Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Hardware security has emerged as an important field of study aimed at mitigating issues such as piracy, counterfeiting, and side channel attacks. One popular solution for such hardware security attacks are physical unclonable functions (PUF) which provide a hardware specific unique signature or identification. The uniqueness of a PUF depends on intrinsic process variations within individual integrated circuits. As process variations become more prevalent due to technology scaling into the nanometer regime, novel nanoelectronic technologies such as memristors become viable options for improved security in emerging integrated circuits. In this paper, we provide an overview of memristor based PUF structures and circuits that illustrate the potential for nanoelectronic hardware security solutions. <s> BIB001 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Domain wall memory (DWM) is one possible candidate for embedded cache application due to its multi-level cell capability, low standby power, fast access time, good endurance, and good retention. In this paper, we utilize a physics-based model of domain wall to comprehend the process variations and Joule heating that can lead to functional issues in the memory. We propose techniques to mitigate the impact of variability and Joule heating while enabling low-power and high-frequency operation. We show that the process variations in the nanowire (NW) is not good towards robustness, but it can be very useful for device authentication. We propose physically unclonable functions (PUFs) that exploit the nonlinear DW-dynamics for secure key generation. Two flavors of PUF designs are described namely relay-PUF and memory-PUF with lower overhead and power as compared to a traditional CMOS-PUFs and offer a higher degree of resilience against cloning. <s> BIB002 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> This paper presents a rigorous step towards design-for-assurance by introducing a new class of logically reconfigurable design resilient to design reverse engineering. Based on the non-volatile spin transfer torque (STT) magnetic technology, we introduce a basic set of non-volatile reconfigurable Look-Up-Table (LUT) logic components (NV-STT-based LUTs). STT-based LUT with significantly different set of characteristics compared to CMOS provides new opportunities to enhance design security yet makes it challenging to remain highly competitive with custom CMOS or even SRAM-based LUT in terms of power, performance and area. To address these challenges, we propose several algorithms to select and replace custom CMOS gates with reconfigurable STT-based LUTs during design implementation such that the functionality of STT-based components and therefore the entire design cannot be determined in any manageable time, rendering any design reverse engineering attack ineffective. Our study conducted on a large number of standard circuit benchmarks concludes significant resiliency of hybrid STT-CMOS circuits against various types of attacks. Furthermore, the selection algorithms on average have a small impact of less than 3%, 8%, and 3% on design parametric constraints including performance, power and area, respectively. <s> BIB003 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> The experimental demonstration of current-driven spin-transfer torque (STT) for switching magnets and push domain walls (DWs) in magnetic nanowires have opened up new avenues for spintronic computations. These devices have shown great promise for logic and memory applications due to superior energy efficiency and nonvolatility. It has been noted that the nonlinear dynamics of DWs in the physical magnetic system is an untapped source of entropy that can be leveraged for hardware security. The inherent noise, spatial, and temporal randomness in the magnetic system can be employed in conjunction with microscopic and macroscopic properties to realize novel hardware security primitives. Due to simplicity of integration, the spintronic circuits can be an add-on to the silicon substrate to complement the existing CMOS-based security and trust infrastructures. This paper investigates the prospects of spintronics in hardware security by exploring the security-specific properties and novel security primitives realized using spintronic building blocks. As spintronic elements enter the mainstream computing platforms, they are exposed to emerging attacks that were infeasible before. This paper covers the security vulnerabilities, security and privacy attack models, and possible countermeasures to enable safe computing environment using spintronics. <s> BIB004 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Due to the globalization of Integrated Circuit (IC) design in the semiconductor industry and the outsourcing of chip manufacturing, third Party Intellectual Properties (3PIPs) become vulnerable to IP piracy, reverse engineering, counterfeit IC, and hardware trojans. A designer has to employ a strong technique to thwart such attacks, e.g. using Strong Logic Locking method [1]. But, such technique cannot be used to protect some circuits since the inserted key-gates rely on the topology of the circuit. Also, it requires higher power, delay, and area overheads compared to other techniques. In this paper, we present the use of spintronic devices to help protect ICs with less performance overhead. We then evaluate the proposed