Co-Principal investigator:Dr. Pouya Tavousi, University of Connecticut

Inspection and reverse engineering of microelectronics requires acquiring detailed 3D images of these parts. Doing so using nondestructive methods such as X-ray computed tomography (X-ray CT) has resolution limitations. Destructive methods, which work based on consecutive delayering and imaging of the sample, face a tradeoff between throughput and resolution. Using focused ion beam (FIB) for delayering, although high precision, is low throughput. On the other hand, mechanical methods that can offer fast delayering, are low precision and may put the sample integrity at risk. Herein, we propose to use femtosecond laser as the delayering method in combination with multimodality microscopy as the imaging technique for performing rapid 3D imaging. The proposed technique has several advantages. First, it eliminates the 3D image distortion resulting from non-flat layers, that can occur in other methods. It further allows layer height variations to be maintained within a small range. Finally, it enables material characterization based on the processing of material ablation rate at different locations.

P1_23 Climate and Related Stressors of Semiconductor Supply Chains

Co-Principal investigator: Dr. Zachary A. Collier, Dr. Julianne D. Quinn, Mr. Thomas Polmateer; University of Virginia

The global supply chains for semiconductors and embedded devices are geographically distributed, exposed to stressors associated to climate and natural disasters. Sea level rise, hurricanes and typhoons, floods, droughts, and other sources of risk can disrupt the global supply chain, potentially resulting in cascading effects similar to those of the COVID pandemic. As climate impacts natural and manmade systems, assessing the disruptions of climate-induced stressors to the global semiconductor supply chain is an essential activity of risk management. This proposed CHEST project will develop practical methodologies to explore the vulnerabilities of the global supply chains of semiconductors and integrated devices to climate and other stressors. By correlating geographic maps of key supply chain nodes with projected climate variables over several geographic scales and time frames, the effort will identify the most vulnerable links in the supply chain. This will aid manufacturers in devising risk mitigations, such as alternative sourcing strategies, freight plans, etc., that can reduce climate risks into the future.

P2_23 Risk of Critical Materials Supply Disruptions in Chip Manufacturing

Co-Principal investigator: Dr. Zachary A. Collier, Dr. Garrick Louis, Mr. Thomas Polmateer; University of Virginia

The semiconductor manufacturing process needs supplies of various materials including chemical elements and compounds. Globally sourcing these various inputs and acquiring a secure supply is a supply chain challenge. Geopolitical tensions and other supply chain disruptions can impact the availability of such critical process inputs. Supply chain managers need a process to identify and prioritize the vulnerabilities of key material inputs. This proposed CHEST project will develop a methodology to assess the vulnerability associated with material inputs for semiconductor manufacturing. By identifying the set of material inputs and their geographic sources of supply, we will identify the most vulnerable materials. This information can support supply chain risk management and procurement strategies that mitigate risks of disruptions in supply.

P3_23Specification Reverse Engineering from FPGA Netlists

Co-Principal investigator: Dr. Marty Emmert, University of Cincinnati

Ensuring the safety and security of critical legacy FPGA (Field-Programmable Gate Array) hardware generally requires reengineering these systems in state-of-the-art technologies using the latest design-for-trust methods. Often HDL models of the legacy systems need to be reverse engineered due to the lack of ready availability of the original HDL models. Reverse engineering of FPGA designs can be divided into two major phases: (1) Extraction of an LUT (Look-Up Table) level netlist from the configuration bit-stream data. This phase is named netlist reverse engineering. (2) Extraction of an RTL (Register-Transfer Level) model from the LUT-level netlist. This phase is termed functional reverse engineering or specification discovery and poses significant challenges due to the granularity of the LUTs which absorb large Boolean functions, and the unstructured nature of the LUT netlists. This phase, i.e. specification discovery, is the focus of the proposed project.

