臺灣博碩士論文加值系統

由於半導體製造的複雜性和成本的升高，目前電路的設計分布在全球多個地方，IC工具也由不同地方提供。設計在供應鏈中更容易發生各種各樣的攻擊。硬體特洛伊木馬（HTH）有可能被植入，以洩露機密或導致系統故障。 HTH的主要類別之一是可靠度木馬，遏制了IC的可靠性並加速了老化。另外，暴露這種攻擊是非常困難的。在這個研究中，我們提出了一種佈局後階段(post-layout)的可靠度木馬，可以通過操縱電路的電力輸送網絡中EM所引起的老化行為來精細控制攻擊者（甚至設計人員）所設定的電路壽命。同時，製成變異是我們加入考慮來確保特洛伊木馬運行良好的不確定性。基於各種28nm設計的實驗證明，我們的攻擊在控制MTTF中的平均誤差僅為1.3％，96.8％的samples將具有可預期的壽命。

Due to escalating complexity and cost of semiconductor manufacturing, current circuits are designed in multiple locations worldwide, so are the software tools provided elsewhere. Designs become more prone to various kinds of attacks in the supply chain. Hardware Trojan horses (HTHs) can be implanted to facilitate the leakage of confidential or cause the failure of a system. One of the main categories of HTH is reliability Trojan that tampers with IC reliability and hastens the aging. Additionally, it is very difficult to expose such attack. In this work, we propose a post-layout staged reliability Trojan that can finely control the circuit lifetime as spec-ified by attackers (or even designers) by manipulating EM-induced aging behavior in the power delivery network of a circuit. At the same time, process variation is an im-portant uncertainty we consider as to ensure that the Trojan works well in effect. Experiments based on various 28nm designs have demonstrated that our attack has averagely only 1.3% of error in controlling MTTFs and 96.8% of samples will have tolerable expected lifetimes.

Chapter 1 Introduction 1
Chapter 2 Related Work and Contribution 4
Chapter 3 Power Delivery Network (PDN) 6
Chapter 4 Problem Definition and Tamper Flow 9
4.1 Problem Desciption 9
4.2 Find Candidate 10
4.3 Select Attack Targets 11
4.4 Calculate Effectiveness and Refinement 16
4.5 Overall Tamper Flow 17
Chapter 5 Experimental Results 19
Chapter 6 Summary 23
Bibliography 24
Glossary (Index of Terms) 26

[1] , International Technology Roadmap for Semiconductor, 2013.
[2] M. Tehranipoor et al., “Trustworthy hardware: Trojan detection and design-for-trust challeng-es,” IEEE Computer, vol. 44, no. 7, pp. 66-74, July 2011
[3] M. Tehranipoor and F. Koushanfar, “A survey of hardware Trojan taxonomy and detec-tion,” IEEE Design & Test of Computers, vol. 27, no. 1, pp. 10-25, Jan.-Feb. 2010.
[4] R. Karri et al., “Trustworthy hardware: identi-fying and classifying hardware Trojans,” IEEE Computer, vol. 43, no. 10, pp. 39-46, Oct. 2010
[5] Black, James R. "Electromigration—A brief survey and some recent results." IEEE Transactions on Electron Devices 16.4 (1969): 338-347.
[6] Black, James R. "Electromigration failure modes in aluminum metallization for semi-conductor devices." Proceedings of the IEEE 57.9 (1969): 1587-1594.
[7] A. Sreedhar, S. Kundu, I. Koren, “On Reliability Trojan Injection and Detection,” Jour-nal of Low Power Electronics Vol. 8, 1–10, 2012.
[8] Shiyanovskii, Yuriy, et al. "Process reliability based trojans through NBTI and HCI effects." Adaptive Hardware and Systems (AHS), 2010 NASA/ESA Conference on. IEEE, 2010
[9] N. Karimi et al., “MAGIC: Malicious Aging in Circuits/Cores,” ACM Transactions on Archi-tecture and Code Optimization (TACO): Vol-ume 12 Issue 1, April 2015.
[10] K. Yang, M. Hicks et al., “A2: Analog Malicious Hardware,” 2016 IEEE Symposium on Security and Privacy.
[11] Li, Di-An, and Malgorzata Marek-Sadowska. "Variation-aware Electromigration analysis of power/ground networks." Proceedings of the International Conference on Comput-er-Aided Design. IEEE Press, 2011.
[12] Ho, Chung-Wen, A. Ruehli, and Pierce Brennan. "The modified nodal approach to network analysis." IEEE Transactions on circuits and systems 22.6 (1975): 504-509.
[13] Qian, Haifeng, Sani R. Nassif, and Sachin S. Sapatnekar. "Power grid analysis using random walks." IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 24.8 (2005): 1204-1224.
[14] Zhao, Min, et al. "Hierarchical analysis of power distribution networks." IEEE Transac-tions on Computer-Aided Design of Integrated Circuits and Systems 21.2 (2002): 159-168.
[15] Kozhaya, Joseph N., Sani R. Nassif, and Farid N. Najm. "A multigrid-like technique for power grid analysis." IEEE Transactions on Computer-Aided Design of Integrated Cir-cuits and Systems 21.10 (2002): 1148-1160.
[16] Tarjan, Robert. "Depth-first search and linear graph algorithms." SIAM journal on com-puting 1.2 (1972): 146-160.
[17] Mack, Chris A. Field guide to optical lithography. Vol. 6. Bellingham, Washington, USA: SPIE Press, 2006.
[18] ngSpice, http://ngspice.sourceforge.net/