Device and method related to circuit for detecting hardware Trojans

Abstract

An apparatus includes an integrated circuit (IC) and additional circuitry. The IC includes internal circuitry having sensitive / secret data (SSD) to be kept confidential from a suspected hardware trojan (HT), and the internal circuitry includes an access port through which information associated with the internal circuitry can be accessed by external circuitry associated with the HT. The additional circuitry is used to learn behavior of the internal circuitry that is unique to the integrated circuit under different operating conditions involving the internal circuitry, the SSD, and other data functionally associated with an application of the integrated circuit.

Description

Technical Field

[0001] Aspects of various embodiments are directed to apparatus and methods involving circuits for learning behaviors associated with detecting hardware Trojans. Background Art

[0002] Many integrated circuits (ICs) contain secret information for authentication purposes (e.g., private keys, passwords) or personal information such as driver configuration files. Hardware Trojans (HTs) can transmit (sometimes referred to as "leaking") such information to unauthorized attackers, which can result in financial and confidence losses. In this context, HTs refer to or include malicious modification of circuits, such as by modifying the data and / or programmed operation of an integrated circuit. Auditors and users can request documented countermeasures for HTs.

[0003] HTs can leak secret data through regular channels, where the leaked data may be hidden using steganography to traverse input / output (I / O) channel controls, or through side channels (also called covert channels) to bypass I / O channel controls. HTs may use delayed activation so that they become active only after some time in the field, thereby evading detection during verification, validation, and production testing.

[0004] These and other issues have challenged the efficiency of HT learning behavior based circuit implementations for a variety of applications. Summary of the invention

[0005] Various example embodiments address problems such as those addressed above and / or other problems that may become apparent from the following disclosure directed to circuits for learning internal circuit behavior associated with detecting hardware Trojans (HTs).

[0006] In certain example embodiments, aspects of the present disclosure are directed to a circuit that learns behaviors of internal circuits that are unique to the integrated circuit (IC) under different operating conditions in order to detect HT online.

[0007] In a more specific example embodiment, a device includes an IC and additional circuitry. The IC includes internal circuitry having sensitive / secret data (SSD) to be kept confidential with respect to a suspected HT, and the internal circuitry includes an access port through which information associated with the internal circuitry can be accessed by external circuitry associated with the HT. The additional circuitry learns a behavior of the internal circuitry that is unique to the IC under different operating conditions involving the internal circuitry, involving the SSD, and involving other data functionally associated with an application of the IC. The behavior of the internal circuitry is learned by the additional circuitry by observing a regular channel of the internal circuitry and a side channel of the internal circuitry.

[0008] The device further includes a learning center memory, at which the further circuit stores data and instructions for performing an association process (sometimes referred to herein as "association instructions"). The learned behavior of the internal circuit is developed from the stored data. For example, the further circuit includes the learning center memory and the association instructions, and the association instructions are used to develop the learned behavior of the internal circuit and evaluate and associate statistical data related to the operation of the internal circuit under the different operating conditions. The learned behavior of the internal circuit is developed based on statistical properties or irregularities associated with the internal circuit by changing or adjusting logical operations used to trigger monitoring or recording events. In addition, the further circuit can determine the probability distribution of the following: the least significant bit (LSB) and the second LSB; the time interval between two accesses to an external port; the difference in memory access addresses; and the difference in read or written data.

[0009] The additional circuitry in a specific aspect includes a heuristic operation circuit. For example, the circuitry may additionally include or store instructions for performing a deep learning process (sometimes referred to herein as "deep learning instructions"). In various more specific embodiments based on the above features, the behavior is learned by modifying input data to the internal circuit. For example, the different operating conditions include accessing the internal circuit using one or more changed versions of the SSD and / or other data. As a specific example, the additional circuitry uses deep learning instructions to provide feedback data to modify the SSD and other data functionally associated with the application of the IC. More specifically, the additional circuitry can use the provided feedback data to learn additional behaviors of the internal circuitry and thereby develop heuristic-based operations.

[0010] In various related embodiments, the additional circuit detects a suspicious HT attempting to transfer information through the port (e.g., a regular channel). A suspicious HT may be detected as attempting to transfer information through a port related to timing of accessing a memory or operation of a control bus address and control lines. The additional circuit will detect the suspicious HT attempting to transfer information from the IC through the internal circuit.

[0011] Other specific example embodiments relate to a non-transitory computer-readable storage medium for an IC, the IC including internal circuitry having an SSD and including an access port through which information associated with the internal circuitry is accessible to external circuitry associated with the HT. The non-transitory computer-readable storage medium includes instructions that, when executed, cause a processor of a computing device to: cause a heuristic operating circuit to learn behavior of the internal circuitry, the behavior being unique to the IC under different operating conditions, the different operating conditions involving: | the internal circuitry, the SSD, and other data functionally associated with an application of the IC; and use the behavior learned by the heuristic operating circuitry to detect a suspicious HT or block a suspicious HT from accessing the IC.

[0012] The instructions are executable to cause such processor circuitry to modify the SSD and other data, and in response, observe a regular channel of the internal circuitry to obtain regular channel data and observe a side channel of the internal circuitry to obtain side channel data. For example, the instructions are executed to observe a regular channel of the internal circuitry to obtain regular channel data and observe a side channel of the internal circuitry to obtain side channel data, associate the modified SSD with the regular channel data and the side channel data, and provide a message in response to the association exceeding a threshold. The processor further isolates the modified SSD and the resulting regular channel data from circuitry of a device that operates on the regular channel data, such as through a sandbox environment.