More specifically, this project will (1) enhance and integrate multiple methods to identify word-level data path modules in LUT netlists, (2) develop new methods to eliminate false positives and overlaps to increase accuracy, (3) develop specialized functional reverse engineering methods for DSP slices and multi-port BlockRAM memory units, (4) develop an RTL model extraction methodology and tool flow based on these point algorithms, and (5) evaluate and demonstrate the tool flow on practical FPGA designs.

P4_23 Data Augmentation to Enhance Machine Learning Based Security Assessment and Reverse Engineering of Microelectronics through a Cloud-based platform

Co-Principal investigator: Dr. Pouya Tavousi, University of Connecticut

Defective microelectronics pose significant risks to industries, governments, and societies. Efficient identification of defective parts is critical to prevent or mitigate potential damages. Imaging is one of the methods used for detecting defects, but both manual and automated approaches suffer from the lack of ground truth data from defective parts. This limitation hinders the ability of subject matter experts and machine learning models to effectively recognize and classify new cases of defective parts. In this proposal, we propose a data augmentation workflow that generates virtual defective/counterfeit parts, thereby overcoming the lack of data problem and enabling the creation of large datasets at low cost. Our data augmentation workflow further generates automatically labelled ground truth data for training machine-learning-based image segmentations which would enable reverse engineering of parts from multiple modalities of images. The workflow will be implemented and available via a cloud-based platform which not only enables the use of the services without the need for any special software/hardware on the user’s side, but also allows users from remote geographical locations to collaborate on image visualization and analysis through shared sessions, which is particularly useful for workforce training purposes.

P5_23 Automated High-resolution Inspection and Reverse Engineering of Microelectronics Using Laser and Multimodality Microscopy

Co-Principal investigator: Dr. Pouya Tavousi, University of Connecticut

To inspect and reverse engineer microelectronics, obtaining detailed 3D images of the parts is necessary. However, the use of nondestructive methods like X-ray computed tomography (X-ray CT) has limitations in resolution. Destructive methods, which involve delayering and imaging the sample, have a tradeoff between throughput and resolution. Focused ion beam (FIB) delayering has high precision but low throughput, while mechanical methods provide fast delayering but low precision and potential damage to the sample. In this proposal, femtosecond laser delayering combined with multimodality microscopy for imaging is suggested for rapid 3D imaging. This method has several benefits: it eliminates 3D image distortion caused by non-flat layers and maintains layer height variations within a small range. Additionally, it allows for material characterization based on the processing of material ablation rate at various locations as well as using laser-induced breakdown spectroscopy.

Co-Principal investigator: N/A

In this project, we propose to develop machine learning-based solutions for attesting the provenance of manufactured wafers containing integrated circuits (ICs), in order to provide assurance regarding their origin and curtail the risk of using these ICs in sensitive applications. Our conjecture is that the foundry, the equipment, and the mask-set used during manufacturing leave a systematic signature on fabricated wafers, which can be measured, modeled and compared against for the purpose of provenance attestation. Accordingly, we propose to expand existing statistical side-channel fingerprinting methods and to develop novel machine learning-based methods which will use measurements obtained at various steps of semiconductor manufacturing to quantitatively assess the likelihood that a wafer was fabricated at a trusted facility, through a trusted line of equipment and with a trusted mask-set. To evaluate our method, we will initially use an extensive dataset that has been furnished to us from one of the IAB members (GlobalFoundries), containing all available relevant data from approximately 10K wafers fabricated in a 12nm FinFET technology. Additional data and synthetic enhancement thereof will also be pursued throughout this project to broaden the evaluation scope of the developed methods.

