Talk Title:
Trust but Verify: Hardware Assurance in a Globalized Supply Chain through Reverse Engineering
Abstract:
The economics of the modern semiconductor industry has created an atmosphere that is more conducive to malicious supply chain activities. In the past, original component/equipment manufacturers were in complete control of fabrication, packaging, testing, and distribution of their electronics. Today, however, the prohibitive costs associated with owning and operating fabrication facilities (or "fabs") has made this infeasible for all but a few companies. As a result, the model now followed is "fabless" where many of the aforementioned steps are outsourced to facilities in a handful of countries. With lesser oversight over supply chains, state level attackers and other hackers can surreptitiously modify integrated circuits (ICs) and printed circuit boards (PCBs) with hardware Trojans, killswitches, and backdoors. In parallel, the shorter product lifecycles and increasing amounts of e-waste are incentivizing and facilitating counterfeit electronics.
Hardware Trojans and counterfeits are a danger to companies and consumers alike. Unfortunately, the existing approaches for dealing with them are limited and/or ineffective. For Trojans, it is challenging and, in some cases, impossible to generate test vectors that discover stealthy, well-placed hardware Trojans in billion-transistor chips. Side-channel and parametric signal analysis for Trojan and counterfeit detection cannot avoid process variation and measurement noise. Thus, the current best practices for counterfeit avoidance are the use of subject matter experts (SME) or lifetime buys, both of which are non-ideal. Although reverse engineering is often presented in a negative light, it may be the only foolproof method for providing hardware assurance, especially for commercial-off-the-shelf (COTS) ICs and PCBs where little prior information is available.
In this talk, we shall debunk common myths and present the recent advances in IC/PCB reverse engineering steps: delayering, imaging, automated image analysis, and automated annotation. Further, we will delineate the scenarios where reverse engineering can support hardware security and assurance. Finally, we will describe the gaps that need to be filled before realizing the ideal hardware assurance flows.
Speaker Bio:
Domenic Forte is an Associate Professor and the Steven A. Yatauro Faculty Fellow with the Electrical and Computer Engineering Department at University of Florida, where he also serves at the Director of the FICS Research SeCurity and AssuraNce (SCAN) lab. His research covers the domain of hardware security from nano devices to printed circuit boards (PCBs) where he has nearly 200 publications. Dr. Forte is a senior member of the IEEE, a member of the ACM, and serves on the organizing committees of top conferences in hardware security such as HOST and AsianHOST. He also serves and has served on the technical program committees of DAC, ICCAD, NDSS, ITC, ISTFA, BTAS, and many more. Dr. Forte is a recipient of the Presidential Early Career Award for Scientists and Engineers (PECASE), the Early Career Award for Scientists and Engineers (ECASE) by Army Research Office (ARO), the NSF Faculty Early Career Development Program (CAREER) Award, and the ARO Young Investigator Award. His research has also been recognized with best paper awards and nominations from IJCB, ISTFA, HOST, DAC, and AHS.
