Survey of hardware protection of design data for integrated circuits and intellectual properties
---
paper_title: Counterfeit chips on the rise

paper_content:

As more firms report finding phony chips, the danger they pose becomes clearer — Making semiconductors is a big business–and, so it seems, is counterfeiting them. Just how big is becoming clearer than ever, thanks in part to the candor of the U.S. military, and it will become even clearer as new laws in the United States come into effect later this year.
---
paper_title: Recycling of waste printed circuit boards: a review of current technologies and treatment status in China.

paper_content:

From the use of renewable resources and environmental protection viewpoints, recycling of waste printed circuit boards (PCBs) receives wide concerns as the amounts of scrap PCBs increases dramatically. However, treatment for waste PCBs is a challenge due to the fact that PCBs are diverse and complex in terms of materials and components makeup as well as the original equipment's manufacturing processes. Recycle technology for waste PCBs in China is still immature. Previous studies focused on metals recovery, but resource utilization for nonmetals and further separation of the mixed metals are relatively fewer. Therefore, it is urgent to develop a proper recycle technology for waste PCBs. In this paper, current status of waste PCBs treatment in China was introduced, and several recycle technologies were analyzed. Some advices against the existing problems during recycling process were presented. Based on circular economy concept in China and complete recycling and resource utilization for all materials, a new environmental-friendly integrated recycling process with no pollution and high efficiency for waste PCBs was provided and discussed in detail.
---
paper_title: Reverse-Engineering a Cryptographic RFID Tag

paper_content:

The security of embedded devices often relies on the secrecy of proprietary cryptographic algorithms. These algorithms and their weaknesses are frequently disclosed through reverse-engineering software, but it is commonly thought to be too expensive to reconstruct designs from a hardware implementation alone. This paper challenges that belief by presenting an approach to reverse-engineering a cipher from a silicon implementation. Using this mostly automated approach, we reveal a cipher from an RFID tag that is not known to have a software or micro-code implementation. We reconstruct the cipher from the widely used Mifare Classic RFID tag by using a combination of image analysis of circuits and protocol analysis. Our analysis reveals that the security of the tag is even below the level that its 48-bit key length suggests due to a number of design flaws. Weak random numbers and a weakness in the authentication protocol allow for pre-computed rainbow tables to be used to find any key in a matter of seconds. Our approach of deducing functionality from circuit images is mostly automated, hence it is also feasible for large chips. The assumption that algorithms can be kept secret should therefore to be avoided for any type of silicon chip.
---
paper_title: Reverse Engineering of CMOS Integrated Circuits

paper_content:

New methods for automated visual recognition of metal interconnect technological layers of integrated circuits are presented. Image processing and analysis algorithms are used in these methods to extract interconnect structure locations and dimensions. Recognized structure data is used to recreate initial photolithographic mask data suitable for further analysis. Proposed methods were experimentaly tested and their precision was calculated from test results. To perform experimental testing, custom software was developed as a framework for this and future research. Methods proposed here are initial part of collection of methods suitable for complete chip topological structure extraction, including all layers. Ill. 4, bibl. 13 (in English; summaries in English, Russian and Lithuanian).
---
paper_title: Trustworthy Hardware: Identifying and Classifying Hardware Trojans

paper_content:

For reasons of economy, critical systems will inevitably depend on electronics made in untrusted factories. A proposed new hardware Trojan taxonomy provides a first step in better understanding existing and potential threats.
---
paper_title: Experiences in Hardware Trojan design and implementation

paper_content:

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.
---
paper_title: EPIC: ending piracy of integrated circuits

paper_content:

As semiconductor manufacturing requires greater capital investments, the use of contract foundries has grown dramatically, increasing exposure to mask theft and unauthorized excess production. While only recently studied, IC piracy has now become a major challenge for the electronics and defense industries [6]. We propose a novel comprehensive technique to end piracy of integrated circuits (EPIC). It requires that every chip be activated with an external key, which can only be generated by the holder of IP rights, and cannot be duplicated. EPIC is based on (i) automatically-generated chip IDs, (ii) a novel combinational locking algorithm, and (iii) innovative use of public-key cryptography. Our evaluation suggests that the overhead of EPIC on circuit delay and power is negligible, and the standard flows for verification and test do not require change. In fact, major required components have already been integrated into several chips in production. We also use formal methods to evaluate combinational locking and computational attacks. A comprehensive protocol analysis concludes that EPIC is surprisingly resistant to various piracy attempts.
---
paper_title: A Survey of Hardware Trojan Taxonomy and Detection

paper_content:

Editor's note:Today's integrated circuits are vulnerable to hardware Trojans, which are malicious alterations to the circuit, either during design or fabrication. This article presents a classification of hardware Trojans and a survey of published techniques for Trojan detection.
---
paper_title: Reverse engineering of embedded consumer electronic systems

paper_content:

Cutting edge consumer electronics systems typically rely upon embedded processors and software for a large part of their competitive features. Developing such features is, in turn, a costly part of the design exercise that is usually recouped through initial high-price sales.
---
paper_title: Non-Invasive Reverse Engineering of CMOS Integrated Circuits

paper_content:

In this paper a novel non-invasive procedure will be presented to determine nonlinear binary multi-input multi-output (MIMO) integrated circuits (ICs) solely by their input-output behaviour. The algorithm identifies unknown CMOS ICs through the abstraction of traditional automata theory. The entire determination procedure was simulated and fully tested on IEEE ISCAS benchmark models as well as user defined models of real ICs. The results obtained will be presented in this paper. For every circuit analysed the function has been successfully determined by the novel identification procedure proposed.
---
paper_title: Can EDA combat the rise of electronic counterfeiting?

paper_content:

The Semiconductor Industry Associates (SIA) estimates that counterfeiting costs the US semiconductor companies $7.5B in lost revenue, and this is indeed a growing global problem. Repackaging the old ICs, selling the failed test parts, as well as gray marketing, are the most dominant counterfeiting practices. Can technology do a better job than lawyers? What are the technical challenges to be addressed? What EDA technologies will work: embedding IP protection measures in the design phase, developing rapid post- silicon certification, or counterfeit detection tools and methods?
---
paper_title: Screening for counterfeit electronic parts

paper_content:

Counterfeit electronic parts have become a significant cause of worry in the electronic parts supply chain. Counterfeit parts detected in the electronics industry can be new or surplus parts that are modified in some manner, or they can be salvaged scrap parts that are refurbished to look like new. In the latter case, the packaging of these parts is altered to modify their identity or disguise the effects of salvaging. The modification can be as simple as the removal of old markings and the addition of new markings, or as complicated as the recovery of a die and repackaging in a new package. In this paper, we discuss the types of parts used to create counterfeit semiconductor parts and the defects/degradation inherent in these parts due to the nature of the sources they come from. We also discuss proposed inspection standards and their limitations. The processes used to modify the packaging of these parts to create counterfeits are then discussed along with the traces left behind from each of the processes. We then present a methodology for detecting signs of possible part modifications to determine the risk of a part or part lot being counterfeit.
---
paper_title: Protecting bus-based hardware IP by secret sharing

paper_content:

Our work addresses protection of hardware IP at the mask level with the goal of preventing unauthorized manufacturing. The proposed protocol based on chip locking and activation is applicable to a broad category of electronic systems with a primary bus. Such designs include (1) numerous IP offerings for USB, PCI, PCI-E, AMBA and other bus standards typically used in system-on-a-chip designs and computer peripherals, (2) SRAM-based FPGAs that are programmed through an input bus, (3) general-purpose and embedded microprocessors, including soft cores, (4) DSPs, (5) network processors, and (6) game consoles. Our key insight is that such designs can be locked by scrambling the central bus by controlled reversible bit-permutations and substitutions. To securely establish a unique code per chip to control bus scrambling, we employ true random number generators and Diffie-Hellman cryptography during activation.
---
paper_title: Remote activation of ICs for piracy prevention and digital right management

paper_content:

We introduce a remote activation scheme that aims to protect integrated circuits (IC) intellectual property (IP) against piracy. Remote activation enables designers to lock each working IC and to then remotely enable it. The new method exploits inherent unclonable variability in modern manufacturing for unique identification (ID) and integrated the IDs into the circuit functionality. The objectives are realized by replication of a few states of the finite state machine (FSM) and adding control to the state transitions. On each chip, the added control signals are a function of the unique IDs and are thus unclonable. On standard benchmark circuits, the experimental results show that the novel activation method is stable, unclonable, attack-resilient, while having a low overhead and a unique key for each IC.
---
paper_title: EPIC: ending piracy of integrated circuits

paper_content:

As semiconductor manufacturing requires greater capital investments, the use of contract foundries has grown dramatically, increasing exposure to mask theft and unauthorized excess production. While only recently studied, IC piracy has now become a major challenge for the electronics and defense industries [6]. We propose a novel comprehensive technique to end piracy of integrated circuits (EPIC). It requires that every chip be activated with an external key, which can only be generated by the holder of IP rights, and cannot be duplicated. EPIC is based on (i) automatically-generated chip IDs, (ii) a novel combinational locking algorithm, and (iii) innovative use of public-key cryptography. Our evaluation suggests that the overhead of EPIC on circuit delay and power is negligible, and the standard flows for verification and test do not require change. In fact, major required components have already been integrated into several chips in production. We also use formal methods to evaluate combinational locking and computational attacks. A comprehensive protocol analysis concludes that EPIC is surprisingly resistant to various piracy attempts.
---
paper_title: IC activation and user authentication for security-sensitive systems

paper_content:

A number of applications depend on the protection of security-sensitive hardware, preventing unauthorized users from gaining access to the functionality of the integrated circuits (ICs). Failure to protect such devices can have consequences ranging from the loss of financial revenue to the loss of human lives. The key to providing protection does not lie in the prevention of theft but in a secure IC activation and user authentication procedure so that an adversary has nothing to gain by acquiring the physical hardware. The proposed protection scheme is robust against various types of malicious attack, such as reverse engineering to extract the circuit layout, brute-forcing the access key, and FIBing. The scheme provides the capability both for one-time or every-powerup activation and for every-powerup user authentication. Given the resource constraints of many security-sensitive hardware systems (such as those deployed in remote locations or carried in combat arenas), this paper proposes and evaluates the cost of several techniques for achieving secure activation and authentication.
---
paper_title: Ending Piracy of Integrated Circuits

paper_content:

An effective technique to combat IC piracy is to render infringement impractical by making physical tampering unprofitable and attacks computationally infeasible. EPIC accomplishes this using a novel low-overhead combinational chip-locking system and a chip-activation protocol based on public-key cryptography.
---
paper_title: A protection mechanism for intellectual property rights (IPR) in FPGA design environment

paper_content:

One of the major difficulties in offering new VLSI designs is protecting the designer's intellectual property rights (IPR). It often requires limited field deployment and testing before a novel implementation may be accepted for general use. The difficulty arises in the need to deploy the design for testing while disabling the tester from deciphering the design details. A similar requirement applies when the designer is interested in limiting the number of deployments as part of a business agreement. This work leverages the similarities between the issues of IPR protection in the hardware and software arenas and presents a novel solution to protect the use of designs in the FPGA hardware environment. The mechanisms used are based on hardware-supported design encryption and secured authentication protocols.
---
paper_title: Abstract Active Hardware Metering for Intellectual Property Protection and Security

paper_content:

We introduce the first active hardware metering scheme that aims to protect integrated circuits (IC) intellectual property (IP) against piracy and runtime tampering. The novel metering method simultaneously employs inherent unclonable variability in modern manufacturing technology, and functionality preserving alternations of the structural IC specifications. Active metering works by enabling the designers to lock each IC and to remotely disable it. The objectives are realized by adding new states and transitions to the original finite state machine (FSM) to create boosted finite state machines(BFSM) of the pertinent design. A unique and unpredictable ID generated by an IC is utilized to place an BFSM into the power-up state upon activation. The designer, knowing the transition table, is the only one who can generate input sequences required to bring the BFSM into the functional initial (reset) state. To facilitate remote disabling of ICs, black hole states are integrated within the BFSM. ::: ::: We introduce nine types of potential attacks against the proposed active metering method. We further describe a number of countermeasures that must be taken to preserve the security of active metering against the potential attacks. The implementation details of the method with the objectives of being low-overhead, unclonable, obfuscated, stable, while having a diverse set of keys is presented. The active metering method was implemented, synthesized and mapped on the standard benchmark circuits. Experimental evaluations illustrate that the method has a low-overhead in terms of power, delay, and area, while it is extremely resilient against the considered attacks.
---
paper_title: Security analysis of integrated circuit camouflaging

paper_content:

Camouflaging is a layout-level technique that hampers an attacker from reverse engineering by introducing, in one embodiment, dummy contacts into the layout. By using a mix of real and dummy contacts, one can camouflage a standard cell whose functionality can be one of many. If an attacker cannot resolve the functionality of a camouflaged gate, he/she will extract an incorrect netlist. In this paper, we analyze the feasibility of identifying the functionality of camouflaged gates. We also propose techniques to make the dummy contact-based IC camouflaging technique resilient to reverse engineering. Furthermore, we judiciously select gates to camouflage by using techniques which ensure that the outputs of the extracted netlist are controllably corrupted. The techniques leverage IC testing principles such as justification and sensitization. The proposed techniques are evaluated using ISCAS benchmark circuits and OpenSparc T1 microprocessor controllers.
---
paper_title: Securing computer hardware using 3D integrated circuit (IC) technology and split manufacturing for obfuscation

paper_content:

The fabrication of digital Integrated Circuits (ICs) is increasingly outsourced. Given this trend, security is recognized as an important issue. The threat agent is an attacker at the IC foundry that has information about the circuit and inserts covert, malicious circuitry. The use of 3D IC technology has been suggested as a possible technique to counter this threat. However, to our knowledge, there is no prior work on how such technology can be used effectively. We propose a way to use 3D IC technology for security in this context. Specifically, we obfuscate the circuit by lifting wires to a trusted tier, which is fabricated separately. This is referred to as split manufacturing. For this setting, we provide a precise notion of security, that we call k-security, and a characterization of the underlying computational problems and their complexity. We further propose a concrete approach for identifying sets of wires to be lifted, and the corresponding security they provide. We conclude with a comprehensive empirical assessment with benchmark circuits that highlights the security versus cost trade-offs introduced by 3D IC based circuit obfuscation.
---
paper_title: Preventing integrated circuit piracy using reconfigurable logic barriers

paper_content:

With each new feature size, integrated circuit (IC) manufacturing costs increase. Rising expenses cause the once vertical IC supply chain to flatten out. Companies are increasing their reliance on contractors, often foreign, to supplement their supply chain deficiencies as they no longer can provide all of the services themselves. This shift has brought with it several security concerns classified under three categories: (1) Metering controlling the number of ICs created and for whom. (2) Theft controlling the dissemination of intellectual property (IP). (3) Trust controlling the confidence in the IC post-fabrication. Our research focuses on providing a solution to the metering problem by restricting an attacker’s access to the IC design. Our solution modifies the CAD tool flow in order to identify locations in the circuit which can be protected with reconfigurable logic barriers. These barriers require the correct key to be present for information to flow through. Incorrect key values render the IC useless as the flow of information is blocked. Our selection heuristics utilize observability and controllability don’t care sets along with a node’s location in the network to maximize an attacker’s burden while keeping in mind the associated overhead. We implement our approach in an open-source logic synthesis tool, compare it against previous solutions and evaluate its effectiveness against a knowledgeable attacker.
---
paper_title: Preventing IC Piracy Using Reconfigurable Logic Barriers

paper_content:

Hardware metering to prevent IC piracy is a challenging and important problem. The authors propose a combinational locking scheme based on intelligent placement of the barriers throughout the design in which the objective is to maximize the effectiveness of the barriers and to minimize the overhead.
---
paper_title: Embedded reconfigurable logic for ASIC design obfuscation against supply chain attacks

paper_content:

Hardware is the foundation and the root of trust of any security system. However, in today's global IC industry, an IP provider, an IC design house, a CAD company, or a foundry may subvert a VLSI system with back doors or logic bombs. Such a supply chain adversary's capability is rooted in his knowledge on the hardware design. Successful hardware design obfuscation would severely limit a supply chain adversary's capability if not preventing all supply chain attacks. However, not all designs are obfuscatable in traditional technologies. We propose to achieve ASIC design obfuscation based on embedded reconfigurable logic which is determined by the end user and unknown to any party in the supply chain. Combined with other security techniques, embedded reconfigurable logic can provide the root of ASIC design obfuscation, data confidentiality and tamper-proofness. As a case study, we evaluate hardware-based code injection attacks and reconfiguration-based instruction set obfuscation based on an open source SPARC processor LEON2. We prevent program monitor Trojan attacks and increase the area of a minimum code injection Trojan with a 1KB ROM by 2.38% for every 1% area increase of the LEON2 processor.
---
paper_title: Security Trends for FPGAS

paper_content:

This book is designed for all those who would like to upgrade their knowledge in the field of security and digital platforms including reconfigurable FPGAs. It is the result of a national project (ICTER) funded by the French National Research Agency (ANR) and involving four research centers (Montpellier, Paris, Lorient, Saint-Etienne) and a private company. This book details several solutions for secure application execution and application update. It presents an analysis of current threats against embedded systems and especially FPGAs. The discussion includes requirements to build a secure system, according to the FIPS standard. New secure schemes are proposed to ensure data confidentiality, integrity and authentication. These new schemes fit the tight requirements of embedded systems (performance, memory footprint, logic area and energy consumption). The cost of different architectures for performance, memory, and energy are estimated. Innovative solutions for remote reconfigurations are also detailed, taking into account security when downloading a new bitstream. Since the replay of an old bitstream in the field is a major threat for embedded systems, this issue is discussed and an original solution proposed. * Proposes solutions at the logical, architecture and system levels in order to provide a global solution * Clearly defines the security boundaries for a system * Describes different hierarchical levels of a design, from application to technological levels
---
paper_title: Dynamically configurable security for SRAM FPGA bitstreams

paper_content:

FPGAs are becoming increasingly attractive – thanks to the improvement of their capacities and their performances. Today, FPGAs represent an efficient design solution for numerous systems. Moreover, since FPGAs are important for the electronics industry, it becomes necessary to improve their security, particularly for SRAM FPGAs, since they are more vulnerable than other FPGA technologies. This paper proposes a solution to improve the security of SRAM FPGAs through flexible bitstream encryption. This proposition is distinct from other works because it uses the latest capabilities of SRAM FPGAs like partial dynamic reconfiguration and self-reconfiguration. It does not need an external battery to store the secret key. It opens a new way of application partitioning oriented by the security policy.
---
paper_title: In the blink of an eye: There goes your AES key

paper_content:

This paper is a short summary of a real world AES key extraction performed on a military grade FPGA marketed as 'virtually unbreakable' and 'highly secure'. We demonstrated that it is possible to extract the AES key from the Actel/Microsemi ProASIC3 chip in a time of 0.01 seconds using a new side-channel analysis technique called Pipeline Emission Analysis (PEA). This new technique does not introduce a new form of side-channel attacks (SCA), it introduces a substantially improved method of waveform analysis over conventional attack technology. It could be used to improve upon the speed at which all SCA can be performed, on any device and especially against devices previously thought to be unfeasible to break because of the time and equipment cost. Possessing the AES key for the ProASIC3 would allow an attacker to decrypt the bitstream or authenticate himself as a legitimate user and extract the bitstream from the device where no read back facility exists. This means the device is wide open to intellectual property theft, fraud and reverse engineering of the design to allow the introduction of a backdoor or Trojan. We show that with a very low cost hardware setup made with parts obtained from a local electronics distributor you can improve upon existing SCA up to a factor of x1,000,000 in time and at a fraction of the cost of existing SCA equipment.
---
paper_title: A protocol for secure remote updates of FPGA configurations

paper_content:

We present a security protocol for the remote update of volatile FPGA configurations stored in non-volatile memory. Our approach can be implemented on existing FPGAs, as it sits entirely in user logic. Our protocol provides for remote attestation of the running configuration and the status of the upload process. It authenticates the uploading party both before initiating the upload and before completing it, to both limit a denial-of-service attack and protect the integrity of the bitstream. Encryption protects bitstream confidentiality in transit; we either decrypt it before non-volatile storage, or pass on ciphertext if the configuration logic can decrypt it. We discuss how tamper-proofing the connection between the FPGA and the non-volatile memory, as well as space for multiple bitstreams in the latter, can improve resilience against downgrading and denial-of-service attacks.
---
paper_title: A secure self-reconfiguring architecture based on open-source hardware

paper_content:

With the new and powerful field programmable gate array (FPGA) families, new possibilities have been opened. One of these features is the possibility of reconfiguring a section of the FPGA while the rest is working. Moreover, this fixed part could be responsible for reprogramming the reconfigurable part, either because a change in functionality is required or because a new version of the hardware needs to be implemented. This paper shows how an FPGA system based on an open source OpenRISC 1200 microprocessor takes advantage of this feature to perform the secure download of the firmware and the hardware needed to run an application. In this particular case a Reed-Solomon encoder and a cryptographic application were used to demonstrate the viability of the scheme
---
paper_title: Secure partial reconfiguration of FPGAs

paper_content:

SRAM FPGAs are vulnerable to security breaches such as bitstream cloning, reverse-engineering, and tampering. Bitstream encryption and authentication are two most effective and practical solutions to improve the security of FPGAs. In this paper, we investigate a method to perform a secure dynamic partial reconfiguration of SRAM FPGAs using embedded processor cores. Two schemes based on hard-wired PowerPC processor core and the MicroBlaze soft processor core have been compared and contrasted in terms of speed and FPGA resource usage. A practical experiment, demonstrating feasibility, performance, and flexibility of both schemes has been conducted using Xilinx ML310 board with Xilinx Virtex-II Pro FPGA
---
paper_title: Bitstream encryption and authentication with AES-GCM in dynamically reconfigurable systems

paper_content:

A high-speed and secure dynamic partial reconfiguration (DPR) system is realized with AES-GCM that guarantees both confidentiality and authenticity of FPGA bitstreams. In DPR systems, bitstream authentication is essential for avoiding fatal damage caused by unintended bitstreams. An encryption-only system can prevent bitstream cloning and reverse engineering, but cannot prevent erroneous or malicious bitstreams from being configured. Authenticated encryption is a relatively new concept that provides both message encryption and authentication, and AES-GCM is one of the latest authenticated encryption algorithms suitable for hardware implementation. We implemented the AES-GCM-based DPR system targeting the Virtex-5 device on an off-the-shelf board, and evaluated its throughput and hardware resource utilization. For comparison, we also implemented AES-CBC and SHA-256 modules on the same device. The experimental results showed that the AES-GCM-based system achieved higher throughput with less resource utilization than the AES/SHA-based system. The AES-GCM-module achieved more than 1 Gbps throughput and the entire system achieved about 800 Mbps throughput with reasonable resource utilization. This paper clarifies the advantage of using AES-GCM for protecting DPR systems.
---
paper_title: On the vulnerability of FPGA bitstream encryption against power analysis attacks: extracting keys from xilinx Virtex-II FPGAs

paper_content:

Over the last two decades FPGAs have become central components for many advanced digital systems, e.g., video signal processing, network routers, data acquisition and military systems. In order to protect the intellectual property and to prevent fraud, e.g., by cloning a design embedded into an FPGA or manipulating its content, many current FPGAs employ a bitstream encryption feature. We develop a successful attack on the bitstream encryption engine integrated in the widespread Virtex-II Pro FPGAs from Xilinx, using side-channel analysis. After measuring the power consumption of a single power-up of the device and a modest amount of off-line computation, we are able to recover all three different keys used by its triple DES module. Our method allows extracting secret keys from any real-world device where the bitstream encryption feature of Virtex-II Pro is enabled. As a consequence, the target product can be cloned and manipulated at the will of the attacker since no side-channel protection was included into the design of the decryption module. Also, more advanced attacks such as reverse engineering or the introduction of hardware Trojans become potential threats. While performing the side-channel attack, we were able to deduce a hypothetical architecture of the hardware encryption engine. To our knowledge, this is the first attack against the bitstream encryption of a commercial FPGA reported in the open literature.
---
paper_title: Secure remote reconfiguration of an FPGA-based embedded system

paper_content:

This paper describes the protocol, architecture, and implementation details of an FPGA-based embedded system that is able to remotely reconfigure the FPGA, using a TCP/IP connection, in a secure way. When considering the security aspects, we imply data confidentiality, explicit key authentication and data origin authentication. Since these aspects are overhead for the main application, the system is to be as small as possible. Therefore we have focused on compactness rather than on speed for the implementation. The implemented solution exists out of 2 components: a communication part and a cryptographic part. The system can be easily integrated at any point in the design of an FPGA-based embedded system, due to the simple and modular architecture.
---
paper_title: Black-Box Side-Channel Attacks Highlight the Importance of Countermeasures – An Analysis of the Xilinx Virtex-4 and Virtex-5 Bitstream Encryption Mechanism –

paper_content:

This paper presents a side-channel analysis of the bitstream encryption mechanism provided by Xilinx Virtex FPGAs. This work covers our results analyzing the Virtex-4 and Virtex-5 family showing that the encryption mechanism can be completely broken with moderate effort. The presented results provide an overview of a practical real-world analysis and should help practitioners to judge the necessity to implement side-channel countermeasures. We demonstrate sophisticated attacks on off-the-shelf FPGAs that go far beyond schoolbook attacks on 8-bit AES S-boxes. We were able to perform the key extraction by using only the measurements of a single power-up. Access to the key enables cloning and manipulating a design, which has been encrypted to protect the intellectual property and to prevent fraud. As a consequence, the target product faces serious threats like IP theft and more advanced attacks such as reverse engineering or the introduction of hardware Trojans. To the best of our knowledge, this is the first successful attack against the bitstream encryption of Xilinx Virtex-4 and Virtex-5 reported in open literature.
---
paper_title: A single-chip solution for the secure remote configuration of FPGAs using bitstream compression

paper_content:

This paper presents a system that allows the secure remote configuration of an FPGA, which is assumed to be the only device in the secure zone. This means that no security critical information passes over the borders of the FPGA chip, reducing the opportunities for an attacker to break the system. In particular, bitstream compression in combination with partial reconfiguration is used to avoid the use of an external memory for the storage of the bitstream. Additionally there is no need for an external processor for the transfer of the bitstream. Nevertheless, our solution contains a mechanism that verifies the integrity of the complete bitstream before starting the configuration. This prevents attempts to load unqualified bitstreams and reduces the downtime. The integrity check, the decryption, the authentication of the origin and the freshness check of the bitstream are performed inside the FPGA while its current configuration is still active. The contribution of this work is that it presents the first complete working system for the secure remote configuration of FPGAs, consisting of a single FPGA chip and an initiating server, given that the integrity of the complete bitstream is verified before configuration. This paper gives details on the overall system and the FPGA architecture, which have been implemented and tested.
---
paper_title: Can EDA combat the rise of electronic counterfeiting?