P7_23 Investigating the Weaknesses of IP Protection through eFPGA-based Hardware Redaction

Co-Principal investigator: Dr. Yiorgos Makris, University of Texas at Dallas

Protecting Intellectual Property (IP) of electronic designs from untrusted parties involved in the semiconductor manufacturing supply chain has become a topic of intense interest. Among different proposed solutions design obfuscation has shown to be the most viable solution. Design obfuscation can be described as the process that transforms a circuit into another functional equivalent version that is significantly difficult, ideally impossible, to reverse engineer. One very promising new approach for design obfuscation is through hardware redaction, by mapping a portion of the hardware design to an embedded Field-Programmable Gate Array (eFPGA). This approach has been shown to be more secure than traditional approaches as the search space is much larger considering that the bitstream not only determines the functional logic mapped onto the eFPGA but also the interconnect [2-4]. One of the main problems with this approach though is the added design complexity, and area, power and delay overheads. Moreover, we have recently presented the first attack by mapping approximate synthesizable predictive models onto the eFPGA [5]. Although this attack only works for designs that tolerate certain degrees of errors at their output, it opens the window to more sophisticated attacks. In this proposal we plan on investigating these attacks, analyze the weaknesses of this approach and suggest countermeasures against these attacks.

P8_23 Cost-Effective IC Redaction through a CMOS/MRAM Transistor-Level Programmable Fabric

Co-Principal investigator: Dr. Joseph Friedman,  Dr. Yiorgos Makris, University of Texas at Dallas

In this project, we propose to develop a cost-effective mechanism for protecting sensitive hardware intellectual property through hybrid ASIC/Programmable integrated circuit design. In contrast with the use of eFPGAs or other Look-Up Table (LUT-) based solutions, which incur intolerable area, power and performance overhead and which require external storage and loading of the configuration bitstream upon power-on, this project takes a different approach: based on the observation that existing solutions may be an overkill, we start with a state-of-the-art Transistor-Level Programmable (TRAP) fabric, which PI Sechen and Co-PI Makris developed previously for the purpose of IC redaction, and we seek to explore the trade-off between fine-grain programmability and ability to withstand bitstream retrieval attacks. Moreover, leveraging Co-PI Friedman’s expertise in spintronics, we seek to replace the SRAM memory that is currently employed in TRAP with MRAM. Besides dramatically reducing the required overhead, the proposed fine-grained hybrid CMOS/MRAM implementation of TRAP also offers the option of non-volatile bitstream storage, thereby simplifying IC operation. Successful design of this hybrid CMOS/MRAM design in the first year of this project will lead to a request for an extension in order to tape-out this fabric at a compatible technology and demonstrate it in silicon.

P9_23 Robust Cross-Device Side-Channel Attacks

Co-Principal investigator: Dr. Marty Emmert, University of Cincinnati

Built upon the research findings of this project in Year 1 & Year 2, this research in Year 3 proposes a new method to reduce the size of neural networks for side-channel attacks in the cross-device setting. In the cross-device setting, training power traces are from one device while test power traces are from a different device. It is a more realistic attack setting than the single-device setting primarily investigated in existing studies. Distribution shifts between training traces and test traces can be introduced by discrepancies in keys, hardware, software, and acquisition setups between two devices. In Year 1, we have developed two methods based on transfer learning, including triplet networks and adversarial domain adaptation, to successfully improve the accuracy of deep-learning side-channel attacks in the cross-device scenario. In other words, we answered the question “How to transfer?” in Year 1. In Year 2, we focus on investigating various software discrepancies and developing methods to quantify distribution shifts caused by hardware and software discrepancies.

Despite promising results in Year 1 and Year 2, the neural networks we developed for side-channel attacks are complex, which requires millions of parameters and several hours (even days) to train on a GPU machine. This raises significant challenges for deploying a neural network on an embedded or mobile device to perform side-channel attacks. In other words, the current neural networks are not portable. To tackle the above limitation in Year 3, the team proposes a new pruning algorithm to reduce the size of neural networks but still be able to effectively recover keys. In addition to size reduction, pruning can also reduce training time and memory usage, which allows a resource-constrained device, such as a Raspberry Pi, to run testing (and even training) of deep-learning side-channel attacks. We will implement the proposed method and conduct comprehensive evaluations by examining both power and EM (electromagnetic) traces on multiple targets, including microcontrollers (8-bit AVR XMEGA and 32-bit ARM STM32F3) and FPGAs (Xilinx Artix-7), running AES-128 encryption using ChipWhisperer platform. Large-scale datasets, source code, and publications will be shared with CHEST industry partners.

