Mitigating Cyberattacks caused by Fast-Acting Hardware

This is a research based project sponsored by Dr. Saied Hemati and the University of Idaho ECE Department. The goal of this project is to design a nearly undetectable hardware trojan capable of disabling targeted integrated circuits (ICs) and developing defensive schemes to prevent a widespread flash fatal trojan attack.

Background
A widespread flash fatal trojan attack may cause millions of sensitive communications, networking, computing, sensing, and/or interfacing devices to stop working and may cause enormous financial, political, or military losses. Developing techniques for eliminating security weaknesses and circuit vulnerabilities, which can be exploited in a flash fatal Trojan attack, is a high payoff and high risk research goal requiring expertise in cybersecurity, transistor physics, and mixed-signal integrated circuit design techniques.

Mission Statement
To conduct exploratory research on the feasibility of hardware Trojan attacks, and to develop suitable defensive schemes to protect vital systems.

Specifications

 * The device must fit in a 4 mm squared area for fabrication.


 * Trojan must produce enough voltage to break a modern MOSFET or FINFET.


 * Trojan must be built within a simple, existing IC device.


 * Ideally must be hidden and difficult to detect (small layout and very low power consumption)


 * Trojan must be able to be activated by an external signal


 * IC circuit must use 130 nm technology to meet MOSIS November 13th deadline


 * If the device is fabricated and validated, research will be conducted on methods to mitigate its effect.

In the event that this deadline is missed:


 * The device may be designed and simulated in 65 nm technology. If would not be fabricated, unless, pending negotiation, $5000 can be raised. Total area would  decrease to 1 mm squared.
 * The device may be designed and simulated in the most modern attainable technology, then physically proven using large scale discrete devices.
 * The client, Dr. Saied Hemati, makes the final call on alternatives and may decide to provide another alternative if necessary.

Deliverables
Our deliverables will include:
 * A functioning (at least once!) trojan capable of rendering an IC unusable.
 * Research regarding the best defensive schemes to protect IC's against trojans similar to our design.
 * A technical paper with (hopefully) publishable results.

Vulnerabilities






DC to DC Converters
Since our goal is to build a voltage up to a gate oxide breakdown level from a low input voltage, we first looked at classic DC boost converters that could be altered to complete the job. The details of these are explained below.

Inductive Boost Converter
The first DC to DC converter that we looked at was the classic DC to DC boost converter.



The boost converter can generate voltages dependent on the size of the capacitor, inductor, and the switching frequency. This topic was not explored too much due to the size of inductors. One consideration was using the integrated circuit packaging intrinsic inductances, or using an off chip inductor. While this style of DC to DC converter could certainly generate the voltages needed, it would be easily identified and thus is not suited for a hardware trojan project.



Charge Pump
The team spent a fair amount of time exploring the charge pump, specifically the Dickson charge pump, as the DC to DC converter to boost the input voltage to gate oxide breakdown level voltages.



We built it Cadence



And simulated it



but problems include



On Chip Capacitors






The Team
{| class="wikitable collapsible" style="width:80%; margin-right:auto; background: #FFFFFF; border:2px solid #FFFFFF;" !style="background-color:#000000; width:65%"| Member !style="background-color:#000000; width:35%"| Discipline
 * - style="color:white"

Hector grew up in Boise, Idaho. His academic interests include microelectronics and power electronics. Outside of school, he enjoys just being a dude. After graduation, he plans on becoming a hard working engineer in the workforce. Dustin was born and raised in Idaho Falls, Idaho. His academic interests include electronics and communication systems. Throughout his time at the University of Idaho, he has served as a lab assistant for the Circuits I lab and as President of the ECE Ambassadors organization. Outside of school, he enjoys playing hockey and woodworking. After graduation, he is moving to Orlando, FL, to be a Systems Integration and Test Engineer.
 * Hector Cruz || Electrical Engineering
 * colspan="6"| teamtbd_hector.jpg
 * colspan="6"| teamtbd_hector.jpg
 * colspan="6"| teamtbd_hector.jpg
 * colspan="6" bgcolor="#000000"|
 * Dustin Mallett || Electrical Engineering & Applied Scientific Modeling Mathematics
 * colspan="6"| teamtbd_dustin.jpg
 * Dustin Mallett || Electrical Engineering & Applied Scientific Modeling Mathematics
 * colspan="6"| teamtbd_dustin.jpg
 * colspan="6"| teamtbd_dustin.jpg

Brenton grew up in Kuna, Idaho. His academic interests include microelectronic design and semiconductor devices. Outside of school, he enjoys playing on the University of Idaho club lacrosse team. After graduation, he is moving back to Boise to be a DRAM Product Engineer at Micron Technology. Rafael is from Aguas Claras, Brazil. His academic interests include microelectronic design and power electronics. After graduation, he intends on continuing towards a masters degree here at the University of Idaho with a focus on power electronics.
 * colspan="6" bgcolor="#000000"|
 * Brenton Van Leeuwen || Electrical Engineering
 * colspan="6"| teamtbd_brenton.jpg
 * Brenton Van Leeuwen || Electrical Engineering
 * colspan="6"| teamtbd_brenton.jpg
 * colspan="6"| teamtbd_brenton.jpg
 * colspan="6" bgcolor="#000000"|
 * Rafael Watanabe || Electrical Engineering & Applied Scientific Modeling Mathematics
 * colspan="6"| teamtbd_rafael.jpg
 * Rafael Watanabe || Electrical Engineering & Applied Scientific Modeling Mathematics
 * colspan="6"| teamtbd_rafael.jpg
 * colspan="6"| teamtbd_rafael.jpg
 * colspan="6" bgcolor="#000000"|
 * colspan="6" bgcolor="#000000"|