[0013] The instructions may be used to detect the suspicious HT. For example, the instructions are executed to further cause the processor to observe an SSD having regular channel data and side channel data, associate the modified SSD with the regular channel data and the side channel data, and provide an indication of detecting a suspicious HT attempting to transmit information in response to the correlation exceeding a threshold. In other examples, the instructions are executed to further cause the processor to associate the modified SSD and other data with the regular channel data and the side channel data, and provide an indication of detecting a suspicious HT attempting to transmit information in response to the correlation exceeding a threshold. In a specific aspect, the instructions are executed to observe an SSD having regular channel data and side channel data, causing the heuristic operation circuit to learn the behavior of the internal circuit using deep learning instructions, and determine a threshold value for the corresponding learned behavior. The instructions that cause the heuristic operation circuit to learn the behavior of the internal circuit are executed to further cause the processor to determine the probability distribution of the following: the least significant bit (LSB) and the second LSB; the time interval between two accesses to an external port; the difference in memory access addresses; and the difference in read or written data. And, the instructions are executed to change a power supply voltage in response to detecting the suspect HT and evaluating the impact on the suspect HT.

[0014] The above discussion / summary is not intended to describe each embodiment or every implementation of the present disclosure. The following figures and detailed description also illustrate various embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Various example embodiments may be more fully understood when the following detailed description is considered in conjunction with the accompanying drawings, in which:

[0016] Figure 1 is an example device including circuitry according to the present disclosure;

[0017] Figure 2 It is shown that according to the present disclosure Figure 1 A flowchart of an exemplary set of activities and / or data flows for devices of the type implemented in a consistent manner;

[0018] Figure 3A-3B An example of a device including heuristic operating circuitry according to the present disclosure is shown;

[0019] Figure 4A-4B An example device and an exemplary set of activities and / or data flows of the device including heuristic operating circuits according to the present disclosure are shown;

[0020] Figure 5A-5B 3 and 4 are diagrams showing the embodiment of the present disclosure. Figure 4A A flowchart of an exemplary set of activities and / or data flows for a device of the type implemented in a consistent manner; and

[0021] Figure 6 is an example device including heuristic operating circuitry according to the present disclosure.

[0022] Although the various embodiments discussed herein may take modified and alternative forms, various aspects of the various embodiments have been illustrated by way of example in the accompanying drawings and the aspects will be described in detail. However, it should be understood that it is not intended to limit the present disclosure to the specific embodiments described. On the contrary, it is intended to cover all modifications, equivalents, and alternatives that fall within the scope of the present disclosure, including aspects defined in the claims. In addition, as used throughout this application, the term "example" is merely illustrative and non-restrictive. DETAILED DESCRIPTION

[0023] Aspects of the present disclosure are believed to be applicable to various different types of devices, systems, and methods involving hardware Trojan (HT) based mechanisms that use circuits to learn the behavior of internal circuits to detect HT. In certain embodiments, aspects of the present disclosure have been shown to be beneficial when used in the context of heuristically operated circuits that learn the behavior of internal circuits that are unique to a specific integrated circuit (IC) that detects suspected HT online. In some embodiments, suspicious HTs are detected and blocked from accessing the IC. Although not necessarily so limited, aspects may be understood through the following discussion of non-limiting examples using exemplary contexts.

[0024] Therefore, in the following description, various specific details are set forth to describe the specific examples presented herein. However, it should be apparent to those skilled in the art that one or more other examples and / or variations of these examples may be practiced without all the specific details given below. In other examples, well-known features are not described in detail to avoid blurring the description of the examples herein. For ease of illustration, the same reference numerals may be used in different figures to refer to the same element or other examples of the same element. And, although various aspects and features may be described in separate drawings in some cases, it should be understood that the features of one drawing or embodiment may be combined with the features of another drawing or embodiment, even if the combination is not explicitly shown or explicitly described as a combination.

[0025] Protection is provided to the IC by detecting leakage of secret data (referred to herein as "sensitive / secret data") through HT and preventing or reducing leakage of sensitive / secret data (SSD). Since the IC contains multiple different types of SSDs, there are different types of HTs and different leakage and delay or triggering techniques adopted by different types of HTs, and multiple techniques can be used to trigger and detect HT. Embodiments according to the present disclosure relate to circuits that can use multiple "lines of defense" to prevent multiple different combinations of SSDs, HT types, leakage channels, and delay or trigger mechanisms. For functional safety, the circuit can be used to estimate the leakage detection coverage. The multiple lines of defense include a first line of defense, which includes secure purchase of trusted hardware intellectual property (IP), a security layout center, certified layout and verification tools, a secure archive access block, and a detailed hardware source code review. One or more additional lines of defense can be used, including the use of behavioral analysis to detect suspicious HTs without knowing or assuming HTs. The detection is based on different behaviors under different conditions, and the different conditions involve SSDs to be kept confidential and functional data to be used in applications (sometimes referred to herein as "application data"). Other additional lines of defense may include using a sandbox environment to temporarily modify certain input data of modules that may be related to HT (such as using a sandbox environment to temporarily modify the SSD and associate the regular channel with the side channel), and temporarily modifying typical trigger conditions.