P10_23 Secure Coding against Hardware Attacks

Co-Principal investigator: Dr. Marty Emmert, Dr. Nan Niu, University of Cincinnati

This project proposes to develop a new method to automatically detect lines in C code (and assembly code) that are vulnerable under hardware attacks, including side-channel attacks and fault injection attacks. The overarching goal is to promote the security and resilience of embedded systems against hardware attacks by minimizing vulnerabilities at the software level. This will be a multi-year project in which the entire framework eventually will be able to perform automatic detection and repair over C and assembly code against side-channel attacks and fault-injection attacks. Programmers will be able to leverage this framework to minimize hardware-related vulnerabilities in source code at the development stage. In Year 1, the team will focus on detecting lines that are vulnerable under fault injection attacks.

A fault injection attack is a physical attack on data and behavior of an embedded device by changing the voltage, temperature or electromagnetic radiation. To mitigate fault injection attacks, one effective way at the software level is to write secure code that is more resilient against the attacks. For instance, the value of a Boolean variable (e.g., flag) in an if statement (e.g., if (flag == 1)) can be easily modified by fault injection attacks while using non-trivial numerical values (e.g., if (flag == 0x3CA5)) can make the attacks more difficult (modifying a single bit v.s. modifying multiple bits).

The team has previously developed and published a method [1] which can automatically detect 3 out of 9 insecure coding patterns defined in Riscure whitepaper [2, 3]. In this project, the team will extend the research (1) to detect the remaining 6 insecure coding patterns in C and 2 to detect the previous 3 insecure coding patterns that we have examined in assembly. Our main idea is to (1) parse code with static program analysis tools (e.g., ANTLR and Joem) or customized parsers; (2) detect insecure lines with string matching and Natural Language Processing. Datasets, source code, and publications will be shared with CHEST partners.

P11_23 Side Channel Vulnerability Analysis and Mitigation for Emerging Machine Learning Models on ARM and X86 Architectures

Co-Principal investigator: N/A

In recent years, rapid advancements in artificial intelligence (AI) have led to transformative changes in various industries, offering opportunities to automate tasks, enhance decision-making, and foster innovation. One example is the ResNet [1] architecture, a Convolutional Neural Network model used widely in computer vision tasks such as image classification, object detection, and semantic segmentation. Similarly, the Transformer [2] model is widely used in natural language processing. However, with the increasing use of AI in collecting and processing vast amounts of personal data, such as biometric data, online activity, and location data, there is a growing concern for privacy and security vulnerabilities exploited by side-channel attacks.

This project aims to investigate and mitigate potential security vulnerabilities that target side-channel information in current AI technologies. The project consists of two parts: vulnerability investigation and mitigation solutions. In the first part, we plan to implement and deploy adversarial approaches that leverage various side-channel information, including timing, power consumption, and hardware performance events. In the second part, we will determine the root cause of these vulnerabilities and propose mitigation solutions to patch and prevent these vulnerabilities from being exploited by potential attackers. By addressing these privacy and security concerns, we can ensure that AI technologies continue to offer benefits to society while have been safeguarded potential risks.

P12_23 Security Analysis of Post-Quantum Cryptography CRYSTAL-Kyber Implementations

Co-Principal investigator: N/A

Post-quantum cryptography (PQC) has gained significant attention in recent years, mainly due to the growing concern over the potential threats posed by quantum computers to traditional public-key cryptographic algorithms such as RSA and ECC. CRYSTALS-Kyber is a lattice-based key encapsulation mechanism (KEM) designed to resist both classical and quantum computers. It can be implemented on commodity processors or specialized hardware to secure all network traffic by encryption. However, standard Kyber implementations are still susceptible to side-channel attacks, specifically power and electromagnetic side channels. This project proposes to investigate a series of less invasive and more realistic power/EM attacks that utilize software measurements to break Kyber key exchanges, compromising the security and authenticity of data communications in a more efficient way.

