Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> CHALLENGES FOR HARDWARE SECURITY USING EMERGING TECHNOLOGIES <s> A successful detection of the stealthy dopant-level circuit trojan, proposed by Becker et al. at CHES 2013 [1], is reported. Contrary to an assumption made by Becker et al., dopant types in active region are visible with either scanning electron microscopy SEM or focused ion beam FIB imaging. The successful measurement is explained by an LSI failure analysis technique called the passive voltage contrast [2]. The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device [3]: an anti-reverse-engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with 1 an optical microscope, 2 SEM, and 3 FIB. As a result, the four possible dopant-well combinations, namely i p+/n-well, ii p+/p-well, iii n+/n-well and iv n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, however, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16-times expensive than that of a metal layer in terms of the number of images. <s> BIB001 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> CHALLENGES FOR HARDWARE SECURITY USING EMERGING TECHNOLOGIES <s> Modern Integrated Circuits (ICs) employ several classes of countermeasures to mitigate physical attacks. Recently, a powerful semi-invasive attack relying on optical contactless probing has been introduced, which can assist the attacker in circumventing the integrated countermeasures and probe the secret data on a chip. This attack can be mounted using IC debug tools from the backside of the chip. The first published attack based on this technique was conducted against a proof-of-concept hardware implementation on a Field Programmable Gate Array (FPGA). Therefore, the success of optical probing techniques against a real commercial device without any knowledge of the hardware implementation is still questionable. The aim of this work is to assess the threat of optical contactless probing in a real attack scenario. To this end, we conduct an optical probing attack against the bitstream encryption feature of a common FPGA. We demonstrate that the adversary is able to extract the plaintext data containing sensitive design information and intellectual property (IP). In contrast to previous optical attacks from the IC backside, our attack does not require any device preparation or silicon polishing, which makes it a non-invasive attack. Additionally, we debunk the myth that small technology sizes are unsusceptible to optical attacks, as we use an optical resolution of about 1 um to successfully attack a 28 nm device. Based on our time measurements, an attacker needs less than 10 working days to conduct the optical analysis and reverse-engineer the security-related parts of the hardware. Finally, we propose and discuss potential countermeasures, which could make the attack more challenging. <s> BIB002 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> CHALLENGES FOR HARDWARE SECURITY USING EMERGING TECHNOLOGIES <s> Modern electronic systems become evermore complex, yet remain modular, with integrated circuits (ICs) acting as versatile hardware components at their heart. Electronic design automation (EDA) for ICs has focused traditionally on power, performance, and area. However, given the rise of hardware-centric security threats, we believe that EDA must also adopt related notions like secure by design and secure composition of hardware. Despite various promising studies, we argue that some aspects still require more efforts, for example: effective means for compilation of assumptions and constraints for security schemes, all the way from the system level down to the "bare metal"; modeling, evaluation, and consideration of security-relevant metrics; or automated and holistic synthesis of various countermeasures, without inducing negative cross-effects. In this paper, we first introduce hardware security for the EDA community. Next we review prior (academic) art for EDA-driven security evaluation and implementation of countermeasures. We then discuss strategies and challenges for advancing research and development toward secure composition of circuits and systems. <s> BIB003
As with any security scheme, also those relying on emerging technologies face some challenges. I have outlined specific limitations and challenges for selected prior art already in the discussion above, but here I seek to take a broader view. Possibly the most important and complex challenges arise from the fact that security schemes in general and those based on emerging technologies in particular rely on proper technology exploration, device characterization and modeling, circuit architectures, design strategies, etc. While security schemes tailored for CMOS technology can leverage well-defined and well-characterized technology libraries, state-of-the-art design tools, 5 etc., this is not so straightforward for most emerging technologies, as their characterization and design support is still progressing. However, the resulting challenges may-and should-be rather considered as chances, namely to incorporate security as best as possible right from the beginning, and not only as an afterthought, as we often see for security schemes using CMOS technology. To do so, I propose that the following steps, among others and not necessarily in that particular order, are to be considered: (1) Establish closer interaction between the communities working on hardware security, physical design, and emerging technologies. I argue that a collaborative exchange between our communities is essential for any advancement. (2) (Re-)definition of security metrics and joint "translation" of those metrics. Only then can the emerging-technology communities consider hardware security in a proper, quantifiable manner during technology exploration and device design. For example, while the correlation of switching activities and power consumption (for estimation of power side-channel leakage) seems rather easy to model also for emerging technologies, the commonly promoted criteria for PUFs, like uniqueness or unpredictability, are highly device-specific and require "translation" for effective modeling. (3) Joint reconsideration of threat models. With the progression of emerging technologies, it can be expected that further fallacies, possibly yet unexplored, come into play. For example, advanced tools for failure analysis of emerging technologies can be "misused" for physical attacks in the field. For security schemes based on CMOS technology, we have seen this with the proliferation and wider availability of, e.g., electron microscopy BIB001 and electro-optical probing BIB002 . (4) Technology exploration, prototyping, and joint evaluation of securities schemes based on emerging technologies. That is also because process variations are expected to be more pronounced for most emerging technologies. For PUFs, e.g., stronger variations would serve well for uniqueness/entropy, but hinder reproducibility. Only once such empirical insights are available it would seem possible to devise, e.g., error correction schemes to improve the reproducibility. (5) Since most emerging technologies are being promoted for CMOS integration, it becomes important to determine the "weakest link(s) in the chain" for such hybrid implementations of security schemes. These efforts should range from device to circuit to system level, and should also revise related design strategies as needed. Somewhat related, note that the composition of security schemes remains a challenge even for CMOS-only ICs; the physical-design community should become more involved here as well BIB003 .