Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Can you guarantee secrecy even if an adversary can eavesdrop on your brain? We consider the problem of protecting privacy in circuits, when faced with an adversary that can access a bounded number of wires in the circuit. This question is motivated by side channel attacks, which allow an adversary to gain partial access to the inner workings of hardware. Recent work has shown that side channel attacks pose a serious threat to cryptosystems implemented in embedded devices. In this paper, we develop theoretical foundations for security against side channels. In particular, we propose several efficient techniques for building private circuits resisting this type of attacks. We initiate a systematic study of the complexity of such private circuits, and in contrast to most prior work in this area provide a formal threat model and give proofs of security for our constructions. <s> BIB001 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> A classical model is used for the power consumption of cryptographic devices. It is based on the Hamming distance of the data handled with regard to an unknown but constant reference state. Once validated experimentally it allows an optimal attack to be derived called Correlation Power Analysis. It also explains the defects of former approaches such as Differential Power Analysis. <s> BIB002 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Side-channel attacks are easy-to-implement whilst powerful attacks against cryptographic implementations, and their targets range from primitives, protocols, modules, and devices to even systems. These attacks pose a serious threat to the security of cryptographic modules. In consequence, cryptographic implementations have to be evaluated for their resistivity against such attacks and the incorporation of different countermeasures has to be considered. This paper surveys the methods and techniques employed in these attacks, the destructive effects of such attacks, the countermeasures against such attacks and evaluation of their feasibility and applicability. Finally, the necessity and feasibility of adopting this kind of physical security testing and evaluation in the development of FIPS 140-3 standard are explored. This paper is not only a survey paper, but also more a position paper. <s> BIB003 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> We describe several software side-channel attacks based on inter-process leakage through the state of the CPU's memory cache. This leakage reveals memory access patterns, which can be used for cryptanalysis of cryptographic primitives that employ data-dependent table lookups. The attacks allow an unprivileged process to attack other processes running in parallel on the same processor, despite partition. ing methods such as memory protection, sandboxing and virtualization. Some of our methods require only the ability to trigger services that perform encryption or MAC using the unknown key, such as encrypted disk partitions or secure network links. Moreover, we demonstrate an extremely strong type of attack, which requires knowledge of neither the specific plaintexts nor ciphertexts, and works by merely monitoring the effect of the cryptographic process on the cache. We discuss in detail several such attacks on AES, and experimentally demonstrate their applicability to real systems, such as OpenSSL and Linux's dm-crypt encrypted partitions (in the latter case, the full key can be recovered after just 800 writes to the partition, taking 65 milliseconds). Finally, we describe several countermeasures for mitigating such attacks. <s> BIB004 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> As the surplus market of failure analysis equipment continues to grow, the cost of performing invasive IC analysis continues to diminish. Hardware vendors in high-security applications utilize security by obscurity to implement layers of protection on their devices. High-security applications must assume that the attacker is skillful, well-equipped and well-funded. Modern security ICs are designed to make readout of decrypted data and changes to security configuration of the device impossible. Countermeasures such as meshes and attack sensors thwart many state of the art attacks. Because of the perceived difficulty and lack of publicly known attacks, the IC backside has largely been ignored by the security community. However, the backside is currently the weakest link in modern ICs because no devices currently on the market are protected against fully-invasive attacks through the IC backside. Fully-invasive backside attacks circumvent all known countermeasures utilized by modern implementations. In this work, we demonstrate the first two practical fully-invasive attacks against the IC backside. Our first attack is fully-invasive backside microprobing. Using this attack we were able to capture decrypted data directly from the data bus of the target IC's CPU core. We also present a fully invasive backside circuit edit. With this attack we were able to set security and configuration fuses of the device to arbitrary values. <s> BIB005 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Many side channels including power consumption, electromagnetic emanation, optical radiation, and even sound have been studied since the first publication of a side channel attack at the end of the 1990s. Most of these channels can be relatively easily used for an overall analysis of the cryptographic system (implementation of efficient passive attacks) or for injection of faults. Until recently, only the optical channel allowed both analysis of locally leaked information and precise injection of faults (single-bit errors). Recent works showed that the near-field electromagnetic channel enables similar results to be obtained. Like the optical channel, the near-field electromagnetic channel allows both active and passive attacks, which, in addition, can be theoretically non-invasive and contactless. However, the cost of the attack bench that is needed to exploit the near-field electromagnetic channel is less than that of an optical channel. Recently, we showed that it is possible to use the near-field electromagnetic channel to perform an efficient active attack targeting the true random number generator (TRNG) based on ring oscillators. In cryptography, TRNGs are chiefly used to generate encryption keys and other critical security parameters, so the proposed active attack could have serious consequences for the security of the whole cryptographic system. Here, we present the coupling of a passive attack and an active attack. The proposed coupled attack first uses a spectral differential analysis of the TRNG electromagnetic radiation to obtain valuable information on the position of ring oscillators and their frequency range. This information is then used to tune the electromagnetic harmonic signal to temporarily synchronize the ring oscillators. In this paper, we propose a fault model of the entropy extractor which shows that the behavior of the ring oscillators changes, and that it occurs additional and unwanted “fake rising edges” of the clock signal which disturb the flip-flops involved in such TRNGs. The effectiveness of our proposed coupled attack questions the use of ring oscillators in the design of TRNGs. <s> BIB006 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Passive physical attacks, like power analysis, pose a serious threat to the security of embedded systems and corresponding countermeasures need to be implemented. In this talk, we demonstrate how the costs for protecting digital circuits against passive physical attacks can be lowered significantly. We introduce a novel masking approach called domain-oriented masking (DOM). Our approach provides the same level of security as threshold implementations (TI), while it requires less chip area and less randomness. DOM can also be scaled easily to arbitrary protection orders for any circuit. To demonstrate the flexibility of our scheme, we apply DOM to a hardware design of the Advanced Encryption Standard (AES). The presented AES implementation is built in a way that it can be synthesized for any protection order. Although our AES design is scalable, it is smaller, faster, and less randomness demanding than other side-channel protected AES implementations. Our first-order secure AES design, for example, requires only 18 bits of randomness per S-box operation and 6 kGE of chip area. We demonstrate the flexibility of our AES implementation by synthesizing it up to the 15th protection order. Beside our theoretical security analysis, we also evaluate the security of the AES implementation with a t-test based side-channel leakage assessments up to the second protection order. To demonstrate the flexibility of our scheme, we apply DOM to a hardware design of the Advanced Encryption Standard (AES). The presented AES implementation is built in a way that it can be synthesized for any protection order. Although our AES design is scalable, it is smaller, faster, and less randomness demanding than other side-channel protected AES implementations. Our first-order secure AES design, for example, requires only 18 bits of randomness per S-box operation and 6~kGE of chip area. We demonstrate the flexibility of our AES implementation by synthesizing it up to the 15th protection order. Beside our theoretical security analysis, we also evaluate the security of the AES implementation with a t-test based side-channel leakage assessments up to the second protection order. <s> BIB007 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> This paper demonstrates a Fault Attack on anAES core protected by an infection type countermeasure. The redundant AES is implemented on a Xilinx Spartan-6FPGA, with a feature size of 45 nm. By injecting exactlythe same fault in both state registers of the redundantimplementation using lasers, we are able to annul theprotection added by the countermeasure and thus performa successful Differential Fault Analysis. This requires ahigh precision double laser setup in order to hit twodifferent locations on the chip at the same point intime. With a priori knowledge about the location of bothstate registers, we were able to generate applicable faultyciphertexts within minutes. Our results show that forapplications demanding a high level of security, relyingon a duplication of hardware is not sufficient. <s> BIB008 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Recent work shows that the Rowhammer hardware bug can be used to craft powerful attacks and completely subvert a system. However, existing efforts either describe probabilistic (and thus unreliable) attacks or rely on special (and often unavailable) memory management features to place victim objects in vulnerable physical memory locations. Moreover, prior work only targets x86 and researchers have openly wondered whether Rowhammer attacks on other architectures, such as ARM, are even possible. We show that