P13_23 Risk and Uncertainty Quantification using Multi-fidelity CHEST Devices

Co-Principal investigator: Dr. James Lambert, Dr. Zachary Collier, University of Virginia

Continuous and reliable risk and uncertainty analysis of complex systems is essential for developing timely risk mitigation strategies and optimal operation of the systems. It is, therefore, imperative to constantly understand and predict the behavior of the system under often incomplete and imperfect observations of the system. Ignoring the uncertainty stemming from imperfect observations may lead to a lack of preparedness for unforeseen scenarios. In this work, we aim to develop efficient uncertainty quantification methodologies that take into account the imperfections in observations and facilitate reliable risk estimation and management.

Co-Principal investigator: N/A

The growth of Internet of Things (IoT) devices in various sectors has been substantial. Central to the IoT ecosystem are embedded devices, which comprise hardware and firmware. Firmware is the primary source of business logic, and any vulnerabilities present in it can have a direct or indirect effect on the entire system. Several factors have contributed to the absence of vulnerability detection and mitigation features in embedded devices. These include a lack of awareness of security concerns, the need for rapid time-to-market, resource limitations, and insufficient scalable and user-friendly automated tools for firmware testing. Consequently, the firmware in these devices is susceptible to attacks by malicious actors seeking to exploit these vulnerabilities. There exist several types of embedded firmware, which include Linux OS-based, monolithic firmware such as bare-metal, and RTOS-based firmware. The analysis of such firmware can be carried out using static and dynamic techniques. Although the study of Linux OS-based user space firmware has been considerably decent, analyzing monolithic firmware remains a challenging task. Various industries, such as automotive, aerospace, defense, and critical infrastructures, employ monolithic firmware-based embedded systems. The diverse range of custom implementations from various vendors makes the analysis of such systems a more complicated task. While fuzzing is a cutting-edge technique used to identify security vulnerabilities in software, implementing it from an embedded perspective poses significant challenges. This project aims to improve and streamline fuzzing techniques to perform the security assessment on hardware peripheral-based third-party SDKs/libraries (e.g. I2C, SPI) used in various embedded devices.

P15_23 Deploying Advanced GPT & LLM Language Models in an Ontology-Driven Framework for Hardware Vulnerability Prediction and Analysis

Co-Principal investigator: Dr. Houman Homayoun, University of California Davis

The number of publicly known Common Vulnerabilities and Exposures (CVEs) submitted to the national vulnerability database (NVD) has increased significantly due to the increasing complexity of modern computing systems. However, it is cumbersome to extract useful information from this large corpus of unstructured data and find meaningful trends over time without proper tools. As a result, vulnerability management has become an important task in cybersecurity [1]. Recently, there has been a lot of analytical studies on the openly available Common Weaknesses Enumeration (CWE) database. These studies mostly focus on connecting the CVE entries in the NVD to a corresponding weakness in the CWE dataset using traditional Machine Learning (ML) approaches. However, almost all existing works in the literature focus on software vulnerabilities, and hardware vulnerabilities are often far from the focus of the analysis. Unlike software vulnerabilities, hardware vulnerabilities are not easily patchable and cannot be fully mitigated. It was not until February 2020 that the MITRE added a new category focused only on hardware exposures. Moreover, the CVE instances are manually connected to CWE entries by cyber security experts, however there are some inconsistencies due to human error. Furthermore, there is a need for a novel ML-assisted framework that extracts useful information from these openly available datasets, find trends, analyze the relationships and similarities among various data points, and provide insight into how to prevent emerging vulnerabilities and impacts. Thus, we aim to propose an ML-based framework for vulnerability and impact vector classification focusing on the hardware vulnerabilities in the IoT domain. Our proposed approach will be equipped with an ontology-driven framework, which updates the ontology in an automated fashion and aims to identify similar patterns of vulnerabilities over time using Generative Pre-trained Transformers (GPT) and Large Language Models (LLMs). By exposing pre-trained models such as GPT-3 API to CVE datasets, and fine tuning it using hugging face framework we will develop a smart framework which helps mitigate the impacts of vulnerabilities or predict and prevent future vulnerabilities. Our proposed ML-based approach in conjunction with our proposed ontology-driven framework will provide recommendations in regards to mitigation strategies to reduce the impacts vulnerabilities.

