconfigurability, essentially undermining the reliability and functional characteristics of the chip; the authors argued that this key feature of reconfigurable NWFETs could be maliciously exploited as reliability-centered Trojans, or could be deliberately used as “kill switches.” In [20], optical detection utilizing nanowires interacting with plasmonic was proposed and experimentally demonstrated. This idea applies to labeling and authentication of chips (or other goods). Since nanowires are not required, the authors proposed the concept of plasmon-enhanced optical PUF and provided physical simulation results and security analysis.

3. 3D and 2.5D Integration

3D and 2.5D integration provides the main benefits for enhancing hardware security: physical separation of components, whether across interconnects, active devices, or both; and physical encapsulation of components to protect them from field adversarial activities. Other papers have also reviewed the benefits and drawbacks of 3D and 2.5D integration for hardware security, see for example [21].

3.1 Confidentiality and Integrity of Hardware: Logic Locking

3D and 2.5D integration has not yet been used for logic locking. In loosely related work, the use of locking principles to advance the concept of split manufacturing was employed. More specifically, they lock FEOL and delegate the unlocking work to a separate, trusted BEOL facility. The authors noted that their scheme could also unlock at the package or board level, likely suggesting implementation as 2.5D ICs.

3.2 Confidentiality and Integrity of Hardware: Camouflage

The first camouflage specifically proposed for 3D integration was aimed at M3D ICs. The authors developed and described a custom M3D camouflage library and evaluated their scheme at the gate and chip levels.

This camouflage is achieved through virtual contacts, a method that has already been proposed in classical two-dimensional integrated circuits. Therefore, although not conceptually novel, the work in [22] leverages the benefits provided by M3D integrated circuits to strive for improved scalability of camouflage. This is noteworthy because camouflage in existing technologies may incur significant layout costs. In fact, such costs only consider a few gates to be camouflaged; while limited camouflage scales make such schemes vulnerable to SAT attacks. In contrast, the work reported in [22] consumes, on average, only 25% of the power, 15% of the delay cost, and 43% area savings compared to conventional 2D gates.

3.3 Confidentiality and Integrity of Hardware: Split Manufacturing

Advancing split manufacturing through 3D and 2.5D integration seems both straightforward and promising. This is because 3D and 2.5D integration allows the design to be divided into multiple chips, which can independently maintain their FEOL and BEOL layers, while the entire 2.5D/3D stack may contain further parts of the system-level interconnect. Additionally, although verification studies have been conducted, concerns about the practicality of classical split manufacturing remain prevalent, as individual chips do not necessarily need to be split manufactured, but rather the entire system.

In 2008, Tezzaron Semiconductor outlined the concept of “3D split manufacturing.” A variety of studies have also hinted at 3D split manufacturing, but most have some limitations. For example, study [23] remains at the conceptual level, while study [24] utilizes 2.5D integration, “only” connecting the parts hidden by untrusted facilities. The latter is essentially equivalent to traditional split manufacturing but seems more practical; nevertheless, study [24] reported significant layout costs. Later, “native 3D split manufacturing” was promoted, which involves logical splitting between trusted and untrusted facilities.

A significant finding of these later studies is that 3D partitioning and vertical interconnect structures play a crucial role and define the cost-security trade-offs as follows: the more designs are split across multiple chips, the higher the layout costs, as more vertical interconnect links and related circuits are required, but it is more flexible and easier to “disassemble” IP across the 3D stack.

Note that 3D split manufacturing combined with camouflage has been proposed. While study [25] applied conventional central camouflage, study [26] argues that another camouflage method is more suitable for 3D split manufacturing, namely obfuscating vertical interconnects.

Other studies have also suggested camouflage at the system level. For instance, [27] proposed to obfuscate the vertical interconnect structure of 3D ICs by rerouting within dedicated chips network-on-chip (NoC) chips “sandwiched” between conventional chips. This idea is conceptually similar to the random routing concept in [26], but more flexible, though also more expensive.

3.4 Confidentiality and Integrity of Hardware: Trojan Defense

In [26], the authors utilized the benefits provided by 3D split manufacturing to advance formally secure but high-cost schemes to reduce Trojan insertion during manufacturing.

Moreover, during design and manufacturing, 3D and 2.5D ICs seem more susceptible to Trojan insertion attacks than 2D ICs. For example, research in [27] suggests that negative bias temperature instability (NBTI) effects are covert Trojan triggers, motivated by thermal management being a well-known challenge for 3D ICs. In a more general sense, the broader prospects of 3D and 2.5D integration-related vendors and participants may provide new opportunities for attackers to embed Trojans. The widespread adoption of wafer-level chip-scale packaging (WLCSP) also faces such security risks. The assumed attack here is that some malicious integrated tools could place a thin Trojan chip between the target chip and package micro bumps, and that Trojan chip would contain TSVs, allowing arbitrary access to all these signals through and into these external connections. To avoid detection by visual or X-ray inspection, it is believed that aligning these TSVs with micro bump positions may suffice.

