Bảo mật và Tin cậy Phần cứng Tương tự: Luận án Tiến sĩ của Julian Leonhard (Sorbonne Université)

Analog hardware security and trust Julian Leonhard To cite this version: Julian Leonhard. Analog hardware security and trust. Cryptography and Security [cs. �tel-03681806v2� HAL Id: tel-03681806 https://tel.fr/tel-03681806v2 Submitted on 30 May 2022 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not.

The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. T H È S E D E D O C T O R AT DE SORBONNE UNIVERSITÉ A N A L O G H A R D WA R E S E C U R I T Y A N D T R U S T présentée par julian leonhard École Doctorale Informatique, Télécommunications et Électronique réalisée au Laboratoire d’Informatique Paris 6 soutenue le 25 Mars 2021 devant le jury composé de : M. Giorgio DI NATALE DR CNRS, TIMA, Grenoble Rapporteur M.

Ilia POLIAN Prof., University of Stuttgart Rapporteur Mme. Emmanuelle ENCRENAZ MCF, Sorbonne Université Examinatrice M. Helmut GRÄB Prof., Technical University Munich Examinateur M. Ozgur SINANOGLU Prof., NYU Abu Dhabi Examinateur M.

Jean-Luc DANGER Prof., Télécom ParisTech Examinateur Mme. Marie-Minerve LOUËRAT CR CNRS, Sorbonne Université Invitée M. Hassan ABOUSHADY MCF, Sorbonne Université Invité M. Haralampos STRATIGOPOULOS DR CNRS, Sorbonne Université Directeur de Thèse Julian Leonhard: Analog Hardware Security and Trust, © January 2021 Für meinen Doktoropa Werner Leonhard.

1926 – 2018 ABSTRACT The ongoing globalization and specialization of the integrated circuit (IC) supply chain has led semiconductor companies to share their valuable intellectual property (IP) assets with numerous parties for means of manufacturing, testing, etc. As a consequence, sensitive IPs and ICs are being exposed to untrusted parties, resulting in serious piracy threats such as counterfeiting or reverse engineering. In this thesis we develop methods to secure analog and mixed signal IPs/ICs from piracy threats within the supply chain. We propose an anti-piracy methodology for locking mixed-signal ICs via logic locking of their digital part.

The capabilities of the technique are demonstrated on a Σ∆ ADC in a hardware experiment and in a real-world audio-application. Furthermore, we propose an obfuscation methodology towards analog IP protection against reverse engineering. Obfuscation is achieved by camouflaging the effective geometry of layout components via the use of fake contacts. We apply and evaluate the technique on an operational amplifier and an RF Σ∆ ADC.

Finally, we propose an attack to break all analog circuit locking techniques that act upon the biasing of the circuit. The attack is based on re-synthesizing the biasing circuits and requires only the use of an optimization algorithm. It is put to test on a locked voltage regulator using a genetic algorithm. This thesis demonstrates that establishing security and trust for analog and mixed signal IPs and ICs, while still in its infancy, is feasible.

The presented techniques have the potential to protect analog and mixed- signal circuits against a large subset of all the possible risk scenarios while inflicting low overheads in terms of area, power and performance. The changes carried out in the ICs’ analog sections are subtle, a key requirement for the adoption of our techniques by analog designers. RÉSUMÉ La mondialisation et la spécialisation actuelles de la chaîne d’appro- visionnement des circuits intégrés (CI) ont conduit les entreprises de semi-conducteurs à partager leur précieuse propriété intellectuelle (PI) avec de nombreuses parties pour les faire fabriquer, tester, etc. En consé- quence, les PI et les CI sensibles sont exposés à des parties potentiellement malveillantes, ce qui entraîne de graves menaces de piratage telles que la contrefaçon ou la retro ingénierie.

Dans cette thèse, nous développons v des méthodes pour sécuriser les PI/CI analogiques et mixtes contre les menaces de piratage dans la chaîne d’approvisionnement. Nous proposons une méthodologie anti-piratage pour verrouiller les circuits intégrés mixtes via l’application de logic locking à leur partie numérique. Les capacités de la technique sont démontrées sur un ADC Σ∆ dans le cadre d’une expérience matérielle et dans une application audio. En outre, nous proposons une méthodologie d’offuscation pour la protection de la propriété intellectuelle analogique contre la rétro- ingénierie.

L’offuscation est réalisé en camouflant la géométrie effective des composants de layout par l’utilisation de faux contacts. Nous ap- pliquons et évaluons la technique sur un amplificateur opérationnel et un RF Σ∆ ADC. Enfin, nous proposons une attaque pour contourner toutes les techniques de verrouillage des circuits analogiques qui agissent sur la polarisation du circuit. L’attaque est basée sur la ré-synthèse des circuits de polarisation et ne nécessite que l’utilisation d’un algorithme d’optimisation.

Elle est démontrée sur un régulateur de tension verrouillé à l’aide d’un algorithme génétique. Cette thèse démontre qu’il est possible d’établir la sécurité et la confiance pour les CI analogiques et mixtes, bien que ça soit qu’un début. Les tech- niques présentées ont le potentiel de protéger les circuits analogiques et mixtes contre une grande partie de tous les scénarios de risque possibles tout en infligeant de faibles coûts en termes de surface, de puissance et de performance. Les changements effectués dans les sections analogiques des CI sont subtils, ce qui est une condition essentielle pour l’adoption de nos techniques par les concepteurs de circuits analogiques.

vi P U B L I C AT I O N S As a result of this thesis the following publications have appeared: [1] J. Stratigopou- los, “MixLock: securing mixed-signal circuits via logic locking,” in Proc. Design, Automation & Test in Europe Conference, 2019. Stratigopoulos, “Mixed-signal hardware security using MixLock: demonstration in an audio application,” in International Confer- ence on Synthesis, Modeling, Analysis and Simulation Methods and Applications to Circuit Design, 2019.