P16_23 Enabling Dynamic Flow Analysis for Bare-Metal Embedded Firmware Binaries

Co-Principal investigator: N/A

Embedded systems serve as foundational components of the technologies that pervade modern life. Given that an embedded system’s behavior is in turn defined by the firmware that resides in the system’s memory, it follows that bugs and vulnerabilities found in device firmware can become critical threats that have cascading consequences at both individual and national levels. Despite this reality, firmware security for many embedded and cyber-physical systems consistently remains unaddressed, making firmware bugs are all too common in the real world. Worse, many of them can be difficult to isolate and diagnose due to firmware programs’ tight coupling with hardware and temporal nature, necessitating more thorough analysis techniques. In traditional software, control flow graph (CFG) analysis and dynamic information flow tracking (DIFT) are powerful techniques for detecting and triaging vulnerabilities [1-3]; however, they have gotten less attention in firmware due to the inherent challenges of applying dynamic techniques to firmware. We propose the design and implementation of an emulation-based analysis framework that enables control flow graph analysis and dynamic information flow tracking for bare-metal embedded systems firmware binaries, which are particularly useful for detecting memory-based vulnerabilities and control flow hijacking exploits. Such a framework would be an invaluable asset to both embedded systems developers and security analysts for hardening firmware.

P17_23 Integrating GPUs and FPGAs with Processing-in-Memory to Accelerate Fully Homomorphic Encryption

Co-Principal investigator: N/A

Computer security continues to grow in importance as computation and storage of sensitive data is increasingly outsourced to cloud-based computing services. Moreover, with the rapid development of quantum computers, we expect to see new classes of threats looming that can defeat the security of long trusted cryptosystems. Fully Homomorphic Encryption (FHE) is a potential solution to address both challenges. FHE enables computation directly on encrypted data, supporting secure computations on untrusted computing servers. The security of many modern FHE schemes is based on the hardness of the Ring Learning with Errors problem, which is presumed to be resistant to quantum attacks.

Although FHE offers a high degree of security, it suffers from prohibitively large computational costs. In the first year of this project, we characterized FPGA-based and GPU-based implementations of polynomial multiplication. The goal was to accelerate its two major computationally-expensive operations: 1) modular reduction and 2) the Number Theoretic Transform (NTT). We have already published two papers on our progress on this project [1][2] and have a paper under review describing the range of microarchitectural extensions that we have explored. We have leveraged a Xilinx FPGA in our work to implement some of our microarchitectural enhancements, which has allowed us to get timing, power and area parameters. From our analysis of FHE during the first year of this project, we have identified key bottlenecks that remain in our GPU-based FHE implementation. Our focus moving forward it to consider addressing these bottlenecks from both a memory technology solution and algorithmic optimizations.

