DeepSecurity - Applying Deep Learning to Hardware Security

With the globalisation of supply chains the design and manufacture of today's electronic devices are now distributed worldwide, for example, through the use of overseas foundries, third party intellectual property (IP) and third party test facilities. Many different untrusted entities may be involved in the design and assembly phases and therefore, it is becoming increasingly difficult to ensure the integrity and authenticity of devices. The supply chain is now considered to be susceptible to a range of hardware-based threats, including hardware Trojans, IP piracy, integrated circuit (IC) overproduction or recycling, reverse engineering, IC cloning and side-channel attacks. These attacks are major security threats to military, medical, government, transportation, and other critical and embedded systems applications. The proposed project will use a common approach to investigate two of these threats, namely the use of deep-learning in the context of side-channel attacks and hardware Trojans.

Side-channel attacks (SCAs) exploit physical signal leakages, such as power consumption, electromagnetic emanations or timing characteristics, from cryptographic implementations, and have become a serious security concern with many practical real-world demonstrations, such as secret key recovery from the Mifare DESFire smart card used in public transport ticketing applications and from encrypted bitstreams on Xilinx Virtex-4/5 FPGAs. A hardware Trojan (HT) is a malicious modification of a circuit in order to control, modify, disable, monitor or affect the operation of the circuit. Although there have been no public reports of HTs detected in practice, in 2008 it was speculated that a critical failure in a Syrian radar may have been intentionally triggered via a hidden 'back door' inside a commercial off-the-shelf (COTS) microprocessor.

The proposed project seeks to investigate the application of deep learning in SCA and HT detection, with the ultimate goal of utilising deep learning based verification processes in Electronic Design Automation tools to provide feedback to designers on the security of their designs. In relation to the call, the project addresses the challenge of 'maintaining confidence in security through the development process', and more specifically 'building supply chain confidence' and 'novel hardware analysis toolsets and techniques'.

The overall goal of the DeepSecurity research project is to investigate the use of deep learning for security verification in EDA tools, specifically in relation to hardware Trojan detection and side channel analysis, to allow non-security experts receive feedback on how to improve the security of their designs prior to fabrication. Hence, the research outputs will be of immediate relevance to entities for which supply chain confidence is of critical importance, for example, military, medical, government, transportation, and other critical infrastructure organisations.

In terms of direct economic impact, the project partners, BAE Systems and Cryptography Research (CRI) will be the first users and beneficiaries of the research outputs, but further beneficiaries will naturally ensue. Securing an untrustable hardware supply chain is an area of significant interest for BAE. CRI offers side channel countermeasures in addition to independent testing of devices to evaluate their side-channel resistance. Therefore, for them the research into DL-based attacks is particularly relevant, in addition to the proposed DL-based automated side-channel secure verification framework.

Hardware security is regarded as the foundation of effective IoT security and is essential to realising the IoT value proposition. A common theme in all the realms of IoT is the need for dependability and security. This was highlighted in the 2015 HiPEAC Vision report as a primary challenge for IoT. It outlines that security has to become one of the primary design features of whole systems, thus, underlining the importance of the proposed DeepSecurity project. Hence, the provision of security assurances to IoT devices, acts as an enabling layer for IoT applications and analytics, which when in full deployment will result in significant societal impact through, for example, more intelligent food production, energy consumption, traffic congestion/collision avoidance and remote healthcare applications.

The project will also enrich the skills pool in the UK with uniquely skilled researchers in the areas of hardware Trojan detection, side channel analysis and (secure) hardware design processes. CRI has offered to provide internship opportunities for the PhD students working on the project. In addition, experiences and insights developed in the project will be reflected back into the teaching curriculum of the MSc in Applied Cyber Security at QUB.