SaTC: STARSS: Small: iPROBE - An Internal Shielding Approach for Protecting against Frontside and Backside Probing Attacks

随着电子产品在日常生活中的普及，集成电路（IC）处理和存储的敏感信息比以往任何时候都多。对芯片上资产（如密钥、固件、个人和信息）的提取通过伪造、盗窃、欺诈、开发漏洞等方式威胁着最先进的军事技术、商业行业和社会。虽然针对软件和非侵入性提取方法的保护已被广泛研究，但物理探测很少受到关注。特别是聚焦离子束（FIB）是一种强大的工具，它不仅允许攻击者访问和探测资产，还可以破坏和/或绕过现有的对策。由于FIB的能力几乎是无限的，最好的方法应该使探测尽可能昂贵，耗时和令人沮丧。然而，这样做的一个重要障碍在于，设计抗FIB芯片的时间、精力和成本必须保持合理，特别是对于那些不是安全专家的设计人员。该项目研究iPROBE，这是第一个旨在阻止集成电路正面和背面探测攻击的计算机辅助设计（CAD）方法。作为CAD解决方案，iPROBE通过自动平衡各种对策的安全性和开销，减轻了设计人员的负担。与诸如顶级网格的特定对策相比，它还允许保护仅集中在设计的最敏感部分，从而降低成本。iPROBE将设计资产作为输入，并使用信息理论和测试启发的指标来识别需要保护的所有网络。在物理设计期间，网络根据其对探测的敏感性和脆弱性进行排名。内部屏蔽使用现有的功能网络以及额外的测试网络来构建，以包围排名最高的网络。切断功能网络理想地使芯片无用或破坏敏感数据。同样，切断试验网也可以被探测到并用来触发自毁。T-专用电路和其它对策与内部屏蔽集成以进一步增加攻击复杂性。为了评估，基准电路与传统的流程和iPROBE实现。比较两者之间的面积、功率和时序，以估计iPROBE对性能的影响。安全性的评估使用了PI先前开发的定制IC探测评估工具（升级后用于背面攻击评估），并使用PI实验室中的FIB对通过MOSIS制造的iPROBE设计的芯片执行真实的攻击。

With the proliferation of electronics into every day life, integrated circuits (ICs) process and store more sensitive information than ever before. The extraction of on-chip assets, such as keys, firmware, personal and information, threatens state-of-the-art military technologies, commercial industries, and society alike through counterfeiting, theft, fraud, development of exploits, and much more. Although protection against software and non-invasive methods of extraction has been widely investigated, physical probing has received little attention. In particular, Focused Ion Beam (FIB) is a powerful tool that allows attackers to not only to access and probe assets, but to destroy and/or bypass existing countermeasures. Since FIB capabilities are almost limitless, the best approaches should make probing as costly, time consuming, and frustrating as possible. However, a significant barrier in doing so lies in the fact that the time, effort, and cost to design a FIB-resistant chip must remain reasonable, especially to designers who are not security experts. This project investigates iPROBE, the first ever computer-aided design (CAD) approach aimed at hindering frontside and backside probing attacks on integrated circuits. As a CAD solution, iPROBE relieves the designer's burden by automatically balancing the security and overhead of various countermeasures. Compared to ad hoc countermeasures such as top level meshes, it also allows protection to be concentrated on only the most sensitive portions of a design, thereby lowering cost. iPROBE takes design assets as input, and uses information-theoretic and test-inspired metrics to identify all nets requiring protection. During physical design, nets are ranked in terms of their sensitivity and vulnerability to probing. Internal shields are constructed using existing functional nets as well as additional test nets to surround the highest ranked nets. Cutting through the functional nets ideally renders the chip useless or destroys the sensitive data. Similarly, cutting through test nets can be detected and used to trigger self-destruction. t-private circuits and other countermeasures are integrated with the internal shield to further increase attack complexity. For evaluation, benchmark circuits are implemented with conventional flows and with iPROBE. Area, power, and timing between the two are compared to estimate the iPROBE's impact on performance. Security is evaluated using a custom-built IC probing evaluation tool previously developed by the PIs (with upgrades for backside attack evaluation) and using FIBs in the PIs' lab to execute real attacks on iPROBE-designed chips that are fabricated through MOSIS.