CAREER: Trustworthy Hardware from Untrustworthy Components

硬件组件可能包含恶意的非法修改，这些修改可以虹吸敏感信息以传输给对手或关闭关键操作。 对硬件的这种修改--计算中信任的根源--可能会损害系统的可信度。 恶意修改（后门）可以通过团队中恶意内部人员实现的核心组件或通过第三方知识产权（IP）进入设计。本研究探讨了构建可信硬件系统的技术，即使这些硬件组件是不可信的，恶意的。本研究中使用的一个关键见解是，虽然大量的数字后门实现是可行的，但它们都可以分为四个简单的类别，这些类别具有独特的行为特征，可以用来阻止后门。数字后门只能通过两种方式触发：它们必须在一定时间后打开，或者通过特制的输入。 这种分类是完整的，因为时间和数据是数字系统唯一可以改变的两种方式。后门被唤醒后，它只能以两种方式影响被感染的硬件组件：它可以导致硬件组件产生无关的输出或损坏现有的输出。后门检测技术监视硬件单元的输出以发现异常行为，而保护技术扰乱输入，使得后门在运行时不可能被触发。加强硬件模块的输入和输出以防止后门提供了全面的保护，并首次为认证数字硬件没有后门提供了坚实的基础。 这种认证可以显著增强可信计算的状态

Hardware components can contain malicious, illegal modifications that can siphon sensitive information to transmit to adversaries or shutdown critical operations. Such modifications to the hardware - the root of trust in computing - can compromise trustworthiness of systems. A malicious modification (backdoor) can find its way into a design through a core component implemented by a malicious insider on the team, or through a third-party intellectual property (IP). This research investigates techniques to build trustworthy hardware systems even with such untrustworthy, malicious hardware components.A key insight used in this study is that while a large number of digital backdoor implementations are feasible they can be all classified into four simple categories with unique behavioral characteristics that can be leveraged to thwart backdoors. Digital backdoors can only be triggered in two ways: they must turn-on after certain amount of time or by specially crafted inputs. This classification is complete because time and data are the only two ways a digital system can change. After a backdoor is woken up it can impact the infested hardware component in only two ways: it can cause the hardware component to produce extraneous outputs or corrupt existing outputs. Backdoor detection techniques monitor the outputs of hardware units for anomalous behavior while protection techniques scramble inputs making it infeasible for the backdoor to be triggered at runtime. Hardening both the inputs and outputs of a hardware module against backdoors provides comprehensive protection and provides a strong basis, for the first time, to certify digital hardware to be free of backdoors. Such certification can significantly enhance the state of trustworthy computing