deterministic Rowhammer attacks are feasible on commodity mobile platforms and that they cannot be mitigated by current defenses. Rather than assuming special memory management features, our attack, DRAMMER, solely relies on the predictable memory reuse patterns of standard physical memory allocators. We implement DRAMMER on Android/ARM, demonstrating the practicability of our attack, but also discuss a generalization of our approach to other Linux-based platforms. Furthermore, we show that traditional x86-based Rowhammer exploitation techniques no longer work on mobile platforms and address the resulting challenges towards practical mobile Rowhammer attacks. To support our claims, we present the first Rowhammer-based Android root exploit relying on no software vulnerability, and requiring no user permissions. In addition, we present an analysis of several popular smartphones and find that many of them are susceptible to our DRAMMER attack. We conclude by discussing potential mitigation strategies and urging our community to address the concrete threat of faulty DRAM chips in widespread commodity platforms. <s> BIB009 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> The reversal of a silicon chip to find out its security structure is common and possible at the present time. Thanks to reversing, it is possible to use a probing attack to obtain useful information such as personal information or a cryptographic key. For this reason, security-related blocks such as DES (Data Encryption Standard), AES (Advanced Encryption Standard), and RSA (Rivest Shamir Adleman) engines should be located in the lower layer of the chip to guard against a probing attack; in this regard, the addition of a silicon-surface-protection layer onto the chip surface is a crucial protective measure. But, for manufacturers, the implementation of an additional silicon layer is burdensome, because the addition of just one layer to a chip significantly increases the overall production cost; furthermore, the chip size is increased due to the bulk of the secure logic part and routing area of the silicon protection layer. To resolve this issue, this paper proposes a practical silicon-surface-protection method using a metal layer that increases the security level of the chip while minimizing its size and cost. The proposed method uses a shift register for the alternation and variation of the metal-layer data, and the inter-connection area is removed to minimize the size and cost of the chip in a more extensive manner than related methods. <s> BIB010 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Editor’s note: As a type of invasive physical attacks, probing attacks are able to access and directly monitor security critical nets of an IC and extract sensitive information. In this paper, the authors summarize the state-of-the-art probing and anti-probing technologies and their challenges, and discuss the opportunities in the relevant research. —Yiran Chen, Duke University <s> BIB011 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Modern Integrated Circuits (ICs) employ several classes of countermeasures to mitigate physical attacks. Recently, a powerful semi-invasive attack relying on optical contactless probing has been introduced, which can assist the attacker in circumventing the integrated countermeasures and probe the secret data on a chip. This attack can be mounted using IC debug tools from the backside of the chip. The first published attack based on this technique was conducted against a proof-of-concept hardware implementation on a Field Programmable Gate Array (FPGA). Therefore, the success of optical probing techniques against a real commercial device without any knowledge of the hardware implementation is still questionable. The aim of this work is to assess the threat of optical contactless probing in a real attack scenario. To this end, we conduct an optical probing attack against the bitstream encryption feature of a common FPGA. We demonstrate that the adversary is able to extract the plaintext data containing sensitive design information and intellectual property (IP). In contrast to previous optical attacks from the IC backside, our attack does not require any device preparation or silicon polishing, which makes it a non-invasive attack. Additionally, we debunk the myth that small technology sizes are unsusceptible to optical attacks, as we use an optical resolution of about 1 um to successfully attack a 28 nm device. Based on our time measurements, an attacker needs less than 10 working days to conduct the optical analysis and reverse-engineer the security-related parts of the hardware. Finally, we propose and discuss potential countermeasures, which could make the attack more challenging. <s> BIB012 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Attackers target many different types of computer systems in use today, exploiting software vulnerabilities to take over the device and make it act maliciously. Reports of numerous attacks have been published, against the constrained embedded devices of the Internet of Things, mobile devices like smartphones and tablets, high-performance desktop and server environments, as well as complex industrial control systems. Trusted computing architectures give users and remote parties like software vendors guarantees about the behaviour of the software they run, protecting them against software-level attackers. This paper defines the security properties offered by them, and presents detailed descriptions of