Breakthrough silicon scanning discovers backdoor in military chip

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7428 LNCS, Issue , 2012, Pages 23-40

  Skorobogatov, Sergei ^a   Woods, Christopher ^b  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

^b Quo Vadis Labs   (United Kingdom)

Author keywords

Hardware Assurance; PEA; side channel analysis; silicon scanning; silicon Trojans and backdoors

Indexed keywords

CONFIGURATION BITSTREAM; EMISSION ANALYSIS; FPGA CONFIGURATION; IN-CHIP; PEA; RE-PROGRAMMING; SECRET KEY; SECURITY KEY; SIDE-CHANNEL ANALYSIS; TROJANS;

CRIME; CRYPTOGRAPHY; EMBEDDED SYSTEMS; FIRMWARE; REVERSE ENGINEERING;

HARDWARE;

EID: 84866651033     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-33027-8_2     Document Type: Conference Paper

References (28)

1. Tehranipoor, M., Koushanfar, F.: A survey of hardware Trojan taxonomy and detection. IEEE Design and Test of Computers (2010)
2. Military ProASIC3/EL FPGA Fabric User's Guide. Microsemi (2011), http://www.actel.com/documents/Mil-PA3-EL-UG.pdf
3. Design Security in Nonvolatile Flash and Antifuse FPGAs, Security Backgrounder, http://www.actel.com/documents/DesignSecurity-WP.pdf
4. Actel ProASIC3/E Production FPGAs, Features and Advantages (2007), http://www.actel.com/documents/PA3-E-Tech-WP.pdf
5. The Free Dictionary. Backdoor, http://www.thefreedictionary.com/backdoor
6. Torrance, R., James, D.: The State-of-the-Art in IC Reverse Engineering. In: Clavier, C., Gaj, K. (eds.) CHES 2009. LNCS, vol. 5747, pp. 363-381. Springer, Heidelberg (2009)
7. Jha, S., Jha, S.K.: Randomization Based Probabilistic Approach to Detect Trojan Circuits. In: Proc. 11th IEEE High Assurance System Engineering Symp., pp. 117-124 (2008)
8. Banga, M., Hsiao, M.: A Region based Approach for the Identification of Hardware Trojans. In: IEEE Int.Workshop on Hardware-Oriented Security and Trust, HOST, pp. 40-47 (2008)
9. Wolff, F., Papachristou, C., Bhunia, S., Chakraborty, R.S.: Towards Trojan-free Trusted ICs: Problem Analysis and Detection Scheme. In: Design, Automation and Test in Europe, DATE 2008, March 10-14, pp. 1362-1365 (2008)
10. Wang, X., Tehranipoor, M., Plusquellic, J.: Detecting Malicious Inclusions in Secure Hareware: Challenges and Solutions. In: IEEE Int. Hardware-Oriented Security and Trust, HOST (2008)
11. Agrawal, D., Baktir, S., Karakoyunlu, D., Rohatgi, P., Sunar, B.: Trojan Detection using IC Fingerprinting. In: IEEE Symp. on Security and Privacy, SP, pp. 296-310 (2007)
12. Jin, Y., Makris, Y.: Hardware Trojan Detection using Path Delay Fingerprint. In: IEEE Int. Workshop on Hardware-Oriented Security and Trust, HOST (2008)
13. Du, D., Narasimhan, S., Chakraborty, R.S., Bhunia, S.: Self-referencing: A Scalable Side-Channel Approach for Hardware Trojan Detection. In:Mangard, S., Standaert, F.-X. (eds.) CHES 2010. LNCS, vol. 6225, pp. 173-187. Springer, Heidelberg (2010)
14. Rad, R., Tehranipoor, M., Plusquellic, J.: A Sensitivity Analysis of Power Signal Methods for Detecting Hardware Trojans under Real Process and Environmental Conditions. IEEE. Trans. in VLSI 18, 1735-1744 (2009)
15. Kocher, P., Jaffe, J., Jun, B.: Differential Power Analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388-397. Springer, Heidelberg (1999)
16. Military ProASIC3/EL Low Power Flash FPGAs Datasheet. Microsemi (2012), http://www.actel.com/documents/Mil-PA3-EL-DS.pdf
17. Tehranipoor, M., Wang, C.: Introduction to Hardware Security and Trust. Springer (2011)
18. JTAG Boundary scan. IEEE Std 1149.1-2001
19. JTAG Programming specification. IEEE 1532-2002
20. Da Rolt, J., Di Natale, G., Flottes, M.-L., Rouzeyre, B.: New security threats against chips containing scan chain structures. In: IEEE Int. Workshop on Hardware-Oriented Security and Trust, HOST, pp. 110-115 (2011)
21. Actel, ISP and STAPL, Application Note AC171, http://www.actel.com/ documents/ISP-STAPL-AN.pdf
22. ProASIC3 Frequently Asked Questions, Actel Corporation, Mountain View, CA 94043-4655 USA, http://www.actel.com/documents/pa3-faq.html
23. Skorobogatov, S.: Flash Memory 'Bumping" Attacks. In: Mangard, S., Standaert, F.-X. (eds.) CHES 2010. LNCS, vol. 6225, pp. 158-172. Springer, Heidelberg (2010)
24. Skorobogatov, S., Woods, C.: In the blink of an eye: There goes your AES key. IACR Cryptology ePrint Archive, Report 2012/296 (2012), http://eprint.iacr.org/2012/296
25. Integrated Circuit Investigation Method and Apparatus. Patent number WO2012/046029 A1
26. Skorobogatov, S.: Synchronization method for SCA and fault attacks. Journal of Cryptographic Engineering (JCEN) 1(1), 71-77 (2011)
27. Intrinsic ID, Quiddikey on ProASIC3 FPGAs, http://www.intrinsic-id.com/ quiddikey-on-Actel-FPGA.html
28. Skorobogatov, S.: Data Remanence in Flash Memory Devices. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 339-353. Springer, Heidelberg (2005)