[0026] In a specific example, multiple lines of defense against HT are used. The multiple detection lines of defense include statistically based correlation attribute evaluation to detect steganographic leakage of SSD based on, for example, statistics of the least significant bit (LSB) and the second LSB, observation of SSD and application data and correlation with output data, modification of SSD and / or application data and correlation with output data processed in a sandbox environment, and change the power supply voltage to modify the physically unclonable function (PUF) value and evaluate the impact on the suspicious HT. As a specific example, it is reported that many HTs use PUF for different purposes. One purpose is to be able to associate different data streams with different ICs when leakage information of different ICs is transmitted to attackers over the network. Another purpose is to hide the presence of HT caused by applying different PUF encrypted data streams. PUF can be power supply voltage sensitive. In order to allow the detection of HT using PUF, the circuit uses a trimming input of a low dropout regulator (LDO) to modify the power supply voltage so that the power supply voltage is still within the limits of the digital corelib unit, but the PUF may be disturbed. In addition, the circuit can be used to combine the detection of steganographic or conventional channel and side channel attacks. During system validation, embodiments according to the present disclosure combine monitoring of regular input / output (I / O) channels with monitoring of side channels for suspicious activity.

[0027] Performing both steganalysis and side-channel analysis of regular I / O channels simultaneously may be advantageous for a number of reasons. On the one hand, there are many different steganalysis methods to consider, and on the other hand, there are many different covert channel methods to consider, both of the same order of magnitude - about 10-50. Both steganographic and side-channel attackers may use new and / or uncommon HT methods, making the risk of them being covered by the standard detection portfolio sufficiently low (this sets a lower limit on the number of attack scenarios). Both steganographic and side-channel attackers may invest a lot of money in implementing their attacks and want to maximize the success rate of their attacks - therefore, they do not want to be surprised by flaws in immature mechanisms. HT can use proven and mature methods (this sets an upper limit on the number of attack scenarios). In addition, both steganography and side-channel detection may benefit from using a protected environment (sometimes called a sandbox environment) for hardware modules that may be affected by HT. Moreover, both steganographic and side-channel attackers can use data encryption via HT and can use HT that is triggered after a delay in the field, so the sandbox needs to ensure that not only the application and / or SSD is temporarily modified, but also the potential (delayed) trigger is activated.

[0028] As described above, example devices according to the present disclosure can perform steganography and side channel detection for a variety of different types of HT and / or attack scenarios. Some example steganography attack / detection scenarios include LSB matching, image or audio specific attacks, for example, using wavelet transforms, checksum violations (intentionally changing bits in a redundant, fault-tolerant code's data stream in order to correct introduced bit errors), and analysis based on moments of probability density functions (PDFs) or characteristic functions (CFs). Example side channel attack scenarios include and / or based on the timing of memory read or write accesses, the timing of transmitting or requesting a certain message, based on a freely selectable bit in the header of certain transport protocols, based on "port knocking", for example, requesting access to a certain port that is not needed by the application.

[0029] A specific example device according to various embodiments includes an IC and an additional circuit. The IC includes an internal circuit having an SSD to be kept confidential with respect to a suspected HT, and the internal circuit includes an access port through which information associated with the internal circuit can be accessed by an external circuit associated with the HT. The additional circuit, which may be a heuristic operating circuit, learns a behavior of the internal circuit that is unique to the IC under different operating conditions involving the internal circuit, the SSD, and other data functionally associated with an application of the IC. The behavior of the internal circuit is learned by the additional circuit by observing a regular channel of the internal circuit and a side channel of the internal circuit.

[0030] In other related example embodiments, the device further includes a learning center memory at which further circuitry stores data from which learned behavior of the internal circuitry is developed and stores instructions for performing related processes or otherwise associated therewith (sometimes referred to herein as "association instructions"). Further circuitry may include a learning center memory and association instructions for developing learned behavior of the internal circuitry and evaluating and associating statistical data related to the operation of the internal circuitry under different operating conditions. The learned behavior of the internal circuitry is developed based on statistical properties or irregularities associated with the internal circuitry by changing or adjusting logical operations for triggering monitoring or recording events.

[0031] In various embodiments, the behavior is learned by modifying input data to the internal circuit, such as by using one or more modified versions of the SSD and / or other data. As a specific example, the additional circuit stores instructions for performing a deep learning process (sometimes referred to herein as "deep learning instructions"). The additional circuit uses the deep learning instructions to provide feedback data to modify the SSD and other data functionally associated with the application of the IC. The additional circuit uses the provided feedback data to learn additional behaviors of the internal circuit and thereby develop heuristic-based operations.

[0032] In various related embodiments, the further circuitry detects suspicious HTs attempting to transfer information through the port (eg, regular channel). Detection may include detecting suspicious HTs attempting to transfer information through the port associated with timing or operation of address and / or control lines to access memory.

[0033] Other example embodiments relate to a non-transitory computer-readable storage medium for an IC including internal circuitry having an SSD and including an access port through which information associated with the internal circuitry is accessible to external circuitry associated with the HT, as otherwise described herein.

[0034] Now turning to the attached figure, Figure 1 is an example device including heuristic operating circuitry according to the present disclosure. As shown, the device includes an IC 100 having an internal circuit 117 that performs processing or encoding 108 involving an SSD 106 that is kept confidential with respect to a suspicious HT 109. In some embodiments, the internal circuit 117 includes circuitry such as one or more processors, memory (including volatile and / or non-volatile) registers, logic, sensors, and the like.

[0035] IC 100 has access ports through which information associated with internal circuitry 117 can be accessed by external circuitry associated with HT 109. The access ports may include one or more regular channels 113 and one or more side channels 111. Figure 1 Only a single conventional channel and side channel are shown, but the IC may include multiple conventional channels and / or side channels. Internal circuitry 117 provides processing and / or encoding 108 of input data and produces output data. The input data includes SSD 106, PUF data 102, and / or application data 104, which is processed to provide output data (sometimes referred to herein as "output channel data") via conventional channel 113. Application data 104 may include data functionally associated with an application of IC 100.

