Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> Recently, following the work pioneered by Kocher [1], using cache behavior as a timing side-channel to leak critical system information has received lots of attentions because of its easy-to-implement nature and amazingly good results. Recent attacks have been demonstrated to successfully leak the full key from many commonly used encryption algorithms including RSA, AES, etc. These attacks pose great threats to applications that depend on these encryption methods such as banking systems, military systems, etc. To mitigate the increasing threat, numerous countermeasures, mostly software patches, have been proposed. Hardware mitigations, however, have been less pursued. In this paper, we show that emerging 3D integration technology offers new opportunities in defense against these attacks. We propose two cache design mechanisms that can make the attacker's job harder, even impossible. Experimental results show that using our cache design, the side-channel leakage is significantly reduced while still achieving performance gains over a conventional 2D system. <s> BIB001 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> Side-channel attacks are important security challenges as they reveal sensitive information about on-chip activities. Among such attacks, the thermal side-channel has been shown to disclose the activities of key functional blocks and even encryption keys. This paper proposes a novel approach to proactively conceal critical activities in the functional layers while minimizing the power dissipation by (i) leveraging inherent characteristics of 3D integration to protect from side-channel attacks and (ii) dynamically generating custom activity patterns to match the activity to be concealed in the functional layers. Experimental analysis shows that 3D technology combined with the proposed run-time algorithm effectively reduces the Side-channel Vulnerability Factor (SVF) below 0.05 and the Spatial Thermal Side-channel Factor (STSF) below 0.59. <s> BIB002 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> Various side-channel attacks (SCAs) on ICs have been successfully demonstrated and also mitigated to some degree. In the context of 3D ICs, however, prior art has mainly focused on efficient implementations of classical SCA countermeasures. That is, SCAs tailored for up-and-coming 3D ICs have been overlooked so far. In this paper, we conduct such a novel study and focus on one of the most accessible and critical side channels: thermal leakage of activity and power patterns. We address the thermal leakage in 3D ICs early on during floorplanning, along with tailored extensions for power and thermal management. Our key idea is to carefully exploit the specifics of material and structural properties in 3D ICs, thereby decorrelating the thermal behaviour from underlying power and activity patterns. Most importantly, we discuss powerful SCAs and demonstrate how our open-source tool helps to mitigate them. <s> BIB003 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> Three-dimensional (3D) integration is envisioned as a natural defense to thwart side-channel analysis (SCA) attacks. However, there lack extensive studies on the unique feature of 3D power distribution network (PDN) noise and its impact on the efficiency of SCA attacks in 3D chips. This work fills the gap. Our experiments based on the real PDN and through-silicon via (TSV) models indicate that the noise from the other 3D planes is additive, which can significantly change the power profile of the crytpo unit in a 3D chip. We exploit the cross-plane PDN noise to develop a new counter-measure against the correlation power analysis (CPA) attacks in 3D integrated circuits (ICs). Simulation results show that the proposed method successfully improves the system resilience against CPA attacks and enhances the correlation difference by 29.1% and 18.7% over 2D and 3D baseline, respectively. <s> BIB004 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> In this work, a novel technique of fault injection attack on secure integrated circuits (ICs) devices is presented: Lateral Laser Fault Injection (LLFI). Laser Fault Injection with backside illumination is typically the most efficient and widely used technique to perturb secure ICs. However, the appearance of new packaging techniques and new physical countermeasures that may block or difficult the IC backside access may limit the efficiency of such technique in the future. In this context, a new Laser Fault Injection alternative is proposed. The IC is attacked through the side of the chip, by focusing the incident laser beam on that area. This novel concept is presented and experimentally proven in this paper. <s> BIB005 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Data Security at Runtime: Side-Channel and Fault-Injection <s> We review threats and selected schemes concerning hardware security at design and manufacturing time as well as at runtime. We find that 3D integration can serve well to enhance the resilience of different hardware security schemes, but it also requires thoughtful use of the options provided by the umbrella term of 3D integration. Toward enforcing security at runtime, we envision secure 2.5D system-level integration of untrusted chips and “all around” shielding for 3D ICs. <s> BIB006
Attacks. In general, side-channel attacks seem to become more difficult for 3D and 2.5D ICs, considering the higher density of active devices and the more complex circuit structures and architectures, which can result into more noisy side-channels. For example, the authors of BIB004 studied power side-channel attacks on 3D ICs, and they observed that the power noise profiles from the different chips within the 3D IC are superposed. They also propose a randomized cross-linking scheme of voltage supplies toward cryptographic modules, to render attacks more difficult. Some prior art also studied side-channel attacks targeted explicitly for 3D ICs. For example, BIB002 and BIB003 demonstrate that thermal side-channel attacks on 3D ICs can be mitigated at runtime and at design time, respectively. However, the approach in BIB002 seems less practical; to mitigate information leakage through thermal patterns, it leverages dynamic generation of additional dummy activities, which exacerbates the challenge of thermal management for 3D ICs naturally further. In contrast, the authors of BIB003 model the impact of TSVs and module placement on heat distribution as well as thermal leakage during floorplanning, thereby enabling leakage mitigation along with reduction of peak temperatures. Besides, some studies leverage 3D and 2.5D integration to advocate for security schemes otherwise considered too costly. For example, the study in BIB001 leverages randomized eviction and heterogeneous latencies for a cache architecture. The authors demonstrate that such techniques incur high performance overheads in 2D ICs but can be realized even with gains in 3D ICs. As with side-channel attacks, fault-injection attacks may become more difficult, due to the physical encapsulation of 3D/2.5D ICs. Still, in BIB005 it was shown recently that a lateral re-arrangement of the laser setup can suffice to enable such fault-injection attacks also for backside-protected 2D ICs and possibly also for 2.5D and 3D ICs. However, with a dedicated physical design of 3D ICs, e.g., placing TSVs densely at the chip boundaries, forming a "vertical shield" structure BIB006 , along with regular shields in the BEOL and backside protection, even such attacks might remain difficult.