1、从集成电路芯片角度看物联网和系统安全IOT AND SYSTEM SECURITY:FROM THE VLSI PERSPECTIVEContentsINTRO TO IOTVLSI ATTACKSREVERSE ENGINEERINGCASE STUDYInternet of Things(IoT)Expanding Adoption of IoTA Recent Survey of IoT Adoption0%10%20%30%40%50%IoT platform/middlewareHome automationIndustrial automationConnected/smart c

2、itiesEnergy managementBuilding automationAgricultureHealthcareAutomotiveTransportation20172016Internet of Things(IoT)by 202020204BILLIONConnected People$4TRILLIONRevenue Opportunity25+MILLIONApps50TRILLIONGBs of Data25+BILLIONEmbedded and Intelligent SystemsIoT Design and StructureWeb Services(Weath

3、er,SNS,)Internet of ThingsSoftware CodeHardware PlatformApplicationsDevice Data CollectionDevice Control&MonitoringMashup ServiceCloud to Support IoTMicroprocessorHow To Ensure IoT Security?Cross-Layer:Technical cybersecurity solutions should take various layers of computing systems into considerati

4、on.Layered View of Computing SystemsHardware LayersSoftware LayersHardware-Software BoundaryWHY INTEGRATED CIRCUITS(IC,AKA VLSI)SECURITYIntroduction to Secure BootEstablish a root of trustStart code execution from a trusted sourceHave trusted source check next step of the code chainProcessorBoot Cod

5、eExternal codecheckPass:executeFail:panic()Secure Boot ChainProcessorBoot CodeExternal codecheckMore External CodeBypassing Boot ProcessBoot Process Security Validation Modern SoCs are designed to provide high flexibility Dilemma:Flexibility vs security Task:Evaluate the security implications of all

6、 possible boot configurations Case study:TI Sitara AM3703 SoCPCB Reverse EngineeringTop viewSide viewChip Reverse EngineeringNXP Mifare Proprietary cryptographic algorithm:CRYPTO-1 Reverse engineering:Algorithm and LFSR structure Widely used in ID cardsIC Supply ChainGlobal Integrated Circuit(IC)Sup

7、ply ChainManufacturingTesting and PackagingUsageDesignG2G1i0i1i2G3G4i3i4What software developers see.What hardware developers see.Integration Circuit(IC)Reverse Engineering Netlist recovery by a foundry or end-user threatens intellectual property and facilitates system level exploitation.The technol

8、ogy is advancingPackaged ICDieDelayering,Imaging,RecognitionG2G1i0i1i2G3G4i3i4NetlistFICS Research SeCurity and AssuraNce(SCAN)LabCourtesy of FICS UFImaging and Circuit Edit Capabilities100 m1 m100 nm10 nm1 nmDestructiveNondestructiveLYRA-3 XMH(Gallium FIB-SEM)FERA3-GMH(Plasma FIB-SEM)Skyscan 2211(X

9、-ray Micro CT)Imaging ResolutionMilling rate2000 m3/s200 m3/sOrion NanoFab(He-Ne FIB)20 m3/sCourtesy of FICS UFOptical Backside AnalysisPhoton EmissionLaser Stimulation/Fault InjectionOptical Contactless ProbingCourtesy of Shahin Tajik FICSPHOTON EMISSION ANALYSIS(PEM)Combinatorial vs.Sequential Log

10、icCombinatorial Logic:AND,OR,NOT,XORs,etc.Sequential Logic:Counter,Shift Register,State Machines,etc.Presence of Clock in Sequential LogicAltera MAX V(180 nm)Courtesy of Shahin Tajik FICSRing-Oscillator EmissionIdentical Switching Frequency by all LEsSwitching frequency independent and generally higher than clock frequencyApplications:TRNG and Internal ClocksAltera MAX V(180 nm)Courtesy of Shahin Tajik FICSConclusionsIC SECURITY REVISITING IOT SECURITYWORKFORCE GENERATIONHARDWARE FOR SOFTWARETHANKS