[0036] The device further includes further circuitry 110 that learns behavior of the internal circuitry 117 that is unique to the IC 100 under different operating conditions involving the IC 100, the SSD 106, and the application data 104. In a specific embodiment, the further circuitry 110 is a heuristic operating circuit that learns the behavior using a heuristic technique. The behavior is learned by observing one or more regular channels 113 and one or more side channels 111 of the internal circuitry 117 over a threshold time period. The further circuitry 110 causes different operating conditions by changing or adjusting the logic operations used to trigger monitoring or recording events based on statistical properties or irregularities associated with the internal circuitry 117 and observing the resulting processing and / or encoding 108.

[0037] The device and / or the further circuit 110 may include a learning center memory 115, where the heuristic operation circuit 110 stores data and associated instructions 112 from which the learned behavior of the internal circuit 117 is developed. The learning center memory 115 may further store deep learning instructions 114. The further circuit 110 uses the associated instructions 112 to develop the learned behavior of the internal circuit 117, and evaluates and associates statistics related to the operation of the internal circuit 117 under different operating conditions, including identifying the correlation between the input data and the output data of the internal circuit 117. The further circuit 110 may use the deep learning instructions 114 to provide feedback data, as described further herein. The further circuit 110 uses the provided feedback data to learn the further behavior of the internal circuit 117, and thereby develops heuristic-based operations. The execution of the deep learning instructions 114 may include or result in the creation of different histograms for learning behaviors and determining thresholds for corresponding behaviors.

[0038] The additional circuit 110 stores data at a learning central memory 115 from which the learned behavior of the internal circuit 117 is developed by changing or adjusting the logic operations used to trigger monitoring or recording events based on statistical properties or irregularities associated with the internal circuit 117. Based on the learned behavior, the additional circuit 110 can detect a suspicious HT 109 that attempts to leak information through a port, such as one or more regular channels 113 and / or one or more side channels 111. The suspicious HT 109 can be detected as attempting to transfer information from the IC 100 through the internal circuit 117 and / or the port. Such an attempt can be associated with the timing operations of accessing the memory, such as the timing of bus address and control lines.

[0039] Taking into account unknown features, behavioral analysis can be based on statistics. In general, the more features considered, the higher the false alarm rate due to the statistical nature of the analysis. For steganography and side channels, given about 10-50 different attack scenarios, a threshold false alarm rate below each scenario is acceptable; therefore, a large amount of data is observed before a potential HT warning is issued. Figure 1 The principle of observation-based behavior analysis is shown. The association between input data and output data (e.g., regular channel 113 and side channel 111) of the process or module 108 associated with the internal circuit 117 that may be affected by HT 109 is performed by the additional circuit 110. The additional circuit 110 collects statistics related to data access timing, read / write special addresses, which can reveal SSD 106, read data not used for additional processing or storage, data written to memory, and information (e.g., timing and address) written to the control bus. The statistics are used to learn or identify the confidence of the existence of suspicious HT 109.

[0040] In various embodiments, detecting the HT 109 and / or changing the operation of the IC may include using the supply voltage to modify the PUF data 102. The supply voltage may be modified using a trim input of the LDO, and the output data and / or ports observed in response thereto, such as by accessing registers in a random access memory (RAM) of the IC 100. As can be appreciated, the PUF data 102 (e.g., a pattern of 1s and 0s and / or a unique key) is the same or at least nearly the same at the same supply voltage, and changes in response to changes in the supply voltage. The supply voltage changes are still within the limits of the digital corelib unit. This effectively creates a cloned PUF for use by the HT 109, where the RAM is the same (e.g., the same flips), but the PUF data 102 is not the same. The supply voltage is within the allowed range of the digital module, but is sufficient to produce variability in the PUF data 102 (e.g., pattern) from the module.

[0041] In various embodiments, the association is performed by further using a deep learning process supported by a learning phase (e.g., executing deep learning instructions 114), wherein the learning phase covers multiple input data, system settings, and possible HT models for detecting HT. The observation can be based on a modification of the input data and the observation, wherein the modified input data and the processed output data are in a sandbox environment that protects or isolates the circuitry that receives its input data from the effects of erroneous output receipt. In such embodiments, as further described herein, different operating conditions may include accessing internal circuitry 117 using one or more modified versions of the input data, including altered versions of SSD 106 and / or application data 104. In this regard, a sandbox environment refers to or includes a computer module (e.g., computer instructions and / or data, such as modified input data and output data responsive to the modified input data) and / or a memory or other circuitry that is isolated from other dedicated circuit operations. The device provides a sandbox environment associated with processing and / or coding 108 of internal circuitry 117 via further circuitry 110 so that altered versions of SSD 106 and / or application data 104 do not affect later components of IC 100 , such as circuits operating on output data of internal circuitry 117 .

[0042] Figure 2 It is shown that according to the present disclosure Figure 1 Flowchart of an exemplary set of activities and / or data flows for a device of the type implemented in a consistent manner. For example, set of activities 220 is performed by circuit 110 and includes the following: Figure 1 The operations are shown as being associated with the associated instructions 112. The associated instructions include computer executable instructions that, when executed, cause a processor of a computing device (eg, a heuristic operating circuit) to learn the behavior of an internal circuit under different operating conditions.