design based on security metric and performance overhead. One of the best spintronic device candidates is the All Spin Logic due to its unique properties: small area, no spin-charge signal conversion, and its compatibility with conventional CMOS technology. <s> BIB005 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> In this paper, a key-controlled hybrid spin-CMOS polymorphic logic gate using a novel 5 terminal magnetic domain wall motion device is proposed. The proposed hybrid polymorphic gate is able to perform a full set of 2-input Boolean logic functions (i.e. AND/NAND, OR/NOR, NOT, XOR/XNOR) by configuring the applied keys. The SPICE device-circuit co-simulation indicates that a full adder design using our proposed polymorphic logic gate shows 74.23% power reduction and 7.14% transistor count reduction compared with traditional CMOS full adder design. Our proposed polymorphic gate could be a promising hardware security primitive to address IC counterfeiting or reverse engineering by logic locking and polymorphic transformation. To summarize, by providing zero leakage power, low dynamic power consumption, compactness and polymorphism to logic circuits, our proposed design can thrive a new paradigm for future power efficient and secured computing platform. <s> BIB006 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Modern Integrated Circuits (ICs) employ several classes of countermeasures to mitigate physical attacks. Recently, a powerful semi-invasive attack relying on optical contactless probing has been introduced, which can assist the attacker in circumventing the integrated countermeasures and probe the secret data on a chip. This attack can be mounted using IC debug tools from the backside of the chip. The first published attack based on this technique was conducted against a proof-of-concept hardware implementation on a Field Programmable Gate Array (FPGA). Therefore, the success of optical probing techniques against a real commercial device without any knowledge of the hardware implementation is still questionable. The aim of this work is to assess the threat of optical contactless probing in a real attack scenario. To this end, we conduct an optical probing attack against the bitstream encryption feature of a common FPGA. We demonstrate that the adversary is able to extract the plaintext data containing sensitive design information and intellectual property (IP). In contrast to previous optical attacks from the IC backside, our attack does not require any device preparation or silicon polishing, which makes it a non-invasive attack. Additionally, we debunk the myth that small technology sizes are unsusceptible to optical attacks, as we use an optical resolution of about 1 um to successfully attack a 28 nm device. Based on our time measurements, an attacker needs less than 10 working days to conduct the optical analysis and reverse-engineer the security-related parts of the hardware. Finally, we propose and discuss potential countermeasures, which could make the attack more challenging. <s> BIB007 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> In this paper, we propose a spin-based true random number generator (TRNG) that uses the inherent stochasticity in nanomagnets as the source of entropy. In contrast to previous works on spin-based TRNGs, we focus on the precessional switching strategy in nanomagnets to generate a truly random sequence. Using the NIST SP 800-22 test suite for randomness, we demonstrate that the output of the proposed TRNG circuit is statistically random with 99% confidence levels. The effects of process and temperature variability on the device are studied and shown to have no effect on the quality of randomness of the device. To benchmark the performance of the TRNG in terms of area, throughput, and power, we use SPICE (Simulation Program with Integrated Circuit Emphasis)-based models of the nanomagnet and combine them with CMOS device models at the 45 nm technology node. The throughput, power, and area footprints of the proposed TRNG are shown to be better than those of existing state-of-the-art TRNGs. We identify the op... <s> BIB008 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Since memristors came to the forefront of research, minimal work has explored their application to computer arithmetic. This paper proposes two memristor-based implementations of an N-bit shift-and-add multiplier, one using IMPLY operations and a second using MAD operations. The optimized IMPLY-based implementation reduces the baseline delay from 2N ::: 2 ::: + 29N steps and 17N+3 memristors to 2N ::: 2 ::: + 21N steps and 7N+1 memristors. A second implementation is proposed that is constructed from MAD gates, a lower-area, lower-delay alternative to IMPLY logic. This design performs an N-bit multiplication in N ::: 2 ::: + N steps with 5N memristors and 3N+2 drivers. Both designs require fewer steps and less than 1/6 of the number of components of a traditional CMOS design. Finally, both of the implementations are extended to implement radix-2 Booth multipliers. The IMPLY design only increases by 1 step per iteration and 2N memristors and drivers. The MAD design increases by N memristors and 6N switches but maintains the same delay as the shift-and-add multiplier. Both designs maintain a lower area and lower delay than the CMOS equivalent. <s> BIB009 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Circuit obfuscation is a frequently used approach