paper_content:

The Semiconductor Industry Associates (SIA) estimates that counterfeiting costs the US semiconductor companies $7.5B in lost revenue, and this is indeed a growing global problem. Repackaging the old ICs, selling the failed test parts, as well as gray marketing, are the most dominant counterfeiting practices. Can technology do a better job than lawyers? What are the technical challenges to be addressed? What EDA technologies will work: embedding IP protection measures in the design phase, developing rapid post- silicon certification, or counterfeit detection tools and methods?
---
paper_title: Screening for counterfeit electronic parts

paper_content:

Counterfeit electronic parts have become a significant cause of worry in the electronic parts supply chain. Counterfeit parts detected in the electronics industry can be new or surplus parts that are modified in some manner, or they can be salvaged scrap parts that are refurbished to look like new. In the latter case, the packaging of these parts is altered to modify their identity or disguise the effects of salvaging. The modification can be as simple as the removal of old markings and the addition of new markings, or as complicated as the recovery of a die and repackaging in a new package. In this paper, we discuss the types of parts used to create counterfeit semiconductor parts and the defects/degradation inherent in these parts due to the nature of the sources they come from. We also discuss proposed inspection standards and their limitations. The processes used to modify the packaging of these parts to create counterfeits are then discussed along with the traces left behind from each of the processes. We then present a methodology for detecting signs of possible part modifications to determine the risk of a part or part lot being counterfeit.
---
paper_title: Protecting designs with a passive thermal tag

paper_content:

The theft of electronic designs and in particular Intellectual Property (IP) Cores is problematic [1]. Proving a design has been stolen is difficult if not impossible. A method is required to quickly and cheaply identify electronic designs and especially IP Core designs embedded within larger chips or programmed into Field Programmable Gate Arrays (FPGA). This paper introduces a novel thermal tag which will fulfill this requirement.
---
paper_title: Hierarchical watermarking for protection of DSP filter cores

paper_content:

A hierarchical watermarking approach is developed that incorporates an ownership identification directly into the design development process. This approach offers a high degree of tamper resistance and provides easy, noninvasive copy detection. We present two FIR digital filter cores, one watermarked at the algorithm level and the second at the algorithm and architecture levels. A unique ownership signature (watermark) is placed at each level. At the algorithm level, the watermark is embedded in the filter coefficients during the development of the transfer function. At the architecture level, we use circuit transformations to watermark the design. Experimental results show approximately 7% area overhead of the algorithm-level watermarked design over a non-watermarked design. The cost of area for the design watermarked at both the algorithm and architecture levels is less than 40%.
---
paper_title: Behavioral synthesis techniques for intellectual property protection

paper_content:

The economic viability of the reusable core-based design paradigm depends on the development of techniques for intellectual property protection. We introduce the first dynamic watermarking technique for protecting the value of intellectual property of CAD and compilation tools and reusable core components. The essence of the new approach is the addition of a set of design and timing constraints which encodes the author's signature. The constraints are selected in such a way that they result in minimal hardware overhead while embedding the signature which is unique and difficult to detect, remove and forge. We establish the first set of relevant metrics which forms the basis for the quantitative analysis, evaluation, and comparison of watermarking techniques. We develop a generic approach for signature data hiding in designs, which is applicable in conjunction with an arbitrary behavioral synthesis task, such as scheduling assignment, allocation, and transformations. Error correcting codes are used to augment the protection of the signature data from tampering attempts. On a large set of design examples, studies indicate the effectiveness of the new approach in a sense that the signature data, which are highly resilient, difficult to detect and remove, and yet easy to verify, can be embedded in designs with very low hardware overhead.
---
paper_title: IP protection of DSP algorithms for system on chip implementation

paper_content:

Silicon technology has now advanced to the point that there is a serious mismatch in the time taken to design advanced silicon-based systems and the time to market for any new product or product derivative. To obviate this delay, a new paradigm is emerging based on intellectual property (IP) exchange, where designers and differing companies share subsystems (virtual cores) between themselves to reduce design time to acceptable levels. To this end, over 150 companies including all the major players formed the Virtual Socket Interface Alliance in March 1997. The protection of IP has become a serious issue as intercompany subsystem design exchange becomes more commonplace. This paper presents new techniques to protect the IP of virtual cores that implement digital signal processing (DSP) algorithms. The approach involves embedding codewords into the design of fundamental signal processing algorithms such as digital filters and the DFT in such a way that proof of authorship can be retained, and, if required, easily identified. The techniques discussed can be adapted to protect other fundamental DSP algorithms such as convolution and correlation. The protection of IP via watermarking techniques is increasingly being applied at all levels of design. It is particularly advantageous if such techniques are applied at the highest abstraction levels in the design flow, and if such techniques are applied at basic algorithm level, they become very difficult to detect at lower levels of system design.
---
paper_title: Netlist-level IP protection by watermarking for LUT-based FPGAs

paper_content:

This paper presents a novel approach to watermark FPGA designs on the netlist level. We restrict the dynamically addressable part of the logic table, thus freeing space for insertion of signature bits into lookup tables (LUTs). In this way, we tightly integrate the watermark with the design so that simply removing mark carrying components would damage the intellectual property core. Converting functional LUTs to LUT-based RAMs or shift registers prevents deletion due to optimization. With this technique, we take watermark carrying components out of the scope of optimization algorithms to achieve complete transparency towards development environments. We can extract the marks from the bitfile of an FPGA. The method was tested on a Xilinx Virtex-II Pro FPGA and showed low overhead in terms of timing and resources at a reasonable number of water-marked cells.
---
paper_title: Power Signature Watermarking of IP Cores for FPGAs

paper_content:

In this paper, we introduce a new method for watermarking of IP cores for FPGA architectures where the signature (watermark) is detected at the power supply pins of the FPGA. This is the first watermarking method where the signature is extracted in this way. We are able to sign IP cores at the netlist as well as the bitfile level, so a wide spectrum of cores can be protected. In principle, the proposed power watermarking method works for all kinds of FPGAs. For Xilinx FPGAs, we demonstrate in detail that we can integrate the watermarking algorithms and the signature into the functionality of the watermarked core. So it is very hard to remove the watermark without destroying the core. Furthermore, we introduce a detection algorithm which can decode the signature from a voltage trace with high reliability. Additionally, two enhanced robustness algorithms are introduced which improve the detection probability in case of considerable noise sources. Using these techniques, it is possible to decode the signature even if other cores operate on the same device at the same time.
---
paper_title: Watermarking-based copyright protection of sequential functions

paper_content:

Watermarking is proposed as a means to protect intellectual property contents of electronic systems from copyright infringement. The technique consists of implanting indelible stamps in the circuit's inner structure, while not disrupting its functionality or degrading its performance. In this paper a novel method is proposed for the creation of watermarks in regular sequential functions operating on finite input/output sets. This is an important class of circuits, as it is the basis of most digital controllers. Algorithms are proposed for implanting and detecting watermarks so as to minimize implementation overhead for a specified level of robustness.
---
paper_title: Intellectual property protection by watermarking combinational logic synthesis solutions

paper_content:

The intellectual property business model is vulnerable to a number of potentially devastating obstructions, such as misappropriation and intellectual property fraud. We propose a new method for intellectual property protection which facilitates design watermarking at the combinational logic synthesis level. We developed protocols for embedding designer- and/or tool-specific information into a logic network while performing multi-level logic minimization and technology mapping. We demonstrate that the difficulty of erasing an author's signature or finding another signature in the synthesized design can be made arbitrarily computationally difficult. We also developed a statistical method which enables us to establish the strength of the proof of authorship. The watermarking method has been tested on a standard set of real-life benchmarks where an exceptionally high probability of authorship has been achieved with a negligible overhead in solution quality.
---
paper_title: Side channels as building blocks

paper_content:

Since the introduction of the first side-channel analyses in academia about 15 years ago, several physical attacks have been presented that exploit side-channel leakages to break implementations of cryptographic algorithms. This article deals with the same physical property of electronic devices, but focuses on the art of tailoring it for constructive uses. More precisely, two scenarios, i.e., hardware Trojans and IP watermarking, are illustrated in which the designer of an electronic circuit can add functionality by considering side channels as part of the available design space. Both applications use the same concept, i.e., deliberately leaking a secret through a side channel while keeping the introduced side channel hidden from adversaries and attackers. This article provides a broad overview of the existing works for both applications and should serve as a comprehensible introduction to the underlying field of research. This includes many subtle details that have not been discussed in literature yet, including existing shortcomings and possible improvements to the existing works. The solutions summarized in this article provide general guidelines for theorists and practitioners to use side channels constructively to achieve designs that are robust against detection and removal. Furthermore, we present an entirely new design of a Trojan side-channel. This architecture demonstrates the potential of a Trojan side-channel that is neatly tailored to the targeted implementation. The new design removes all non-invasive starting points a third party could use to analyze or get access to the secret-channel.
---
paper_title: IP watermark verification based on power consumption analysis

paper_content:

The increasing production costs of electronic devices and changes in the design methods of integrated circuits (ICs) has led to emerging threats in the microelectronics industry. Today, high value chips are the target of counterfeiting, theft and malicious hardware insertion (such as hardware trojans). Intellectual property (IP) protection has become a major concern and we propose to fight counterfeiting and theft by designing salutary hardware (salware). Instead of insert malicious effects inside an IP like a malware (e.g. a hardware trojan), a salware uses the same techniques, strategies and means for IP protection. One of the most studied salware is IP watermarking. Many works propose to target the finite state machine of digital IP to perform the watermarking. But, most of the time, the verification of the watermark is not clearly described. This conduces to a lack of credibility of these works. This paper proposes a watermark verification scheme using a correlation analysis based on the measurement of the IC power consumption. This article presents this process of verification and also discusses the selection of its parameters according to experimental results.
---
paper_title: Integrated circuit digital rights management techniques using physical level characterization

paper_content:

Digital rights management (DRM) of integrated circuits (ICs) is a crucially important task both economically and strategically. Several IC metering techniques have been proposed, but until now their effectiveness for royalty management has not been quantified. IC auditing is an important DRM step that goes beyond metering; it not only detects that a pirated IC has been produced but also determines the quantity of pirated ICs. Our strategic objective is to create a new intrinsic passive metering technique as well as the first IC auditing technique, and to maximize and quantify their effectiveness using statistical analysis and IC characterization techniques. Our main technical innovations include physical level gate characterization, a Bayesian approach for coincidence analysis, and an adaptation of animal counting techniques for IC production estimation. We evaluate the accuracy of the IC metering and auditing approach using simulations on a set of ISCAS benchmarks.
---
paper_title: Intellectual Property Protection for Integrated Systems Using Soft Physical Hash Functions

paper_content:

Intellectual property right violations are an important problem for integrated system designers. We propose a new solution for mitigating such violations, denoted as soft physical hash functions. It combines previously introduced ideas of soft hash functions (in the field of image processing) and side-channel leakage (in the field of cryptographic hardware). For this purpose, we first introduce and formalize the components of an intellectual property detection infrastructure using soft physical hash functions. Next, we discuss its advantages over previous proposals aiming at similar goals. The most important point here is that the proposed technique can be applied to already deployed products. Finally, we validate our approach with a first experimental study.
---
paper_title: A PUF Based on a Transient Effect Ring Oscillator and Insensitive to Locking Phenomenon

paper_content:

This paper presents a new silicon physical unclonable function (PUF) based on a transient effect ring oscillator (TERO). The proposed PUF has state of the art PUF characteristics with a good ratio of PUF response variability to response length. Unlike RO-PUF, it is not sensitive to the locking phenomenon, which challenges the use of ring oscillators for the design of both PUF and TRNG. The novel architecture using differential structures guarantees high stability of the TERO-PUF. The area of the TERO-PUF is relatively high, but is still comparable with other PUF designs. However, since the same piece of hardware can be used for both PUF and random number generation, the proposed principle offers an interesting low area mixed solution.
---
paper_title: Counterfeit electronics: A rising threat in the semiconductor manufacturing industry

paper_content:

As the supply chain of electronic circuits grows more complex, with parts coming from different suppliers scattered across the globe, counterfeit integrated circuits (ICs) are becoming a serious challenge which calls for immediate solutions. Counterfeiting includes re-labeling legitimate chips or illegitimately replicating chips and deceptively selling them as made by the legitimate manufacturer, or simply selling fake chips. Counterfeiting also includes providing defective parts or simply previously used parts recycled from scrapped assemblies. Obviously, there is a multitude of legal and financial implications involved in such activities and even if these devices initially work, they may have reduced lifetime and may pose reliability risks. In this tutorial, we provide a comprehensive review of existing techniques which seek to prevent and/or detect counterfeit integrated circuits. Various approaches are discussed and an advanced machine learning-based method employing parametric measurements is described in detail.
---
paper_title: FPGA Intrinsic PUFs and Their Use for IP Protection

paper_content:

In recent years, IP protection of FPGA hardware designs has become a requirement for many IP vendors. In [34], Simpson and Schaumont proposed a fundamentally different approach to IP protection on FPGAs based on the use of Physical Unclonable Functions (PUFs). Their work only assumes the existence of a PUF on the FPGAs without actually proposing a PUF construction. In this paper, we propose new protocols for the IP protection problem on FPGAs and provide the first construction of a PUF intrinsic to current FPGAs based on SRAM memory randomness present on current FPGAs. We analyze SRAM-based PUF statistical properties and investigate the trade offs that can be made when implementing a fuzzy extractor.
---
paper_title: An Easy-to-Design PUF Based on a Single Oscillator: The Loop PUF

paper_content:

This paper presents an easy to design Physically Unclonable Function (PUF). The proposed PUF implementation is a loop composed of $N$ identical and controllable delay chains which are serially assembled in a loop to create a single ring oscillator. The frequency discrepancies resulting from the oscillator driven by complementary combinations of the delay chains allows to characterize one device. The presented PUF, nicknamed the Loop PUF (LPUF), returns a frequency comparison of loops made of $N$ delay chains ($N\geq2$). The comparisons are done sequentially on the same structure. Unlike others PUFs based on delays, there is no specific routing constraints. Hence the LPUF is particularly flexible and easy to design. The basic use of the Loop PUF is to generate intrinsic device keys for cryptographic algorithms. It can also be used to generate challenge response pairs for simple authentication. Experiments have been carried out on CYCLONE II FPGAs to assess the performance of the LPUF, such as randomness, uniqueness and steadiness. They clearly show both the easiness of design and the quality level of the LPUF. The measurement time \emph{vs} steadiness, as well as resistance against side-channel and modeling attacks are discussed.
---
paper_title: A large scale characterization of RO-PUF

paper_content:

To validate the effectiveness of a Physical Unclonable Function (PUF), it needs to be characterized over a large population of chips. Though simulation methods can provide approximate results, an on-chip experiment produces more accurate result. In this paper, we characterize a PUF based on ring oscillator (RO) using a significantly large population of 125 FPGAs. We analyze the experimental data using a ring oscillator loop delay model, and quantify the quality factors of a PUF such as uniqueness and reliability. The RO-PUF shows an average inter-die Hamming distance of 47.31%, and an average intra-die Hamming distance of 0.86% at normal operating condition. Additionally, we intend to make this large RO frequency dataset available publicly for the research community.
---
paper_title: Design and Implementation of PUF-Based "Unclonable" RFID ICs for Anti-Counterfeiting and Security Applications

paper_content:

Physical unclonable functions (PUFs) exploit the physical characteristics of the silicon and the IC manufacturing process variations to uniquely characterize each and every silicon chip. Since it is practically impossible to model, copy, or control the IC manufacturing process variations, PUFs not only make these chips unique, but also effectively unclonable. Exploiting the inherent variations in the IC manufacturing process, PUFs provide a secure, robust, low cost mechanism to authenticate silicon chips. This makes PUFs attractive for RFID ICs where cost and security are the key requirements. In this paper we present the design and implementation of PUF enabled "unclonable" RFIDs. The PUF-enabled RFID has been fabricated in 0.18 mu technology, and extensive testing results demonstrate that PUFs can securely authenticate an RFID with minimal overheads. We also highlight the advantages of PUF based RFIDs in anti-counterfeiting and security applications.
---
paper_title: Intellectual property protection for FPGA designs with soft physical hash functions: First experimental results

paper_content:

The use of Soft Physical Hash (SPH) functions has been recently introduced as a flexible and efficient way to detect Intellectual Property (IP) cores in microelectronic systems. Previous works have mainly investigated software IP to validate this approach. In this paper, we extend it towards the practically important case of FPGA designs. Based on experiments, we put forward that SPH functions-based detection is a promising and low-cost solution for preventing anti-counterfeiting, as it does not require any a-priori modification of the design flow. In particular, we illustrate its performances with stand-alone FPGA designs, re-synthetized FPGA designs, and in the context of parasitic IPs running in parallel.
---
paper_title: PUFs: Myth, fact or busted? A security evaluation of physically unclonable functions (PUFs) cast in silicon

paper_content:

Physically Unclonable Functions (PUFs) are an emerging technology and have been proposed as central building blocks in a variety of cryptographic protocols and security architectures. However, the security features of PUFs are still under investigation: Evaluation results in the literature are difficult to compare due to varying test conditions, different analysis methods and the fact that representative data sets are publicly unavailable. ::: ::: In this paper, we present the first large-scale security analysis of ASIC implementations of the five most popular intrinsic electronic PUF types, including arbiter, ring oscillator, SRAM, flip-flop and latch PUFs. Our analysis is based on PUF data obtained at different operating conditions from 96 ASICs housing multiple PUF instances, which have been manufactured in TSMC 65 nm CMOS technology. In this context, we present an evaluation methodology and quantify the robustness and unpredictability properties of PUFs. Since all PUFs have been implemented in the same ASIC and analyzed with the same evaluation methodology, our results allow for the first time a fair comparison of their properties.
---
paper_title: Robust FPGA intellectual property protection through multiple small watermarks

paper_content:

A number of researchers have proposed using digital marks to provide ownership identification for intellectual property. Many of these techniques share three specific weaknesses: complexity of copy detection, vulnerability to mark removal after revelation for ownership verification, and mark integrity issues due to partial mark removal. This paper presents a method for watermarking field programmable gate array (FPGA) intellectual property (IP) that achieves robustness by responding to these three weaknesses. The key technique involves using secure hash functions to generate and embed multiple small marks that are more detectable, verifiable, and secure than existing IP protection techniques.
---
paper_title: Cryptographic rights management of FPGA intellectual property cores

paper_content:

As the capacity of FPGA's increases to millions of equivalent gates the use of Intellectual Property (IP) cores becomes increasingly important to control design complexity. FPGA's are becoming platforms for integrating a system solution from components supplied by independent vendors in the same way as printed circuit boards provided a platform for earlier generations of designers. However, the current commercial model for IP cores involves large up-front license fees reminiscent of ASIC NRE charges. In order to match the IP core business model to the low to medium volume applications addressed by FPGA customers it is important to develop cryptographic techniques which allow IP core vendors to sell their product on a pay-per-use basis rather than through up-front license fees.
---
paper_title: Dynamic Intellectual Property Protection for Reconfigurable Devices

paper_content:

The distinct advantage of SRAM-based field programmable gate arrays (FPGA) is their flexibility for configuration changes. However, this opens up the threat of theft of Intellectual Property (IP) since the system configuration is stored in easy-to-access Flash memory. To prevent this, high-end FPGAs have already been extended with symmetric-key decryption engines used to load an encrypted version of the configuration that cannot simply be copied and used without knowledge of the secret key. However, such protection systems based on straightforward use of symmetric cryptography are not well-suited with respect to business and licensing processes, since they are lacking a convenient scheme for key transport and installation. We propose a new protection scheme for the IP of circuits in configuration bit files that provides a significant improvement to the current unsatisfying situation. It uses both public-key and symmetric cryptography, but does not burden FPGAs with the usual overhead of public-key cryptography: While it needs hard-wired symmetric cryptography, the public-key functionality is moved into a temporary configuration bit stream for a one-time setup procedure. This approach requires only very few modifications to current FPGA technology. Using five basic stages, the new protection scheme allows new accounting models for volume licensing of IP, with automated key installation on FPGAs taking place at the customer's site.
---
paper_title: Novel secret-key IPR protection in FPGA environment

paper_content:

Some VLSI IP owners prefer to leave programming their IP into a field programmable gate array (FPGA) to the end customer. A major concern is the possible over-deployment of the IP into more devices than originally licensed. In this paper, the authors proposed a system based on secured handshaking with encrypted device and design authentication information ensuring that the IP can only be deployed into agreed upon devices. The system consists of hardware-supported design encryption and secured authentication protocols.
---
paper_title: A Pay-per-Use Licensing Scheme for Hardware IP Cores in Recent SRAM-Based FPGAs

paper_content:

Currently achievable intellectual property (IP) protection solutions for field-programmable gate arrays (FPGAs) are limited to single large "monolithic" configurations. However, the ever growing capabilities of FPGAs and the consequential increasing complexity of their designs ask for a modular development model, where individual IP cores from multiple parties are integrated into a larger system. To enable such a model, the availability of IP protection at the modular level is imperative. In this work, we propose an IP protection mechanism for FPGA designs at the level of individual IP cores, by making use of the self-reconfiguring capabilities of modern FPGAs and deploying a trusted third party to run a metering service, similar to the work of Giineysu et ah and Drimer et at The proposed scheme makes it possible to enforce a pay-per-use licensing scheme which holds considerable advantages, both for IP core providers as well as for system integrators. Moreover, the scheme has a minimal implementation overhead and is the first of its kind to be solely based on primitives that are already available in recent commercially available FPGA devices. This allows for an immediate and feasible deployment, in contrast to earlier proposed solutions.
---
paper_title: Secure IP-block distribution for hardware devices

paper_content:

EDA vendors have proposed a standard for the sharing of IP among vendors to be used in the design and development of IP for FPGAs. Although, we do not propose any attacks, we show that there are easy ways in which the security of the whole process can be enhanced by using standard cryptographic techniques such as secret sharing and public-key based key exchange. We also explore the advantages that newer primitives have such as All-Or-Nothing Transforms and Physical Unclonable Functions. We show that the protocols proposed would significantly reduce the effects that the leakage of a single key would have over the whole system.
---
paper_title: Offline Hardware/Software Authentication for Reconfigurable Platforms

paper_content:

Many Field-Programmable Gate Array (FPGA) based systems utilize third-party intellectual property (IP) in their development. When they are deployed in non-networked environments, the question raises how this IP can be protected against non-authorized use. We describe an offline authentication scheme for IP modules. The scheme implements mutual authentication of the IP modules and the hardware platform, and enables us to provide authentication and integrity assurances to both the system developer and IP provider. Compared to the Trusted Computing Platform’s approach to hardware, software authentication, our solution is more lightweight and tightly integrates with existing FPGA security features. We are able to demonstrate an implementation of the authentication scheme that requires a symmetric cipher and a Physically Unclonable Function (PUF). In addition to the low hardware requirements, our implementation does not require any on-chip, non-volatile storage.
---
paper_title: SALWARE : Salutary Hardware to design Trusted IC

paper_content:

Fabless semiconductor industries are facing the rise of design costs of integrated circuits. This rise is link to the technology change and the complexity increasing. It follows that integrated circuits have become targets of counterfeiting and theft. The SALWARE project aims to study (theoretically and experimentally) salutary hardware design in order to fight against theft, illegal cloning and counterfeiting of integrated circuits. Salutary hardware means an embedded hardware system, hardly detectable / circumvented, inserted in an integrated circuit or a virtual component (Intellectual Property), used to provide intellectual property information (eg watermarking or hardware license) and / or to remotely activate the circuit or IP after manufacture and during use.
---
paper_title: Hardware IP Protection During Evaluation Using Embedded Sequential Trojan

paper_content:

The authors propose a low-cost solution for hardware IP protection during evaluation, by embedding a hardware Trojan inside an IP in the form of a finite state machine. The Trojan disrupts the normal functional behavior of the IP on occurrence of a sequence of rare events, thereby effectively putting an expiry date on the usage of the IP.
---
paper_title: Periodic licensing of FPGA based intellectual property

paper_content:

This work describes a method of licensing IP on FPGAs based on techniques derived from software licensing schemes. Current software and hardware licensing techniques are described in detail, including a survey of current research in the fields of FPGA security, secure memory technologies, and cryptography. A licensing architecture for FPGA IP is proposed, and an implementation on a Xilinx Vertex 2 FPGA demonstrates that expiration of FPGA based IP can be achieved. Future work includes the development of a hardware architecture for consumer products that supports licensable IP cores as well as their delivery
---

Title: Survey of Hardware Protection of Design Data for Integrated Circuits and Intellectual Properties

Section 1: Introduction
Description 1: Introduce the key stakeholders in the IC manufacturing process and their roles.

Section 2: The Main Threats to Design Data
Description 2: Describe the various threats to design data, including reverse engineering, counterfeiting, theft, and hardware Trojans.

Section 3: Protection Schemes
Description 3: Discuss various protection schemes to safeguard design data, such as hardware locking/unlocking, obfuscation, camouflaging, and reconfigurable hardware.

Section 4: Hardware Locking/Unlocking (Hardware Encryption and Obfuscation)
Description 4: Explain methods for locking/unlocking hardware, including FSM modifications, key-based schemes, and cryptographic protocols.

Section 5: Hardware Camouflaging
Description 5: Define hardware camouflaging techniques, including the use of non-standard gate libraries and split manufacturing.

Section 6: Reconfigurable Area and Bitstream Encryption of FPGA Configuration
Description 6: Describe methods for incorporating reconfigurable areas and encrypting FPGA bitstreams to protect design data.

Section 7: Hardware Identification
Description 7: Discuss techniques for hardware identification, including watermarking and fingerprinting.

Section 8: IP Licensing and Temporary Protection
Description 8: Explore IP licensing schemes and temporary protection methods to control the use and distribution of intellectual properties.

Section 9: Comparison of Protection Schemes
Description 9: Compare various protection schemes based on their area and power overheads, and effectiveness against different threats.

Section 10: Conclusion
Description 10: Summarize the key points discussed and propose future directions for research in hardware protection of design data.