twelve hardware-based attestation and isolation architectures from academia and industry. We compare all twelve designs with respect to the security properties and architectural features they offer. The presented architectures have been designed for a wide range of devices, supporting different security properties. <s> BIB013 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Digital keys are commonly used in today’s hardware security systems. However, the provable destruction of these keys after use remains a challenging problem. Most security primitives built using traditional complementary metal–oxide–semiconductor transistors are not well suited to address this issue because of their volatility and unreliability at small scales. Here we show that the unique physical fingerprint of a 128 × 64 hafnium oxide memristor crossbar array integrated with transistors is capable of provable key destruction. The fingerprint is extracted by comparing the conductance of neighbouring memristors, and it can be revealed only if a digital key stored on the same array is erased. On the basis of this provable key destruction technique, we propose a protocol for logic locking/unlocking that can support secure outsourcing of integrated circuit manufacturing. By leveraging the unique properties of memristors, including reconfigurability and variability, our chip demonstrates the integration of security, memory and computing functionalities into the same circuits, and could be used to develop more secure, compact and efficient memristive hardware systems. <s> BIB014 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Power analysis attacks (PAAs), a class of side-channel attacks based on power consumption measurements, are a major concern in the protection of secret data stored in cryptographic devices. In this paper, we introduce the secure double rate registers (SDRRs) as a register-transfer level (RTL) countermeasure to increase the security of cryptographic devices against PAAs. We exploit the SDRR in a conventional advanced encryption standard (AES)-128 architecture, improving the immunity of the cryptographic hardware to the state-of-the-art PAAs. In the AES-128 exploiting SDRR, the combinational path evaluates random data throughout the entire clock cycle, and the interleaved processing of random and real data ensures the protection of both combinational and sequential logics. Our technique does not require the duplication of the combinational path to process the random data, thus limiting area overhead, unlike previous RTL countermeasures. The proposed approach is validated by means of PAAs based on real measurements on a field-programmable gate array implementation and on a 65-nm CMOS prototype chip. The protected implementation shows a strongly reduced correlation coefficient for the correct key, and more than three orders of magnitude increase in the measurements to disclosure with respect to the unprotected AES-128. <s> BIB015 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Error-detecting codes (EDCs) are an efficient and versatile tool to detect disturbances during the operation of a circuit. Historically, EDCs were considered in the context of reliability and safety, where failures were assumed to occur due to natural reasons, like noise or ageing. However, they have also been suggested in the security context, as an approach to counteract malicious physical attacks on cryptographic and other security-critical circuits. In this paper, we review recently developed security-oriented code constructions, pointing out the differences in assumptions and efficiency metrics for reliability- and security-oriented EDCs. We propose a number of architectures to apply these findings to actual cryptographic circuits. Experimental results obtained using a fault injector on an FPGA board demonstrate the detection and correction performance of the architectures. <s> BIB016 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> S. Skorobogatov and R. Anderson identified laser illumination as an effective technique to conduct fault attacks in 2002. In these early days of laser-induced fault injection, it was proven to be possible to inject single-bit faults into integrated circuits. This corresponds to the more restrictive fault model found in the fault attack bibliography. The target area under laser illumination (a few micrometers, down to ~1 µm) broadly matched that of a single transistor. It was consistent with a single-bit fault model. However, since then the technology of secure devices has evolved. In current circuits even the smallest laser spots may illuminate several logic cells. This raises the question of the validity of the single-bit fault model: does it still hold? In this work, we report an assessment of its validity through experimental results obtained from circuits designed at the 28 nm CMOS technology node. We also describe the main properties of the corresponding fault model obtained from both static and dynamic experiments. <s> BIB017 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Microprobing allows intercepting data from on-chip wires as well as injecting faults into data or control lines. This makes it a commonly used attack technique against security-related semiconductors, such as smart card controllers. We present the low area probing detector (LAPD) as an efficient approach to detect microprobing. It compares delay differences between symmetric lines such as bus lines to detect timing asymmetries introduced by the capacitive