to conceal logic functionalities in order to prevent reverse engineering attacks on fabricated chips. Efficient obfuscation implementations are expected with lower design complexity and overhead but higher attack difficulties. In this paper, an emerging obfuscation approach is proposed by leveraging spin-orbit torque (SOT) devices-based look-up-tables as reconfigurable logic to replace the carefully selected gates. It is essentially impossible to identify the obfuscated gate with SOTs inside according to the physical geometry characteristics because the configured functionalities are represented by magnetization states. Such an obfuscation approach makes the circuit security further improved with high exponential attack complexities. Experiments on MCNC and ISCAS 85/89 benchmark suits show that the proposed approach could reduce the area overheads due to obfuscation by 10% averagely. <s> BIB010 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Protecting intellectual property (IP) in electronic circuits has become a serious challenge in recent years. Logic locking/encryption and layout camouflaging are two prominent techniques for IP protection. Most existing approaches, however, particularly those focused on CMOS integration, incur excessive design overheads resulting from their need for additional circuit structures or device-level modifications. This work leverages the innate polymorphism of an emerging spin-based device, called the giant spin-Hall effect (GSHE) switch, to simultaneously enable locking and camouflaging within a single instance. Using the GSHE switch, we propose a powerful primitive that enables cloaking all the 16 Boolean functions possible for two inputs. We conduct a comprehensive study using state-of-the-art Boolean satisfiability (SAT) attacks to demonstrate the superior resilience of the proposed primitive in comparison to several others in the literature. While we tailor the primitive for deterministic computation, it can readily support stochastic computation; we argue that stochastic behavior can break most, if not all, existing SAT attacks. Finally, we discuss the resilience of the primitive against various side-channel attacks as well as invasive monitoring at runtime, which are arguably even more concerning threats than SAT attacks. <s> BIB011 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Hardware-centric security threats have emerged in every stage of the IC supply chain. Prior defenses have been developed to protect against intellectual property (IP) piracy at different stages. However, so far only logic locking can protect the IP end to end. We present dynamic camouflaging to thwart IP reverse engineering at all stages in the supply chain. We exploit the multi-functionality, post-fabrication reconfigurability, and run-time polymorphism of spin-based devices, specifically the magneto-electric spin-orbit (MESO) device. Leveraging these properties, dynamic camouflaging is resilient to state-of-the-art attacks such as SAT, approximate SAT (AppSAT) and HackTest, and can further impede side-channel analysis. For MESO-based full-chip dynamic camouflaging we anticipate massive improvements in power (7,400x), performance (5.9x), and area (73x) over spin- and CMOS-based camouflaging. We outline the prospects of dynamic camouflaging for error-tolerant image processing applications. <s> BIB012 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Hardware-intrinsic security primitives employ instance-specific and process-induced variations in electronic hardware as a source of cryptographic data. Among various emerging technologies, memristors offer unique opportunities in such security applications due to their underlying stochastic operation. Here we show that the analogue tuning and nonlinear conductance variations of memristors can be used to build a basic building block for implementing physically unclonable functions that are resilient, dense, fast and energy-efficient. Using two vertically integrated 10 × 10 metal-oxide memristive crossbar circuits, we experimentally demonstrate a security primitive that offers a near ideal 50% average uniformity and diffuseness, as well as a minimum bit error rate of around 1.5 ± 1%. Readjustment of the conductances of the devices allows nearly unique security instances to be implemented with the same crossbar circuit. <s> BIB013 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Digital keys are commonly used in today’s hardware security systems. However, the provable destruction of these keys after use remains a challenging problem. Most security primitives built using traditional complementary metal–oxide–semiconductor transistors are not well suited to address this issue because of their volatility and unreliability at small scales. Here we show that the unique physical fingerprint of a 128 × 64 hafnium oxide memristor crossbar array integrated with transistors is capable of provable key destruction. The fingerprint is extracted by comparing the conductance of neighbouring memristors, and it can be revealed only if a digital key stored on the same array is erased. On the basis of this provable key destruction technique, we propose a protocol for logic locking/unlocking that can support secure outsourcing of integrated circuit manufacturing. By leveraging the unique properties of memristors, including reconfigurability and variability, our chip demonstrates the integration of security, memory and computing