[0043] The circuit observes the regular channel at 222 and observes the side channel at 226. The observation of the regular channel and the side channel can be performed simultaneously and used to learn the behavior of the internal circuit under different operating conditions. The observation is in response to changing the internal operating conditions (such as changing the power supply voltage). Based on the observation and using the association instruction (and the optional deep learning instruction as described elsewhere in this document), the heuristic operation circuit can issue a warning of suspected HT. For example, the association instruction is executed to associate the modified SSD with the regular channel data (e.g., output channel data) at 224, associate the modified SSD with the side channel data at 228, and in response to the correlation exceeding the threshold, issue a warning that a suspected HT is detected at 229.

[0044] Figure 3A-3B An example device including a heuristic operating circuit according to the present disclosure is shown. More specifically, Figure 3A The illustrated heuristic operation circuitry may provide one or more altered versions of the SSD 336 and / or application data 334 to the internal circuitry to learn the behavior of the internal circuitry. By altering the SSD 336 and / or application data 334, a deep learning mechanism may be used, and the altered or modified SSD 336 and / or application data 334 processed by the internal circuitry is placed in a sandbox environment 346 to isolate the circuitry that processes the output data, thereby preventing the operation of incorrect or erroneous output data from the internal circuitry due to the modification.

[0045] Figure 3A The device shown includes an IC 330 having access ports (e.g., a regular channel 339 and a side channel 337) through which information associated with the internal circuitry is accessible by external circuitry associated with the HT 349. The internal circuitry provides processing and / or encoding 338 in response to input data, including SSD 336, PUF data 332, and / or application data 334, to provide output data through the regular channel 339.

[0046] The device additionally includes heuristic operation circuitry 340 that learns the behavior of the internal circuitry of IC 330. The learned behavior is unique to IC 330 under different operating conditions involving the internal circuitry, SSD 336, and other data (e.g., application data 334) functionally associated with an application of IC 330. As previously described, the behavior is learned using association instructions 342 and / or deep learning instructions 344. In various embodiments, heuristic operation circuitry 340 includes a memory (e.g., a medium) and a processor, as otherwise described herein.

[0047] By modifying the SSD 336 and / or application data 334, and in some embodiments, the PUF data 332 via the LDO 348, the heuristic operation circuit 340 can better learn the behavior of the IC 330 than simply observing the IC 330 under different operating conditions. As previously described, in such embodiments, the heuristic operation circuit 340 places the processing and / or encoding 338 of the internal circuit in a sandbox environment 346 to isolate the modified input data from other circuits operating on the output data from the internal circuit. This can prevent erroneous / incorrect output data from damaging the system in which the IC 330 operates.

[0048] Deep learning instructions 344 include computer executable instructions that, when executed, cause a processor of a computing device (e.g., Figure 4AThe heuristic operation circuit 340) modifies the input data. The heuristic operation circuit 340 executes a deep learning instruction 344 to modify the input data including the SSD 336 and / or the application data 334 using the circuits shown as the gate logic 333, 335. By modifying the input data, the heuristic operation circuit 340 can understand how the regular channel 339 and the side channel 338 are affected by the application data 334 and the SSD 336. The following is a non-limiting example of how to modify the application data 334 and / or the SSD 336. In various embodiments, the deep learning instruction 344 is used to (temporarily) invert all bits of the SSD 336 and / or the application data 334. Since the compression operation in HT is generally linear, the output is also an inverted output signal or signal stream. In other embodiments and / or additionally, the deep learning instruction 344 is used to (temporarily) set all bits of the SSD 336 and / or the application data 334 to zero or one. The compression operation in the HT then compresses the bits into a shorter data stream that is recognizable regardless of the actual appearance. In a specific embodiment, the heuristic operation circuit 340 uses deep learning instructions 344 to provide feedback data to modify the SSD 336 and application data 334, and uses association instructions 342 to associate the modified SSD 336 and / or application data 334 with the output channel data, as described above.

[0049] Figure 3B An example computing device including a non-transitory computer-readable medium storing executable code according to the present disclosure is shown. According to an example herein, the computing device includes a heuristic operating circuit such as Figure 3A The circuit 340 shown. The computing device and the IC (such as Figure 3A 330) shown, the IC including internal circuitry and including an access port through which information associated with the internal circuitry can be accessed by external circuitry associated with the HT.

[0050] The computing device has a processor 351 and a computer readable medium 353 storing a set of instructions 355 and 357. The computer readable medium 353 may include, for example, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a solid-state drive, and / or a discrete data register group. At 355, the computing device may cause the heuristic operation circuit to learn the behavior of the internal circuit. Under different operating conditions involving the internal circuit, the SSD, and other data functionally associated with the application of the IC, the behavior is unique to the IC. The behavior is learned by observing the regular channel of the internal circuit to obtain regular channel data and observing the side channel of the internal circuit to obtain side channel data, and associating the SSD or the modified SSD with the regular channel data and the side channel data. In some embodiments, the computing device modifies the SSD (and optionally other data) to generate a changed version of the SSD, and in response, observes the regular channel and side channel of the internal circuit to obtain regular channel data and side channel data. The computing device may further associate the modified SDD with the regular channel data and the side channel data. As can be appreciated, conventional channel data includes output data from internal circuitry in response to a modified SSD. Side channel data includes information from the implementation of the IC, such as power consumption, timing information, and electromagnetic emissions, and this information can be used to infer information about the SSD and the output data and / or input data. For example, in some cases, side channel data can be used to retrieve keys associated with encrypted data.

[0051] In a specific embodiment, the computing device uses deep learning instructions (and the above-mentioned associated instructions) to cause the heuristic operation circuit to learn the behavior of the internal circuit and determine different thresholds for the corresponding learned behavior. The deep learning instructions are executed to determine the probability distribution of multiple different statistical observations (e.g., the probability of HT). For example, the probability distribution is associated with accesses to external ports and external memories, and the accesses are aggregated into the least significant bit (LSB) and the second LSB, the time interval between two accesses to the external port, the address difference of the memory access, and the histogram of the difference of data read and / or write.