load of a probe. Compared with state-of-the-art microprobing countermeasures from industry, such as shields or bus encryption, the area overhead is minimal and no delays are introduced; in contrast to probing detection schemes from academia, such as the probe attempt detector, no analog circuitry is needed. We show the Monte Carlo simulation results of mismatch variations as well as process, voltage, and temperature corners on a 65-nm technology and present a simple reliability optimization. Eventually, we show that the detection of state-of-the-art commercial microprobes is possible even under extreme conditions and the margin with respect to false positives is sufficient. <s> BIB018 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Software security techniques rely on correct execution by the hardware. Securing hardware components has been challenging due to their complexity and the proportionate attack surface they present during their design, manufacture, deployment, and operation. Recognizing that external communication represents one of the greatest threats to a system's security, this paper introduces the TrustGuard containment architecture. TrustGuard contains malicious and erroneous behavior using a relatively simple and pluggable gatekeeping hardware component called the Sentry. The Sentry bridges a physical gap between the untrusted system and its external interfaces. TrustGuard allows only communication that results from the correct execution of trusted software, thereby preventing the ill effects of actions by malicious hardware or software from leaving the system. The simplicity and pluggability of the Sentry, which is implemented in less than half the lines of code of a simple in-order processor, enables additional measures to secure this root of trust, including formal verification, supervised manufacture, and supply chain diversification with less than a 15% impact on performance. <s> BIB019 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Leveraging 2.5D interposer technology, we advocate the integration of untrusted commodity components/chiplets with physically separate, entrusted logic components. Such organization provides a modern root of trust for secure system-level integration. We showcase our scheme by utilizing industrial ARM components that are interconnected via a security-providing active interposer, and thoroughly evaluate the achievable security via different threat scenarios. Finally, we provide detailed end-to-end physical design results to demonstrate the efficacy of our proposed methodology. <s> BIB020 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> ARM TrustZone builds a trusted execution environment based on the concept of hardware separation. It has been quite successful in defending against various software attacks and forcing attackers to explore vulnerabilities in interface designs and side channels. The recently reported CLKscrew attack breaks TrustZone through software by overclocking CPU to generate hardware faults. However, overclocking makes the processor run at a very high frequency, which is relatively easy to detect and prevent, for example by hardware frequency locking. In this paper, we propose an innovative software-controlled hardware fault-based attack, VoltJockey, on multi-core processors that adopt dynamic voltage and frequency scaling (DVFS) techniques for energy efficiency. Unlike CLKscrew, we manipulate the voltages rather than the frequencies via DVFS unit to generate hardware faults on the victim cores, which makes VoltJockey stealthier and harder to prevent than CLKscrew. We deliberately control the fault generation to facilitate differential fault analysis to break TrustZone. The entire attack process is based on software without any involvement of hardware. We implement VoltJockey on an ARM-based Krait processor from a commodity Android phone and demonstrate how to reveal the AES key from TrustZone and how to breach the RSA-based TrustZone authentication. These results suggest that VoltJockey has a comparable efficiency to side channels in obtaining TrustZone-guarded credentials, as well as the potential of bypassing the RSA-based verification to load untrusted applications into TrustZone. We also discuss both hardware-based and software-based countermeasures and their limitations. <s> BIB021 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Side-channel power analysis is a powerful method of breaking secure cryptographic algorithms, but typically power analysis is considered to require specialized measurement equipment on or near the device. Assuming an attacker first gained the ability to run code on the unsecure side of a device, they could trigger encryptions and use the on-board ADC to capture power traces of that hardware encryption engine.This is demonstrated on a SAML11 which contains a M23 core with a TrustZone-M implementation as the hardware security barrier. This attack requires 160 × 106 traces, or approximately 5 GByte of data. This attack does not use any external measurement equipment, entirely performing the power analysis using the ADC on-board the microcontroller under attack. The attack is demonstrated to work both from the non-secure and secure environment on the chip, being a demonstration of a cross-domain power analysis attack.To understand the effect of noise and sample rate reduction, an attack is mounted on the SAML11 hardware AES peripheral using classic external equipment, and results are compared for various sample rates and