functionalities into the same circuits, and could be used to develop more secure, compact and efficient memristive hardware systems. <s> BIB014 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Protecting intellectual property (IP) has become a serious challenge for chip designers. Most countermeasures are tailored for CMOS integration and tend to incur excessive overheads, resulting from additional circuitry or device-level modifications. On the other hand, power density is a critical concern for sub-50 nm nodes, necessitating alternate design concepts. Although initially tailored for error-tolerant applications, imprecise computing has gained traction as a general-purpose design technique. Emerging devices are currently being explored to implement ultra-low-power circuits for inexact computing applications. In this paper, we quantify the security threats of imprecise computing using emerging devices. More specifically, we leverage the innate polymorphism and tunable stochastic behavior of spin-orbit torque (SOT) devices, particularly, the giant spin-Hall effect (GSHE) switch. We enable IP protection (by means of logic locking and camouflaging) simultaneously for deterministic and probabilistic computing, directly at the GSHE device level. We conduct a comprehensive security analysis using state-of-the-art Boolean satisfiability (SAT) attacks; this study demonstrates the superior resilience of our GSHE primitive when tailored for deterministic computing. We also demonstrate how probabilistic computing can thwart most, if not all, existing SAT attacks. Based on this finding, we propose an attack scheme called probabilistic SAT (PSAT) which can bypass the defense offered by logic locking and camouflaging for imprecise computing schemes. Further, we illustrate how careful application of our GSHE primitive can remain secure even on the application of the PSAT attack. Finally, we also discuss side-channel attacks and invasive monitoring, which are arguably even more concerning threats than SAT attacks. <s> BIB015 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> A prevalent class of side-channel attacks relies on Differential Power Analysis (DPA) methods, which monitor power traces during cryptographic processing to discover secret keys. Reconfigurability via Polymorphic Gate Modules (PGMs) offers an approach to obscure DPA information by dynamically rearranging the operation of constituent sub-circuits, albeit at the cost of increased area and power consumption. Thus, we develop the Power Analysis-Resilient Circuit (PARC) design methodology to instantiate the use of spin-based devices as an extension to conventional Register Transfer Language (RTL) specifications. PARC replaces a specific portion of the circuit to maximize a new Effectiveness of Design (EoD) metric, which quantifies DPA impact versus its performance overhead. To validate functionality, PARC is applied to various benchmark circuits including ISCAS-89, MCNC, and ITC-99. EoD results indicate that PARC significantly increases the number of power traces that an adversary would need to use in order to extract power information but incurs a low cost to the functional circuit itself. <s> BIB016 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> Data theft and tampering are serious concerns as attackers have aggressively begun to exploit weaknesses in current memory systems to advance their nefarious schemes. The storage industry is moving toward emerging non-volatile memories (NVM), including the spin-transfer torque magnetoresistive random access memory (STT-MRAM) and the phase change memory (PCM), owing to their high density and low power operation. The advent of novel memory technologies has led to new vulnerabilities including data sensitivity to magnetic field and temperature fluctuations and data persistence after power down. In this paper, we propose SMART: a Secure Magnetoelectric Antiferromagnet-Based Tamper-Proof memory, which leverages unique properties of antiferromagnetic materials and offers dense, on-chip non-volatile storage. SMART memory is not only resilient against data confidentiality attacks seeking to leak sensitive information but also protects data integrity and prevents Denial of Service (DoS) attacks on the memory. It is impervious to power side-channel attacks, which exploit asymmetric reads/writes for 0 and 1 logic levels, and photonic side-channel attacks, which monitor photo-emission signatures from the chip backside. Further, the ultra-low power magnetoelectric switching coupled with the terahertz regime antiferromagnetic dynamics result in 4 orders lower energy-per-bit and 3 orders smaller latency for the SMART memory as compared to prior NVMs such as STT-MRAM and PCM. <s> BIB017 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Spintronics. <s> The high cost of IC design has made chip protection one of the first priorities of the semiconductor industry. In addition, with the growing number of untrusted foundries, the possibility of inside foundry attack is escalating. However, by taking advantage of polymorphic gates, the layouts of the circuits with different functionalities look exactly identical, making it impossible even for an inside foundry attacker to distinguish the defined functionality of an IC by looking at its layout. Moreover, since memristor is compatible with CMOS structure, it is possible to efficiently design hybrid memristor-CMOS circuits. In this paper, we propose a hardware obfuscation method based on polymorphic hybrid memristor-CMOS technology. Overhead of the polymorphic designs and the time complexity of possible attacks are discussed. <s> BIB018