However, runtime Trojan detection could benefit from 3D and 2.5D integration. This is because the associated security features can be implemented using trusted manufacturing processes separately and integrated/stacked later with monitored commodity chips.

3.5 Confidentiality and Integrity of Hardware: PUF

Integrating multiple chips into a 3D/2.5D stack seems beneficial for understanding the concept of PUF, as each chip is an independent process variation. Therefore, multiple independent entropy sources can be used to construct PUFs. In [28,29], two such schemes were proposed, further leveraging TSV process variations. Although these studies are promising in principle, their practical resilience remains to be proven against state-of-the-art machine learning attacks.

3.6 Runtime Data Security: Unauthorized Access or Modification of Data

3D and 2.5D integration can achieve physical separation of components, thus enabling reliable security features such as runtime monitors or verifiers.

The practical implementation of these schemes may itself become a vulnerability. For instance, introspection interfaces that require additional logic to be added to the monitored commodity chip. It is easy to see that once these interfaces are modified by malicious actors during the design or manufacturing of the commodity chip, they will fail. Thus, undesirable dependencies arise, potentially completely undermining the scheme.

For example, a 2.5D root of trust that integrates an untrusted commodity chip with a chip containing security features into an active intermediary, further forming a backbone for system-level communication between chips. Thus, there is a clear physical separation between commodity and security components, avoiding any compromising dependencies.

3.7 Runtime Data Security: Side-Channel and Fault Injection Attacks

Overall, for 3D and 2.5D ICs, considering the higher density of active devices and more complex circuit structures and architectures, makes side-channel attacks noisier and more challenging. For example, the authors in [30] studied power side-channel attacks on 3D ICs, observing that the power noise distribution from different chips within 3D ICs is superimposed. They also proposed a random cross-linking scheme for voltage power supplies for encryption modules to make attacks on such modules more difficult.

Some existing technologies have also explicitly studied side-channel attacks targeting 3D integrated circuits. For instance, [32] and [31] demonstrate that thermal side-channel attacks on 3D ICs can be mitigated at runtime and design time, respectively. However, the methods in [32] seem less practical; to reduce information leakage through thermal modes, it utilizes the dynamic generation of additional virtual activities, which further exacerbates thermal management challenges in 3D integrated circuits. In contrast, the authors of [31] simulated the impact of TSV and module placement on thermal distribution and leakage during floor planning, thus reducing peak temperatures while minimizing leakage.

Additionally, some studies advocate security schemes enabled by 3D and 2.5D integration that are deemed too expensive. For example, research in [33] utilized random eviction and heterogeneous delays as cache architectures. The authors demonstrated that this technique incurs high performance overhead in 2D ICs, but can still be realized even in 3D ICs.

Similar to side-channel attacks, fault injection attacks may become more difficult due to the physical packaging of 3D/2.5D ICs.

Nevertheless, recent research in [34] has shown that laterally rearranging laser devices is sufficient to enable such fault injection attacks, which may apply to both back-protected 2D ICs and 2.5D and 3D ICs. However, if 3D integrated circuits adopt dedicated physical designs, such as densely placing TSVs at chip boundaries to form “vertical shielding” structures, while using conventional shielding and back protection in BEOL.

3.8 Runtime Data Security: Physical Readout and Detection Attacks

Similar to fault injection attacks, the concept of physical framing enabled by 3D/2.5D integration may hinder readout and detection attacks. In [35], the authors advocate for 3D ICs supporting “all-around shielding.” Similar protective measures against detection have been discussed previously.

References

[1] J. Rajendran et al., “Nano meets security: Exploring nanoelectronic devices for security applications,” Proc. IEEE, vol. 103, no. 5, pp. 829–849, 2015. https: //doi.org/10.1109/JPROC.2014.2387353

[2] S. Ghosh, “Spintronics and security: Prospects, vulnerabilities, attack models, and preventions,” Proc. IEEE, vol. 104, no. 10, pp. 1864–1893, 2016. https://doi. org/10.1109/JPROC.2016.2583419

[3] F. Rahman et al., “Security beyond CMOS: Fundamentals, applications, and roadmap,” Trans. VLSI Syst., vol. PP, no. 99, pp. 1–14, 2017. https://doi.org/10. 1109/TVLSI.2017.2742943