[0052] At 357, the computing device uses the behavior learned by the heuristic operation circuit to detect or block suspicious HTs, such as blocking HTs from accessing the IC. In some examples, the computing device provides a message or other type of indication in response to the association of the modified SSD with conventional channel data and side channel data exceeding a threshold. The message indicates the detection of a suspicious HT attempting to transmit information. The modified SSD can be responsive to changes in the heuristic operation circuit and / or based on different operating conditions. The computing device further provides a sandbox environment for internal circuits and related processing by providing a modified SSD, observing output data in response, and isolating the circuit processing the output data from the modified (e.g., incorrect) output data. The modified output data is output by the internal circuit in response to processing the modified SSD. In some specific embodiments, the computer device further changes the power supply voltage (to modify the possible PUF value) in response to detecting the suspicious HT and evaluating the impact on the suspicious HT.

[0053] Figure 4A-4B An example device including heuristic operating circuitry and an example set of activities and / or data flows of the device are shown according to the present disclosure.

[0054] More specifically, Figure 4A A device is shown that uses heuristic operation circuit 478 to learn internal behavior based on modifying input data and imitating HT. The device includes an IC 470 having access ports (e.g., a regular channel 481 and a side channel 479) through which information associated with the internal circuit can be accessed by external circuits associated with the HT. The internal circuit provides processing and / or encoding 484 in response to input data to provide output data through the regular channel 481, the input data including SSD 476, PUF data 472 and / or application data 474.

[0055] The heuristic operation circuit 478 observes the regular channel 481 and the side channel 479 in response to different operating conditions (such as different supply voltages adjusted using the LDO 477 as described above). The heuristic operation circuit 478 shown in Figure 4 can provide one or more modified versions of the SSD 476 and / or application data 474 to the internal circuit, such as through logic gates 473, 475, for processing and encoding 484, and learn the behavior of the internal circuit using associated instructions 480 and deep learning instructions 482. The processing and / or encoding 484 of the internal circuit is placed in a sandbox environment so that the circuit does not operate on output data from the internal circuit that is incorrect due to modification of input data, as described above.

[0056] Deep learning instructions 482 are used to identify correlations in unsupervised self-learning patterns, such as Figure 3ADuring the self-learning mode, a large amount of data is used to detect whether the HT is transmitting information. For example, to determine whether a HT that leaks information is detected, many different leaking and non-leaking runs with different operating conditions and / or modified input data are performed. Figure 3A By using deep learning instructions 482 and information related to typical leak conditions (e.g., a routine for processing SSD 476), typical non-leak conditions (e.g., just after boot up, making the delayed triggered HT inactive), suspicious or plausible modifications of the regular channel 481 caused by HT, suspicious or plausible modifications of the side channel 479 caused by HT, and known general statistical properties about the regular channel 481 and the side channel 479, Figure 4A The device shown reduces the number of operations. The information can be used to emulate HTs 471-1, 471-2, 471-3, 471-N and place the emulated HTs 471-1, 471-2, 471-3, 471-N at different locations of IC 470.

[0057] The learning procedure, which may be off-line, may be performed by simulating the netlist 468 of the IC 470 and by performing a verification process, wherein different simulated HTs 471-1, 471-2, 471-3, 471-N at different locations of the IC 470 are sequentially applied in different runs of the deep learning instructions 482. The deep learning instructions 482 are used to evaluate the response of the simulated netlist 468 including the different simulated HTs 471-1, 471-2, 471-3, 471-N.

[0058] Figure 4B The establishment of a simulated HT (such as Figure 4A 490 of an example flow chart of a simulated HT 471-1, 471-2, 471-3, 471-N) shown. The simulated HT may have the following properties: switch from inactive to active to simulate the behavior of triggering the HT, modify the behavior of the regular channel and the side channel, be placed in different locations of the IC to access different input nodes and output nodes of the circuit, and modify different operations of the regular and side channels. As shown, at 491 and 492, information indicating different HTs and general rules for HTs, channels, SSDs, and application data is input to simulate the HT. Using this information, at 493, the heuristic operation circuit learns the internal behavior with and without the simulated HT. At 494, the heuristic operation circuit performs a verification process without the simulated HT to provide a false alarm rate at 495. At 496, the heuristic operation circuit performs a verification process with the simulated HT to provide a detection rate at 497.

[0059] Execute deep learning instructions to learn behavior and / or provide feedback, such as providing feedback data to modify the SSD and other data functionally associated with the application of the IC. Multiple rules as shown at 492 can be implemented by deep learning instructions or used with them to generate a probability distribution (such as a histogram) indicating the probability (e.g., confidence) of a suspicious HT and determine the corresponding threshold or rate. Deep learning instructions can be used to perform pre-processing / data reduction of data volume (e.g., identifying constant values, identifying changing values) into a probability distribution. For example, access to an external port and / or to an external memory (such as RAM) can be aggregated into a first histogram showing the time interval between two accesses, a second histogram showing the address difference of the accessed memory, a third histogram showing the difference in written or read data, and other histograms such as histograms of LSB and second LSB. Deep learning instructions can be used to perform feature extraction. For example, this feature extraction can focus on nonlinear behavior, for example, HT can react to small or large changes in secret data in the same way-it notices that the SSD has changed and attempts to leak it after encoding the SSD. Without an active HT, the device may not react to changes to the SSD at all, or if it does, the reaction to small modifications to the SSD may be different than the reaction to large modifications.