Various studies proposed polymorphic behavior and/or reconfigurability for IP protection. For example, Alasad et al. BIB005 use all-spin logic for camouflaging. However, the layouts for some of their proposed device primitives are unique; they can be readily distinguished during imaging-based reverse engineering. Besides, their primitives suffer from relatively high energy consumption, with around 350 µW consumed for ns-range delays. In BIB003 BIB010 , the authors introduced spintronics-based reconfigurable lookup tables (LUTs) for design obfuscation. However, these approaches can fall short regarding their resilience against SAT attacks BIB015 . Also note that such approaches are conceptionally similar to design obfuscation leveraging traditional field-programmable gate arrays (FPGAs). In BIB006 and BIB015 BIB011 , polymorphic and obfuscated logic has been studied, based on domain-wall motion devices and on giant spin-Hall effect (GSHE) devices, respectively. One important benefit of the latter studies over the former is that they support all 16 possible functions per device; this renders these devices superior in terms of SAT resilience BIB015 BIB011 . In BIB012 , the notion of "dynamic camouflaging" based on polymorphic magnetoelectric spin-orbit (MESO) devices has been introduced. Unlike regular camouflaging, this notion can also protect against adversaries in the foundries and test facilities, as the true functionality is configured only later on within the polymorphic fabric. Thus, this notion is also conceptionally similar to logic locking; however, unlike with locking, no additional devices or gates are required to realize this kind of security. It has been noted that spintronics can offer some resilience against side-channel attacks BIB015 BIB012 BIB016 . For example, the magnetoelectric switching of these devices does not emit photons; related attacks as in BIB007 can be ruled out to begin with. With spintronics used for logic, fault-injection and side-channel attacks based on magnetic fields or temperature curves may be more difficult to achieve BIB015 BIB012 , unlike with spintronics used for memories BIB004 . Moreover, in BIB016 the authors used spintronics to build up polymorphic circuitry and different circuit templates for the same functionality, which are randomly switched between at runtime, in order to mask the power side-channel. In BIB004 BIB002 , the authors advocate the process variations for nanowire manufacturing in domain-wall memories for PUFs. In BIB008 , the authors leverage the inherently stochastic spin switching mechanism in nanomagnets for TRNGs. Through device-level simulations, the authors demonstrate that their TRNG device works across large temperature ranges, is immune to process variations, and can be implemented with significantly smaller layout costs than CMOS TRNGs. In BIB017 , the authors propose an antiferromagnetsbased secure memory scheme, which offers protection against tampering, side-channel, and read-out attacks, and also promises orders of lower energy-per-bit than STT-RAM or PCMs. Most studies focus on circuit design and security analysis, but few on technology aspects. While spintronics are making fast progress toward application, it seems important to consider technology exploration also within the concerned security studies. e.g., for PUFs leveraging the process variations and the stochastic operation of memristors in 2013 BIB001 . More recently, another PUF concept has been proposed BIB013 , which leverages the non-linear I-V characteristics of memristors ("pinched hysteresis") and applies analogue tuning of the memristor conductance, to increase the performance of such PUFs and to reduce the complexity of the peripheral circuitry. The authors of BIB013 provided an experimental demonstration and measurement results for their PUF concept. In BIB014 , a memristive crossbar array is at the heart for secure management of secret keys. The authors propose to combine unique fingerprints of memristor devices with storage of key values within those devices. They construct control circuitry such that upon extraction of the fingerprints (for verification of authenticity of the chip), the key is destroyed. Therefore, the secret key remains "alive" on the chip to enable its functionality (following the notion of logic locking) until any read-out is conducted. The authors of BIB014 provide an experimental demonstration and measurement results for their concept. Such a concept is an important step for the practicality of logic locking, which requires tamper-proof memories for its security promises against malicious end-users in the field. In BIB018 , the authors propose polymorphic circuitry for obfuscation also in the context of memristors. That is possible because, in principle, the functionality of memristor devices within such obfuscated logic can be reconfigured. While the authors provide a first study at the circuit and layout level-albeit without details on the technology exploration and library characterization-they do not provide any experimental demonstration. Moreover, other studies caution about delay and power consumption for memristor-based logic unless circuit structures are optimized BIB009 , which seems to conflict with obfuscation principles.