[4] Q. Alasad, J. Yuan, and D. Fan, “Leveraging all-spin logic to improve hardware security,” in Proc. Great Lakes Symp. VLSI, 2017, pp. 491–494. https://doi.org/10. 1145/3060403.3060471

[5] T. Winograd et al., “Hybrid STT-CMOS designs for reverse-engineering prevention,” in Proc. Des. Autom. Conf., 2016, pp. 88–93. https://doi.org/10.1145/ 2897937.2898099

[6] S. Patnaik et al., “Spin-orbit torque devices for hardware security: From deterministic to probabilistic regime,” Trans. Comp.-Aided Des. Integ. Circ. Sys., vol. 39, pp. 1591–1606, 2019. https://doi.org/10.1109/TCAD.2019.2917856

[7] F. Parveen, Z. He, S. Angizi, and D. Fan, “Hybrid polymorphic logic gate with 5-terminal magnetic domain wall motion device,” in Proc. Comp. Soc. Symp. VLSI, 2017, pp. 152–157. https://doi.org/10.1109/ISVLSI.2017.35

[8] S. Patnaik et al., “Advancing hardware security using polymorphic and stochastic spin-hall effect devices,” in Proc. Des. Autom. Test Europe, 2018, pp. 97–102. https://doi.org/10.23919/DATE.2018.8341986

[9] N. Rangarajan et al., “Opening the doors to dynamic camouflaging: Harnessing the power of polymorphic devices,” Trans. Emerg. Top. Comp., vol. Early Access, 2020. https://doi.org/10.1109/TETC.2020.2991134

[10] A. Roohi and R. F. DeMara, “PARC: A novel design methodology for power analysis resilient circuits using spintronics,” Trans. Nanotech., vol. 18, pp. 885– 889, 2019. https://doi.org/10.1109/TNANO.2019.2934887

[11] A. S. Iyengar, S. Ghosh, and K. Ramclam, “Domain wall magnets for embedded memory and hardware security,” J. Emerg. Sel. Topics Circ. Sys., vol. 5, no. 1, pp. 40–50, 2015. https://doi.org/10.1109/JETCAS.2015.2398232

[12] N. Rangarajan, A. Parthasarathy, and S. Rakheja, “A spin-based true random number generator exploiting the stochastic precessional switching of nanomagnets,” J. Appl. Phys., vol. 121, no. 22, p. 223905, 2017. https://doi.org/10.1063/1.4985702

[13] N. Rangarajan et al., “SMART: A secure magnetoelectric antiferromagnet-based tamper-proof non-volatile memory,” vol. 8, pp. 76 130–76 142, 2020. https://doi. org/10.1109/ACCESS.2020.2988889

[14] H. Nili et al., “Hardware-intrinsic security primitives enabled by analogue state and nonlinear conductance variations in integrated memristors,” Nature Electronics, vol. 1, no. 3, pp. 197–202, 2018. https://doi.org/10.1038/s41928-018-0039-7

[15] A. Rezaei, J. Gu, and H. Zhou, “Hybrid memristor-CMOS obfuscation against untrusted foundries,” in Proc. Comp. Soc. Symp. VLSI, 2019, pp. 535–540. https: //doi.org/10.1109/ISVLSI.2019.00102

[16] L. Liu, H. Huang, and S. Hu, “Lorenz chaotic system-based carbon nanotube physical unclonable functions,” Trans. Comp.-Aided Des. Integ. Circ. Sys., vol. 37, no. 7, pp. 1408–1421, 2018. https://doi.org/10.1109/TCAD.2017.2762919

[17] C. K. H. Suresh, B. Mazumdar, S. S. Ali, and O. Sinanoglu, “A comparative security analysis of current and emerging technologies,” Micro, vol. 36, no. 5, pp. 50–61, 2016. https://doi.org/10.1109/MM.2016.87

[18] Y. Bi et al., “Emerging technology-based design of primitives for hardware security,” J. Emerg. Tech. Comp. Sys., vol. 13, no. 1, pp. 3:1–3:19, 2016. https: //doi.org/10.1145/2816818

[19] S. Rai et al., “Security promises and vulnerabilities in emerging reconfigurable nanotechnology-based circuits,” Trans. Emerg. Top. Comp., vol. Early Access, 2020. https://doi.org/10.1109/TETC.2020.3039375

[20] Y. Cui et al., “Encoding molecular information in plasmonic nanostructures for anti-counterfeiting applications,” Nanoscale, no. 6, pp. 282–288, 2014. https: //doi.org/10.1039/C3NR04375D

[21] J. Knechtel, S. Patnaik, and O. Sinanoglu, “3D integration: Another dimension toward hardware security,” in Proc. Int. On-Line Test Symp., 2019, pp. 147–150. https://doi.org/10.1109/IOLTS.2019.8854395