[0060] Verification is performed (e.g., at 494 and 496) on multiple data sets applied to netlist 468, such as without simulated HTs, to evaluate and adjust false alarm rates. Additionally, verification is performed on multiple data sets applied to netlist 468, such as at 493, with simulated HTs different from those used during training and placed at different locations of netlist 468 to evaluate detection rates. Many different HTs are known and well-defined, with the total number of publicly available HT models estimated to be over 1,000.

[0061] The false alarm rate and detection rate are set or otherwise adjusted at 495 and 497. Since the result of the behavior analysis is not a hard "true / false" decision of detected HT behavior, but rather the possibility of HT behavior, the detection threshold can be adjusted so that the false alarm rate is acceptable. The detection rate is evaluated using this adjusted threshold.

[0062] Figure 5A-5B It is shown that according to the present disclosure Figure 3A and Figure 4A A flowchart of an exemplary set of activities and / or data flows for devices of the type implemented in a consistent manner.

[0063] More specifically, Figure 5AAn example method for learning the behavior of the internal circuit of an IC based on observation is shown. As shown, at 552 and 555, the conventional channel and the side channel are observed in response to different operating conditions and / or modified input data. In response to the observation, a deep learning instruction is executed, as described above, to generate a probability distribution indicating the probability of a suspicious HT, such as a histogram. A histogram of the LSB is created at 553 using conventional channel observations (e.g., conventional channel data), and a histogram of the second LSB is created at 554. A histogram showing the time interval between two accesses is created at 556 using side channel observations (e.g., side channel data), a histogram showing the address difference of the accessed memory is created at 557, and a histogram showing the difference in read or written data is created at 558. At 559, for each created histogram, the mean, standard deviation, and reasonable threshold are calculated and used to determine the threshold. In various specific embodiments, the observations at 552 and 555 can be in response to modifying the SSD or other input data (or in response to not modifying the input data).

[0064] Figure 5B An example method 560 for detecting HT based on modification is shown. The method 560 includes modifying an SSD at 561. In response to the modification, a regular channel is observed at 562, and a side channel is observed at 564. Based on the observation, the modified SSD is associated with regular channel data at 563, and the modified SSD is associated with side channel data at 565. The association is compared to one or more given thresholds, and at 566, an alert is issued in response to the association exceeding the given threshold.

[0065] Figure 6 is an example device including a heuristic operating circuit according to the present disclosure. More specifically, Figure 6 is an example embodiment of an IC 601 that uses a heuristic operating circuit to learn the internal behavior of an internal circuit based on modifying input data and emulating HT, the heuristic operating circuit may include a central processing unit (CPU) 610 or form a part of a central processing unit (CPU) 610. The device includes an IC 601 having access ports (e.g., regular channels 619-1, 619-2 and side channels 618-1, 618-2), through which information associated with the internal circuit can be accessed by an external circuit associated with HT. The internal circuit provides processing and / or encoding 616 in response to input data to provide output data through regular channels 619-1, 619-2, the input data including SSD 607, PUF data 603 and / or application data 605.

[0066] The heuristic operation circuitry, which may include or form part of the CPU 610, observes the normal channels 619-1, 619-2 and the side channels 618-1, 618-2 in response to different operating conditions. The heuristic operation circuitry may provide one or more altered versions of the SSD 607, application data 605, and PUF data 603 to internal circuitry, such as through logic gates, for processing and encoding 616 to use the associated instructions 612 (e.g., as described above, for example, in conjunction with Figure 2 ) and deep learning instructions 614 (e.g., as described above, for example, in conjunction with Figure 4A-4B ) Learn the behavior of the internal circuit. For example, execute the association instruction 612 to access input data (which may or may not be modified), access output data (e.g., channel data) responsive to the input data, associate the input data with the output data and optionally issue a warning. Execute the deep learning instruction 614 to modify the input data, learn the behavior of the IC based on multiple input data (including modified input data), system settings, and possible HT models for detecting HT (e.g., creating different histograms for learning behaviors and determining thresholds for corresponding behaviors), and optionally provide feedback data based on the learned behavior, such as additional modifications to the input data. As shown, the processing and / or coding 616 of the internal circuit is placed in a sandbox environment 617 so that the circuit does not operate on output data from the internal circuit that is incorrect due to modification of the input data.

[0067] Each of the various example hardware components of the IC is dependent upon the particular IC. IC 601 illustrates some example implementations. Figure 6 In the illustrated embodiment, modifications to the SSD 607 and application data 605 (as described above), associations, sandbox environment 617, and HT detection are intermittently run into application mode on the internal CPU 610. Details of the HT detection acquired by the deep learning instructions 614 may be stored on-chip in the ROM 613 of the CPU 610. The PUF data 603 may include power-on values ​​for memories, or frequencies of different ring oscillators, or initial states of flip-flops, each of which is unique (or nearly unique) to each IC, and each provided by power regulated by an internal LDO 611, which may be adjusted by user registers, which may also be accessed by the internal CPU 610. Application data 605 may be provided by registers 606, which may be externally programmed via SPI, for example, and may also be accessed by the internal CPU 610. The SSD 607 (e.g., private keys for data encryption) may be stored in an OTP 608 programmed during production testing.

[0068] The side channels 618-1, 618-2 may include the timing of the I / O channels (e.g., measured at high resolution by a dedicated timer circuit 621) and / or headers of data packets transmitted via the regular I / O channels. The side channels 618-1, 618-2 may also and / or alternatively include analog values, such as power supply current that may be modulated by the HT 615 to leak information; in this case, the analog values ​​may be digitized by a dedicated analog-to-digital converter 620. The regular channels 619-1, 619-2 may include data transmissions sent to other ICs or a common data bus via the HSIO interface 622. The regular channels may also include access to user registers 623, such as via SPI.