Stratigopoulos, “Analog and mixed-signal ic security via sizing camouflaging,” IEEE Transactions on Computer-Aided Design of Inte- grated Circuits and Systems, 2020. Stratigopoulos, “Breaking analog biasing locking techniques via re-synthesis,” in 26th Asia and South Pacific Design Automation Conference, 2021. vii To explain all nature is too difficult a task for any one man or even for any one age. ’Tis much better to do a little with certainty, and leave the rest for others that come after you, than to explain all things — Isaac Newton, 1704 ACKNOWLEDGMENTS Three years passed in the blink on an eye, even though in the beginning the journey seemed infinite.

Reflecting, I am humbled and filled with joy to have crossed paths with many wonderful people from all over the world. A bit like a particle moving through space and seeing its trajectory change in the attracting force field of other particles, only briefly crossing some, while traveling together with others for years. One particle that had a profound impact on my trajectory is my supervi- sor Haralampos, or, as we say in German more fittingly, my doctor-father. Thank you Haralampos for bearing with me, for pushing me and for be- lieving in me.

You taught me to see the bigger picture, to be very precise with words and to focus on the goal and find a new way when suffering setbacks. Also, whenever in the future I should downplay my work, there will be a little Haralampos popping up on my shoulder saying: "Julian, for the last time, stop belittling your work!". I have gotten to know few PhD students who are as happy with their supervisor as I am. Thank you Haralampos, it truly was a pleasure to work with you, on a professional as well as on a human level.

My deep gratitude also goes to two very important people in the mak- ing of my PhD: Marie-Minerve and Hassan. Whenever an organizational problem arose, Marie-Minerve cared and helped us PhD students where she could, e., under her guidance we taught the university that cli- mate action starts by taking the train for Paris-Florence. Whenever she proof-read one of our papers her criticism was excellent and I wish to one day be able to read a paper like she does. Hassan, the ruler over the Σ∆-universe provided us with all the system- and schematic-level models, layouts, hardware, the corresponding know-how and what else not we required on countless occasions.

Hassan played a key role by providing excellent technical explanations as well as allowing our ideas to materialize in hardware. Shadi and Alhassan both were irreplaceable and very reliable links in our (now secured) paper supply-chain. My deep gratitude goes to them for the many hours they spent measuring, supporting and simulating ix with and for us. Shadi, please let me know when you find the time- multiplier so we can switch it off during vacation.

I’d like to salute my dearest and absolutely fantastic lab-particles & -mates: Antonios (Amp-tonios), Sarah, Alán, Theofilos, Gabriel, Ilias, Mohamed, Ning and Rodrigo. It makes me immensely happy to have shared these many Fredos, Nescafés and other Greek coffee specialties with you, to have sung and danced in the lab with you or to have feasted on countless sweets (Baklava, Künefe, or that fabulous Terkenlis chocolate Easter lamb from Thessaloniki) with you! I mean, we even were at a conference dinner at Montmartre with a full blown Drag show! When I’m gone, please never forget what Sarah the Wise once said: “a meeting without food should be an email." Working together with the team at NYU Abu-Dhabi was a fantastic experience and I was always looking forward to our calls. Especially in the beginning when we, analog people, were trying hard to grasp digital logic locking, Ozgur would always find a way to make us understand. The NYU people also saved the day, when, just before the DATE deadline and after something had gone quite wrong, Yasin worked all night to send a fix, allowing a new batch of experiments to start at 4am.

The night guard of Sorbonne later that night assured me I was definitely the last one to leave the campus that night. Thanks Yasin! A big thank you also goes to Nimisha for the live-support, the proof-reading and the good explanations on locking and synthesis! I want to extend my thanks to some of the people in the LIP6 laboratory I had the pleasure to get to know a bit better: Amine, Roselyne, Manuel, Emmanuelle, Shahin, Sylvain, Farouk, Franck, Habib, Dimitri, Jean-Paul, Daniela, Mariam, Doaa, Tamer, Islam, Abdelkrim and Jacky. In the context of the university I also want to thank the EDITE de Paris, my doctoral school, for having awarded me their scholarship, allowing me to pursue my PhD studies in the best conditions. After the lab you have to live somewhere and for me, living at Cité Universitaire de Paris was a privilege.

I will keep so many memories of these great days here. Thank you to my friends in the Colégio de España for making me delicious food (I took photos of it, every day!) while I was quarantined in my room with COVID: Jan, Paula, Franzi, Claudia and Mercedes. Living in the Swedish House in 2019/20 was one of the greatest periods in Paris, especially during the first lockdown in spring 2020. I’ll never forget these good times with you at the Cité U, my dear friends from near and far: Pedro, Myrto, Daniel, Micaela, Cecilia, Luna, Jeanne, Léna, Evelina, Sylvia, Carla, Hilda, Alex, Rebecca, Daria, Tangi, Pierre, Joséphine, Grégory, Yukiko, Yajna, Marie and so many, many more.

The Vélo Volant deserves a special place in my heart. Never would I have believed I would do a PhD and run a bike repair shop on the x weekends. I’m so very proud of you and of what you do for others: Marie, Geoffrey, Francesco, Matthew, Clément, Sara, Boris, Manon, Adrien, Leo and all the bénévoles who work and worked with us to help people learn about mechanics while never forgetting that at 5pm « c’est l’heure de goûter »!