Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Confidentiality and Integrity of Hardware: Trojan Defense. <s> The fabrication of digital Integrated Circuits (ICs) is increasingly outsourced. Given this trend, security is recognized as an important issue. The threat agent is an attacker at the IC foundry that has information about the circuit and inserts covert, malicious circuitry. The use of 3D IC technology has been suggested as a possible technique to counter this threat. However, to our knowledge, there is no prior work on how such technology can be used effectively. We propose a way to use 3D IC technology for security in this context. Specifically, we obfuscate the circuit by lifting wires to a trusted tier, which is fabricated separately. This is referred to as split manufacturing. For this setting, we provide a precise notion of security, that we call k-security, and a characterization of the underlying computational problems and their complexity. We further propose a concrete approach for identifying sets of wires to be lifted, and the corresponding security they provide. We conclude with a comprehensive empirical assessment with benchmark circuits that highlights the security versus cost trade-offs introduced by 3D IC based circuit obfuscation. <s> BIB001 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Confidentiality and Integrity of Hardware: Trojan Defense. <s> A manufacturer of custom hardware (ASICs) can undermine the intended execution of that hardware, high-assurance execution thus requires controlling the manufacturing chain. However, a trusted platform might be orders of magnitude worse in performance or price than an advanced, untrusted platform. This paper initiates exploration of an alternative: using verifiable computation (VC), an untrusted ASIC computes proofs of correct execution, which are verified by a trusted processor or ASIC. In contrast to the usual VC setup, here the prover and verifier together must impose less overhead than the alternative of executing directly on the trusted platform. We instantiate this approach by designing and implementing physically realizable, area-efficient, high throughput ASICs (for a prover and verifier), in fully synthesizable Verilog. The system, called Zebra, is based on the CMT and Allspice interactive proof protocols, and required new observations about CMT, careful hardware design, and attention to architectural challenges. For a class of real computations, Zebra meets or exceeds the performance of executing directly on the trusted platform. <s> BIB002 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Confidentiality and Integrity of Hardware: Trojan Defense. <s> Abstract 3-D ICs provide more transistor density and higher performance at smaller area compared to traditional 2-D ICs. However, elevated temperatures and longer heat dissipation paths in 3-D IC can lead to non-ideal delay variations. Higher temperatures lead to negative bias temperature instability (NBTI), and consequently shifts threshold voltage (Vth), which leads to current degradation and delay increment. These variations can be exploited by hardware intruder and introduce malicious circuit components causing malfunctioning in 3-D ICs. This paper takes the threat model in which the attacker has access to the hard-intellectual property (IP) development, and defender is at the foundry. This paper demonstrates that a hardware intruder can leverage the exacerbated NBTI effect to trigger the Trojan payload. Consequently, such Trojans does not require a conventional triggering circuit; hence we named it as self-triggered. The proposed hardware Trojan is very difficult to detect and can scape various countermeasures at testing phase due to ‘non-existing triggering signal’. The point of attack for the proposed Trojan is the body of the semiconductor device, for example, the body of PMOS device. When the Trojan gets activated it shorts the body and source of the PMOS to ground leading the device without power supply. We discussed the stealthy nature of our proposed Trojan against the existing countermeasures and also provided a discussion on a novel avenue of detecting such kinds of hardware Trojans. <s> BIB003 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Confidentiality and Integrity of Hardware: Trojan Defense. <s> Split manufacturing (SM) and layout camouflaging (LC) are two promising techniques to obscure integrated circuits (ICs) from malicious entities during and after manufacturing. While both techniques enable protecting the intellectual property (IP) of ICs, SM can further mitigate the insertion of hardware Trojans (HTs). In this paper, we strive for the "best of both worlds," that is we seek to combine the individual strengths of SM and LC. By jointly extending SM and LC techniques toward 3D integration, an up-and-coming paradigm based on stacking and interconnecting of multiple chips, we establish a modern approach to hardware security. Toward that end, we develop a security-driven CAD and manufacturing flow for 3D ICs in two variations, one for IP protection and one for HT prevention. Essential concepts of that flow are (i) "3D splitting" of the netlist to protect, (ii) obfuscation of the vertical interconnects (i.e., the wiring between stacked chips), and (iii) for HT prevention, a security-driven synthesis stage. We conduct comprehensive experiments on DRC-clean layouts of multi-million-gate DARPA and OpenCores designs (and others). Strengthened by extensive security analysis for both IP protection and HT prevention, we argue that entering the third dimension is eminent for effective and efficient hardware security. <s> BIB004 </s> Hardware Security For and Beyond CMOS Technology: An Overview on Fundamentals, Applications, and Challenges <s> Confidentiality and Integrity of Hardware: Trojan Defense. <s> Leveraging 2.5D interposer technology, we advocate the integration of untrusted commodity components/chiplets with physically separate, entrusted logic components. Such organization provides a modern root of trust for secure system-level integration. We showcase our scheme by utilizing industrial ARM components that are interconnected via a security-providing active interposer, and thoroughly evaluate the achievable security via different threat scenarios. Finally, we provide detailed end-to-end physical design results to demonstrate the efficacy of our proposed methodology. <s> BIB005
In BIB004 , the authors leveraged the benefits provided by 3D split manufacturing to advance the formally-secure but high-cost scheme of BIB001 to mitigate Trojan insertion at manufacturing time. Besides, 3D and 2.5D ICs seem rather more vulnerable than 2D ICs to Trojan insertion during design and manufacturing time. For example, the study in BIB003 considered the negative bias temperature instability (NBTI) effect as stealthy Trojan trigger, motivated by the fact that thermal management is a well-known challenge for 3D ICs. In a more general manner, I caution that the broader landscape of suppliers and actors involved with 3D and 2.5D integration can open up new opportunities for attackers to embed Trojans. Such a concern has also been voiced recently in  , along with the wide-spread notion of wafer-level chip-scale packaging (WLCSP). The hypothesized attack here is that some malicious fabrication or integration facility could place a thin Trojan chip between the target chip and the package microbumps, while that Trojan chip would contain TSVs to both pass-through and tap into those external connections, gaining access to all signals at will. To mitigate detection by visual or X-ray inspection, it was argued that aligning those TSVs with the microbump locations might suffice. Trojan detection at runtime, however, can benefit from 3D and 2.5D integration. That is because related security features can be implemented separately using a trusted fabrication process and integrated/stacked later on with the commodity chip(s) to be monitored BIB005 BIB002 ; see also the discussion on data security below.