P18_23 On-Chip and Continuous Monitoring of EM Signals for Secure Microelectronics

Co-Principal investigator: Dr. Marty Emmert, University of Cincinnati

IC designs are getting complex requiring billions of transistors on a chip. Manufacturing of IC and semiconductors is getting even more complex with availability of new transistor technologies at advanced nodes and 2.5D, 3D, and monolithic integration and heterogenous packaging options to meet the system requirements. Under these scenarios, detecting hardware trojans during design and manufacturing stages is a complex problem as most detection techniques work under a basic assumption of a “threat-model” that can have limitations. For heterogeneously integrated systems, detection of trojans is more complex as integrated test vectors are needed. Insertion of hardware trojan is not a random event (like Process Voltage Temperature variabilities) but rather it is driven by an attacker’s intent. Therefore, defense electronics need more stringent protection schemes over non-defense electronics due to possible scale of damage (i.e. Zero Trust Model). This imposes an interesting problem to address: how defense electronics can be selectively made more secured while using the same manufacturing and design tools used by non-defense electronics? We propose to solve this problem by developing low-cost integrity monitoring approaches and integrating it on pre-fabricated CMOS dies or heterogeneously packaged systems. Our proposed monitoring approach is based on integrating antenna arrays with high spatial coverage on CMOS dies and sensing the electromagnetic (EM) emissions from IC in real-time over its entire lifetime. The sensitivity of this approach can be increased by making use of machine learning (ML) based approach for data analysis that can detect changes in EM signals from expected behavior. Using this approach we can detect any integrity issues leading to changes in EM signals. Our current emphasis is to make use of this approach for predicting normal vs. accelerated aging of ICs due to process tampering. We believe this approach is scalable and can be integrated to monitors entire system or each component even in complex heterogenous packages.

P19_23 GNN-based Hardware Trojan Detection for Large Complex Third-Party IPs

Co-Principal investigator: Dr. Caiwen Ding, University of Connecticut

The third Party (3PP) IPs have been widely used in industry to facilitate hardware designs. However, it has been a major concern that hardware Trojan may be embedded in 3PP IPs. It is important to detect any Trojans in early design stages. This project studies graphic neural networks (GNN) based methods for hardware Trojan detection for large complex 3PP IPs. The GNN models are trained with individual components and used for detecting hardware Trojans in large complex systems. In addition, we will study the techniques that partition large graphs and make the GNN based detection methods more accessible.

P20_23 Scalable Security Verification Framework for Digital and Analog/Mixed-Signal System-on-Chips

Co-Principal investigator: Dr. Yiorgos Makris, University of Texas at Dallas

System-on-Chip (SoC) is the brain behind modern computing devices, which are being extensively used in recording, analyzing, and communicating some of our most intimate personal information including health, location, activity, etc. Reusable hardware IP-based SoC design has emerged as a pervasive design practice in the industry to dramatically reduce design and verification cost while meeting aggressive time-to-market constraints. Growing reliance on these pre-verified hardware IPs, often gathered from untrusted third-party vendors (3PIPs), severely affects the security and trustworthiness of SoC computing platforms. Based on Common Vulnerability Exposure (CVE-MITRE) estimates, if hardware-level vulnerabilities are removed, the overall system vulnerability will reduce by 43%. Existing research has demonstrated that commercial EDA tools fall short in executing security validation on a full-scale SoC [1]. In this research, we address this critical issue, by proposing a semi-formal SoC security validation approach. Unlike formal techniques, our proposed approach doesn’t suffer from state space explosion. On the other hand, the proposed method is able to identify corner case scenarios (typically exploited for introducing security vulnerabilities), that usually remain undetected by traditional simulation-based methods. The proposed technique will be scaled for digital and analog SoC components, as well as extended for improving post-silicon security validation.

Co-Principal investigator: N/A

The optical-electromagnetic (EM) channel in embedded camera circuits leaks sensitive images from camera systems, even when the camera is not recording. This problem is hard to solve because the circuits often require exposure to light in order to capture images in normal use, thus RF shielding would interrupt the normal use of the camera’s field of view. Moreover, the billions of already deployed smartphones makes it difficult to solve the leakage without requiring a hardware change. Our primary proposed research in the “EM Eye” project is to measure to what degree the electromagnetic leakage signals from camera circuits allow eavesdropping adversaries to recover the visual contents in the camera image streams, then testing the effectiveness of prototype defenses.