[0069] The various devices described above may use a combination of the following measures that may be synergistically combined for online detection of data leakage. The measures include statistically based correlation property evaluation to detect SSD steganographic leakage based on statistics of LSB and second LSB, observation of SSD and application data and correlation with output data, modification of SSD and / or application data and correlation with output data processed in a sandbox environment. The measures further include changing the power supply voltage to modify possible PUF values ​​and evaluating the impact on suspicious HT generation, as well as evaluation of statistical properties and irregularities based on deep learning techniques.

[0070] The skilled person will recognize that the various terms used in this specification (including the claims) mean the ordinary meanings in the art unless otherwise specified. As an example, this specification describes and / or illustrates aspects useful for implementing the claimed disclosure in the form of various circuits or circuit systems, which may be illustrated as terms such as blocks, modules, devices, systems, units, controllers, and / or other circuit type depictions or illustrated using such terms (e.g., Figure 1 and 3A 108 and 346 depict blocks / modules as described herein). Such circuits or circuit systems are used with other elements to illustrate how certain embodiments may be performed in the form of structures, steps, functions, operations, activities, etc. For example, in certain embodiments discussed above, one or more modules are discrete logic circuits or programmable logic circuits that are configured and arranged to implement these operations / activities, such as those that may be combined with Figure 3B and / or Figure 5BIn some embodiments, such programmable circuits are one or more computer circuits, including memory circuitry for storing and accessing programs to be executed as a set (or sets) of instructions (and / or to be used as configuration data for defining how the programmable circuitry is to be executed), and the operations or processes as described herein are used by the programmable circuitry to perform the relevant steps, functions, operations, activities, etc. Depending on the application, the instructions (and / or configuration data) can be configured to be implemented in a logic circuitry, where the instructions (whether represented in the form of object code, firmware or software) are stored in and accessible from the memory (circuitry).

[0071] Based on the above discussion and illustrations, those skilled in the art will readily recognize that various modifications and changes may be made to the various embodiments without strictly following the exemplary embodiments and applications shown and described herein. For example, the methods illustrated in the accompanying drawings may involve steps performed in various orders (where one or more aspects of the embodiments herein are retained) or may involve fewer or more steps. For example, Figure 1 The equipment shown may include Figure 6 The circuit 601 is shown. Similarly, Figure 3A The apparatus shown can be used to implement various processes shown herein, such as Figure 2 Such modifications do not depart from the true scope of the various aspects of the present disclosure, including those set forth in the claims.

Claims

1. A device, characterized in that: include: an integrated circuit comprising an internal circuit having sensitive / secret data SSD to be kept confidential from a suspected hardware Trojan HT, and comprising an access port through which information associated with the internal circuit can be accessed by an external circuit associated with the HT; and further circuitry for learning a behavior of the internal circuitry that is unique to the integrated circuit under different operating conditions involving the internal circuitry, the SSD, and other data functionally associated with an application of the integrated circuit, Wherein the different operating conditions include using one or more altered versions of the SSD to access the internal circuitry.

2. The device according to claim 1, characterized in that The further circuit is a heuristic operating circuit, and the behavior of the internal circuit is learned by the heuristic operating circuit by observing a regular channel of the internal circuit and a side channel of the internal circuit.

3. The device according to claim 1, characterized in that A learning center memory is further included where the further circuitry stores data and associated instructions from which learned behavior of the internal circuitry is developed.

4. The device according to claim 1, characterized in that The further circuitry includes a learning center memory and associated instructions for developing learned behavior of the internal circuitry and evaluating and correlating statistical data relating to operation of the internal circuitry under different operating conditions.

5. The device according to claim 1, characterized in that The additional circuitry includes a learning center memory and associated instructions for developing learned behavior of the internal circuitry and evaluating and associating statistical data relating to the operation of the internal circuitry under different operating conditions, wherein the additional circuitry will use deep learning instructions to provide feedback data to modify the SSD and other data functionally associated with the application of the integrated circuit.

6. The device according to claim 1, characterized in that The further circuit will determine the following probability distribution: The least significant bit LSB and the second LSB; The time interval between two accesses to the external port; Differences in memory access addresses; and The difference between reading or writing data.

7. The device according to claim 1, characterized in that Also included is a learning center memory where the further circuitry stores data from which learned behavior of the internal circuitry is developed by changing or adjusting logic operations used to trigger monitoring or recording events based on statistical properties or irregularities associated with the internal circuitry.

8. The device according to claim 1, characterized in that The additional circuitry will detect suspicious HTs attempting to transmit information through the port.

9. A non-transitory computer-readable storage medium, characterized in that: For use in an integrated circuit comprising an internal circuit having a sensitive / secret data SSD and comprising an access port through which information associated with the internal circuit can be accessed by an external circuit associated with a hardware Trojan HT, the non-transitory computer-readable storage medium comprises instructions that, when executed, cause a processor of a computing device to: causing a heuristic operating circuit to learn behavior of the internal circuitry that is unique to the integrated circuit under different operating conditions, the different operating conditions involving: the internal circuitry, the SSD, and other data functionally associated with an application of the integrated circuit; and using the behavior learned by the heuristic operation circuit to detect a suspicious HT or to block a suspicious HT from accessing the integrated circuit, Wherein the different operating conditions include using one or more altered versions of the SSD to access the internal circuitry.

Images