[22] C. Yan et al., “Hardware-efficient logic camouflaging for monolithic 3D ICs,” Trans. Circ. Sys., vol. 65, no. 6, pp. 799–803, 2018. https://doi.org/10.1109/TCSII. 2017.2749523

[23] J. Dofe et al., “Security threats and countermeasures in three-dimensional integrated circuits,” in Proc. Great Lakes Symp. VLSI, 2017, pp. 321–326. https: //doi.org/10.1145/3060403.3060500

[24] Y. Xie, C. Bao, and A. Srivastava, “Security-aware 2.5D integrated circuit design flow against hardware IP piracy,” Computer, vol. 50, no. 5, pp. 62–71, 2017. https://doi.org/10.1109/MC.2017.121

[25] P. Gu et al., “Cost-efficient 3D integration to hinder reverse engineering during and after manufacturing,” in Proc. Asian Hardw.-Orient. Sec. Trust Symp., 2018, pp. 74–79. https://doi.org/10.1109/AsianHOST.2018.8607176

[26] S. Patnaik, M. Ashraf, O. Sinanoglu, and J. Knechtel, “A modern approach to IP protection and trojan prevention: Split manufacturing for 3D ICs and obfuscation of vertical interconnects,” Trans. Emerg. Top. Comp., vol. Early Access, 2019. https://doi.org/10.1109/TETC.2019.2933572

[27] J. Dofe, Q. Yu, H. Wang, and E. Salman, “Hardware security threats and potential countermeasures in emerging 3D ICs,” in Proc. Great Lakes Symp. VLSI, 2016, pp. 69–74. https://doi.org/10.1145/2902961.2903014

[28] M. Wang, A. Yates, and I. L. Markov, “SuperPUF: Integrating heterogeneous physically unclonable functions,” in Proc. Int. Conf. Comp.-Aided Des., 2014, pp. 454–461. https://doi.org/10.1109/ICCAD.2014.7001391

[29] C. Wang et al., “TSV-based PUF circuit for 3DIC sensor nodes in IoT applications,” in Proc. Electron. Dev. Solid State Circ., 2015, pp. 313–316. https://doi.org/10.1109/ EDSSC.2015.7285113

[30] J. Dofe and Q. Yu, “Exploiting PDN noise to thwart correlation power analysis attacks in 3D ICs,” in Proc. Int. Worksh. Sys.-Level Interconn. Pred., 2018. https: //doi.org/10.1145/3225209.3225212

[31] J. Knechtel and O. Sinanoglu, “On mitigation of side-channel attacks in 3D ICs: Decorrelating thermal patterns from power and activity,” in Proc. Des. Autom. Conf., 2017, pp. 12:1–12:6. https://doi.org/10.1145/3061639.3062293

[32] P. Gu et al., “Thermal-aware 3D design for side-channel information leakage,” in Proc. Int. Conf. Comp. Des., 2016, pp. 520–527. https://doi.org/10.1109/ICCD. 2016.7753336

[33] C. Bao and A. Srivastava, “3D integration: New opportunities in defense against cache-timing side-channel attacks,” in Proc. Int. Conf. Comp. Des., 2015, pp. 273–280. https://doi.org/10.1109/ICCD.2015.7357114

[34] J. Rodriguez, A. Baldomero, V. Montilla, and J. Mujal, “LLFI: Lateral laser fault injection attack,” in Proc. Worksh. Fault Diag. Tol. Cryptogr., 2019, pp. 41–47. https://doi.org/10.1109/FDTC.2019.00014

[35] J. Knechtel, S. Patnaik, and O. Sinanoglu, “3D integration: Another dimension toward hardware security,” in Proc. Int. On-Line Test Symp., 2019, pp. 147–150. https://doi.org/10.1109/IOLTS.2019.8854395

Chinese Confidentiality Association

Science and Technology Branch

Scan to follow us

Author: Liu Siyuan

Editor: Xia Tian Tian

Top 5 Highlights of 2023

Cross-Network Attacks: Introduction to the Technology of Breaching Physical Isolation

Thoughts on Top-Level Design for Smart City Security

Revisiting Some New Issues Faced in the Development of Digital Forensics Technology

Development and Challenges of Low Earth Orbit Satellite Interconnected Networks

Introduction to LaserShark Non-Contact Attack Implant Technology

Recent Highlights Review

Hardware Security of CMOS Technology

Out-of-Band Signal Injection Attacks Based on Sound

Applications of Artificial Intelligence in Cybersecurity

How Browser Fingerprinting Identifies Traffic from Web Crawlers

Overview of Key Technologies in Physical Layer Security

Related posts

Leave a Comment Cancel reply