hardware setups. A discussion on how users of this device can help prevent such remote attacks is also presented, along with metrics that can be used in evaluating other devices. Complete copies of all recorded power traces and scripts used by the authors are publicly presented. <s> BIB022 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space by exploiting side-effects from transient instructions. While this attack has been mitigated through stronger isolation boundaries between user and kernel space, Meltdown inspired an entirely new class of fault-driven transient-execution attacks. Particularly, over the past year, Meltdown-type attacks have been extended to not only leak data from the L1 cache but also from various other microarchitectural structures, including the FPU register file and store buffer. ::: ::: In this paper, we present the ZombieLoad attack which uncovers a novel Meltdown-type effect in the processor's fill-buffer logic. Our analysis shows that faulting load instructions (i.e., loads that have to be re-issued) may transiently dereference unauthorized destinations previously brought into the fill buffer by the current or a sibling logical CPU. In contrast to concurrent attacks on the fill buffer, we are the first to report data leakage of recently loaded and stored stale values across logical cores even on Meltdown- and MDS-resistant processors. Hence, despite Intel's claims, we show that the hardware fixes in new CPUs are not sufficient. We demonstrate ZombieLoad's effectiveness in a multitude of practical attack scenarios across CPU privilege rings, OS processes, virtual machines, and SGX enclaves. We discuss both short and long-term mitigation approaches and arrive at the conclusion that disabling hyperthreading is the only possible workaround to prevent at least the most-powerful cross-hyperthread attack scenarios on current processors, as Intel's software fixes are incomplete. <s> BIB023 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> In this paper we present a novel hidden-delay-fault sensor design and a preliminary analysis of its circuit integration and applicability. In our proposed method, the delay sensing is achieved by sampling data on both rising and falling clock edges and using a variable duty cycle to control the length of the path to be tested. The main advantage of our proposed method is that it works at nominal frequency, it can detect hidden-delay-faults on short paths and it is versatile in its applicability. It can be used (i) during testing to perform user-defined hidden-delay-fault test, (ii) for reliability degradation estimation due to process, environmental variations and ageing, and (iii) in security to detect the insertion of Trojan horses that alter the path delay. <s> BIB024 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Probing attacks against integrated circuits has become a serious concern, especially for security-critical applications. With the help of modern circuit editing tools, an attacker could remove layers of materials and expose wires carrying sensitive on-chip assets, such as cryptographic keys and proprietary firmware, for probing. Most of the existing protection methods use an active shield that provides tamper-evident covers at the top-most metal layers to the circuitry below. However, they lack formal proofs of their effectiveness as some active shields have already been circumvented by hackers. In this paper, we investigate the problem of protection against front-side probing attacks and propose a framework to assess a design's vulnerabilities against probing attacks. Metrics are developed to evaluate the resilience of designs to bypass an attack and reroute the attack, the two common techniques used to compromise an antiprobing mechanism. Exemplary assets from a system-on-chip layout are used to evaluate the proposed flow. The results show that long net and high layer wires are vulnerable to a probing attack equipped with high aspect ratio focused ion beam. Meanwhile, nets that occupy small area on the chip are probably compromised through rerouting shield wires. On the other hand, the multilayer internal orthogonal shield performs the best among common shield structures. <s> BIB025 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> INTRODUCTION <s> Invasive attacks such as micro-probing or focused-ion-beam (FIB) circuit editing are serious threats to security-related semiconductors. To ensure that there is security against invasive attacks, an effective countermeasure is to use a protective layer as a secure shield. Previous secure shield methods can be classified into one of two categories; detection circuits based on the delay difference or block ciphers. For the former, timing asymmetries caused by the capacitance of the probe are detected. The main drawback of this method is that it is highly vulnerable to chip editing by FIB equipment. FIB circuit editing can easily cripple the detection circuits of the secure shield. In contrast, the cryptographically secure shield based on the block cipher can provide strong protection against FIB circuit editing. However, it is prone to micro-probing attacks because of its inability to detect the capacitance load of the probe. In this paper, we propose a robust secure shield architecture against invasive attacks including both probe attempts and the FIB circuit editing. The proposed method is based on detection circuits with low hardware overhead and fast analysis time and includes protection circuits to prevent information from being leaked. <s> BIB026
In our modern age of omnipresent and highly interconnected information technology, (cyber)security becomes ever more challenged. Among many other prominent incidents, e.g., in April 2019, more than 885 million records from First American Corporation, including bank account details, Social Security digits, etc., were leaked publicly on the internet  . Within the realm of cybersecurity in general, hardware security in particular is concerned about achieving security and trust directly within the underlying electronics. Therefore, hardware security seeks to build up, e.g., so-called root of trust (RoT) schemes for isolation and attestation of computation BIB013 BIB019 BIB020 , or other hardware primitives and protection schemes. As with most aspects of modern electronic systems and integrated circuits (ICs), hardware security has traditionally evolved around the dominant complementary metal-oxide-semiconductor (CMOS) technology. However, with the rise of various emerging technologies, whose main purpose is to overcome the fundamental limitations for scaling and power consumption of CMOS technology, unique opportunities arise also to advance the notion of hardware security. For example, the use of memristive technology is promising for the secure management of secret keys BIB014 , which is rather challenging for CMOS memory technologies. In this paper, I review initially the fundamentals of hardware security and prior art for CMOS technology, for both the key domains of (i) data security at runtime and (ii) confidentiality and integrity of hardware itself (Sec. 2). Then, I cover the fundamentals of selected, prominent emerging technologies, namely (i) spintronics, (ii) memristors, (iii) carbon nanotubes and related transistors, (iv) nanowires and related transistors, and (v) 3D and 2.5D integration (Sec. 3). Based on this review, promising matches of emerging technologies and their properties toward the needs for hardware security are revealed (Sec. 4). Selected researched and (at least partially) demonstrated security schemes which are based on emerging technologies are also discussed in Sec. 4. In Sec. 5, I uncover challenges-and resulting chances-for future advancements, essentially advocating for further interdisciplinary efforts. access or modification of data, side-channel and fault-injection attacks, and physical read-out and probing attacks. Next, I provide an overview on these threats and related countermeasures. 2.1.1 Unauthorized Access or Modification of Data. Such "breadand-butter" attacks are conducted mainly at the software level. Cryptography represents the most commonly applied protection scheme, while many hardware security features have been proposed and implemented as well, e.g., RoT architectures BIB013 BIB019 BIB020 or hardware crypto modules  and true random number generators (TRNGs) to support the latter. However, if not designed and implemented carefully, such security features become prone to hardware-centric attacks, e.g., see BIB002 BIB006 BIB021 BIB022  ; such attacks are discussed below. 2.1.2 Side-Channel and Fault-Injection Attacks. Side-channel attacks infer information from physical channels which are leaky due to sensitivities of electronics BIB003 . For example, it is well-known that the advanced encryption standard (AES) is vulnerable to power side-channel attacks when the hardware implementation is unprotected BIB002 BIB022 . For another example, modern processors leak information through caches and other buffers, related to timing behaviour, speculative execution, et cetera BIB004  BIB023 . Most countermeasures apply some kind of "hiding" or masking, i.e., diffusion of the information leaked through side-channels, by various means taken from the system level BIB007 down to gates BIB015 . Fault-injection attacks induce faults to aid deducing sensitive information. Therefore, fault injection can also support or advance side-channels attacks. Fault-injection attacks cover direct, invasive fault injection, e.g., by laser light BIB008 or electromagnetic waves BIB006  , as well as indirect fault injection, e.g., by repetitive writing to particular memory locations BIB009 or by deliberate "misuse" of dynamic voltage and frequency scaling (DVFS) features BIB021 . Countermeasures include detection of faults at runtime, e.g., see BIB024 , and hardening against fault injection at design and manufacturing time, e.g., see BIB016 BIB017 . Note that distinguishing between natural and malicious faults is non-trivial  2.1.3 Physical Read-Out and Probing Attacks. An adversary with access to equipment used traditionally for failure analysis or inspection, like electro-optical probing or focused-ion beam milling tools  , can mount quite powerful read-out attacks. Among others, these attacks are: probing of transistors and wires BIB011 BIB005 , either through the metal layers or the substrate backside; monitoring of the photon emission induced by CMOS transistor switching BIB012 ; or monitoring of electrical charges in memories  . Countermeasures seek to prevent and/or detect the physical access. Solutions include, e.g., shielding structures in the BEOL BIB025 BIB026 BIB010 , deflection or scrambling structures in the substrate  , and detector circuitry BIB018 . Earlier studies such as BIB001 also considered formally secure techniques. However, such schemes are subject to limitations assumed for the attackers, which can become obsolete and would then render the formal guarantees void.